Cert-Manager dns01 质询订单待处理答案

【问题标题】：Cert-Manager dns01 challenge order pendingCert-Manager dns01 质询订单待处理
【发布时间】：2021-01-14 14:28:21
【问题描述】：

遵循https://cert-manager.io/docs/installation/kubernetes/ 中提到的步骤

# Kubernetes 1.16+
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.3/cert-manager.yaml


$ kubectl -n cert-manager get pods
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-958cb7d4d-m62xm               1/1     Running   0          137m
cert-manager-cainjector-8495f7f6c9-56ck6   1/1     Running   0          137m
cert-manager-webhook-5dcdfbd9d4-6mw74      1/1     Running   0          137m

集群发行者

% kubectl -n cert-manager describe ClusterIssuer letsencrypt
Name:         letsencrypt
Namespace:
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"cert-manager.io/v1alpha2","kind":"ClusterIssuer","metadata":{"annotations":{},"name":"letsencrypt"},"spec":{"acme":{"email"...
API Version:  cert-manager.io/v1
Kind:         ClusterIssuer
Metadata:
  Creation Timestamp:  2020-10-21T17:31:16Z
  Generation:          1
  Resource Version:    120254050
  Self Link:           /apis/cert-manager.io/v1/clusterissuers/letsencrypt
  UID:                 fe54ce07-61be-446f-9db1-4745b742ac71
Spec:
  Acme:
    Email:            admin@example.com
    Preferred Chain:
    Private Key Secret Ref:
      Name:  letsencrypt-test-key
    Server:  https://acme-v02.api.letsencrypt.org/directory
    Solvers:
      dns01:
        route53:
          Access Key ID:   ####
          Hosted Zone ID:  ####
          Region:          us-west-2
          Secret Access Key Secret Ref:
            Key:   secret_key
            Name:  aws-secret
      Selector:
        Dns Zones:
          example.com
Status:
  Acme:
    Last Registered Email:  admin@example.com
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/98054390
  Conditions:
    Last Transition Time:  2020-10-21T17:31:16Z
    Message:               The ACME account was registered with the ACME server
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                    <none>

证书

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: test-cert
  namespace: cert-manager
spec:
  commonName: '*.test.example.com'
  secretName: test-cert
  dnsNames:
    - '*.test.example.com'
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer


$ kubectl -n cert-manager get certificate
NAME        READY   SECRET      AGE
test-cert   False   test-cert   65m


$ kubectl -n cert-manager describe certificate test-cert
Name:         test-cert
Namespace:    cert-manager
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"cert-manager.io/v1alpha2","kind":"Certificate","metadata":{"annotations":{},"name":"test-cert","namespace":"cert-manager"},...
API Version:  cert-manager.io/v1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2020-10-21T17:31:23Z
  Generation:          1
  Resource Version:    120254080
  Self Link:           /apis/cert-manager.io/v1/namespaces/cert-manager/certificates/test-cert
  UID:                 82148eee-5f4b-47d7-a09a-407e4d041101
Spec:
  Common Name:  *.test.example.com
  Dns Names:
    *.test.example.com
  Issuer Ref:
    Kind:       ClusterIssuer
    Name:       letsencrypt
  Secret Name:  test-cert
Status:
  Conditions:
    Last Transition Time:        2020-10-21T17:31:23Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
    Last Transition Time:        2020-10-21T17:31:23Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
  Next Private Key Secret Name:  test-cert-gqhmj

证书申请

  $ kubectl -n cert-manager get CertificateRequest
  NAME              READY   AGE
  test-cert-zqbwz   False   67m

  $ kubectl -n cert-manager describe CertificateRequest test-cert-zqbwz
  Name:         test-cert-zqbwz
  Namespace:    cert-manager
  Labels:       <none>
  Annotations:  cert-manager.io/certificate-name: test-cert
                cert-manager.io/certificate-revision: 1
                cert-manager.io/private-key-secret-name: test-cert-gqhmj
                kubectl.kubernetes.io/last-applied-configuration:
                  {"apiVersion":"cert-manager.io/v1alpha2","kind":"Certificate","metadata":{"annotations":{},"name":"test-cert","namespace":"cert-manager"},...
  API Version:  cert-manager.io/v1
  Kind:         CertificateRequest
  Metadata:
    Creation Timestamp:  2020-10-21T17:31:24Z
    Generate Name:       test-cert-
    Generation:          1
    Owner References:
      API Version:           cert-manager.io/v1
      Block Owner Deletion:  true
      Controller:            true
      Kind:                  Certificate
      Name:                  test-cert
      UID:                   82148eee-5f4b-47d7-a09a-407e4d041101
    Resource Version:        120254090
    Self Link:               /apis/cert-manager.io/v1/namespaces/cert-manager/certificaterequests/test-cert-zqbwz
    UID:                     bb9d218d-084d-40a5-8f83-46ca5ac4f70a
  Spec:
    Issuer Ref:
      Kind:   ClusterIssuer
      Name:   letsencrypt
    Request:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSR...Q0FURSBSRVFVRVNULS0tLS0K
  Status:
    Conditions:
      Last Transition Time:  2020-10-21T17:31:24Z
      Message:               Waiting on certificate issuance from order cert-manager/test-cert-zqbwz-2027085711: "pending"
      Reason:                Pending
      Status:                False
      Type:                  Ready
  Events:                    <none>

