如何让入口在 Microk8s 中使用我的 TLS 证书

Question

I have the following Ingress configuration:

apiVersion: networking.k8s.io/v1        
kind: Ingress
metadata:
  name: http-ingress
spec:
  rules:
  - host: example-adress.com
    http:
      paths:
        - path: /apple
          pathType: Prefix
          backend:
            service:
                name: apple-service
                port: 
                  number: 80
        - path: /banana
          pathType: Prefix
          backend:
            service:
                name: banana-service
                port: 
                  number: 80
  tls: 
    - hosts: 
        - example-adress.com
      secretName: testsecret-tls

And i also created the Secret:

apiVersion: v1
kind: Secret
metadata:
  name: testsecret-tls
  namespace: default
data:
  tls.crt: path to .crt
  tls.key: Zpath to .key
type: kubernetes.io/tls

But when i connect to one of my services and check the certificate it says that it uses a cert created by Kubernetes Ingress Controller Fake certificate. When i run microk8s kubectl describe ingress i get the following output:

Name:             http-ingress
Namespace:        default
Address:          127.0.0.1
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
 testsecret-tls terminates example-adress.com
Rules:
 Host               Path  Backends
 ----               ----  --------
 example-adress.com
                    /apple    apple-service:80 (10.1.55.17:5678)
                    /banana   banana-service:80 (10.1.55.10:5678)
Annotations:         <none>
Events:
 Type    Reason  Age                From                      Message
 ----    ------  ----               ----                      -------
 Normal  CREATE  28m                nginx-ingress-controller  Ingress default/http-ingress
 Normal  UPDATE  20m (x2 over 28m)  nginx-ingress-controller  Ingress default/http-ingress

What do i need to change to make my Ingress use my Cert instead of generating a new one everytime?

Answer 1

Posting this out of comment as it works.

Based on your tls secret yaml, you tried to add certificate and private key using paths, which is not supported currently ( reference ) Fragment from reference:

When using this type of Secret, the tls.key and the tls.crt key must be provided in the data (or stringData ) field of the Secret configuration, although the API server doesn't actually validate the values for each key.

Therefore there are two suggestions how to move forward:

• Add base64 encrypted values for key and certificate to tls secret
• Allow kubernetes do it for you with the following command: kubectl create secret tls testsecret-tls --cert=tls.cert --key=tls.key