Cert-manager: CloudFlare Dns01 re-queuing item due to error processing" "error"="Could not find the start of authority

Created on 18 Oct 2019  路  2Comments  路  Source: jetstack/cert-manager

Bugs should be filed for issues encountered whilst operating cert-manager.
You should first attempt to resolve your issues through the community support
channels, e.g. Slack, in order to rule out individual configuration errors.
Please provide as much detail as possible.

Describe the bug:
dns challenge stuck in pending status forever due to error "Could not find the start of authority"
Using CloudFlare as dns management

I verified the SOA record, the nameservers are displace when I run nslook up.

Here is the yaml files for me, do I have any configuration issue?
Here is the Issuer file
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
name: acme-issuer-dnschallengeendtoend
namespace: cert-manager
spec:
acme:
email: [email protected]
server: https://acmeUrlhere/v2/DV
privateKeySecretRef:

  name: secret

solvers:
- dns01:
    cloudflare:
      email: [email protected]
      apiKeySecretRef:
        name: cloudflare-api-key
        key: api-key

Here is the certificate file
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: example-com
namespace: cert-manager
spec:
secretName: example-com-tls
dnsNames:

  • example.com
    issuerRef:
    name: acme-issuer-dnschallengeendtoend
    kind: ClusterIssuer

Here I attached the log file as well
1018 17:03:25.676603 1 controller.go:135] cert-manager/controller/orders "level"=0 "msg"="finished processing work item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890"
I1018 17:03:25.676207 1 logger.go:68] Calling GetChallenge
I1018 17:03:29.775064 1 controller.go:129] cert-manager/controller/orders "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890"
I1018 17:03:29.775379 1 logger.go:98] Calling DNS01ChallengeRecord
I1018 17:03:29.775514 1 sync.go:155] cert-manager/controller/orders "level"=0 "msg"="No action taken" "resource_kind"="Order" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890" "resource_namespace"="cert-manager"
I1018 17:03:29.775561 1 controller.go:135] cert-manager/controller/orders "level"=0 "msg"="finished processing work item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890"
I1018 17:03:29.777122 1 controller.go:135] cert-manager/controller/challenges "level"=0 "msg"="finished processing work item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:29.777175 1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:29.777578 1 dns.go:106] cert-manager/controller/challenges/Present "level"=0 "msg"="presenting DNS01 challenge for domain" "dnsName"="dnschallengesectigo.ml" "domain"="dnschallengesectigo.ml" "resource_kind"="Challenge" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890-1665173357" "resource_namespace"="cert-manager" "type"="dns-01"
I1018 17:03:29.787215 1 controller.go:129] cert-manager/controller/orders "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890"
I1018 17:03:29.787616 1 logger.go:98] Calling DNS01ChallengeRecord
I1018 17:03:29.787753 1 sync.go:155] cert-manager/controller/orders "level"=0 "msg"="No action taken" "resource_kind"="Order" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890" "resource_namespace"="cert-manager"
I1018 17:03:29.787926 1 controller.go:135] cert-manager/controller/orders "level"=0 "msg"="finished processing work item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890"
E1018 17:03:29.791643 1 controller.go:131] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="Could not find the start of authority" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:29.791685 1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:29.792006 1 dns.go:106] cert-manager/controller/challenges/Present "level"=0 "msg"="presenting DNS01 challenge for domain" "dnsName"="dnschallengesectigo.ml" "domain"="dnschallengesectigo.ml" "resource_kind"="Challenge" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890-1665173357" "resource_namespace"="cert-manager" "type"="dns-01"
E1018 17:03:29.794203 1 controller.go:131] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="Could not find the start of authority" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:34.793646 1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:34.794078 1 dns.go:106] cert-manager/controller/challenges/Present "level"=0 "msg"="presenting DNS01 challenge for domain" "dnsName"="dnschallengesectigo.ml" "domain"="dnschallengesectigo.ml" "resource_kind"="Challenge" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890-1665173357" "resource_namespace"="cert-manager" "type"="dns-01"
E1018 17:03:34.797682 1 controller.go:131] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="Could not find the start of authority" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:54.798760 1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:03:54.799312 1 dns.go:106] cert-manager/controller/challenges/Present "level"=0 "msg"="presenting DNS01 challenge for domain" "dnsName"="dnschallengesectigo.ml" "domain"="dnschallengesectigo.ml" "resource_kind"="Challenge" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890-1665173357" "resource_namespace"="cert-manager" "type"="dns-01"
E1018 17:03:54.801436 1 controller.go:131] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="Could not find the start of authority" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:04:34.802120 1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:04:34.803319 1 dns.go:106] cert-manager/controller/challenges/Present "level"=0 "msg"="presenting DNS01 challenge for domain" "dnsName"="dnschallengesectigo.ml" "domain"="dnschallengesectigo.ml" "resource_kind"="Challenge" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890-1665173357" "resource_namespace"="cert-manager" "type"="dns-01"
E1018 17:04:34.824939 1 controller.go:131] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="Could not find the start of authority" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:05:54.827186 1 controller.go:129] cert-manager/controller/challenges "level"=0 "msg"="syncing item" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"
I1018 17:05:54.828249 1 dns.go:106] cert-manager/controller/challenges/Present "level"=0 "msg"="presenting DNS01 challenge for domain" "dnsName"="dnschallengesectigo.ml" "domain"="dnschallengesectigo.ml" "resource_kind"="Challenge" "resource_name"="dnschallengesectigol-ml-1225831616-4263745890-1665173357" "resource_namespace"="cert-manager" "type"="dns-01"
E1018 17:05:54.833893 1 controller.go:131] cert-manager/controller/challenges "msg"="re-queuing item due to error processing" "error"="Could not find the start of authority" "key"="cert-manager/dnschallengesectigol-ml-1225831616-4263745890-1665173357"

