Kubernetes Ingress TLS 与 cert-manager ClusterIssuer 自动签发实践

ClusterIssuer（Let’s Encrypt 生产环境）：apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: [email protected] privateKeySecretRef: name: letsencrypt-prod-key solvers: - http01: ingress: class: nginx Ingress 绑定 TLS 与自动签发：apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app annotations: cert-manager.io/cluster-issuer: letsencrypt-prod spec: ingressClassName: nginx tls: - hosts: - app.example.com secretName: app-tls rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: app port: number: 80