Kubernetes 集群自签证书配置，2024年最新面试流程4轮技术面+1轮HR

[root@template train]# kubectl get pod -ncluster-service
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-75677b59b6-b6th7              1/1     Running   0          2d23h
cert-manager-cainjector-55b7d68468-4r9hr   1/1     Running   0          2d23h
cert-manager-webhook-6775789b6b-2n9w7      1/1     Running   0          2d23h

三、配置Issuer或者Clusterissuer

Issuer 与 ClusterIssuer 的区别是 ClusterIssuer 可跨命名空间使用，而 Issuer 需在每个命名空间下配置后才可使用。我在此使用 ClusterIssuer，其类型选择 Let‘s Encrypt

配置 staging 环境使用的 Let‘s Encrypt ClusterIssuer，并创建：

-     # cluster-issuer-letsencrypt-staging.yaml
        
        apiVersion: cert-manager.io/v1alpha2
        kind: ClusterIssuer
        metadata:
          name: letsencrypt-staging
        spec:
          acme:
            # 务必将此处替换为你自己的邮箱, 否则会配置失败。当证书快过期时 Let's Encrypt 会与你联系
            email: user@example.com
            server: https://acme-staging-v02.api.letsencrypt.org/directory
            privateKeySecretRef:
              # 将用来存储 Private Key 的 Secret 资源
              name: letsencrypt-staging
            # Add a single challenge solver, HTTP01 using nginx
            solvers:
            - http01:
                ingress:
                  class: nginx
                  
           &#