Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ACME http01Challenge randomly not works with k8s after pull new docker image #149

Closed
jkralik opened this issue Jan 3, 2020 · 2 comments
Closed
Assignees
Labels

Comments

@jkralik
Copy link
Contributor

jkralik commented Jan 3, 2020

Subject of the issue

When acme server challenging acme client (lego) it gets error:

  • dial tcp: i/o timeout
  • dial tcp 10.106.221.133:80: connect: connection refused

It is caused by ingress when during container startup with updated docker image.

Your environment - kubectl version

Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.3", GitCommit:"2d3c76f9091b6bec110a5e63777c332469e0cba2", GitTreeState:"clean", BuildDate:"2019-08-19T11:13:54Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T19:09:08Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"

Expected behaviour

Use retry-able http client (https://github.com/hashicorp/go-retryablehttp) for acme http challenge.

Actual behaviour

Randomly acme client doesn't obtain certificate for updated container.

Additional context

When I replaced

client := http.Client{
by

        import retryablehttp "github.com/hashicorp/go-retryablehttp"
        ...
	client := retryablehttp.NewClient()
	client.HTTPClient = &http.Client{
		Timeout: 20 * time.Second,
	}
	client.RetryWaitMin = 100 * time.Millisecond
	client.RetryWaitMax = 1 * time.Second
	client.RetryMax = 10

It is works as is expected.

@jkralik
Copy link
Contributor Author

jkralik commented Jan 27, 2020

@sourishkrout
Copy link
Contributor

@jkralik please track #168 for ACME retries which we're currently completing. That's essentially a more wholistic way to solve this in a standard compliant way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants