Making it the right way with kubernetes

Help
1

Hello.
the domain is area.3di.it
I followed this guide:

and I am attempting http challenge.

If I give:
kubectl -n default get certificateRequest -o wide
NAME                          APPROVED   DENIED   READY   ISSUER           REQUESTOR                                         STATUS                                                                                                                                                                                                                                                                                                             AGE
tls-area-ingress-http-25rzz   True                False   area-challenge   system:serviceaccount:cert-manager:cert-manager   Failed to wait for order resource "tls-area-ingress-http-25rzz-3094969806" to become ready: order is in "errored" state: Failed to retrieve Order resource: 400 urn:ietf:params:acme:error:malformed: KeyID header contained an invalid account URL: "https://acme-v02.api.letsencrypt.org/acme/acct/2103372487"

do you have some suggestions on how to fix it, or documentation about letsencrtypt and certificate manager in kubernetes?
Kindest Regards you all.

2 
 KeyID header contained an invalid account URL: "https://acme-v02.api.letsencrypt.org/acme/acct/.....

This error means you've tried to use a production account against the staging server.

I'm not an expert at cert-manager, but I think if you change your privateKeySecretRef it'll make a new account against whatever server you currently have configured.

5 Likes
3

thanks i will try and let you know

1 Like
4

For reference:

4 Likes
5

thanks for the reference.
I'm attempting http challenge.

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: area-challenge
 namespace: default
spec:
 acme:
   email: my-mail@my-domain
   server: https://acme-v02.api.letsencrypt.org/directory
   privateKeySecretRef:
     name: area-issuer-account-key
   solvers:
     - http01:
         ingress:
           class: traefik
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
 name: area-ssl-ingress
 namespace: default
 annotations:
   cert-manager.io/issuer: "area-challenge"
spec:
 tls:
   - hosts:
       - area.3di.it
     secretName: tls-area-ingress-http
 rules:
   - host: area.3di.it
     http:
       paths:
         - path: /
           pathType: Prefix
           backend:
             service:
               name: area-frontend
               port:
                 name: area-frontend

and I'm getting:

kubectl -n default get issuer -o wide
NAME             READY   STATUS                                                 AGE
area-challenge   True    The ACME account was registered with the ACME server   16h
kubectl -n default get certificateRequest -o wide
NAME                          APPROVED   DENIED   READY   ISSUER           REQUESTOR                                         STATUS                                                                                                                                                                                                                                           AGE
tls-area-ingress-http-555xv   True                False   area-challenge   system:serviceaccount:cert-manager:cert-manager   Failed to wait for order resource "tls-area-ingress-http-555xv-3094969806" to become ready: order is in "errored" state: Failed to retrieve Order resource: 404 urn:ietf:params:acme:error:malformed: No order found for account ID 2103372487   12h
 kubectl -n default get certificates
NAME                    READY   SECRET                  AGE
tls-area-ingress-http   False   tls-area-ingress-http   16h

 kubectl -n default describe secret tls-area-ingress-http
Error from server (NotFound): secrets "tls-area-ingress-http" not found

Reading again at my original reference it seems that: HTTP challenge

For most common scenarios the HTTP-01 challenge is a convenient start to solve an ACME based validation. To make this scenario work, Traefik Proxy needs to be reachable from the internet on HTTP port 80, and the used DNS domain has to be configured to point to it. Maybe the issue is that I have not touched the dns?

1 Like
6

Sounds similar to Certificate not renewing, referencing unknown order? · cert-manager/cert-manager · Discussion #3494 · GitHub and the general resolution there was to delete either the certificate request or re-create the certificate. Apparently the old certificate request should get auto deleted on the next attempt.

2 Likes
7

but do I still need to edit the dns in order to make it work? at this moment I do not have access to the dns.

8

If I ask for the logs of the traefik pod i can see

ERR error="service port not found: 80" ingress=area-ingress namespace=default providerName=kubernetescrd
ERR Error configuring TLS error="secret default/tls-area-ingress-http does not exist" ingress=area-ssl-ingress namespace=default providerName=kubernetes
ERR error="service port not found: 80" ingress=area-ingress namespace=default providerName=kubernetescrd

maybe the certificates are failing for that reason? or that is just another issue I have?

9

There are two main ways to validate your domain control: http-01 (validate your domain using http on TCP port 80) or dns-01 (validate your domain using a TXT record in DNS).

If your service can provide challenge responses over http (TCP port 80) then you can continue to use that approach.

As an aside, you perhaps already know this but Kubernetes is an incredibly sophisticated platform for scalable service hosting and is specifically designed for very large scale systems, it's not the easiest way to host something. If your service only has one instance, do not use Kubernetes, instead I would suggest just hosting your app directly on a linux virtual machine.

2 Likes
10

hi thanks for the suggestion.
I know it's a sophisticated system but I experimenting and learning on it so that's the way.

2 Likes
11

maybe deleting it and making it again is working.
Is now in Pending state.

kubectl -n default get certificateRequest -o wide
NAME                          APPROVED   DENIED   READY   ISSUER           REQUESTOR                                         STATUS                                                                                                 AGE
tls-area-ingress-http-xxhhd   True                False   area-challenge   system:serviceaccount:cert-manager:cert-manager   Waiting on certificate issuance from order default/tls-area-ingress-http-xxhhd-3094969806: "pending"   51s
12

ok the issue was that I had to publish dns of traefik and use production.

1 Like
13

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.