kubernetes cert-manager忽略了ingress注释。

Question

我已经安排好了库伯奈特和恩吉克斯的入口处和经理。我想使用ECDSA证书，而不是RSA证书，因此我遵循文档，并设置了cert-manager.io/private-key-algorithm: ECDSA的侵入配置。不幸的是，证书管理器似乎忽略了此设置，并创建了RSA证书。

kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: {{ include "myapp.fullname" . }}-ingress
  labels:
    {{- include "myapp.labels" . | nindent 4 }}
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/issuer: {{ .Values.certManager.name }}
    cert-manager.io/private-key-algorithm: ECDSA
spec:
  ingressClassName: nginx
  tls:
    - hosts:
      - {{ .Values.ingressHostName }}
      secretName: "{{ include "myapp.fullname" . }}-{{ .Values.certManager.privateKeySecretRef }}"
  rules:
    - host: {{ .Values.ingressHostName }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.landingpage.frontend.service.fullname }}
                port:
                  number: {{ .Values.landingpage.frontend.service.port }}

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: {{ .Values.certManager.name }}
spec:
  acme:
    # The ACME server URL
    server: {{ .Values.certManager.server }}
    # Email address used for ACME registration
    email: {{ .Values.certManager.email }}
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: "{{ include "myapp.fullname" . }}-cert-manager-key"
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class:  nginx

Answer 1

看起来您还不能通过入口资源来完成这个任务，但是您可以通过证书资源来完成这个任务：

https://github.com/cert-manager/cert-manager/issues/2567