Improve the documentation for diagnosing cert-manager webhook problems

wallrj commented 4 years ago

For example:

Document exactly how the K8S API establishes a TLS connection to the cert-manager webhook server.
Document all the resources where the cert-manager webhook caBundle must be be added (webhook configurations, CRD configurations)
Explain how the cainjector does this automatically based on annotations on the webhook configurations and on the CRDs
Explain how to set up these caBundles manually, if the cainjector is not running or is failing.
Explain how the cert-manager webhook server generates its TLS CA and serving certificate and stores them to a secret on startup.

See https://kubernetes.slack.com/archives/C4NV3DWUC/p1599044537041800

papanito commented 4 years ago

Maybe useful: https://github.com/cert-manager/website/pull/187

Simon0Liu commented 4 years ago

I have exactly the same issue，when I try to execute kubectl apply -f test-resources.yaml, I got Error from server (InternalError): error when creating "test-resources.yaml": Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post https://cert-manager-webhook.cert-manager.svc:443/validate?timeout=10s: context deadline exceeded

My environment 1: Platform: UCloud OS: CentOS 7.8 Cluster Version: 1.18.8 Node：One master，one worker CNI: Calico Provisioner: kubeadm, installed with：https://kuboard.cn/install/history-k8s/install-k8s-1.18.x.html Cert-Manager version: v1.0.1，installed with regular manifests on worker

After that, I did more experiments。

The environment 2: Platform: UCloud OS: CentOS 7.8 Cluster Version: 1.16.6 Node：Three master，no worker CNI: Calico Provisioner: Binary installation, installed with：https://github.com/opsnull/follow-me-install-kubernetes-cluster Cert-Manager version: v1.0.1，installed with regular manifests I passed the test and everything was fine.

The environment 3: Platform: UCloud OS: CentOS 7.8 Cluster Version: 1.17.9 Node：Two master，no worker CNI: Calico Provisioner: Kubespray, installed with：https://github.com/kubernetes-sigs/kubespray Cert-Manager version: v1.0.1，installed with regular manifests I got the same error.

All these errors can be fixed by using hostNetwork, but I still want to know: why the binary installation can work normally?

cert-manager / website

Improve the documentation for diagnosing cert-manager webhook problems #321