使用cert-manager为GoDaddy域名生成Let's Encrypt证书失败求助

错误日志 #

I0728 17:31:12.123952       1 dns.go:88] cert-manager/controller/challenges/Present "msg"="presenting DNS01 challenge for domain" "dnsName"="XXXX" "domain"="XXX" "resource_kind"="Challenge" "resource_name"="letsencrypt-staging-bflxn-153714257-3821133841" "resource_namespace"="default" "resource_version"="v1" "type"="DNS-01" 
E0728 17:31:12.129511       1 controller.go:163] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="godaddy.acme.mycompany.com is forbidden: User \"system:serviceaccount:cert-manager:cert-manager\" cannot create resource \"godaddy\" in API group \"acme.mycompany.com\" at the cluster scope" "key"="default/letsencrypt-staging-bflxn-153714257-3821133841" 

核心问题：cert-manager的ServiceAccount无权限在集群范围创建acme.mycompany.com API组下的godaddy资源，推测与ClusterIssuer的groupName及webhook配置不匹配有关。

已配置资源 #

Secret配置（secret.yml） #

apiVersion: v1
kind: Secret
metadata:
  name: godaddy-api-key
  namespace: cert-manager
type: Opaque
stringData:
  token: GO_DADDY_KEY:GO_DADDY_SECRET

ClusterIssuer配置（issuer.yml） #

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: XXXX
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - selector:
          dnsNames:
          - '*.company.com'
        dns01:
          webhook:
            config:
              apiKeySecretRef:
                name: godaddy-api-key
                key: token
              production: true
              ttl: 600
            groupName: acme.mycompany.com
            solverName: godaddy

注：尝试过多种groupName组合（包括独立域名），均未成功

Certificate配置 #

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: letsencrypt-staging
spec:
  secretName: letsencrypt-staging
  renewBefore: 240h
  dnsNames:
    - "*.company.com"
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer

当前证书状态 #

执行命令k get certificate letsencrypt-staging返回：

$ k get certificate letsencrypt-staging 
NAME                  READY   SECRET                AGE
letsencrypt-staging   False   letsencrypt-staging   8m27s

使用的webhook为snowdrop/godaddy-webhook。

解决步骤 #

1. 对齐webhook与ClusterIssuer的groupName #

安装godaddy-webhook时，确保配置的groupName与ClusterIssuer中groupName: acme.mycompany.com完全一致。若通过Helm安装，重新指定正确值：

helm upgrade --install godaddy-webhook snowdrop/godaddy-webhook \
  --namespace cert-manager \
  --set groupName=acme.mycompany.com

2. 补充RBAC权限 #

创建ClusterRole与ClusterRoleBinding，为cert-manager的ServiceAccount授予操作acme.mycompany.com组资源的权限：

# rbac-fix.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-godaddy-webhook
rules:
- apiGroups: ["acme.mycompany.com"]
  resources: ["godaddies"]
  verbs: ["create", "get", "list", "update", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-godaddy-webhook
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-godaddy-webhook
subjects:
- kind: ServiceAccount
  name: cert-manager
  namespace: cert-manager

应用配置：

kubectl apply -f rbac-fix.yml

3. 检查webhook运行状态 #

确认webhook Pod正常运行：

kubectl get pods -n cert-manager | grep godaddy

若Pod异常，查看日志排查问题：

kubectl logs <godaddy-webhook-pod-name> -n cert-manager

4. 重新触发证书请求 #

删除现有Challenge资源，让cert-manager重新处理验证流程：

kubectl delete challenges -l cert-manager.io/certificate-name=letsencrypt-staging -n default

或直接删除并重新创建Certificate：

kubectl delete certificate letsencrypt-staging
kubectl apply -f certificate.yml

内容的提问来源于stack exchange，提问作者reayn3