It would be helpful if kube-lego binary spit out an I

Well, the code looks like it defaults to staging anyway... <div class="Box Box--co

I added a log line in a branch: <a href="https://github.com/colemickens/kube-lego/comm

The user registration (and directory endpoints!) are cached in a Secret and can conflict with user preferences about kube-lego HOT 7 OPEN

jetstack commented on May 15, 2024 1

The user registration (and directory endpoints!) are cached in a Secret and can conflict with user preferences

from kube-lego.

Comments (7)

colemickens commented on May 15, 2024

Well, the code looks like it defaults to staging anyway...

kube-lego/pkg/kubelego/kubelego.go

Line 213 in 73b7390

kl.legoURL = os.Getenv("LEGO_URL")

I wonder if blowing the rate limits puts your in restricted mode on the staging endpoint as well...

from kube-lego.

colemickens commented on May 15, 2024

I added a log line in a branch: https://github.com/colemickens/kube-lego/commits/colemickens-add-logging-for-acme-url

In my logs now I see. Note that my log line emits the staging URL, and yet later... we're pointed back at Production endpoint.

2016-10-06T06:11:19.083934650Z time="2016-10-06T06:11:19Z" level=info msg="initializing lego acme connection to: %!(EXTRA string=https://acme-staging.api.letsencrypt.org/directory)" context=acme 
2016-10-06T06:11:19.503395968Z 2016/10/06 06:11:19 [INFO][api.mickens.tv, mickens.tv] acme: Obtaining bundled SAN certificate
2016-10-06T06:11:19.930693903Z time="2016-10-06T06:11:19Z" level=warning msg="Error while obtaining certificate: Errors while obtaining cert: map[mickens.tv:acme: Error 400 - urn:acme:error:badNonce - JWS has invalid anti-replay nonce oG76KFjxocdZCFrS_7CId3Xe7iSABJhKnoxPFxoS2co api.mickens.tv:acme: Error 400 - urn:acme:error:badNonce - JWS has invalid anti-replay nonce sb8CZiSG3lVEdr5qR32bo1xvgIabHpBq7bwYrfqMg9A]" context=acme 
2016-10-06T06:11:19.930744105Z time="2016-10-06T06:11:19Z" level=error msg="Error while process certificate requests: Errors while obtaining cert: map[mickens.tv:acme: Error 400 - urn:acme:error:badNonce - JWS has invalid anti-replay nonce oG76KFjxocdZCFrS_7CId3Xe7iSABJhKnoxPFxoS2co api.mickens.tv:acme: Error 400 - urn:acme:error:badNonce - JWS has invalid anti-replay nonce sb8CZiSG3lVEdr5qR32bo1xvgIabHpBq7bwYrfqMg9A]" context=kubelego 
2016-10-06T06:11:19.930750005Z time="2016-10-06T06:11:19Z" level=info msg="Worker: done processing true" context=kubelego 
2016-10-06T06:11:19.930753605Z time="2016-10-06T06:11:19Z" level=info msg="Worker: begin processing true" context=kubelego 
2016-10-06T06:11:19.933728126Z time="2016-10-06T06:11:19Z" level=info msg="ignoring as has no annotiation 'kubernetes.io/tls-acme'" context=ingress name=kube-lego-nginx namespace=kube-lego 
2016-10-06T06:11:19.933744027Z time="2016-10-06T06:11:19Z" level=debug msg=reset context=provider provider=gce 
2016-10-06T06:11:19.933747827Z time="2016-10-06T06:11:19Z" level=debug msg=finialize context=provider provider=gce 
2016-10-06T06:11:19.933751127Z time="2016-10-06T06:11:19Z" level=debug msg=reset context=provider provider=nginx 
2016-10-06T06:11:19.933755427Z time="2016-10-06T06:11:19Z" level=debug msg=finialize context=provider provider=nginx 
2016-10-06T06:11:19.946223233Z time="2016-10-06T06:11:19Z" level=info msg="process certificates requests for ingresses" context=kubelego 
2016-10-06T06:11:19.948964444Z time="2016-10-06T06:11:19Z" level=info msg="cert does not cover all domains" context="ingress_tls" domains=[api.mickens.tv mickens.tv] name=polykube namespace=polykube 
2016-10-06T06:11:19.948979245Z time="2016-10-06T06:11:19Z" level=info msg="requesting certificate for api.mickens.tv,mickens.tv" context="ingress_tls" name=polykube namespace=polykube 
2016-10-06T06:11:19.948988345Z time="2016-10-06T06:11:19Z" level=debug msg="testing reachablity of http://api.mickens.tv/.well-known/acme-challenge/_selftest" context=acme host=api.mickens.tv 
2016-10-06T06:11:19.950927924Z time="2016-10-06T06:11:19Z" level=debug msg="testing reachablity of http://mickens.tv/.well-known/acme-challenge/_selftest" context=acme host=mickens.tv 
2016-10-06T06:11:19.952390883Z 2016/10/06 06:11:19 [INFO][api.mickens.tv, mickens.tv] acme: Obtaining bundled SAN certificate
2016-10-06T06:11:20.238971410Z 2016/10/06 06:11:20 [INFO][api.mickens.tv] acme: Trying to solve HTTP-01
2016-10-06T06:11:20.717524025Z time="2016-10-06T06:11:20Z" level=info msg="responding to challenge request" basePath="/.well-known/acme-challenge" context=acme host=api.mickens.tv token="SXCxFiaERg3I_QRA86OOhekQupJSyErHLDMhVDbJ6eg" 
2016-10-06T06:11:21.406654383Z 2016/10/06 06:11:21 [INFO][api.mickens.tv] The server validated our request
2016-10-06T06:11:21.406685584Z 2016/10/06 06:11:21 [INFO][mickens.tv] acme: Could not find solver for: dns-01
2016-10-06T06:11:21.406690184Z 2016/10/06 06:11:21 [INFO][mickens.tv] acme: Could not find solver for: tls-sni-01
2016-10-06T06:11:21.406693384Z 2016/10/06 06:11:21 [INFO][mickens.tv] acme: Trying to solve HTTP-01
2016-10-06T06:11:21.525082287Z time="2016-10-06T06:11:21Z" level=info msg="responding to challenge request" basePath="/.well-known/acme-challenge" context=acme host=mickens.tv token="zZTo7GUEyJznfCZYfPUT_S87m0EFPbAmkyHorT_e0w4" 
2016-10-06T06:11:22.583815340Z 2016/10/06 06:11:22 [INFO][mickens.tv] The server validated our request
2016-10-06T06:11:22.583850142Z 2016/10/06 06:11:22 [INFO][api.mickens.tv, mickens.tv] acme: Validations succeeded; requesting certificates
2016-10-06T06:11:23.281000125Z 2016/10/06 06:11:23 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert
2016-10-06T06:11:23.350857559Z 2016/10/06 06:11:23 [INFO][api.mickens.tv] Server responded with a certificate.
2016-10-06T06:11:23.350957163Z time="2016-10-06T06:11:23Z" level=info msg="Got certs={api.mickens.tv https://acme-v01.api.letsencrypt.org/acme/cert/0385a77929e1d219b0d43077e908bd51ed00  https://acme-v01.api.letsencrypt.org/acme/reg/4908327 -----BEGIN RSA PRIVATE KEY----- [snipped]

