manager-web | 接口测试平台前端部分 | Frontend Framework library

Im quite new to kubernetes and Im trying to set up a microk8s test environment on a VPS with CentOS.

What I did:

I set up the cluster, enabled the ingress and metallb

When I try configuring TLS Let's Encrypt certificates for my cluster application with a NGINX Ingress controller and cert-manager, something goes wrong with the ClusterIssuer.

My ClusterIssuer is defined as followed:

I am getting this error:

I have installed cert manager according to the documentation using Helm. After installation I am able to get certificates using Ingress too. But after getting certificate I am unable to describe, delete to perform any other option on certificate or any other cert manager resources. I get following error

I'm deploying cert-manager on Azure AKS and trying to have it request a Let's Encrypt certificate. It fails with certificate signed by unknown authority error and I have problem troubleshooting it further.

Not sure whether this is a problem with trusting LE server, a tunnelfront pod, or maybe an internal AKS self-generated CA. So my questions would be:

• how to force cert-manager to debug (display more info) regarding the certificate it does not trust?
• maybe the problem is occuring regularly and there is a known solution?
• what steps should be undertaken to debug the issue further?

I have created an issue on jetstack/cert-manager's Github page, but was not answered, so I came here.

The whole story is as follows:

Certificates are not created. The following errors are reported:

the certificate: Error from server: conversion webhook for &{map[apiVersion:cert-manager.io/v1alpha2 kind:Certificate metadata:map[creationTimestamp:2020-05-13T17:30:48Z generation:1 name:xxx-tls namespace:test ownerReferences:[map[apiVersion:extensions/v1beta1 blockOwnerDeletion:true controller:true kind:Ingress name:xxx-ingress uid:6d73b182-bbce-4834-aee2-414d2b3aa802]] uid:d40bc037-aef7-4139-868f-bd615a423b38] spec:map[dnsNames:[xxx.test.domain.com] issuerRef:map[group:cert-manager.io kind:ClusterIssuer name:letsencrypt-prod] secretName:xxx-tls] status:map[conditions:[map[lastTransitionTime:2020-05-13T18:55:31Z message:Waiting for CertificateRequest "xxx-tls-1403681706" to complete reason:InProgress status:False type:Ready]]]]} failed: Post https://cert-manager-webhook.cert-manager.svc:443/convert?timeout=30s: x509: certificate signed by unknown authority

cert-manager-webhook container: cert-manager 2020/05/15 14:22:58 http: TLS handshake error from 10.20.0.19:35350: remote error: tls: bad certificate

Where 10.20.0.19 is the IP of tunnelfront pod.

Debugging with https://cert-manager.io/docs/faq/acme/ sort of "fails" when trying to kubectl describe order... as kubectl describe certificaterequest... returns CSR contents with error (as above), but not the order ID.

Environment details:

• Kubernetes version: 1.15.10
• Cloud-provider/provisioner : Azure (AKS)
• cert-manager version: 0.14.3
• Install method: static manifests (see below) + cluster issuer (see below) + regular CRDs (not legacy)

cluster issuer:

When starting cert-manager I get the following message

TLS handshake error from 10.42.152.128:38676: EOF

I'm trying to expose kubernetes dashboard publicly via an ingress on a single master bare-metal cluster. The issue is that the LoadBalancer (nginx ingress controller) service I'm using is not opening the 80/443 ports which I would expect it to open/use. Instead it takes some random ports from the 30-32k range. I know I can set this range with --service-node-port-range but I'm quite certain I didn't have to do this a year ago on another server. Am I missing something here?

Currently this is my stack/setup (clean install of Ubuntu 16.04):

• Nginx Ingress Controller (installed via helm)
• MetalLB
• Kubernetes Dashboard
• Kubernetes Dashboard Ingress to deploy it publicly on
• Cert-Manager (installed via helm)

k8s-dashboard-ingress.yaml

• Istio: 1.3 (also tried 1.1 before update to 1.3)
• K8s: 1.16.2
• Cloud provider: DigitalOcean

I have a cluster setup with Istio. I have enabled grafana/kiali and also installed kibana and RabbitMQ management UI and for all of those I have gateways and virtual services configured (all in istio-system namespace) along with HTTPS using SDS and cert-manager and all works fine. It means I can access these resources in the browser over HTTPS with a sub domain.

Then I deployed a microservice (part of a real application) and created Service, VirtualService and Gateway resources for it (for now it is the only one service and gateway except rabbitmq which uses different sub domain and differend port). And it is located in default namespace.

I am unable to create a certificate using cert-manager.

I am following this guide https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html

This works: