Terraform配置Kubernetes Ingress v1空后端规则问题及方案咨询

方案一：直接用cert-manager的Certificate资源生成证书（推荐） #

你的核心需求是获取通配符TLS证书，完全不需要依赖Ingress资源。cert-manager支持直接通过Certificate资源向ClusterIssuer申请证书，绕开Ingress对后端的强制要求，后续微服务的Ingress可直接引用生成的证书Secret。

Terraform配置示例：

resource "kubernetes_certificate_v1" "wildcard_cert" {
  metadata {
    name      = "wildcard-example-com"
    namespace = "default" # 证书Secret会生成在此命名空间
  }

  spec {
    secret_name = "wildcard-example-com-tls" # 存储证书的Secret名称
    issuer_ref {
      kind = "ClusterIssuer"
      name = "<你的cert-manager ClusterIssuer名称>"
    }

    dns_names = [
      "*.example.com",
      "*.api.example.com"
    ]

    # 可选配置：证书有效期与自动续期
    duration = "2160h"    # 90天
    renew_before = "360h" # 提前15天触发续期
  }
}

方案二：为Ingress配置占位符后端（适用于必须保留Ingress的场景） #

Kubernetes Ingress v1强制要求每个路径必须指定有效后端，无法留空。可以配置一个临时占位符服务作为后端，后续微服务的Ingress规则会覆盖该路径的路由逻辑。

步骤1：创建占位符服务与Deployment #

先部署一个返回404的极简服务，作为临时后端：

# 占位符Deployment
resource "kubernetes_deployment_v1" "placeholder_backend" {
  metadata {
    name      = "placeholder-backend"
    namespace = "default"
  }

  spec {
    replicas = 1
    selector {
      match_labels = {
        app = "placeholder-backend"
      }
    }

    template {
      metadata {
        labels = {
          app = "placeholder-backend"
        }
      }

      spec {
        container {
          image = "nginx:alpine"
          name  = "nginx"
          port {
            container_port = 80
          }
          # 自定义nginx配置，访问时返回404
          command = ["/bin/sh", "-c"]
          args = [
            "echo 'server { listen 80; return 404; }' > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"
          ]
        }
      }
    }
  }
}

# 占位符Service
resource "kubernetes_service_v1" "placeholder_backend" {
  metadata {
    name      = "placeholder-backend"
    namespace = "default"
  }

  spec {
    selector = {
      app = "placeholder-backend"
    }
    port {
      port        = 80
      target_port = 80
    }
    type = "ClusterIP"
  }
}

步骤2：修改Ingress配置引用占位符后端 #

将原空后端替换为上述占位符服务，同时补充Ingress v1要求的path_type字段：

resource "kubernetes_ingress_v1" "my-ingress-resource" {
  annotations = {
    "kubernetes.io/ingress.class" = "nginx"
    "cert-manager.io/cluster-issuer" = "<你的cert-manager ClusterIssuer名称>"
    # 注意：Kubernetes 1.22+中，kubernetes.io/tls-acme注解已被cert-manager弃用，无需配置
  }
  spec {
    tls {
      hosts = ["*.example.com", "*.api.example.com"]
      secret_name = "<证书存储的Secret名称>"
    }
    rule {
      host = "*.example.com"
      http {
        path {
          path      = "/"
          path_type = "Prefix" # Ingress v1强制要求指定路径类型

          backend {
            service {
              name = kubernetes_service_v1.placeholder_backend.metadata[0].name
              port {
                number = 80
              }
            }
          }
        }
      }
    }

    rule {
      host = "*.api.example.com"
      http {
        path {
          path      = "/"
          path_type = "Prefix"

          backend {
            service {
              name = kubernetes_service_v1.placeholder_backend.metadata[0].name
              port {
                number = 80
              }
            }
          }
        }
      }
    }
  }
}

后续微服务模块创建的Ingress规则，只要路径更具体（如/api/）或优先级更高，就会自动覆盖占位符的路由。

内容的提问来源于stack exchange，提问作者Shawn