![](/img/trans.png)
[英]Configure SSL certificates in kubernetes with cert-manager istio ingress and LetsEncrypt
[英]Cert-Manager is not issuing any certificates Google Cloud Kubernetes
我正在努力讓 cert-manager 從 let's encrypt 頒發證書,我可以將其與 Google Cloud Kubernetes 中的入口一起使用。
我有一個在默認命名空間中運行部署、服務和入口的集群。 我還在 namecheap 注冊了一個域,並從我的入口向 IP 地址添加了一條 A 記錄。 現在我可以使用 http 訪問該網站,一切正常。 現在我想轉移到 https 並且事情不起作用。
我已經安裝了證書管理器:
kubectl create namespace cert-manager
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.13.1/cert-manager.yaml
我驗證了 cert-manager 正在運行:
kubectl get pods --namespace cert-manager
NAME READY STATUS RESTARTS AGE
cert-manager-5655447474-kw9k7 1/1 Running 0 99m
cert-manager-cainjector-59c9dfd4f7-fjzbf 1/1 Running 0 99m
cert-manager-webhook-865b8fb666-7kmx2 1/1 Running 0 99m
現在我在默認命名空間中創建了一個 ClusterIssuer kubectl apply -f letsencrypt-prod.yaml
:
apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: 'my@email.com'
privateKeySecretRef:
name: letsencrypt-prod
http01: {}
並添加了一個帶有kubectl apply -f certificate.yaml
:
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
name: my-certs
spec:
secretName: my-certs
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
commonName: "www.mydomain.de"
dnsNames:
- "www.mydomain.de"
acme:
config:
- dns01:
provider: cloud-dns
domains:
- "www.mydomain.de"
這是我的入口:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: my-ingress
annotations:
kubernetes.io/ingress.global-static-ip-name: "my-ip"
spec:
rules:
- host: www.mydomain.de
http:
paths:
- backend:
serviceName: my-service
servicePort: 80
tls:
- hosts:
- www.mydomain.de
secretName: my-certs
現在,當我運行kubectl describe certificate my-certs
,沒有事件:
kubectl describe certificate my-certs
Name: my-certs
Namespace: default
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration:
{"apiVersion":"certmanager.k8s.io/v1alpha1","kind":"Certificate","metadata":{"annotations":{},"name":"my-certs","namespace":"default"},"sp...
API Version: certmanager.k8s.io/v1alpha1
Kind: Certificate
Metadata:
Creation Timestamp: 2020-02-23T13:30:15Z
Generation: 1
Resource Version: 787204
Self Link: /apis/certmanager.k8s.io/v1alpha1/namespaces/default/certificates/my-certs
UID: a027a698-5640-11ea-bce8-42010a9c00dc
Spec:
Acme:
Config:
Dns 01:
Provider: cloud-dns
Domains:
www.mydomain.de
Common Name: www.mydomain.de
Dns Names:
www.mydomain.de
Issuer Ref:
Kind: ClusterIssuer
Name: letsencrypt-prod
Secret Name: my-certs
Events: <none>
在 Google Cloud Console 中,我看到入口的消息“找不到 TLS 證書。繼續設置負載均衡器以提供 HTTP”。
這里有什么問題或我錯過了什么?
您可以將以下注釋添加到入口資源,而不是手動創建證書資源:
cert-manager.io/issuer: "letsencrypt-prod"
Cert-manager 將讀取注釋並使用它們來創建證書。
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: my-ingress
annotations:
kubernetes.io/ingress.global-static-ip-name: "my-ip"
cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
rules:
- host: www.mydomain.de
http:
paths:
- backend:
serviceName: my-service
servicePort: 80
tls:
- hosts:
- www.mydomain.de
secretName: my-certs
在此之后檢查是否創建了名稱為 my-certs 的機密和證書。
還要檢查相關問題
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.