Kubernetes Ingress TLS 与 cert-manager ClusterIssuer 自动签发实践

ClusterIssuer（Let’s Encrypt 生产环境）：apiVersion: cert-manager.io/v1

kind: ClusterIssuer

metadata:

name: letsencrypt-prod

spec:

acme:

server: https://acme-v02.api.letsencrypt.org/directory

email: [email protected]

privateKeySecretRef:

name: letsencrypt-prod-key

solvers:

- http01:

ingress:

class: nginx

Ingress 绑定 TLS 与自动签发：apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: app

annotations:

cert-manager.io/cluster-issuer: letsencrypt-prod

spec:

ingressClassName: nginx

tls:

- hosts:

- app.example.com

secretName: app-tls

rules:

- host: app.example.com

http:

paths:

- path: /

pathType: Prefix

backend:

service:

name: app

port:

number: 80