我正试图让Let's Encrypt在我的K3s集群上工作。我一直在遵循下面的教程，但由于它已经一年多了，我正在使用cert-manager的更新版本。
https://pascalw.me/blog/2019/07/02/k3s-https-letsencrypt.html
我正在执行以下命令
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.1/cert-manager.crds.yaml
helm repo add jetstack https://charts.jetstack.io
kubectl create namespace cert-manager
helm install cert-manager jetstack/cert-manager --namespace cert-manager
echo "apiVersion: cert-manager.io/v1beta1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
email: my-email@gmail.com
privateKeySecretRef:
name: staging-issuer-account-key
server: https://acme-staging-v02.api.letsencrypt.org/directory
http01: {}
solvers:
- http01:
ingress:
class: traefik
selector: {}
" | kubectl apply --validate=false -f -
我生成的入口资源如下
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
certmanager.k8s.io/acme-challenge-type: http01
certmanager.k8s.io/issuer: letsencrypt-staging
kubernetes.io/ingress.class: traefik
meta.helm.sh/release-name: whoami-mn
meta.helm.sh/release-namespace: whoami-mn-dev
creationTimestamp: "2020-09-13T08:49:27Z"
generation: 3
labels:
app.kubernetes.io/instance: whoami-mn
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: whoami-mn
app.kubernetes.io/version: "0.1"
helm.sh/chart: whoami-mn-0.4.0
managedFields:
- apiVersion: extensions/v1beta1
fieldsType: FieldsV1
fieldsV1:
f:status:
f:loadBalancer:
f:ingress: {}
manager: traefik
operation: Update
time: "2020-09-13T10:08:21Z"
- apiVersion: networking.k8s.io/v1beta1
fieldsType: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.: {}
f:certmanager.k8s.io/acme-challenge-type: {}
f:certmanager.k8s.io/issuer: {}
f:kubernetes.io/ingress.class: {}
f:meta.helm.sh/release-name: {}
f:meta.helm.sh/release-namespace: {}
f:labels:
.: {}
f:app.kubernetes.io/instance: {}
f:app.kubernetes.io/managed-by: {}
f:app.kubernetes.io/name: {}
f:app.kubernetes.io/version: {}
f:helm.sh/chart: {}
f:spec:
f:rules: {}
f:tls: {}
manager: Go-http-client
operation: Update
time: "2020-09-13T12:37:32Z"
name: whoami-mn
namespace: whoami-mn-dev
resourceVersion: "1127785"
selfLink: /apis/extensions/v1beta1/namespaces/whoami-mn-dev/ingresses/whoami-mn
uid: d4ff44a2-a45e-4ef4-ac53-e76c7603d91a
spec:
rules:
- host: whoami-mn.myhost.com
http:
paths:
- backend:
serviceName: whoami-mn
servicePort: 8080
path: /
pathType: ImplementationSpecific
tls:
- hosts:
- whoami-mn.myhost.com
secretName: whoami-mn-tls
status:
loadBalancer:
ingress:
- ip: 192.168.0.100
但是端点返回404，来自traefik的日志包含多个条目，如以下
{"level":"error","msg":"Error configuring TLS for ingress whoami-mn-dev/whoami-mn: secret whoami-mn-dev/whoami-mn-tls does not exist","time":"2020-09-13T14:44:10Z"}
知道我做错了什么吗？还请让我知道我是否应该张贴任何其他
实现这一点的关键是正确地注释我的入口资源。
cert-manager.io/cluster-issuer: letsencrypt-staging
而不是下面的
certmanager.k8s.io/issuer: letsencrypt-staging
使用了证书管理器的1.0.1版本。