Im trying create wildcard cert on Rancher kubernetes engine behind cloud loadbalancer. After install rancher i have a Issuer:

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  annotations:
    meta.helm.sh/release-name: rancher
    meta.helm.sh/release-namespace: cattle-system
  creationTimestamp: "2021-09-21T12:10:25Z"
  generation: 1
  labels:
    app: rancher
    app.kubernetes.io/managed-by: Helm
    chart: rancher-2.5.9
    heritage: Helm
    release: rancher
  name: rancher
  namespace: cattle-system
  resourceVersion: "1318"
  selfLink: /apis/cert-manager.io/v1/namespaces/cattle-system/issuers/rancher
  uid: #
spec:
  acme:
    email: #
    preferredChain: ""
    privateKeySecretRef:
      name: letsencrypt-production
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        ingress: {}
status:
  acme:
    lastRegisteredEmail: #
    uri: https://acme-v02.api.letsencrypt.org/#
  conditions:
  - lastTransitionTime: "2021-09-21T12:10:27Z"
    message: The ACME account was registered with the ACME server
    reason: ACMEAccountRegistered
    status: "True"
    type: Ready

this is order:

kubectl describe order wildcard-dev-mctqj-4171528257 -n cattle-system

Name:         wildcard-dev-mctqj-4171528257
Namespace:    cattle-system
Labels:       <none>
Annotations:  cert-manager.io/certificate-name: wildcard-dev
              cert-manager.io/certificate-revision: 1
              cert-manager.io/private-key-secret-name: wildcard-dev-2g4rc
API Version:  acme.cert-manager.io/v1
Kind:         Order
Metadata:
  Creation Timestamp:  2021-09-21T14:10:50Z
  Generation:          1
  Managed Fields:
    API Version:  acme.cert-manager.io/v1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:cert-manager.io/certificate-name:
          f:cert-manager.io/certificate-revision:
          f:cert-manager.io/private-key-secret-name:
          f:kubectl.kubernetes.io/last-applied-configuration:
        f:ownerReferences:
          .:
          k:{"uid":"}
            .:
            f:apiVersion:
            f:blockOwnerDeletion:
            f:controller:
            f:kind:
            f:name:
            f:uid:
      f:spec:
        .:
        f:commonName:
        f:dnsNames:
        f:issuerRef:
          .:
          f:kind:
          f:name:
        f:request:
      f:status:
        .:
        f:authorizations:
        f:finalizeURL:
        f:state:
        f:url:
    Manager:    controller
    Operation:  Update
    Time:       2021-09-21T14:10:52Z
Owner References:
    API Version:           cert-manager.io/v1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  CertificateRequest
    Name:                  wildcard-dev-mctqj
    UID:                   #
  Resource Version:        48930
  Self Link:               /apis/acme.cert-manager.io/v1/namespaces/cattle-system/orders/wildcard-dev-mctqj-4171528257
  UID:                     #
Spec:
  Common Name:  *.
  Dns Names:
    *.rancher-dev.com
  Issuer Ref:
    Kind:   Issuer
    Name:   rancher
  Request:
Status:
  Authorizations:
    Challenges:
      Token:        #######
      Type:         dns-01
      URL:          https://acme-v02.api.letsencrypt.org/acme/chall-v3/##
    Identifier:     rancher.dev.com
    Initial State:  pending
    URL:            https://acme-v02.api.letsencrypt.org/acme/authz-v3/##
    Wildcard:       true
  Finalize URL:     https://acme-v02.api.letsencrypt.org/acme/finalize/###
  State:            pending
  URL:              https://acme-v02.api.letsencrypt.org/acme/order/###
Events:
  Type     Reason  Age   From          Message
  ----     ------  ----  ----          -------
  Warning  Solver  49m   cert-manager  Failed to determine a valid solver configuration for the set of domains on the Order: no configured challenge solvers can be used for th  is challenge

dns changed ofc

Certificate:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: wildcard-dev
  namespace: cattle-system
spec:
  secretName: wildcard-dev
  issuerRef:
    kind: Issuer
    name: rancher
  commonName: '*.rancher.dev.com'
  dnsNames:
  - '*.rancher.dev.com'

i dont create ingress yet..

i think trubl in order

Type:         dns-01

What i do wrong ?

Mbe create second issuer ?

Actually, i want create wildcard certificate and clone him wit kubed, becouse i need a lot namespaces in kube with 1 wldcard cert. What can you advise me, guys?)

CodePudding user response：

As it is written here serving-a-wildcard-to-ingress, http01 solver does not support wildcard. Instead you should use dns01 for wildcard certificates.

See documentation to dns01 solver.