☰

Kubernetes Nginx Ingress 无法从 cert-manager 加载自定义证书

tag-icon • tag-icon nginx-ingress cert-manager
Kubernetes Nginx Ingress 无法从 cert-manager 加载自定义证书

我正在使用cert-manager此自定义通配符证书

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-myapp-issuer
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected] # CHANGE-ME
    privateKeySecretRef:
      name: wildcard-myapp-com
    solvers:
      # ACME DNS-01 provider configurations
      - dns01:
          cloudDNS:
            serviceAccountSecretRef:
              name: clouddns-service-account
              key: dns-service-account.json
            project: myapp
        selector:
          dnsNames:
            - '*.myapp.com'
            - myapp.com
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-com-tls
  namespace: default
spec:
  secretName: myapp-com-tls
  issuerRef:
    name: letsencrypt-myapp-issuer
  commonName: '*.myapp.com'
  dnsNames:
    - '*.myapp.com'
    - myapp.com

我正在使用 kustomize 部署 Nginx ingress

spec:
  template:
    spec:
      containers:
      - name: controller
        args:
        - /nginx-ingress-controller
        - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
        - --election-id=ingress-controller-leader
        - --controller-class=k8s.io/ingress-nginx
        - --ingress-class=nginx
        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
        - --validating-webhook=:8443
        - --validating-webhook-certificate=/usr/local/certificates/cert
        - --validating-webhook-key=/usr/local/certificates/key
        - --default-ssl-certificate=default/myapp-com-tls # NOTE THIS LINE

当我打开入口控制器的日志时，我可以看到此错误

加载自定义默认证书时出错，返回生成 ││ 未找到本地 SSL 证书 default/myapp-com-tls

我该怎么做才能解决这个问题？

更新

如果我跑

kubectl get secret myapp-com-tls --namespace default

它什么也不返回。但是如果我运行

kubectl get secret myapp.com-tls-qpmpr --namespace default

它返回

NAME                      TYPE     DATA   AGE
myapp.com-tls-qpmpr   Opaque   1      47m

然而，如果我在 YAML 上更改为此，我会得到同样的错误

--default-ssl-certificate=default/myapp.com-tls-qpmpr

$ kubectl describe certificates myapp-com-tls -n cert-manager
Error from server (NotFound): certificates.cert-manager.io "myapp-com-tls" not found

答案1

问题是由于证书尚未准备好

相关内容