SSL/TLS证书¶

KanjiIQ使用cert-manager和Let's Encrypt实现TLS证书的自动配置和续期。

工作原理¶

sequenceDiagram
    participant I as Ingress Resource
    participant CM as cert-manager
    participant LE as Let's Encrypt
    participant T as Traefik
    participant S as K8s Secret

    I->>CM: New Ingress with cert-manager annotation
    CM->>LE: Request certificate (ACME HTTP-01)
    LE->>T: HTTP-01 challenge request
    T->>LE: Challenge response
    LE->>CM: Certificate issued
    CM->>S: Store as TLS Secret
    T->>S: Read certificate
    Note over T: HTTPS now active
    CM->>CM: Monitor expiry (auto-renew at 30 days)

ClusterIssuer¶

为Let's Encrypt生产环境配置了集群范围的签发者：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: traefik

请求证书¶

任何Ingress资源都可以通过添加单个注解来请求TLS证书：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - kanjiiq.com
        - api.kanjiiq.com
      secretName: kanjiiq-tls  # cert-manager creates this

cert-manager监视带有其注解的Ingress资源，并自动：

创建Certificate资源
通过Traefik执行ACME HTTP-01验证
将签发的证书存储在指定的Secret中
在到期前30天续期

当前证书¶

Secret名称	域名	Ingress
`kanjiiq-tls`	`kanjiiq.com`, `www.kanjiiq.com`, `api.kanjiiq.com`, `admin.kanjiiq.com`	`ingress-kanjiiq.yaml`
`kanjiiq-docs-tls`	`docs.kanjiiq.app`	`ingress-docs.yaml`

故障排查¶

检查证书状态：

# List all certificates
kubectl get certificates -n jlpt-kanji

# Check certificate details
kubectl describe certificate kanjiiq-tls -n jlpt-kanji

# Check cert-manager logs
kubectl logs -n cert-manager deploy/cert-manager

# View certificate challenges in progress
kubectl get challenges -n jlpt-kanji

常见问题：

验证失败：确保DNS A记录指向服务器且80端口可访问
频率限制：Let's Encrypt每周每个域名限制50个证书
Secret未创建：检查cert-manager日志中的ACME错误