Open patrickhempel opened 6 years ago
Same here. I am on k8s 1.8.3 and get:
level=warning msg="authorization failed after 1m0s: reachability test failed: wrong status code '404'"
I had this issue recently. This is definitely specific to me/my network, but not a crazy scenario:
I effectively had a routing issue in my cluster.
I had a DNS record pointing back to my Master node (which has a public IP, and is routed on my internal network differently than the workers). I could access the site/domain just fine there. I could access it from my home network just fine.
On my other kubernetes nodes, however, trying to resolve the public IP caused a bit of an issue, as the internal network "knew better", and tried (unsuccessfully) to re-route.
If you haven't, try your curl command on the node the pod is running in, and see if it still works. If it doesn't, perhaps reroute traffic to that IP via a NAT Gateway.
Thank for the valuable comments above.
In my case it turned out to be another ingress (from an old kube-lego installation) resource causing conflict with the same domain I was trying to get set up. So when the acme challenge was attempted it was pointing to a service that no longer existed and the challenge could not complete successfully and therefore I was getting time="2017-12-20T22:21:55Z" level=debug msg="testing reachability of http://
My advice to troubleshoot, in case you're seeing this error is this:
Good luck :)
Fantastic. The problem I had was I had two ingresses on the same IP address - solution was to delete both, and then deploy the new one (without the certificate) first, followed by my existing one.
I had this problem. I use Nginx inc ingress controller , but I think my solution suitable for everyone
Solution - Don't give a name for ingress controller starting with a,b,c its Nginx's feature - Nginx load config files by alphabet and cert-manager named own configs "%namespace%-cm-*", so Nginx load you ingress config before cert-manger
I had this problem too. Turned out, GKE created a new Loadbalancer with another IP and my DNS had the wrong IP. Once I found this out, the cert was issued and served.
My kube-lego setup is not able to get a cert for one particular domain.
Fetching the selftest url by hand yields a HTTP 200 OK Status.
Other domains are working well. I'm using jetstack/kube-lego:0.1.5 with kubernetes 1.8.
Thank you in advance, Patrick