0

我正在尝试通过cert-manager使用 HTTP 质询验证为我的 Kubernetes 集群颁发证书。但是，出于某种原因，挑战订单正在尝试使用dns-01未配置的验证者。

我试图找出不同的配置，cert-manager再次删除和安装，但没有任何帮助。它在其他 ACME 客户端上工作。

我正在使用cert-manager v1.2.0.

这是我ClusterIssuer的http-01求解器：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: clusterissuer-test-acme
  #namespace: default
spec:
  acme:
    server: https://lab03.test.com:8432/acme/directory
    # Email address used for ACME registration
    email: k8s-security-team@example.org
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: issuer-acme-secret
    # Enable HTTP01 validations
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - selector: {}
      http01:
        ingress:
          class: public

这是我要颁发的证书：

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: cert-lab05-test-com
  namespace: default
spec:
  secretName: cert--secret-lab05-test-com
  renewBefore: 365h # 15d
  issuerRef:
    name: clusterissuer-test-acme
    kind: ClusterIssuer
  commonName: lab05.test.com
  dnsNames:
  - lab05.test.com

我收到以下错误：

Status:
  Authorizations:
    Challenges:
      Token:        QHYyjqayGWufzC6kz313UwkUvRillXZWdBgoEVKyfe83w32SXvaSgkxvYJEKUViVM884eQAAAXnDf-lT
      Type:         dns-01
      URL:          https://lab03.test.com:8432/acme/authz/yFwhSs9x3y4UcyPxCTXHfsSKhhpD1AAAAXnDf-lT/2
    Identifier:     lab05.test.com
    Initial State:  pending
    URL:            https://lab03.test.com:8432/acme/authz/yFwhSs9x3y4UcyPxCTXHfsSKhhpD1AAAAXnDf-lT
    Wildcard:       false
  Finalize URL:     https://lab03.test.com:8432/acme/order/c3a10096-ad3a-4e48-9160-f4d39a617299-7/finalize
  State:            pending
  URL:              https://lab03.test.com:8432/acme/order/c3a10096-ad3a-4e48-9160-f4d39a617299-7
Events:
  Type     Reason  Age   From          Message
  ----     ------  ----  ----          -------
  Warning  Solver  5m9s  cert-manager  Failed to determine a valid solver configuration for the set of domains on the Order: no configured challenge solvers can be used for this challenge

我不明白为什么dns-01应该http-01根据ClusterIssuer设置挑战类型。

4

0 回答 0