k8s 无法使用证书管理器为 GoDaddy 域生成 Let's Encrypt 证书

Question

我使用GoDaddy管理我的DNS，我希望为我的kubernetes部署生成Lets Encrypt证书。但是，尝试生成证书会生成错误

I0728 17:31:12.123952       1 dns.go:88] cert-manager/controller/challenges/Present "msg"="presenting DNS01 challenge for domain" "dnsName"="XXXX" "domain"="XXX" "resource_kind"="Challenge" "resource_name"="letsencrypt-staging-bflxn-153714257-3821133841" "resource_namespace"="default" "resource_version"="v1" "type"="DNS-01" 
E0728 17:31:12.129511       1 controller.go:163] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="godaddy.acme.mycompany.com is forbidden: User "system:serviceaccount:cert-manager:cert-manager" cannot create resource "godaddy" in API group "acme.mycompany.com" at the cluster scope" "key"="default/letsencrypt-staging-bflxn-153714257-3821133841" 

我认为，这个问题的核心是groupName和solver对于我的ClusterIssuer应该是什么。

secret.yml

apiVersion: v1
kind: Secret
metadata:
name: godaddy-api-key
namespace: cert-manager
type: Opaque
stringData:
token: GO_DADDY_KEY:GO_DADDY_SECRET

issuer.yml

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: XXXX
privateKeySecretRef:
name: letsencrypt-staging
solvers:
- selector:
dnsNames:
- '*.company.com'
dns01:
webhook:
config:
apiKeySecretRef:
name: godaddy-api-key
key: token
production: true
ttl: 600
groupName: acme.mycompany.com
solverName: godaddy

注意：我尝试了groupName的不同排列，包括使用一个唯一的域，但没有成功

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: letsencrypt-staging
spec:
secretName: letsencrypt-staging
renewBefore: 240h
dnsNames:
- "*.company.com"
issuerRef:
name: letsencrypt-staging
kind: ClusterIssuer

但证书从未生成

$ k get certificate letsencrypt-staging 
NAME                  READY   SECRET                AGE
letsencrypt-staging   False   letsencrypt-staging   8m27s

我正在使用这个网络挂钩https://github.com/snowdrop/godaddy-webhook

Answer 1

我也遇到了这个问题。我通过添加一个缺失的ClusterRole和ClusterRolebinding来修复它。这是为我解决问题的清单。

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: dns-challenge-missing-role
rules:
- apiGroups: ["acme.mycompany.com"] # "" indicates the core API group
resources: ["godaddy"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: dns-challenge-missing-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: dns-challenge-missing-role
subjects:
- kind: ServiceAccount
name: cert-manager
namespace: cert-manager