Kubernetes Ingress通配符DNS证书签发失败问题求助

我在Kubernetes中配置通配符域名以支持动态子域名，本地测试正常，但部署到DigitalOcean集群后，通配符证书始终无法签发成功，证书状态显示False。

我的K8s配置文件 #

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: myemail@mycompany.com.br
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: apps
  name: menu-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: menu
  template:
    metadata:
      labels:
        app: menu
    spec:
      containers:
        - name: menu
          image: company/company-menu:$VERSION
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
          env:
            - name: VERSION
              value: $VERSION

      imagePullSecrets:
        - name: hub
---
apiVersion: v1
kind: Service
metadata:
  namespace: apps
  name: menu-service
spec:
  selector:
    app: menu
  ports:
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: apps
  name: menu-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: 'nginx'
    ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
    - hosts:
        - menu.mydomain.dev
        - '*.menu.mydomain.dev'
      secretName: menuwild-tls
  rules:
    - host: menu.mydomain.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: menu-service
                port:
                  number: 80

当前证书状态 #

menuwild-tls       False   menuwild-tls       27m

问题根源与解决步骤 #

1. 核心问题：通配符证书不支持HTTP-01验证 #

Let's Encrypt规定，通配符域名证书必须使用DNS-01验证方式，而当前ClusterIssuer配置用的是HTTP-01，这是证书签发失败的直接原因。

2. 配置DigitalOcean DNS-01验证 #

步骤1：创建DigitalOcean API Token的Secret

在DigitalOcean控制台生成具有DNS权限的API Token，然后在集群中创建Secret：

kubectl create secret generic digitalocean-dns --from-literal=access-token=你的DO_API_TOKEN -n cert-manager

步骤2：修改ClusterIssuer为DNS-01验证

替换原ClusterIssuer的solvers部分：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: myemail@mycompany.com.br
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - dns01:
          digitalocean:
            tokenSecretRef:
              name: digitalocean-dns
              key: access-token

3. 补充Ingress的通配符域名规则 #

当前Ingress仅配置了menu.mydomain.dev的路由规则，需要添加*.menu.mydomain.dev的规则，确保所有子域名都能路由到服务：

spec:
  rules:
    - host: menu.mydomain.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: menu-service
                port:
                  number: 80
    - host: '*.menu.mydomain.dev'
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: menu-service
                port:
                  number: 80

4. 重新应用配置并验证 #

# 重新应用所有配置
kubectl apply -f 你的配置文件.yaml

# 查看证书状态
kubectl get certificates -n apps

# 如果状态仍异常，查看证书详细事件排查
kubectl describe certificate menuwild-tls -n apps

为什么本地测试正常？ #

本地环境可能使用的是自签通配符证书，或者未通过Let's Encrypt进行正式签发，因此不会触发DNS-01验证的强制要求。

内容的提问来源于stack exchange，提问作者Rafael Augusto