cert-manager生成的Secret名称与Certificate配置不符的原因

环境与配置信息 #

使用cert-manager维护者提供的cert-manager operator 1.11.0版本，配置的Certificate资源如下：

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hfeqm03-selfsigned-cert
  namespace: mq
spec:
  commonName: hfeqm03
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
  secretName: hfeqm03-selfsigned-cert
  subject:
    organizations:
    - IBM

异常现象 #

应用配置后，系统生成的Secret名称为hfeqm03-selfsigned-cert-czqj4（在spec.secretName指定的名称后追加了随机字符），与官方文档描述不符。查看Certificate的状态与事件：

Status:
  Conditions:
    Last Transition Time:        2023-03-22T10:34:31Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      True
    Type:                        Issuing
    Last Transition Time:        2023-03-22T10:34:33Z
    Message:                     Issuing certificate as Secret does not exist
    Observed Generation:         1
    Reason:                      DoesNotExist
    Status:                      False
    Type:                        Ready
  Next Private Key Secret Name:  hfeqm03-selfsigned-cert-czqj4
Events:
  Type    Reason     Age                   From                                       Message
  ----    ------     ----                  ----                                       -------
  Normal  Issuing    4m18s                 cert-manager-certificates-trigger          Issuing certificate as Secret does not exist
  Normal  Requested  4m16s                 cert-manager-certificates-request-manager  Created new CertificateRequest resource "hfeqm03-selfsigned-cert-pk22n"
  Normal  Requested  4m16s                 cert-manager-certificates-request-manager  Created new CertificateRequest resource "hfeqm03-selfsigned-cert-f9f5s"
  Normal  Generated  4m9s                  cert-manager-certificates-key-manager      Stored new private key in temporary Secret resource "hfeqm03-selfsigned-cert-chv7v"
  Normal  Generated  4m8s (x2 over 4m17s)  cert-manager-certificates-key-manager      Stored new private key in temporary Secret resource "hfeqm03-selfsigned-cert-czqj4"
  Normal  Requested  4m7s                  cert-manager-certificates-request-manager  Created new CertificateRequest resource "hfeqm03-selfsigned-cert-wzxvl"
  Normal  Requested  4m7s                  cert-manager-certificates-request-manager  Created new CertificateRequest resource "hfeqm03-selfsigned-cert-8rqzz"

预期应出现“将新私钥从临时Secret迁移至指定的永久Secret”类事件，但实际未出现。

核心原因及排查方向 #

1. 证书签发流程未完成
   带后缀的Secret是cert-manager签发过程中的临时中间资源，只有当CertificateRequest被成功签署后，控制器才会将私钥和证书迁移到spec.secretName指定的永久Secret中。当前Certificate的Ready状态为False，说明整个签发流程尚未完成，临时Secret还没被替换成目标Secret。

2. CertificateRequest处理异常
   事件中多次创建CertificateRequest，但没有后续的Issued或Approved事件，说明selfsigned-issuer可能存在问题：

   • 先检查selfsigned-issuer的就绪状态：

     kubectl get clusterissuers selfsigned-issuer -o yaml
     

     确认其status.conditions中Ready状态为True，若未就绪，需修复Issuer配置。
   • 若Issuer正常，查看具体CertificateRequest的详细状态，排查签名失败原因：

     kubectl get certificaterequests -n mq hfeqm03-selfsigned-cert-pk22n -o yaml
     

     重点检查status.conditions中的错误信息，比如权限不足、签名配置错误等。

3. 资源冲突或权限问题

   • 检查mq命名空间中是否已存在同名的hfeqm03-selfsigned-cert Secret，若存在可能导致迁移失败，清理后重新触发签发：

     kubectl delete secret -n mq hfeqm03-selfsigned-cert
     kubectl delete certificate -n mq hfeqm03-selfsigned-cert
     kubectl apply -f your-certificate.yaml
     

   • 确认cert-manager控制器在mq命名空间拥有创建、更新Secret的权限，可查看控制器的ClusterRole绑定配置。

内容的提问来源于stack exchange，提问作者Hugh Everett