如何在安装了 Helm 的 ingress-nginx 中使用通配符证书？

Question

如何为 ingress-nginx 中的所有主机使用自定义通配符 TLS 证书？

我使用 ingress-nginx 作为入口控制器。使用 Helm chart 安装：

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

# create secret
kubectl create secret tls example-com-certificate --namespace ingress-nginx \
    --key certs/tls.key \
    --cert certs/tls.crt   
   
# install ingress-nginx and use the secret
helm install ingress-nginx ingress-nginx/ingress-nginx --namespace ingress-nginx \
  --set controller.wildcardTLS.cert=ingress-nginx/example-com-certificate \
  --set controller.service.loadBalancerIP=10.0.0.1

这里是入口资源示例

kind: Ingress
apiVersion: networking.k8s.io/v1beta1
metadata:
  name: myservice-ingress
  namespace: myservice
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/ingress.allow-http: "false"    
    nginx.ingress.kubernetes.io/backend-protocol: "http"
    nginx.ingress.kubernetes.io/default-backend: myservice
spec:  
  tls:  
  - hosts:
    - myservice.example.com
    #secretName omitted to use default wildcard certificate
  rules:
  - host: myservice.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: myservice
          servicePort: 80

预计访问https://myservice.example.com时使用我的example-com-certificate。

但是使用Kubernetes Ingress Controller Fake Certificate 代替。 为什么？

Answer 1

按照这个例子试试：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: myservice-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
  - host: my.example.com
    http:
      paths:
      - backend:
          serviceName: myservice
          servicePort: 80
        path: /
  tls:
  - hosts:
    - '*.example.com'
    - my.example.com
    secretName: wildcard-example-com-tls