Traefik ACME DNS-01 gcloud 重复记录

Question

我不确定这是 traefik 和我的配置特有的问题还是错误，但是将我的提供程序从 route53 移动到 gcloud 我的 acme 配置会从 google 生成 409 重复资源错误。

看起来 acme 代码希望能够覆盖 TXT 记录，但不能在 gcloud 上。

错误看起来像：

time="2018-11-01T11:46:41Z" level=error msg="Error obtaining certificate: acme: Error -> One or more domains had a problem:\n[qa.mydomain.com] error presenting token: googlecloud: googleapi: Error 409: The resource 'entity.change.additions[0].rrdata[1]' named '\"VuOLZS3tfLfrOswFtV3mayqOYaz5PvQK16nJdgMdMez\"' already exists, alreadyExists\n"
time="2018-11-01T11:46:41Z" level=error msg="Unable to obtain ACME certificate for domains \"*.qa.mydomain.com,qa.mydomain.com\" : unable to generate a certificate for the domains [*.qa.mydomain.com qa.mydomain.com]: acme: Error -> One or more domains had a problem:\n[qa.mydomain.com] error presenting token: googlecloud: googleapi: Error 409: The resource 'entity.change.additions[0].rrdata[1]' named '\"VuOLZS3tfLfrOswFtV3mayqOYaz5PvQK16nJdgMdMez\"' already exists, alreadyExists\n"
time="2018-11-01T11:46:41Z" level=error msg="Error obtaining certificate: acme: Error -> One or more domains had a problem:\n[development.mydomain.com] error presenting token: googlecloud: googleapi: Error 409: The resource 'entity.change.additions[0].rrdata[1]' named '\"Jfv6orVfbwi0IdQbmpvG3qnIltMX5x56vGUpHjoBzOa\"' already exists, alreadyExists\n"
time="2018-11-01T11:46:41Z" level=error msg="Unable to obtain ACME certificate for domains \"*.development.mydomain.com,development.mydomain.com\" : unable to generate a certificate for the domains [*.development.mydomain.com development.mydomain.com]: acme: Error -> One or more domains had a problem:\n[development.mydomain.com] error presenting token: googlecloud: googleapi: Error 409: The resource 'entity.change.additions[0].rrdata[1]' named '\"Jfv6orVfbwi0IdQbmpvG3qnIltMX5x56vGUpHjoBzOa\"' already exists, alreadyExists\n"

极致配置：

[acme]
  email = "email@mydomain.com"
  storage = "/acme-certificates/acme.json"
  acmeLogging = true
  entryPoint = "https"

[acme.dnsChallenge]
  provider = "gcloud"

[[acme.domains]]
  main = "*.development.mydomain.com"
  sans = ["development.mydomain.com"]

[[acme.domains]]
  main = "*.qa.mydomain.com"
  sans = ["qa.mydomain.com"]

Answer 1

当您在同一记录上同时拥有一个裸域和一个通配符域时，您会遇到这种错误 - 因为它会尝试添加大多数 DNS 提供商都支持的两条 TXT 记录。

但是，google 要求您删除记录，然后添加具有两个 rrdata 字段而不是两个单独记录的新记录。

:-/

这是一个错误。 Google DNS不容易编程。

Answer 2

记录为 traefik bug，已修补并关闭。