CODEWITHSUNDEEP
certificateistiocert-manager
Tomáš Prítrský
Tomáš Prítrský

Reputation: 121

cert-manager fails to create certificate in K8s cluster with Istio and LetsEncrypt

I have a Kubernetes cluster with Istio installed and I want to secure the gateway with TLS using cert-manager.

So, I deployed a cert-manager, issuer and certificate as per this tutorial: https://github.com/tetratelabs/istio-weekly/blob/main/istio-weekly/003/demo.md (to a cluster reachable via my domain)

But, the TLS secret does not get created - only what seems to be a temporary one with a random string appended: my-domain-com-5p8rd

The cert-manager Pod has these 2 lines spammed in the logs:

  1. W0208 19:30:20.548725 1 reflector.go:424] k8s.io/[email protected]/tools/cache/reflector.go:169: failed to list *v1.Challenge: the server could not find the requested resource (get challenges.acme.cert-manager.io)
  2. E0208 19:30:20.548785 1 reflector.go:140] k8s.io/[email protected]/tools/cache/reflector.go:169: Failed to watch *v1.Challenge: failed to list *v1.Challenge: the server could not find the requested resource (get challenges.acme.cert-manager.io)

Now, I don't understand why it's trying to reach "challenges.acme.cert-manager.io", because my Issuer resource has spec.acme.server: https://acme-v02.api.letsencrypt.org/directory

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt-prod
  namespace: istio-system
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - selector: {}
        http01:
          ingress:
            class: istio

then

kubectl get certificate -A

shows the certificate READY = False

kubectl describe certificaterequest -A

returns

Status:
  Conditions:
    Last Transition Time:  2023-02-08T18:09:55Z
    Message:               Certificate request has been approved by cert-manager.io
    Reason:                cert-manager.io
    Status:                True
    Type:                  Approved
    Last Transition Time:  2023-02-08T18:09:55Z
    Message:               Waiting on certificate issuance from order istio-system/my--domain-com-jl6gm-3167624428: "pending"
    Reason:                Pending
    Status:                False
    Type:                  Ready
Events:                    <none>

notes:

  1. The cluster does not have a Load Balancer, so I expose the ingress-gateway with nodePort(s).
  2. accessing the https://my.domain.com/.well-known/acme-challenge/
  3. cluster is installed on Kubeadm
  4. cluster networking is done via Calico
  5. http01 challenge

Thanks.

Upvotes: 0

Views: 1335

Answers (1)

Tom&#225;š Pr&#237;trsk&#253;
Tom&#225;š Pr&#237;trsk&#253;

Reputation: 121

Figured this out. Turns out, the 'get challenges.acme.cert-manager.io' is not a HTTP get, but rather a resource GET within K8s cluster. There is 'challenges.acme.cert-manager.io' CustomResourceDefinition in cert-manager.yml

Running this command

kubectl get crd -A

returns a list of all CustomResourceDefinitions, but this one was missing.

I copied it out from cert-manager.yml to separate file and applied it manually - suddenly the challenge got created and so did the secret.

Why it didn't get applied with everything else in cert-manager.yml is beyond me.

Upvotes: 3

Related Questions