Cert-Manager 申请 Let's Encrypt 免费 HTTPS 证书
在 Kubernetes 集群中，为服务配置 HTTPS 是生产环境的标配。本文将介绍如何使用 Cert-Manager 结合 Traefik Ingress，通过 Let's Encrypt 自动申请并续签免费的 SSL/TLS 证书。
部署 Cert-Manager
1、首先，我们需要在集群中安装 Cert-Manager。这里我们创建一个独立的命名空间来管理它。
kubectl create namespace cert-manager2、部署 cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.yaml3、ClusterIssuer 是 Cert-Manager 的核心资源，用于定义证书颁发机构
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
spec:
acme:
email: gua3j7@126.com #*用于接收证书过期通知等*
privateKeySecretRef: #指定存储 ACME 客户端私钥的 Kubernetes Secret 的名称
name: letsencrypt-prod
server: https://acme-v02.api.letsencrypt.org/directory
solvers: #定义用于验证证书颁发请求的解析器。
- http01:
ingress:
class: traefik4、创建ingress 自动申请证书
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: work-ingress
namespace: default
annotations:
kubernetes.io/ingress.class: traefik
cert-manager.io/cluster-issuer: letsencrypt-prod # letsencrypt-prod为ClusterIssuer名称
spec:
ingressClassName: traefik # 指定 Ingress Class 为 traefik
tls:
- secretName: miiv-tls *# 证书将被存储在此 Kubernetes Secret 中*
hosts:
- miiv.top # *指定需要证书的域名*
rules:
- host: miiv.top # 转发规则名称
http:
paths:
- path: /
pathType: ImplementationSpecific
backend:
service:
name: miiv-lnp # 服务名
port:
number: 80 # 服务的端口号 service port，非pod port如访问Miiv.top出现not found，查看traefik日志发现
intSlice: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:kube-system:traefik\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError"
W0811 14:29:30.798885 1 reflector.go:561] k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User "system:serviceaccount:kube-system:traefik" cannot list resource "endpointslices" in API group "discovery.k8s.io" at the cluster scope
**原因：缺少对endpointslices、nodes访问规则**
kubectl edit clusterrole traefik-kube-system
ruls末尾增加
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
- nodes
verbs:
- list
- watch
