cert-manager无法关联证书与Secret问题排查求助

报错信息 #

Cert-manager/secret-for-certificate-mapper "msg"="无法获取拥有该Secret的证书" "error"="Certificate.cert-manager.io \"grafanaps-tls\" 未找到"

排查结果 #

经排查，未找到grafanaps-tls证书资源，执行kubectl get certificates输出如下：

NAME               READY   SECRET             AGE
Alertmanagerdf-tls   False   alertmanagerdf-tls   1年61天
Prometheusps-tls     False   prometheusps-tls     1年58天

已执行操作 #

• 因nginx ingress与cert-manager版本过旧不兼容Kubernetes 1.22，已升级相关组件恢复Pod运行
• 执行cmctl check api -n cert-manager，返回结果：cert-manager API已升级至1.7版本，孤立Secret已清理

当前状态与日志 #

• Cert-manager/webhook日志显示："msg"="检测到根CA轮换 - 重新生成服务证书"
• 组件重启后日志无明显异常，但多个服务SSL证书已过期，疑似证书资源缺失或cert-manager与Kubernetes ingress控制器集成存在问题

相关配置信息 #

关注cert-manager的ingressshim配置与args段，以下为cert-manager-cabictor部署配置：

C:\Windows\system32>kubectl describe deployment cert-manager-cabictor -n cert-manager
Name:                   cert-manager-cabictor 
Namespace:              cert-manager
CreationTimestamp:      Thu, 01 Dec 2022 18:31:02 +0530
Labels:                 app=cabictor 
                        app.kubernetes.io/component=cabictor 
                        app.kubernetes.io/instance=cert-manager
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=cabictor 
                        app.kubernetes.io/version=v1.7.3
                        helm.sh/chart=cert-manager-v1.7.3
Annotations:            deployment.kubernetes.io/revision: 2
                        meta.helm.sh/release-name: cert-manager
                        meta.helm.sh/release-namespace: cert-manager
Selector:               app.kubernetes.io/component=cabictor ,app.kubernetes.io/instance=cert-manager,app.kubernetes.io/name=cabictor 
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app=cabictor 
                    app.kubernetes.io/component=cabictor 
                    app.kubernetes.io/instance=cert-manager
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=cabictor 
                    app.kubernetes.io/version=v1.7.3
                    helm.sh/chart=cert-manager-v1.7.3
  Service Account:  cert-manager-cabictor 
  Containers:
   cert-manager:
    Image:      quay.io/jetstack/cert-manager-cabictor :v1.7.3
    Port:       <none>
    Host Port:  <none>
    Args:
      --v=2
      --leader-election-namespace=kube-system
    Environment:
      POD_NAMESPACE:   (v1:metadata.namespace)
    Mounts:           <none>
  Volumes:            <none>
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  <none>
NewReplicaSet:   cert-manager-cabictor -5b65bcdbbd (1/1 replicas created)
Events:          <none>

无法定位并修复根因，恳请协助分析问题并提供解决方法。

内容的提问来源于stack exchange，提问作者sam23