Open jescarri opened 7 years ago
What happens if you run the curl command outside of your cluster?
I guess letsencrypt cannot reach your kube-lego, make sure your http/https ports are open for external access.
I ran curl outside the cluster/another network. if I tail the ingress access logs I can see the kube-lego endpoint is being hit by a go-lang client, I.guess it is lets encrypt?
Please increase your kube-lego log level to verbose and share your ingress and lego logs.
My only thought here is that kube-lego has cached an old DNS entry from before DNS was set up for your domain.
Did you have any more success with this @jescarri? Please also try running curl
against the selftest endpoint from within the kube-lego container - that may give us a bit more insight!
I'm getting this too, and interestingly it only seems to happen on 0.1.5; 0.1.3 and 0.1.4 are both fine. Did something change between those?
I see this error too now in 1.4 and 1.5 and "acme: identifier authorization failed" as err msg is a bit hard to understand, if you don't know the code. At least for me. :)
// ErrAuthorizationFailed indicates that an authorization for an identifier
// did not succeed.
ErrAuthorizationFailed = errors.New("acme: identifier authorization failed")
well my problem was caused by DNS misconfiguration...
DNS problem: SERVFAIL looking up CAA for
according to certbot.
It would've been great if the ACME client or kube-lego would've told me this in a proper error message beforehand..
Also had this error... my steps to analyse the issue:
# kubectl run --tty -i --restart=Never --namespace=kube-lego --image=alpine:edge sh
$ apk --update add curl
$ curl http://MY_HOST.FQDN/.well-known/acme-challenge/_selftest
xxxxxxxxx
$ apk --update add bind-tools
$ dig MY_HOST.FQDN caaa
output ... this should confirm that the DNS entry resolves to the public IP
$ exit
# kubectl delete pod sh --namespace=kube-lego
Both the curl
and the dig
should succeed, otherwise the kube-lego has no chance to issue a certificate.
I am seeing this as well. WhenI chase the actual link (eg. http://mydomain/.well-known/acme-challenge/_selftest), it's actually routing to my app, which of course has no idea what's going on. The interception that's set up by kube-lego
is being ignored, basically.
My setup is as follows:
kind: Ingress apiVersion: extensions/v1beta1 metadata: name: cafe-ingress namespace: test selfLink: /apis/extensions/v1beta1/namespaces/test/ingresses/cafe-ingress uid: 90d49530-298a-11e7-8f6f-ceb05f3ffd15 resourceVersion: '3039728' generation: 18 creationTimestamp: '2017-04-25T07:41:17Z' annotations: kubernetes.io/ingress.class: nginx kubernetes.io/tls-acme: 'true' spec: tls:
kube-lego manifest:
I can reach curl http://foo.aws.identitylabs.mx/.well-known/acme-challenge/_selftest
kube-lego errors:
Any idea whats wrong?
Is is worth mentioning that I can manually request certificates for the same domain for hosts running on the same network using certbot
Thanks!