我设置了一个Kubernetes集群,当前有两个节点,metallb作为负载均衡器。

目前,我想使用Ingress并通过ssl对其进行保护。为此,我决定将nginx ingress与cert-manager一起使用,并将其放置在教程后的网站上。

但是现在我得到了错误“等待http-01挑战传播:无法执行自检GET请求'http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs':获取“http://example.....zone/.well-known/acme-challenge/A5lFUj69fDccpXlvlyVw9-ekATEjt_-DKiJUzJSafxs”:拨打tcp 94.130.150.125:80:connect:连接超时


我当前的ClusterIssuer如下所示:

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
 name: letsencrypt-prod
 namespace: cert-manager
spec:
 acme:
   # The ACME server URL
   server: https://acme-v02.api.letsencrypt.org/directory
   # Email address used for ACME registration
   email: letsencrypt@mymail.de
   # Name of a secret used to store the ACME account private key
   privateKeySecretRef:
     name: letsencrypt-prod
   # Enable the HTTP-01 challenge provider
   solvers:
   - http01:
       ingress:
         class:  nginx

我正在尝试自动提供证书
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    cert-manager.io/acme-challenge-type: http01
spec:
  tls:
  - hosts:
    - example.....zone
    secretName: example-...-zone-tls
  rules:
  - host: example.....zone
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-service
          servicePort: 80

手动地,我可以完美地到达任何地址。

最佳答案

这个为我工作。

LoadBalancer服务中更改ingress-nginx

添加/更改externalTrafficPolicy: Cluster

原因是,证书颁发者的Pod与负载均衡器缠绕在不同的节点上,因此它无法通过入口自言自语。

以下是取自https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.26.1/deploy/static/provider/cloud-generic.yaml的完整块

kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  #CHANGE/ADD THIS
  externalTrafficPolicy: Cluster
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: https

---

07-25 22:49