能否用traefik.me与cert manager实现Kubernetes本地开发HTTPS？求助

在本地Kubernetes开发场景中，计划通过traefik.me（所有子域名指向localhost）搭配cert-manager实现HTTPS访问，已完成Ingress和Certificate资源配置，但cert-manager日志显示HTTP-01校验返回404错误，需技术指导。

现有配置 #

Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-web-ingress
  namespace: myapp
  annotations:
  cert-manager.io/issuer: "letsencrypt-staging"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - traefik.me
    - api.traefik.me
    - beta.traefik.me
    - myapp.traefik.me
    secretName: myapp-tls
  rules:
    - host: myapp.traefik.me
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80
    - host: beta.traefik.me
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: app
                port:
                  number: 80
    - host: api.traefik.me
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: keda-add-ons-http-interceptor-proxy
                port:
                  number: 8080

Certificate配置 #

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-tls
  namespace: myapp
spec:
  secretName: myapp-tls
  issuerRef:
    name: letsencrypt-staging
    kind: Issuer
  dnsNames:
    - traefik.me
    - api.traefik.me
    - beta.traefik.me
    - myapp.traefik.me
  privateKey:
    algorithm: RSA
    size: 2048

cert-manager错误日志 #

E1211 19:23:40.601353       1 sync.go:208] "propagation check failed" err="wrong status code '404', expected '200'" logger="cert-manager.controller" resource_name="myapp-tls-1-3528601542-974909028" resource_namespace="myapp" resource_kind="Challenge" resource_version="v1" dnsName="traefik.me" type="HTTP-01"
I1211 19:23:50.313309       1 pod.go:59] "found one existing HTTP01 solver pod" logger="cert-manager.controller.http01.selfCheck.http01.ensurePod" resource_name="myapp-tls-1-3528601542-3776680831" resource_namespace="myapp" resource_kind="Challenge" resource_version="v1" dnsName="api.traefik.me" type="HTTP-01" related_resource_name="cm-acme-http-solver-jzh75" related_resource_namespace="myapp" related_resource_kind="" related_resource_version=""
I1211 19:23:50.313399       1 service.go:45] "found one existing HTTP01 solver Service for challenge resource" logger="cert-manager.controller.http01.selfCheck.http01.ensureService" resource_name="myapp-tls-1-3528601542-3776680831" resource_namespace="myapp" resource_kind="Challenge" resource_version="v1" dnsName="api.traefik.me" type="HTTP-01" related_resource_name="cm-acme-http-solver-h49bd" related_resource_namespace="myapp" related_resource_kind="" related_resource_version=""

问题分析与修复步骤 #

核心原因 #

HTTP-01校验失败是因为Let's Encrypt发送的校验请求（路径/.well-known/acme-challenge/）无法被正确转发到cert-manager的solver Pod，具体触发点包括Ingress配置错误、根域名路由缺失、本地端口未暴露。

具体修复措施 #

1. 修正Ingress注解格式
   原Ingress的cert-manager.io/issuer注解缺少缩进，导致注解不生效。修正后：

   metadata:
     name: myapp-web-ingress
     namespace: myapp
     annotations:
       cert-manager.io/issuer: "letsencrypt-staging" # 补全缩进，确保注解被识别
   

2. 添加根域名traefik.me的路由规则
   原Ingress未配置根域名traefik.me的路由，而证书请求包含该域名，导致校验请求无匹配规则返回404。添加路由：

   rules:
     - host: traefik.me
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 name: web # 复用已存在的web服务即可，只要能返回200状态码
                 port:
                   number: 80
   

3. 暴露本地Ingress控制器端口
   本地环境中Let's Encrypt无法直接访问localhost，需将Ingress控制器的80端口转发到本地公网可访问的地址：

   kubectl port-forward -n ingress-nginx service/ingress-nginx-controller 80:80 --address 0.0.0.0
   

4. 确认cert-manager与IngressClass关联
   确保cert-manager能识别nginx作为默认IngressClass，若安装时未指定，可执行：

   helm upgrade cert-manager jetstack/cert-manager -n cert-manager --set ingressShim.defaultIngressClass=nginx
   

验证步骤 #

1. 应用修正后的Ingress配置：kubectl apply -f ingress.yaml -n myapp
2. 查看Certificate状态：kubectl get certificate -n myapp，等待状态变为Ready
3. 访问https://myapp.traefik.me，确认HTTPS正常加载

内容的提问来源于stack exchange，提问作者ezio