cert-manager + kubernetes 通配符问题

Question

我正在尝试在云负载均衡器后面的 Rancher kubernetes 引擎上创建通配符证书。 安装牧场主后，我有一个发行者：

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  annotations:
    meta.helm.sh/release-name: rancher
    meta.helm.sh/release-namespace: cattle-system
  creationTimestamp: "2021-09-21T12:10:25Z"
  generation: 1
  labels:
    app: rancher
    app.kubernetes.io/managed-by: Helm
    chart: rancher-2.5.9
    heritage: Helm
    release: rancher
  name: rancher
  namespace: cattle-system
  resourceVersion: "1318"
  selfLink: /apis/cert-manager.io/v1/namespaces/cattle-system/issuers/rancher
  uid: #
spec:
  acme:
    email: #
    preferredChain: ""
    privateKeySecretRef:
      name: letsencrypt-production
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        ingress: {}
status:
  acme:
    lastRegisteredEmail: #
    uri: https://acme-v02.api.letsencrypt.org/#
  conditions:
  - lastTransitionTime: "2021-09-21T12:10:27Z"
    message: The ACME account was registered with the ACME server
    reason: ACMEAccountRegistered
    status: "True"
    type: Ready

这是命令：

kubectl describe order wildcard-dev-mctqj-4171528257 -n cattle-system

Name:         wildcard-dev-mctqj-4171528257
Namespace:    cattle-system
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: wildcard-dev
              cert-manager.io/certificate-revision: 1
              cert-manager.io/private-key-secret-name: wildcard-dev-2g4rc
API Version:  acme.cert-manager.io/v1
Kind:         Order
Metadata:
  Creation Timestamp:  2021-09-21T14:10:50Z
  Generation:          1
  Managed Fields:
    API Version:  acme.cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:cert-manager.io/certificate-name:
          f:cert-manager.io/certificate-revision:
          f:cert-manager.io/private-key-secret-name:
          f:kubectl.kubernetes.io/last-applied-configuration:
        f:ownerReferences:
          .:
          k:{"uid":"}
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:commonName:
        f:dnsNames:
        f:issuerRef:
          .:
          f:kind:
          f:name:
        f:request:
      f:status:
        .:
        f:authorizations:
        f:finalizeURL:
        f:state:
        f:url:
    Manager:    controller
    Operation:  Update
    Time:       2021-09-21T14:10:52Z
Owner References:
    API Version:           cert-manager.io/v1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  CertificateRequest
    Name:                  wildcard-dev-mctqj
    UID:                   #
  Resource Version:        48930
  Self Link:               /apis/acme.cert-manager.io/v1/namespaces/cattle-system/orders/wildcard-dev-mctqj-4171528257
  UID:                     #
Spec:
  Common Name:  *.
  Dns Names:
    *.rancher-dev.com
  Issuer Ref:
    Kind:   Issuer
    Name:   rancher
  Request:
Status:
  Authorizations:
    Challenges:
      Token:        #######
      Type:         dns-01
      URL:          https://acme-v02.api.letsencrypt.org/acme/chall-v3/##
    Identifier:     rancher.dev.com
    Initial State:  pending
    URL:            https://acme-v02.api.letsencrypt.org/acme/authz-v3/##
    Wildcard:       true
  Finalize URL:     https://acme-v02.api.letsencrypt.org/acme/finalize/###
  State:            pending
  URL:              https://acme-v02.api.letsencrypt.org/acme/order/###
Events:
  Type     Reason  Age   From          Message
  ----     ------  ----  ----          -------
  Warning  Solver  49m   cert-manager  Failed to determine a valid solver configuration for the set of domains on the Order: no configured challenge solvers can be used for th  is challenge

dns 已更改

证书：

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-dev
  namespace: cattle-system
spec:
  secretName: wildcard-dev
  issuerRef:
    kind: Issuer
    name: rancher
  commonName: '*.rancher.dev.com'
  dnsNames:
  - '*.rancher.dev.com'

我还没有创建入口..

我认为是有规律的

Type:         dns-01

我做错了什么？

Mbe 创建第二个发行人？

实际上，我想创建通配符证书并用 kubed 克隆他，因为我需要在 kube 中有很多命名空间和 1 个 wldcard 证书。大家有什么建议吗？）

Answer 1

正如这里写的serving-a-wildcard-to-ingress，http01 求解器不支持通配符。相反，您应该使用 dns01 作为通配符证书。

请参阅dns01 solver 的文档。