订单：

  $ kubectl -n cert-manager get order
  NAME                         STATE     AGE
  test-cert-zqbwz-2027085711   pending   68m

  $ kubectl -n cert-manager describe order test-cert-zqbwz-2027085711
  Name:         test-cert-zqbwz-2027085711
  Namespace:    cert-manager
  Labels:       <none>
  Annotations:  cert-manager.io/certificate-name: test-cert
                cert-manager.io/certificate-revision: 1
                cert-manager.io/private-key-secret-name: test-cert-gqhmj
                kubectl.kubernetes.io/last-applied-configuration:
                  {"apiVersion":"cert-manager.io/v1alpha2","kind":"Certificate","metadata":{"annotations":{},"name":"test-cert","namespace":"cert-manager"},...
  API Version:  acme.cert-manager.io/v1
  Kind:         Order
  Metadata:
    Creation Timestamp:  2020-10-21T17:31:24Z
    Generation:          1
    Owner References:
      API Version:           cert-manager.io/v1
      Block Owner Deletion:  true
      Controller:            true
      Kind:                  CertificateRequest
      Name:                  test-cert-zqbwz
      UID:                   bb9d218d-084d-40a5-8f83-46ca5ac4f70a
    Resource Version:        120254091
    Self Link:               /apis/acme.cert-manager.io/v1/namespaces/cert-manager/orders/test-cert-zqbwz-2027085711
    UID:                     622c3ce4-fa2f-484f-a280-c125e09e37d3
  Spec:
    Common Name:  *.test.example.com
    Dns Names:
      *.test.example.com
    Issuer Ref:
      Kind:   ClusterIssuer
      Name:   letsencrypt
    Request:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBS...USUZJQ0FURSBSRVFVRVNULS0tLS0K
  Status:
    Authorizations:
      Challenges:
        Token:        QCbSEvy4g6wIHpcOyU4UkIES9TtBoKMuOOyYNVsJ13w
        Type:         dns-01
        URL:          https://acme-v02.api.letsencrypt.org/acme/chall-v3/8048950916/RQu94g
      Identifier:     test.example.com
      Initial State:  pending
      URL:            https://acme-v02.api.letsencrypt.org/acme/authz-v3/8048950916
      Wildcard:       true
    Finalize URL:     https://acme-v02.api.letsencrypt.org/acme/finalize/68054360/5803374286
    State:            pending
    URL:              https://acme-v02.api.letsencrypt.org/acme/order/68054360/5803374286
  Events:             <none>
Events:                          <none>

为什么证书顺序是 pending 状态，在 Route53 中我确实看到 TXT for _acme-challenge.test.example.com 已创建

我在这里的设置中缺少什么？

【问题讨论】：

上面引用的方法对我来说适用于 Nginx，tls-cert 是在预期的命名空间中自动生成的，密钥和证书都是。为此，您应该将 nginx 负载均衡器的 IP 指向 DNS 它对我有用，acme 挑战将自动测试，证书将其状态从 false 更改为 true，一旦完成
tls-cert secret 是 cert-manager 自己为我创建入口规则的命名空间创建的。你在做与此不同的事情吗
不，我什至创建了测试应用程序，仍然没有生成证书。
只是一个建议，您可以尝试在其他命名空间中创建 helm chart，并查找在那里生成的任何 Kubernetes 对象文件，也许您会在当前命名空间中丢失它们中的任何一个。然后，您可以在弄清楚事情后删除该 helm chart 部署。
也试过 helm，结果相同。向问题添加了 CertificateRequest。

标签： kubernetes amazon-route53 amazon-eks cert-manager

【解决方案1】：

可能是同样的情况

Waiting on certificate issuance from order status "pending"

【讨论】：

抱歉，我已将我的命令更正为您之前的输出。
我的命令不是获取证书，Kubectl 证书批准
$ kubectl -n cert-manager certificate approval test-cert-2glmx No resources found 服务器错误（未找到）：certificatesigningrequests.certificates.k8s.io "test-cert-2glmx" not found跨度>
你的 kubectl get csr -n cert-manager 输出是什么？
% kubectl -n cert-manager get certificate NAME READY SECRET AGE test-cert False test-cert 161m