4
настройте ему мтлс, чо
kubectl get challenge -n istio-system -o wide
Waiting for HTTP-01 challenge propagation: wrong status code '404', expected '200'
В логах истио пишет:[2021-11-18T07:25:22.960Z] "GET /.well-known/acme-challenge/1eCNaRkoOKgFcnaIgj8858qRqBappPRikmguI3v_YlI HTTP/1.1" 404 - via_upstream - "-" 0 14 0 0 "10.20.0.1" "cert-manager/v1.5.4 (clean)" "86a57a1d-0994-9c95-91a0-4ce95072ff36" "<DNS>" "10.20.0.49:8200" outbound|8200||vault.vault.svc.cluster.local 10.20.0.200:59790 10.20.0.200:8080 10.20.0.1:40463 - -
не может достучаться до:http://<DNS>/.well-known/acme-challenge/1eCNaRkoOKgFcnaIgj8858qRqBappPRikmguI3v_YlI
Манифесты такие:apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: vault-dev
namespace: cert-manager
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: '<EMAIL>'
privateKeySecretRef:
name: vault-dev
solvers:
- selector: {}
http01:
ingress:
class: istio
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: vault-dev-cert
namespace: istio-system
spec:
secretName: vault-dev-cert
duration: 2160h # 90d
renewBefore: 360h # 15d
issuerRef:
name: vault-dev
kind: ClusterIssuer
commonName: vault.dev
dnsNames:
- <DNS>———————-
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
name: vault-dev-gw
namespace: vault
spec:
selector:
istio: ingressgateway
servers:
- hosts:
- "*"
port:
name: http-dev
number: 80
protocol: HTTP
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: vault-dev-vs
namespace: vault
spec:
gateways:
- vault-dev-gw
hosts:
- <DNS>
http:
- match:
- uri:
prefix: /
route:
- destination:
host: vault
port:
number: 8200