Question

这就是我所拥有的，我所做的……在latest documentation和我遇到的一些教程之后，几乎可以做到：

安装cert-manager名称空间：

   kubectl create namespace cert-manager

安装cert-manager：

   kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.13.0/cert-manager.yaml

验证安装...应该是三个正在运行的Pod，并且有：

   kubectl get pods --namespace cert-manager

Run test，以确保它能够颁发证书类型...通行证。
制作一个issuer.yaml：

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: 'my@email.com'
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
      - http01:
          ingress:
            class: nginx

制作一个certificate.yaml：

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: examplewebsite-com-tls
spec:
  secretName: examplewebsite-com
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  commonName: examplewebsite.com
  dnsNames:
    - test.examplewebsite.com
  acme:
    config:
      - http01:
          ingressClass: nginx
        domains:
          - test.examplewebsite.com

更新ingress.yaml以反映此情况：

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/add-base-url: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    cert-manager.io/cluster-issuer: "letsencrypt-staging"
    nginx.ingress.kubernetes.io/ssl-redirect: 'false'
  name: ingress-service
  namespace: default
spec:
  tls:
    - hosts:
        - test.examplewebsite.com"
      secretName: examplewebsite-com
  rules:
    - host: test.examplewebsite.com
      http:
        paths:
          - path: /?(.*)
            backend:
              serviceName: client-cluster-ip-service
              servicePort: 3000
          - path: /api/?(.*)
            backend:
              serviceName: api-cluster-ip-service
              servicePort: 5000

应用所有这些并遇到以下问题。

$ kubectl describe certificate examplewebsite-com-tls

Status:
  Conditions:
    Last Transition Time:  2020-01-28T23:52:45Z
    Message:               Waiting for CertificateRequest "examplewebsite-com-tls-2527238951" to complete
    Reason:                InProgress
    Status:                False
    Type:                  Ready
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Requested  117s  cert-manager  Created new CertificateRequest resource "examplewebsite-com-tls-2527238951"

它就无限期地坐在那里。

$ kubectl describe secret examplewebsite-com`

Type:  kubernetes.io/tls

Data
====
ca.crt:   0 bytes
tls.crt:  0 bytes
tls.key:  1675 bytes

DNS已正确设置，因为我可以导航到该网站并查看该应用程序，HTTPS://无效。

我在做什么错了？

Answer 1

certification.yaml完全没有必要。

真的，只有在按照安装说明操作后才需要这样做：

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <email>
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/add-base-url: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  name: ingress
  namespace: default
spec:
  tls:
    - hosts:
        - test.domain.com
      secretName: test-domain-com
  rules:
    - host: test.domain.com
      http:
        paths:
          - path: /?(.*)
            backend:
              serviceName: client-cluster-ip-service
              servicePort: 3000
          - path: /api/?(.*)
            backend:
              serviceName: api-cluster-ip-service
              servicePort: 5000

这里的教程撰写得很好，最新（截至20年1月30日）：

https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes

无法在cert-manager中获得TLS证书

1 个答案: