混合云环境下GCP内部负载均衡器证书配置方案咨询

你当前用HTTP01挑战失败的核心原因是：内部负载均衡器仅能通过VPN访问，Let's Encrypt的验证服务器无法从公网抵达你的挑战路径，因此必须换用以下适配场景的方案：

1. 改用DNS01挑战（推荐适配混合云域名托管场景） #

你的根域名托管在AWS Route53，cert-manager支持通过修改DNS记录完成Let's Encrypt的验证，无需公网访问内部LB。

配置步骤： #

• 给cert-manager的服务账号添加AWS Route53权限，允许它修改example.com的DNS记录（可通过IAM角色绑定，给cert-manager的SA附加管理Route53区域的策略）
• 创建支持DNS01的ClusterIssuer：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dns
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: your-email@example.com
    privateKeySecretRef:
      name: letsencrypt-dns
    solvers:
    - dns01:
        route53:
          region: us-east-1 # 替换为你的Route53区域所在AWS区域
          secretAccessKeySecretRef:
            name: aws-secret
            key: secret-access-key

• 修改Ingress配置，移除HTTP01相关注释，替换为DNS01的ClusterIssuer：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "gce-internal"
    kubernetes.io/ingress.regional-static-ip-name: something-internal
    cert-manager.io/cluster-issuer: "letsencrypt-dns" # 替换为DNS01类型的ClusterIssuer
  labels:
    app.kubernetes.io/instance: name
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: name
    helm.sh/chart: something-0.27.0
  name: something-internal
  namespace: vault
spec:
  rules:
  - host: something.internal.example.com
    http:
      paths:
      - backend:
          service:
            name: service
            port:
              number: port
        path: /
        pathType: Prefix
  tls:
    - secretName: something-internal-tls
      hosts:
        - something.internal.example.com

2. 使用GCP内部托管证书 #

GCP提供内部托管的TLS证书，适配GKE内部LB场景，需通过DNS TXT记录完成域名所有权验证（因域名在AWS，直接在Route53添加记录即可）。

配置步骤： #

• 用gcloud命令创建内部托管证书：

gcloud compute ssl-certificates create something-internal-cert \
  --domains something.internal.example.com \
  --type INTERNAL_MANAGED

• 按照GCP提示，在Route53中添加指定的TXT记录完成域名验证，等待验证通过
• 修改Ingress配置，引用GCP托管证书：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "gce-internal"
    kubernetes.io/ingress.regional-static-ip-name: something-internal
    networking.gke.io/managed-certificates: something-internal-cert # 引用托管证书
  labels:
    app.kubernetes.io/instance: name
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: name
    helm.sh/chart: something-0.27.0
  name: something-internal
  namespace: vault
spec:
  rules:
  - host: something.internal.example.com
    http:
      paths:
      - backend:
          service:
            name: service
            port:
              number: port
        path: /
        pathType: Prefix

3. 使用自签名证书（适合纯内部环境） #

如果仅需内部可信的证书，无需公共CA验证，可通过cert-manager生成自签名证书。

配置步骤： #

• 创建SelfSigned类型的ClusterIssuer：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}

• 修改Ingress配置，引用该ClusterIssuer：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "gce-internal"
    kubernetes.io/ingress.regional-static-ip-name: something-internal
    cert-manager.io/cluster-issuer: "selfsigned-issuer"
  labels:
    app.kubernetes.io/instance: name
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: name
    helm.sh/chart: something-0.27.0
  name: something-internal
  namespace: vault
spec:
  rules:
  - host: something.internal.example.com
    http:
      paths:
      - backend:
          service:
            name: service
            port:
              number: port
        path: /
        pathType: Prefix
  tls:
    - secretName: something-internal-tls
      hosts:
        - something.internal.example.com

注意：自签名证书需要在所有客户端信任该CA证书，否则会触发证书错误提示

内容的提问来源于stack exchange，提问作者Waseem Mir