Knative:启用自动TLS证书设置-不起作用

Question

我正在尝试"启用自动TLS证书设置">

我有一个正在工作的ClusterIssuer(状态："True"(，并且我可以手动创建证书(状态："True"(。

我正在尝试启用自动TLS设置模式。

环境设置：

Knative: v0.12
Istio: v1.4 (SDS)
cert-manager: v0.13.1
kubectl version                                                               
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.9", GitCommit:"2e808b7cb054ee242b68e62455323aa783991f03", GitTreeState:"clean", BuildDate:"2020-01-18T23:33:14Z", GoVersion:"go1.12.12", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"15+", GitVersion:"v1.15.9-gke.9", GitCommit:"a9973cbb2722793e2ea08d20880633ca61d3e669", GitTreeState:"clean", BuildDate:"2020-02-07T22:35:02Z", GoVersion:"go1.12.12b4", Compiler:"gc", Platform:"linux/amd64"}

我有以下网关：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: knative-ingress-gateway
namespace: knative-serving
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*"
tls:
# Sends 301 redirect for all http requests.
# Omit to allow http and https.
httpsRedirect: false
- port:
number: 443
name: https
protocol: HTTPS
hosts:
- "mydomain.com"
tls:
mode: SIMPLE
privateKey: /etc/istio/ingressgateway-certs/tls.key
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt

申请时：

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
name: helloworld-go
namespace: default
spec:
template:
spec:
containers:
- image: gcr.io/knative-samples/helloworld-go # The URL to the image of the app
env:
- name: TARGET
value: "Go Sample v1"

我可以(注意：httpsDirect：false(：

curl http://helloworld-go.default.mydomain.com                                       
Hello Go Sample v1!

但是当尝试使用https:时

curl https://helloworld-go.default.mydomain.com
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to helloworld-go.default.mydomain.com:443

此外：

Knative文档指出："在这种模式下，每个命名空间将提供一个证书，并在Knative中重用"，但我在任何命名空间中都看不到任何证书。

注意，kubectl get ksvcurl是http而不是https:

kubectl get ksvc
NAME            URL                                      LATESTCREATED         LATESTREADY           READY   REASON
helloworld-go   http://helloworld-go.default.mydomain.com   helloworld-go-lxr2n   helloworld-go-lxr2n   True    

Answer 1

我遇到了同样的问题。但版本为0.16.0。我通过不使用"；启用自动TLS证书供应"；与证书管理器相反，我使用了直接从knative提供的HTTP-01。

如何使用Let's Encrypt HTTP01自动配置TLS证书挑战：

1. 转到https://knative.dev/docs/install/any-kubernetes-cluster/#optional-服务扩展
2. 点击"；经由HTTP01的TLS">
3. 按照说明操作
4. 应该有效