Kubernetes Ingress TLS 与 cert-manager ClusterIssuer 自动签发实践

--- title: Kubernetes Ingress TLS 与 cert-manager ClusterIssuer 自动签发实践 keywords: cert-manager, ClusterIssuer, HTTP01, Ingress TLS, annotations description: 使用 cert-manager 的 ClusterIssuer 配合 Nginx Ingress 实现 Let’s Encrypt 证书自动签发与续期。 categories: - 文章资讯 - 技术教程 --- ClusterIssuer（Let’s Encrypt 生产环境）： ``` apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: [email protected] privateKeySecretRef: name: letsencrypt-prod-key solvers: - http01: ingress: class: nginx ``` Ingress 绑定 TLS 与自动签发： ``` apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app annotations: cert-manager.io/cluster-issuer: letsencrypt-prod spec: ingressClassName: nginx tls: - hosts: - app.example.com secretName: app-tls rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: app port: number: 80 ```