0

我试图弄清楚如何在 Kubernetes 上设置大使，但我遇到了一些问题。

我们的应用程序托管在 DogitalOcean 上，我们正在尝试充分利用他们的资源。他们有一个很好的入门工具包来启动和运行环境。我坚持的部分是设置入口控制器。我们为此选择了大使，以下是与之相关的文档：https ://github.com/digitalocean/Kubernetes-Starter-Kit-Developers/blob/main/03-setup-ingress-controller/ambassador.md#step -2---为大使边缘堆栈定义主机

我安装了大使本身没有问题（几乎）。接下来是设置主机。

这是我的主机文件：

---
apiVersion: getambassador.io/v2
kind: Host
metadata:
  name: priz-api-host
  namespace: ambassador
spec:
  hostname: api.priz.guru
  acmeProvider:
    email: alex@priz.guru
  tlsSecret:
    name: tls2-cert
  requestPolicy:
    insecure:
      action: Redirect
      additionalPort: 8080

注意：文档提到主机名必须可以从 Internet 访问，并且确实如此。

应用更改并描述主机后，我收到以下错误：

Normal   Pending  49m (x2 over 49m)  Ambassador Edge Stack  performing ACME challenge for tlsSecret "tls2-cert"."ambassador" (hostnames=["apii.priz.guru"])...
  Warning  Error    48m                Ambassador Edge Stack  obtaining tlsSecret "tls2-cert"."ambassador" (hostnames=["apii.priz.guru"]): acme: Error -> One or more domains had a problem:
[apii.priz.guru] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://apii.priz.guru/.well-known/acme-challenge/e9cme4KfsSovEz_jpjCKTskamm7bpn4Lw8I6JJBaprk [157.230.204.38]: "<html>\r\n<head><title>404 Not Found</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>404 Not Found</h1></center>\r\n<hr><center>", url:
  Normal   Pending  43m (x2 over 43m)  Ambassador Edge Stack  (combined from similar events): performing ACME challenge for tlsSecret "tls2-cert"."ambassador" (hostnames=["api.priz.guru"])...
  Warning  Error    43m                Ambassador Edge Stack  obtaining tlsSecret "tls2-cert"."ambassador" (hostnames=["api.priz.guru"]): acme: Error -> One or more domains had a problem:
[api.priz.guru] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from https://api.priz.guru/.well-known/acme-challenge/sDf1glecKdXnV7HYrWuYzpnCoFOJHYW7Kk0jyDBlxwA [2606:4700:3033::6815:1056]: 404, url:
  Warning  Error  32m  Ambassador Edge Stack  obtaining tlsSecret "tls2-cert"."ambassador" (hostnames=["api.priz.guru"]): acme: Error -> One or more domains had a problem:
[api.priz.guru] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from https://api.priz.guru/.well-known/acme-challenge/Pob867AOqpWS_rws_hB9EGqsZPLCInPDp1dDa2hWGAI [2606:4700:3036::ac43:d279]: 404, url:
  Normal   Pending  11m (x2 over 32m)  Ambassador Edge Stack  tlsSecret "tls2-cert"."ambassador" (hostnames=["api.priz.guru"]): needs updated: tlsSecret does not exist
  Normal   Pending  11m (x2 over 32m)  Ambassador Edge Stack  performing ACME challenge for tlsSecret "tls2-cert"."ambassador" (hostnames=["api.priz.guru"])...
  Warning  Error    11m                Ambassador Edge Stack  obtaining tlsSecret "tls2-cert"."ambassador" (hostnames=["api.priz.guru"]): acme: Error -> One or more domains had a problem:
[api.priz.guru] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from https://api.priz.guru/.well-known/acme-challenge/834gr6TLzUCDq1-j2qvdWMCeMVFSQD3U41EgE57UrbY [2606:4700:3033::6815:1056]: 404, url:

现在，深入研究文档，我试图了解什么是HTTP-01 Challenge。事实上，这种端点在当前服务器上是不存在的。

我很困惑，需要做什么才能使其工作？

4

1 回答 1

0

看起来我自己解决了（不是 100% 确定是否正确）。显然，主机名必须指向大使的公共 IP。由于大使是负责验证证书的人。

于 2022-01-21T09:14:18.217 回答