Kubernetes无法生成Let's Encrypt SSL证书求助

问题描述 #

多次尝试为Kubernetes集群配置Let's Encrypt SSL证书，但最终集群生成的是自签名证书，而非预期的Let's Encrypt证书。域名托管在GoDaddy。

现有配置文件 #

cert-issuer-nginx-ingress.yaml #

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-cluster-issuer
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: email@gmail.com
    privateKeySecretRef:
      name: letsencrypt-cluster-issuer-key
    solvers:
    - http01:
        ingress:
          class: nginx

certificate.yaml #

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: app-dash-board
  namespace: default
spec:
  dnsNames:
    - domain.in
  secretName: app-dash-board-tls
  issuerRef:
    name: letsencrypt-cluster-issuer 
    kind: ClusterIssuer

ingress.yaml #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
  name: influx-dashboard
spec:
  tls:
  - hosts:
    - domain.in
    secretName: influx-dashboard-tls
  rules:
  - host: domain.in
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service: 
            name: frontend-service
            port: 
              number: 80

排查与解决步骤 #

1. 修正Ingress与Certificate的Secret名称匹配问题
   当前Ingress的spec.tls.secretName为influx-dashboard-tls，但Certificate定义的spec.secretName为app-dash-board-tls，两者完全不匹配。当Ingress指定的Secret不存在时，cert-manager会自动生成自签名证书临时替代。需将Ingress中的secretName修改为与Certificate一致的值，修正后的Ingress配置参考下方示例。

2. 验证ClusterIssuer状态
   执行命令检查ClusterIssuer是否正常就绪：

   kubectl describe clusterissuer letsencrypt-cluster-issuer
   

   查看输出中Status字段是否为Ready=True，如果为False，检查Events栏的错误信息，比如ACME注册失败、网络连通性问题等。

3. 验证Certificate状态
   执行命令查看Certificate的签发状态：

   kubectl describe certificate app-dash-board
   

   重点关注Events中的日志，确认是否出现http-01挑战失败的情况，比如Let's Encrypt无法访问你的Ingress节点。

4. 确认GoDaddy域名解析配置
   确保domain.in的A记录或CNAME记录已指向Nginx Ingress Controller的公网IP，可通过nslookup domain.in验证解析是否生效。Let's Encrypt需要通过公网访问到你的Ingress节点完成http-01挑战。

5. 检查Nginx Ingress Controller的公网暴露情况
   确认Ingress Controller的Service为LoadBalancer类型，或已通过端口转发等方式开放80和443端口，确保公网能正常访问这两个端口（http-01挑战依赖80端口）。

6. 清理无关测试资源
   命名空间cert-manager-test中的test-selfsigned Issuer为测试残留资源，与当前问题无关，可执行以下命令清理：

   kubectl delete issuer test-selfsigned -n cert-manager-test
   

修正后的Ingress配置示例 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
  name: influx-dashboard
spec:
  tls:
  - hosts:
    - domain.in
    secretName: app-dash-board-tls  # 与Certificate的secretName保持一致
  rules:
  - host: domain.in
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service: 
            name: frontend-service
            port: 
              number: 80

内容的提问来源于stack exchange，提问作者Suprava