前言

线上的https证书签发突然用不了了，查看日志，有如下错误：

E0523 06:17:42.554969       1 controller.go:158] cert-manager/controller/CertificateIssuing "msg"="re-queuing item due to error processing" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"***-tls\": the object has been modified; please apply your changes to the latest version and try again" "key"="***-tls"

我们的cert-manager用来自动签发用户提交的域名的https证书。开始以为是cert-manager本身的问题，在尝试升级版本、重启均无法解决问题，在这里花了很长时间。后来将关注重点转向签发的域名和证书才很快解决问题。

验证

为了验证是否只是域名或证书的问题，尝试抽取其中两个正确解析到我们服务器的域名。因为已经有ClusterIssuer了，yaml大概如下：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: xxxxxx@gmail.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource that will be used to store the account's private key.
      name: example-issuer-account-key
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
    - http01:
        ingress:
          class: nginx

因此，验证只需要创建一个Certificate和添加相应的Ingress。首先，创建Certificate。

创建yaml文件，运行

  - example1.com
  - example2.com issuerRef: name: letsencrypt-prod We can reference ClusterIssuers by changing the kind here. The default value is Issuer (i.e. a locally namespaced Issuer) kind: ClusterIssuer group: cert-manager.io EOF
- 创建Certificate，运行： ``` kubectl apply -f test-certificate.yaml

接下来创建Ingress。参考原有的Ingerss创建Ingress的yaml文件，配置大概如下：


  kind: Ingress apiVersion: extensions/v1beta1
  metadata: 
      name: example-app 
      namespace: example 
      spec: 
          tls:
  - hosts: 
      - example1.com
      - example2.com secretName: example-tls rules:
  - host: example1.com http: paths: 
      - path: / pathType: ImplementationSpecific backend: serviceName: example-app servicePort: 80
      - path: /api pathType: ImplementationSpecific backend: serviceName: example-app servicePort: 5000
  - host: example2.com http: paths: 
      - path: / pathType: ImplementationSpecific backend: serviceName: example-app servicePort: 80
      - path: /api pathType: ImplementationSpecific backend: serviceName: example-app servicePort: 5000

最后执行kubectl apply -f xxx.yaml创建Ingress。访问上面所签发证书的域名，成功签发！证明cert-manager本身是没有问题的。

解决问题

将所有参与签发证书的域名都排查了一遍，检查是否指向我们的服务器，剔除无效或者指向错误的域名。但剔除无效域名后，问题还是存在，琢磨了下报错信息:xxx-tls obect has been modified，猜测可能是证书的问题，将证书删除，重新触发生成证书，测试签发新的域名，能够成功，问题解决！

cert-manager ：the object has been modified问题解决