发行人更改后，Kubernetes证书经理不更新证书
我使用cert-manager 0.5.2在我们的Kubernetes集群上管理Let的加密证书。
我使用的是Let's Encrypt暂存环境，但现在已经开始使用他们的生产证书了。问题是我的应用程序没有更新到新的有效证书。
我必须在更新发行者，证书和入口资源时搞砸了一些东西，但我看不清楚是什么。我还重新安装了NGINX入口控制器和证书管理器，并重新创建了我的应用程序，但我仍然获得旧证书。我接下来该怎么办？
描述letsencrypt集群发行者：
Name: letsencrypt
Namespace:
Labels:
Annotations: kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"certmanager.k8s.io/v1alpha1","kind":"ClusterIssuer","metadata":{"annotations":{},"name":"letsencrypt","namespace":""},"spec":{"acme":{"e...
API Version: certmanager.k8s.io/v1alpha1
Kind: ClusterIssuer
Metadata:
Cluster Name:
Creation Timestamp: 2019-01-04T09:27:49Z
Generation: 0
Resource Version: 130088
Self Link: /apis/certmanager.k8s.io/v1alpha1/letsencrypt
UID: 00f0ea0f-1003-11e9-997f-ssh3b4bcc625
Spec:
Acme:
Email: administrator@domain.com
Http 01:
Private Key Secret Ref:
Key:
Name: letsencrypt
Server: https://acme-v02.api.letsencrypt.org/directoryStatus:
Acme:
Uri: https://acme-v02.api.letsencrypt.org/acme/acct/48899673Conditions:
Last Transition Time: 2019-01-04T09:28:33Z
Message: The ACME account was registered with the ACME server
Reason: ACMEAccountRegistered
Status: True
Type: ReadyEvents:
描述tls-secret证书：
Name: tls-secret
Namespace: default
Labels:
Annotations: kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"certmanager.k8s.io/v1alpha1","kind":"Certificate","metadata":{"annotations":{},"name":"tls-secret","namespace":"default"},"spec":{"acme"...
API Version: certmanager.k8s.io/v1alpha1
Kind: Certificate
Metadata:
Cluster Name:
Creation Timestamp: 2019-01-04T09:28:13Z
Resource Version: 130060
Self Link: /apis/certmanager.k8s.io/v1alpha1/namespaces/default/certificates/tls-secret
UID: 0f38w7y4-1003-11e9-997f-e6e9b4bcc625
Spec:
Acme:
Config:
Domains:
mydomain.com
Http 01:
Ingress Class: nginxDns Names:
mydomain.comIssuer Ref:
Kind: ClusterIssuer
Name: letsencryptSecret Name: tls-secret
Events:
描述aks-ingress入口控制器：
Name: aks-ingress
Namespace: default
Address:
Default backend: default-http-backend:80 ()
TLS:
tls-secret terminates mydomain.com
Rules:
Host Path Backends
---- ---- --------
mydomain.com
/ myapplication:80 (<none>)Annotations:
kubectl.kubernetes.io/last-applied-configuration: ...
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/rewrite-target: /
certmanager.k8s.io/cluster-issuer: letsencrypt
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal CREATE 21m nginx-ingress-controller Ingress default/aks-ingress
Normal CREATE 21m nginx-ingress-controller Ingress default/aks-ingress
重新启动服务器后记录cert-manager：
I0104 09:28:38.378953 1 setup.go:144] Skipping re-verifying ACME account as cached registration details look sufficient.
I0104 09:28:38.379058 1 controller.go:154] clusterissuers controller: Finished processing work item "letsencrypt"
I0104 09:28:38.378953 1 setup.go:144] Skipping re-verifying ACME account as cached registration details look sufficient.
