Cert-Manager 申请 Let's Encrypt 免费 HTTPS 证书

在 Kubernetes 集群中，为服务配置 HTTPS 是生产环境的标配。本文将介绍如何使用 Cert-Manager 结合 Traefik Ingress，通过 Let's Encrypt 自动申请并续签免费的 SSL/TLS 证书。

部署 Cert-Manager

1、首先，我们需要在集群中安装 Cert-Manager。这里我们创建一个独立的命名空间来管理它。

kubectl create namespace cert-manager

2、部署 cert-manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.yaml

3、ClusterIssuer 是 Cert-Manager 的核心资源，用于定义证书颁发机构

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: gua3j7@126.com   #*用于接收证书过期通知等*
    privateKeySecretRef:    #指定存储 ACME 客户端私钥的 Kubernetes Secret 的名称
      name: letsencrypt-prod
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:               #定义用于验证证书颁发请求的解析器。
      - http01:
          ingress:
            class: traefik

4、创建ingress 自动申请证书

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: work-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    cert-manager.io/cluster-issuer: letsencrypt-prod  # letsencrypt-prod为ClusterIssuer名称
spec:
  ingressClassName: traefik # 指定 Ingress Class 为 traefik
  tls:
    - secretName: miiv-tls *# 证书将被存储在此 Kubernetes Secret 中*
      hosts:
        - miiv.top # *指定需要证书的域名*
  rules:
    - host: miiv.top  # 转发规则名称
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: miiv-lnp # 服务名
                port:
                  number: 80 # 服务的端口号 service port，非pod port

如访问Miiv.top出现not found，查看traefik日志发现

intSlice: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:kube-system:traefik\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError"
W0811 14:29:30.798885       1 reflector.go:561] k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User "system:serviceaccount:kube-system:traefik" cannot list resource "endpointslices" in API group "discovery.k8s.io" at the cluster scope


**原因：缺少对endpointslices、nodes访问规则**
kubectl edit clusterrole traefik-kube-system
ruls末尾增加
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  - nodes
  verbs:
  - list
  - watch