Cert Manager http01 challenge 時 Waiting for http-01 challenge propagation: failed to perform self

Name:         airflow-948mm-com-tls-2173481955-20486659-2561768538
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  acme.cert-manager.io/v1alpha2
Kind:         Challenge
Metadata:
  Creation Timestamp:  2019-12-24T20:07:45Z
  Finalizers:
    finalizer.acme.cert-manager.io
  Generation:  1
  Owner References:
    API Version:           acme.cert-manager.io/v1alpha2
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Order
    Name:                  airflow-948mm-com-tls-2173481955-20486659
    UID:                   a665ac46-2685-11ea-aaac-d61171695d2f
  Resource Version:        74422598
  Self Link:               /apis/acme.cert-manager.io/v1alpha2/namespaces/default/challenges/airflow-948mm-com-tls-2173481955-20486659-2561768538
  UID:                     0ccb602a-2689-11ea-aaac-d61171695d2f
Spec:
  Authz URL:  https://acme-v02.api.letsencrypt.org/acme/authz-v3/1908800991
  Dns Name:   airflow.948mm.com
  Issuer Ref:
    Group:  cert-manager.io
    Kind:   Issuer
    Name:   letsencrypt-prod
  Key:      _nFHyVmTc8NbW2-BgRKTXqJBLQSUsY2g9W2TWIsBe7c.NaXKyxAOHgxOkfJFao9Lw_1H2trs_QmARJDxIX0hkU0
  Solver:
    http01:
      Ingress:
        Class:  nginx
  Token:        _nFHyVmTc8NbW2-BgRKTXqJBLQSUsY2g9W2TWIsBe7c
  Type:         http-01
  URL:          https://acme-v02.api.letsencrypt.org/acme/chall-v3/1908800991/lFwGiQ
  Wildcard:     false
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for http-01 challenge propagation: failed to perform self check GET request 'http://airflow.948mm.com/.well-known/acme-challenge/_nFHyVmTc8NbW2-BgRKTXqJBLQSUsY2g9W2TWIsBe7c': Get http://airflow.948mm.com/.well-known/acme-challenge/_nFHyVmTc8NbW2-BgRKTXqJBLQSUsY2g9W2TWIsBe7c: dial tcp 39.98.140.128:80: connect: connection refused
  State:       pending
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Started    8m4s  cert-manager  Challenge scheduled for processing
  Normal  Presented  8m2s  cert-manager  Presented challenge using http-01 challenge mechanism

解決方法是將nginx的service配置的externalTrafficPolicy的值改爲Cluster。

參考
Kubernetes CluterIssuer Challenge timeouts
從service的externalTrafficPolicy到podAntiAffinity