from kube-lego.

colemickens commented on May 15, 2024

It looks like you just follow redirects from the responses from the ACME endpoint:

kube-lego/vendor/github.com/xenolf/lego/acme/client.go

Line 516 in 632072f

issuerCert, err := c.getIssuerCertificate(links["up"])

So maybe the Staging endpoint is giving URLs that point back to Prod.

from kube-lego.

colemickens commented on May 15, 2024

Found it!

kube-lego caches the user registration in a secret. The user registration contains the directory endpoints. This ends up overriding the LEGO_URL specified in the environment.

This is definitely the bug, but I don't know enough about kube-lego to know the best way to fix it.

from kube-lego.

colemickens commented on May 15, 2024

The repro is:

Run kube-lego in your cluster pointed at Prod. Let it get a cert, or at least go through user registration.
Change kube-lego ConfigMap to point at the LE Staging endpoint.
Observe that you are still getting certs from the LE Production endpoint.

I have a branch with logging that would seem to confirm this.

from kube-lego.

johnparn commented on May 15, 2024

I've been struck by the same thing using gce and tried to delete using the tip in #21.

That didn't work for me, as I had to recreate other parts in setup to get new certs to be generated for the gce loadbalancers.

from kube-lego.

retest-bot commented on May 15, 2024

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

from kube-lego.

The user registration (and directory endpoints!) are cached in a Secret and can conflict with user preferences about kube-lego HOT 7 OPEN

Comments (7)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent