1. Automatically Issuing Ingress Certificates

1. Install cert-manager

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.10/deploy/manifests/00-crds.yaml
kubectl create namespace cert-manager
kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install \
  --name cert-manager \
  --namespace cert-manager \
  --version v0.10.0 \
  jetstack/cert-manager

2. Create a global issuer

Create the file issuer.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@domain.com
    privateKeySecretRef:
      name: letsencrypt-prod
    http01: {}

Create the issuer

1

kubectl apply -f issuer.yaml

3. Issue a certificate

Create the file cert.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: ingress-cert-name
  namespace: app-namespace
spec:
  secretName: ingress-cert-app
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - ingress-app.domain.com
  acme:
    config:
      - http01:
          ingressClass: traefik
        domains:
          - ingress-app.domain.com

Issue the certificate

1

kubectl apply -f cert.yaml

2. Common Kubernetes Troubleshooting

2.1 Node Anomalies

Possible causes of failure:

• kubelet process anomaly
• CNI plugin not installed
• docker anomaly
• Insufficient disk space
• Insufficient memory

How to locate the problem:

• kubectl describe node, to inspect node events
• systemctl status kubelet, to check the kubelet status
• journalctl -u kubelet -f, to check the system logs
• top, to check system CPU and memory usage
• du -sh、df -h, to check disk usage

2.2 Pod Anomalies

A Pod can sit in one of three abnormal running states for a long time: Pending, Waiting, CrashBackoff

• Pending

kubectl describe pod, to inspect the events.

Possible causes: insufficient available resources, unsatisfied affinity policies, node taints that do not allow scheduling

• Waiting

Possible causes: image pull failure. Try pulling the image manually, and check whether the image name, permissions, and network behave as expected.

• CrashBackoff

Possible causes: the service fails to start, or its dependencies cannot be fully satisfied. Check the kubectl logs output, or enter the Pod or Docker to debug.

2.3 Service Anomalies

• endpoint not added correctly

Possible causes: the Pod is abnormal, or the selector does not match any Pod. Check the service’s selector configuration; run kubectl describe service\endpoints\pod to see whether there are abnormal events.

• service port mapping error

Check the service port mapping and whether it matches the Pod port and the port being accessed.

• network configuration problem

Check whether kube-proxy, iptables, or ipvs is abnormal.

3. References

• https://github.com/jetstack/cert-manager/issues/2109