<p>I would like to access my Kubernetes bare-metal cluster with an exposed Nginx Ingress Controller for TLS termination. To be able to automate certificate renewal, I would like to use the Kubernetes addon <a href="https://github.com/jetstack/cert-manager" rel="nofollow noreferrer">cert-manager</a>, which is kube-lego's successor.</p>

<p>What I have done so far:</p>

<ul>
<li><p>Set up a Kubernetes (v1.9.3) cluster on bare-metal (1 master, 1 minion, both running Ubuntu 16.04.4 LTS) with kubeadm and flannel as pod network following this <a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="nofollow noreferrer">guide</a>.</p></li>
<li><p>Installed <a href="https://github.com/kubernetes/charts/tree/master/stable/nginx-ingress" rel="nofollow noreferrer">nginx-ingress</a> (chart version 0.9.5) with Kubernetes package manager <a href="https://github.com/kubernetes/helm" rel="nofollow noreferrer">helm</a><br/>
<code>helm install --name nginx-ingress --namespace kube-system stable/nginx-ingress --set controller.hostNetwork=true,rbac.create=true,controller.service.type=ClusterIP</code></p></li>
<li><p>Installed <a href="https://github.com/kubernetes/charts/tree/master/stable/cert-manager" rel="nofollow noreferrer">cert-manager</a> (chart version 0.2.2) with helm<br/>
<code>helm install --name cert-manager --namespace kube-system stable/cert-manager --set rbac.create=true</code></p></li>
</ul>

<p>The Ingress Controller is exposed successfully and works as expected when I test with an Ingress resource. For proper Let's Encrypt certificate management and automatic renewal with cert-manager I do first of all need an Issuer resource. I created it from this <em>acme-staging-issuer.yaml</em>:<br/></p>

<pre><code>apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
  name: letsencrypt-staging
  namespace: default
spec:
  acme:
    server: https://acme-staging.api.letsencrypt.org/directory
    email: email@example.com
    privateKeySecretRef:
      name: letsencrypt-staging
    http01: {}
</code></pre>

<p><em>kubectl create -f acme-staging-issuer.yaml</em> runs successfully but <em>kubectl describe issuer/letsencrypt-staging</em> gives me:</p>

<pre><code>Status:
  Acme:
    Uri:  
  Conditions:
    Last Transition Time:  2018-03-05T21:29:41Z
    Message:               Failed to verify ACME account: Get https://acme-staging.api.letsencrypt.org/directory: tls: oversized record received with length 20291
    Reason:                ErrRegisterACMEAccount
    Status:                False
    Type:                  Ready
Events:
  Type     Reason                Age               From                     Message
  ----     ------                ----              ----                     -------
  Warning  ErrVerifyACMEAccount  1s (x11 over 7s)  cert-manager-controller  Failed to verify ACME account: Get https://acme-staging.api.letsencrypt.org/directory: tls: oversized record received with length 20291
  Warning  ErrInitIssuer         1s (x11 over 7s)  cert-manager-controller  Error initializing issuer: Get https://acme-staging.api.letsencrypt.org/directory: tls: oversized record received with length 20291
</code></pre>

<p>Without a ready Issuer, I can not proceed to generate cert-manager Certificates or utilse the ingress-shim (for automatic renewal).</p>

<p>What am I missing in my setup? Is it sufficient to expose the ingress controller using <em>hostNetwork=true</em> or is there a better way to expose the its ports 80 and 443 on a bare-metal cluster? How can I resolve <em>tls: oversized record received</em> error when creating a cert-manager Issuer resource?</p>

<p>The <em>tls: oversized record received</em> error was caused by a misconfigured <code>/etc/resolv.conf</code> of the Kubernetes minion. It could be resolved by editing it like this:</p>

<pre><code>$ sudo vi /etc/resolvconf/resolv.conf.d/base
</code></pre>

<p>Add nameserver list:</p>

<pre><code>nameserver 8.8.8.8
nameserver 8.8.4.4
</code></pre>

<p>Update resolvconf:</p>

<pre><code>$ sudo resolvconf -u
</code></pre>
