Kubernetes Ingress TLS 与 cert-manager ClusterIssuer 自动签发实践

---

title: Kubernetes Ingress TLS 与 cert-manager ClusterIssuer 自动签发实践

keywords: cert-manager, ClusterIssuer, HTTP01, Ingress TLS, annotations

description: 使用 cert-manager 的 ClusterIssuer 配合 Nginx Ingress 实现 Let’s Encrypt 证书自动签发与续期。

categories:

• 文章资讯
• 技术教程

---

ClusterIssuer（Let’s Encrypt 生产环境）：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
    - http01:
        ingress:
          class: nginx

Ingress 绑定 TLS 与自动签发：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app
            port:
              number: 80