GKE中cert-manager证书无法找到指定Secret问题求助

问题现象 #

• 应用在GKE的Services和Ingress指定IP下可正常运行，但Ingress提示Secret不存在
• Certificate配置指定secretName: foodipes-com，但实际生成的Secret为foodipes-com-5r2l6（自动追加5位字符）
• Certificate状态为False（未就绪）
• Ingress配置中指定的secretName与Certificate一致，但报错依旧

关键配置与输出 #

1. Certificate配置（certificate.yaml） #

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: foodipes-com
spec:
  secretName: foodipes-com
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - foodipes.com
    - www.foodipes.com

2. ClusterIssuer配置（issuer.yaml） #

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: "easwardsharma@gmail.com"
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

3. Ingress配置（ingress-service.yaml） #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-service
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: 'true'
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    cert-manager.io/cluster-issuer: 'letsencrypt-prod'
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
spec:
  tls:
    - hosts:
        - foodipes.com
        - www.foodipes.com
      secretName: foodipes-com
  rules:
    - host: foodipes.com
      http:
        paths:
          - path: /?(.*)
            pathType: Prefix
            backend:
              service:
                name: client-cluster-ip-service
                port:
                  number: 3000
          - path: /api/?(.*)
            pathType: Prefix
            backend:
              service:
                name: server-cluster-ip-service
                port:
                  number: 5000

4. 关键kubectl输出 #

• kubectl get secrets：

NAME                                 TYPE                 DATA   AGE
foodipes-com-5r2l6                   Opaque               1      7h8m

• kubectl get certificates：

NAME               READY   SECRET         AGE
foodipes-com       False   foodipes-com   19h

• kubectl describe certificate foodipes-com关键片段：

Status:
  Conditions:
    Last Transition Time:        2023-09-26T18:23:34Z
    Message:                     Issuing certificate as Secret does not exist
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
  Next Private Key Secret Name:  foodipes-com-5r2l6
Events:
  Type    Reason     Age   From                                       Message
  ----    ------     ----  ----                                       -------
  Normal  Requested  39m   cert-manager-certificates-request-manager  Created new CertificateRequest resource "foodipes-com-vlg9m"

问题根源分析 #

1. 证书请求未完成审批：Certificate状态显示Issuing，且生成了Next Private Key Secret Name，说明cert-manager已发起证书请求，但请求未完成，导致最终的foodipes-com Secret未生成，带后缀的Secret是临时中间产物。
2. HTTP-01挑战失败：使用HTTP-01 solver时，可能存在以下问题：
   • 域名foodipes.com和www.foodipes.com未解析到Ingress的外部IP
   • 80端口被防火墙或GKE网络策略拦截，Let's Encrypt的挑战请求无法到达
   • nginx Ingress Controller运行异常

排查步骤 #

1. 检查CertificateRequest状态：
   执行命令查看证书请求的详细错误信息：

   kubectl describe certificaterequest foodipes-com-vlg9m
   

2. 检查临时挑战Ingress：
   cert-manager会为HTTP-01挑战创建临时Ingress，执行命令确认其状态：

   kubectl get ingress
   

3. 验证域名解析：
   确认域名指向Ingress的外部IP：

   nslookup foodipes.com
   nslookup www.foodipes.com
   

4. 检查网络连通性：

   • 确认GKE防火墙允许80端口入站流量
   • 检查是否存在阻止流量到达nginx Ingress的网络策略

5. 修正ClusterIssuer环境（可选）：
   如果需要生产环境证书，将ClusterIssuer的server改为生产地址：

   server: https://acme-v02.api.letsencrypt.org/directory
   

解决方案 #

1. 确保域名正确解析到Ingress的外部IP
2. 开放80端口入站流量，允许Let's Encrypt挑战请求访问
3. 若CertificateRequest失败，删除该请求让cert-manager重新发起：

   kubectl delete certificaterequest foodipes-com-vlg9m
   

4. 待CertificateRequest审批完成后，cert-manager会自动将最终证书写入foodipes-com Secret，Ingress即可正常使用

内容的提问来源于stack exchange，提问作者EaswarD Sharma