使用 Let's Encrypt 的 K3s

Question

我正在尝试让 Let's Encrypt 在我的 K3s 集群上运行。我一直在关注下面的教程，但是因为它已经有一年多的历史了，所以我使用的是 cert-manager.

的更高版本

https://pascalw.me/blog/2019/07/02/k3s-https-letsencrypt.html

我正在执行以下命令

kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.1/cert-manager.crds.yaml
helm repo add jetstack https://charts.jetstack.io
kubectl create namespace cert-manager
helm install cert-manager jetstack/cert-manager --namespace cert-manager

echo "apiVersion: cert-manager.io/v1beta1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    email: my-email@gmail.com
    privateKeySecretRef:
      name: staging-issuer-account-key
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    http01: {}
    solvers:
      - http01:
          ingress:
            class: traefik
        selector: {}
" | kubectl apply --validate=false -f -

我生成的入口资源如下所示

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/acme-challenge-type: http01
    certmanager.k8s.io/issuer: letsencrypt-staging
    kubernetes.io/ingress.class: traefik
    meta.helm.sh/release-name: whoami-mn
    meta.helm.sh/release-namespace: whoami-mn-dev
  creationTimestamp: "2020-09-13T08:49:27Z"
  generation: 3
  labels:
    app.kubernetes.io/instance: whoami-mn
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: whoami-mn
    app.kubernetes.io/version: "0.1"
    helm.sh/chart: whoami-mn-0.4.0
  managedFields:
  - apiVersion: extensions/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:loadBalancer:
          f:ingress: {}
    manager: traefik
    operation: Update
    time: "2020-09-13T10:08:21Z"
  - apiVersion: networking.k8s.io/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:certmanager.k8s.io/acme-challenge-type: {}
          f:certmanager.k8s.io/issuer: {}
          f:kubernetes.io/ingress.class: {}
          f:meta.helm.sh/release-name: {}
          f:meta.helm.sh/release-namespace: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/instance: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/version: {}
          f:helm.sh/chart: {}
      f:spec:
        f:rules: {}
        f:tls: {}
    manager: Go-http-client
    operation: Update
    time: "2020-09-13T12:37:32Z"
  name: whoami-mn
  namespace: whoami-mn-dev
  resourceVersion: "1127785"
  selfLink: /apis/extensions/v1beta1/namespaces/whoami-mn-dev/ingresses/whoami-mn
  uid: d4ff44a2-a45e-4ef4-ac53-e76c7603d91a
spec:
  rules:
  - host: whoami-mn.myhost.com
    http:
      paths:
      - backend:
          serviceName: whoami-mn
          servicePort: 8080
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - whoami-mn.myhost.com
    secretName: whoami-mn-tls
status:
  loadBalancer:
    ingress:
    - ip: 192.168.0.100

但是端点 returns 404 和来自 traefik 的日志包含多个条目，如下所示

{"level":"error","msg":"Error configuring TLS for ingress whoami-mn-dev/whoami-mn: secret whoami-mn-dev/whoami-mn-tls does not exist","time":"2020-09-13T14:44:10Z"}

关于我做错了什么的任何线索？也请让我知道我是否应该 post 其他

Answer 1

这项工作的关键是正确注释我的入口资源。

cert-manager.io/cluster-issuer: letsencrypt-staging

而不是以下

certmanager.k8s.io/issuer: letsencrypt-staging

使用了 cert-manager 的 1.0.1 版。

使用 Let's Encrypt 的 K3s

K3s with Let's Encrypt

kubernetes

kubernetes-ingress

lets-encrypt

traefik

k3s