Expected behaviour:
DNS01 challenge should be triggered properly

Steps to reproduce the bug:
Steps to reproduce the bug should be clear and easily reproducible to help people
gain an understanding of the problem.

Environment details::

  • Kubernetes version (e.g. v1.16.0):
  • Cloud-provider: CloudFlare
  • cert-manager version (e.g. v0.11.0):
  • Install method : static manifests

/kind bug

kinbug
Source
picture lulin1994

Most helpful comment

Finally found the solution.
Somehow minikube screwed up the dns, so any request inside the jetstack manager container cannot be sent to the outside world.
In order to make it work, run command "Kubectl -n kube-system edit configmap coredns"
and edit the line in configmap from forward . etc/resolv.conf to forward . 1.1.1.1 or any public namesever. So that pods inside minikube can make handshake to the real world
My issue was specific because I was using an private ACME server. So I had to add a host record in the configmap of coredns as well.
For more information about this, please read this link https://github.com/coredns/coredns/tree/master/plugin/hosts

picture lulin1994 on 29 Oct 2019
🎉2 👀1

All 2 comments

Anyone has the same issue here?

lulin1994 picture lulin1994 on 21 Oct 2019
👍2

Finally found the solution.
Somehow minikube screwed up the dns, so any request inside the jetstack manager container cannot be sent to the outside world.
In order to make it work, run command "Kubectl -n kube-system edit configmap coredns"
and edit the line in configmap from forward . etc/resolv.conf to forward . 1.1.1.1 or any public namesever. So that pods inside minikube can make handshake to the real world
My issue was specific because I was using an private ACME server. So I had to add a host record in the configmap of coredns as well.
For more information about this, please read this link https://github.com/coredns/coredns/tree/master/plugin/hosts

lulin1994 picture lulin1994 on 29 Oct 2019
🎉2 👀1
Was this page helpful?
0 / 5 - 0 ratings

Related issues

timblakely picture timblakely  路  4Comments
jbeda picture jbeda  路  4Comments
Azylog picture Azylog  路  3Comments
howardjohn picture howardjohn  路  3Comments
jonathan-kosgei picture jonathan-kosgei  路  4Comments