Kubernetes中cert-manager无法发证书，HTTP-01挑战返回404

环境与现状 #

• 自建K8s集群：1主节点+1工作节点，已部署MetalLB、Nginx Ingress Controller，Ingress资源可正常跨地域解析访问
• 部署cert-manager并创建ClusterIssuer、配置对应Ingress后，证书始终无法颁发，HTTP-01挑战报错：

Waiting for HTTP-01 challenge propagation: wrong status code '404', expected '200'

• 外部可正常访问挑战对应的URL，但集群内cert-manager访问该URL返回404

集群内域名解析异常现象 #

在multitool容器内测试域名wehealthy.ru时出现矛盾结果：

• 使用dig解析正常，返回正确IP：

diplom-app-deployment-7ccd7f4d99-2kvcn:/# dig wehealthy.ru

; <<>> DiG 9.18.16 <<>> wehealthy.ru
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27560
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: d5bb4fd7d14556f1 (echoed)
;; QUESTION SECTION:
;wehealthy.ru.                  IN      A

;; ANSWER SECTION:
wehealthy.ru.           30      IN      A       82.146.35.54

;; Query time: 140 msec
;; SERVER: 169.254.25.10#53(169.254.25.10) (UDP)
;; WHEN: Mon Jun 24 06:55:36 UTC 2024
;; MSG SIZE  rcvd: 81

• 使用ping、curl时解析到未知外部IP 75.126.102.234：

diplom-app-deployment-7ccd7f4d99-2kvcn:/# ping wehealthy.ru
PING wehealthy.ru.DOMAINS (75.126.102.234) 56(84) bytes of data.

已配置内容与尝试的解决方法 #

ClusterIssuer配置 #

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
  namespace: cert-manager
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: adminzztop245@gmail.com
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - http01:
        ingress:
          ingressClassName: nginx

CoreDNS自定义hosts尝试 #

已在CoreDNS配置中添加hosts条目，但问题未解决：

hosts {
    82.146.35.54 wehealthy.ru
    fallthrough
}

IngressClass检查结果 #

集群仅存在nginx类IngressClass：

kubectl get ingressclasses.networking.k8s.io -A
NAME    CONTROLLER             PARAMETERS   AGE
nginx   k8s.io/ingress-nginx   <none>       2d6h

提问 #

请问是否有人遇到过类似问题？该如何排查解决？

内容的提问来源于stack exchange，提问作者Henry