AKS上Kubeflow v1.6 SSL配置：Cert-manager http-01挑战404错误

在AKS上部署Kubeflow v1.6并配置SSL安全访问，使用组件版本为Cert-manager v1.10.1、Istio v1.16.0。当前遇到的核心问题：acme-solver服务使用8089端口，但集群内外均无法访问该服务。

具体表现：请求domain.com/.well-known/acme-challenge/token本应返回200状态码并包含验证令牌，实际因无法访问集群内8089端口服务返回404错误。Cert-manager自动创建的Ingress未生效。

以下是acme-solver生成的Ingress资源：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: istio
    nginx.ingress.kubernetes.io/whitelist-source-range: "0.0.0.0/0,::/0"
  generateName: cm-acme-http-solver-
  generation: 2
  labels:
    acme.cert-manager.io/http-domain: "700646687"
    acme.cert-manager.io/http-token: "903286350"
    acme.cert-manager.io/http01-solver: "true"
  name: cm-acme-http-solver-m5km5
  namespace: istio-system
  ownerReferences:
  - apiVersion: acme.cert-manager.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Challenge
    name: example-domain-com-wq9x4-635963339-3112361122
    uid: a714c9e7-4152-4a67-849a-770fc8d049a2
  resourceVersion: "22275"
  uid: dd653c5b-8bcf-4275-a820-df1020005a5f
spec:
  rules:
  - host: example.domain.com
    http:
      paths:
      - backend:
          service:
            name: cm-acme-http-solver-8bd7d
            port:
              number: 8089
        path: /.well-known/acme-challenge/6lN1QQNyGRfN9t9zVd8dxM9FWmWe13qDwF6owzXJ-Vk
        pathType: Exact
status:
  loadBalancer:
    ingress:
    - ip: "52.224.73.90"

尝试在istio-system命名空间创建VirtualService转发请求，同样无效，配置如下：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-virtual-service
  namespace: istio-system
spec:
  hosts:
    - example.domain.com
  gateways:
    - istio-ingressgateway
  http:
    - match:
        - uri:
            prefix: "/.well-known/acme-challenge/"
      route:
        - destination:
            host: cm-acme-http-solver.istio-system.svc.cluster.local
            port:
              number: 8089

内容的提问来源于stack exchange，提问作者Mohamed Faris