我正在使用cert-manager
此自定义通配符证书
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-myapp-issuer
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: [email protected] # CHANGE-ME
privateKeySecretRef:
name: wildcard-myapp-com
solvers:
# ACME DNS-01 provider configurations
- dns01:
cloudDNS:
serviceAccountSecretRef:
name: clouddns-service-account
key: dns-service-account.json
project: myapp
selector:
dnsNames:
- '*.myapp.com'
- myapp.com
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: myapp-com-tls
namespace: default
spec:
secretName: myapp-com-tls
issuerRef:
name: letsencrypt-myapp-issuer
commonName: '*.myapp.com'
dnsNames:
- '*.myapp.com'
- myapp.com
我正在使用 kustomize 部署 Nginx ingress
spec:
template:
spec:
containers:
- name: controller
args:
- /nginx-ingress-controller
- --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
- --election-id=ingress-controller-leader
- --controller-class=k8s.io/ingress-nginx
- --ingress-class=nginx
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
- --validating-webhook=:8443
- --validating-webhook-certificate=/usr/local/certificates/cert
- --validating-webhook-key=/usr/local/certificates/key
- --default-ssl-certificate=default/myapp-com-tls # NOTE THIS LINE
当我打开入口控制器的日志时,我可以看到此错误
加载自定义默认证书时出错,返回生成 ││ 未找到本地 SSL 证书 default/myapp-com-tls
我该怎么做才能解决这个问题?
更新
如果我跑
kubectl get secret myapp-com-tls --namespace default
它什么也不返回。但是如果我运行
kubectl get secret myapp.com-tls-qpmpr --namespace default
它返回
NAME TYPE DATA AGE
myapp.com-tls-qpmpr Opaque 1 47m
然而,如果我在 YAML 上更改为此,我会得到同样的错误
--default-ssl-certificate=default/myapp.com-tls-qpmpr
$ kubectl describe certificates myapp-com-tls -n cert-manager
Error from server (NotFound): certificates.cert-manager.io "myapp-com-tls" not found
答案1
问题是由于证书尚未准备好