I0104 09:28:38.379058 1 controller.go:154] clusterissuers controller: Finished processing work item "letsencrypt"
I0104 09:28:38.378455 1 controller.go:140] clusterissuers controller: syncing item 'letsencrypt'
I0104 09:28:38.378455 1 controller.go:140] clusterissuers controller: syncing item 'letsencrypt'
I0104 09:28:33.440466 1 controller.go:185] certificates controller: Finished processing work item "default/tls-secret"
I0104 09:28:33.440417 1 sync.go:206] Certificate default/tls-secret scheduled for renewal in 1423 hours
I0104 09:28:33.440466 1 controller.go:185] certificates controller: Finished processing work item "default/tls-secret"
I0104 09:28:33.440417 1 sync.go:206] Certificate default/tls-secret scheduled for renewal in 1423 hours
I0104 09:28:33.439824 1 controller.go:171] certificates controller: syncing item 'default/tls-secret'
I0104 09:28:33.439824 1 controller.go:171] certificates controller: syncing item 'default/tls-secret'
I0104 09:28:33.377556 1 controller.go:154] clusterissuers controller: Finished processing work item "letsencrypt"
I0104 09:28:33.377556 1 controller.go:154] clusterissuers controller: Finished processing work item "letsencrypt"
I0104 09:28:33.359246 1 helpers.go:147] Setting lastTransitionTime for ClusterIssuer "letsencrypt" condition "Ready" to 2019-01-04 09:28:33.359214315 +0000 UTC m=+79.014291591
I0104 09:28:33.359178 1 setup.go:181] letsencrypt: verified existing registration with ACME server
I0104 09:28:33.359178 1 setup.go:181] letsencrypt: verified existing registration with ACME server
I0104 09:28:33.359246 1 helpers.go:147] Setting lastTransitionTime for ClusterIssuer "letsencrypt" condition "Ready" to 2019-01-04 09:28:33.359214315 +0000 UTC m=+79.014291591
I0104 09:28:32.427832 1 controller.go:140] clusterissuers controller: syncing item 'letsencrypt'
I0104 09:28:32.427978 1 controller.go:182] ingress-shim controller: Finished processing work item "default/aks-ingress"
I0104 09:28:32.427832 1 controller.go:140] clusterissuers controller: syncing item 'letsencrypt'
I0104 09:28:32.427832 1 controller.go:168] ingress-shim controller: syncing item 'default/aks-ingress'
I0104 09:28:32.428133 1 logger.go:88] Calling GetAccount
I0104 09:28:32.427936 1 sync.go:140] Certificate "tls-secret" for ingress "aks-ingress" already exists
I0104 09:28:32.427965 1 sync.go:143] Certificate "tls-secret" for ingress "aks-ingress" is up to date
I0104 09:28:32.427978 1 controller.go:182] ingress-shim controller: Finished processing work item "default/aks-ingress"
I0104 09:28:32.428133 1 logger.go:88] Calling GetAccount
I0104 09:28:32.427936 1 sync.go:140] Certificate "tls-secret" for ingress "aks-ingress" already exists
I0104 09:28:32.427832 1 controller.go:168] ingress-shim controller: syncing item 'default/aks-ingress'
I0104 09:28:32.427965 1 sync.go:143] Certificate "tls-secret" for ingress "aks-ingress" is up to date
I0104 09:28:29.439299 1 controller.go:171] certificates controller: syncing item 'default/tls-secret'
E0104 09:28:29.439586 1 controller.go:180] certificates controller: Re-queuing item "default/tls-secret" due to error processing: Issuer letsencrypt not ready
I0104 09:28:29.439404 1 sync.go:120] Issuer letsencrypt not ready
E0104 09:28:29.439586 1 controller.go:180] certificates controller: Re-queuing item "default/tls-secret" due to error processing: Issuer letsencrypt not ready
I0104 09:28:29.439299 1 controller.go:171] certificates controller: syncing item 'default/tls-secret'
I0104 09:28:29.439404 1 sync.go:120] Issuer letsencrypt not ready
I0104 09:28:27.404656 1 controller.go:68] Starting certificates controller
I0104 09:28:27.404606 1 controller.go:68] Starting issuers controller
I0104 09:28:27.404325 1 controller.go:68] Starting ingress-shim controller
I0104 09:28:27.404606 1 controller.go:68] Starting issuers controller
I0104 09:28:27.404325 1 controller.go:68] Starting ingress-shim controller
I0104 09:28:27.404269 1 controller.go:68] Starting clusterissuers controller
I0104 09:28:27.404656 1 controller.go:68] Starting certificates controller
I0104 09:28:27.404269 1 controller.go:68] Starting clusterissuers controller
I0104 09:28:27.402806 1 leaderelection.go:184] successfully acquired lease kube-system/cert-manager-controller
I0104 09:28:27.402806 1 leaderelection.go:184] successfully acquired lease kube-system/cert-manager-controller
I0104 09:27:14.359634 1 server.go:84] Listening on http://0.0.0.0:9402
I0104 09:27:14.357610 1 controller.go:126] Using the following nameservers for DNS01 checks: [10.0.0.10:53]
I0104 09:27:14.357610 1 controller.go:126] Using the following nameservers for DNS01 checks: [10.0.0.10:53]
I0104 09:27:14.358408 1 leaderelection.go:175] attempting to acquire leader lease kube-system/cert-manager-controller...
I0104 09:27:14.359634 1 server.go:84] Listening on http://0.0.0.0:9402
I0104 09:27:14.356692 1 start.go:79] starting cert-manager v0.5.2 (revision 9e8c3ad899c5aafaa360ca947eac7f5ba6301035)
I0104 09:27:14.358408 1 leaderelection.go:175] attempting to acquire leader lease kube-system/cert-manager-controller...
I0104 09:27:14.356692 1 start.go:79] starting cert-manager v0.5.2 (revision 9e8c3ad899c5aafaa360ca947eac7f5ba6301035)
证书资源：
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
name: tls-secret
spec:
secretName: tls-secret
dnsNames:
-
mydomain.com
acme:
config:-
http01:
ingressClass: nginx
domains:- mydomain.com
issuerRef:
- mydomain.com
name: letsencrypt
kind: ClusterIssuer -
写回答
-
整合最优质的专家资源和技术资料，问答解疑在这种情况下，重新创建密钥和证书管理器证书资源后问题就消失了。
通常要检查的内容，入口资源上的注释（certmanager.k8s.io/cluster-issuer：letsencrypt），证书管理器证书资源，k8s和入口资源中的ssl证书机密
2019-07-17 23:25:18赞同 1 展开评论 打赏
版权声明：本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
