没有命名空间时 Kubectl 删除 tls

Question

在已删除的节点上有一个命名空间“沙盒”，但证书“echo-tls”仍然存在挑战。 但我无法再访问沙盒命名空间来删除​​此证书。 谁能帮我删除这个资源？

这是 cert-manager 的日志：

Found status change for Certificate "echo-tls" condition "Ready": "True" -> "False"; setting lastTransitionTime to...

cert-manager/controller/CertificateReadiness "msg"="re-queuing item due to error processing" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"echo-tls\": StorageError: invalid object, Code: 4, Key: /cert-manager.io/certificates/sandbox/echo-tls, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: ..., UID in object meta: " "key"="sandbox/echo-tls"

重启 pod cert-manager 后，日志如下：

cert-manager/controller/certificaterequests/handleOwnedResource "msg"="error getting referenced owning resource" "error"="certificaterequest.cert-manager.io \"echo-tls-bkmm8\" not found" "related_resource_kind"="CertificateRequest" "related_resource_name"="echo-tls-bkmm8" "related_resource_namespace"="sandbox" "resource_kind"="Order" "resource_name"="echo-tls-bkmm8-1177139468" "resource_namespace"="sandbox" "resource_version"="v1"

cert-manager/controller/orders "msg"="re-queuing item due to error processing" "error"="ACME client for issuer not initialised/available" "key"="sandbox/echo-tls-dwpt4-1177139468"

然后是和以前一样的日志

发行人：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: ***
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress: {}

部署配置：

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: <APP_NAME>
  annotations:
    kubernetes.io/tls-acme: "true"
    kubernetes.io/ingress.class: nginx-<ENV>
    acme.cert-manager.io/http01-ingress-class: nginx-<ENV>
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - ***.fr
    secretName: <APP_NAME>-tls
  rules:
  - host: ***.fr
    http:
      paths:
      - backend:
          serviceName: <APP_NAME>
          servicePort: 80

.k8s_config: &k8s_config
  before_script:
    - export HOME=/tmp
    - export K8S_NAMESPACE="${APP_NAME}"
    - kubectl config set-cluster k8s --server="${K8S_SERVER}"
    - kubectl config set clusters.k8s.certificate-authority-data ${K8S_CA_DATA}
    - kubectl config set-credentials default --token="${K8S_USER_TOKEN}"
    - kubectl config set-context default --cluster=k8s --user=default --namespace=default
    - kubectl config set-context ${K8S_NAMESPACE} --cluster=k8s --user=default --namespace=${K8S_NAMESPACE}
    - kubectl config use-context default
    - if [ -z `kubectl get namespace ${K8S_NAMESPACE} --no-headers --output=go-template={{.metadata.name}} 2>/dev/null` ]; then kubectl create namespace ${K8S_NAMESPACE}; fi
    - if [ -z `kubectl --namespace=${K8S_NAMESPACE} get secret *** --no-headers --output=go-template={{.metadata.name}} 2>/dev/null` ]; then kubectl get secret *** --output yaml | sed "s/namespace:\ default/namespace:\ ${K8S_NAMESPACE}/" | kubectl create -f - ; fi
    - kubectl config use-context ${K8S_NAMESPACE}

Answer 1

1. 通常证书存储在 Kubernetes 机密中：https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets。您可以使用kubectl get secrets --all-namespaces 检索机密。您还可以通过检查给定 pod 的 yaml 描述来检查给定 pod 使用了哪些机密：kubectl get pods -n <pod-namespace> -o yaml（附加信息：https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod）
2. 命名空间是集群范围的，它不位于任何节点上。所以删除节点不会删除任何命名空间。
3. 如果上述曲目不符合您的需求，您能否提供一些 yaml 文件和一些命令行说明，以便重现问题？

Answer 2

终于在本周日，cert-manger 停止了对旧 tls 的挑战。