AWS Kubernetes：在AWS负载平衡器上选择SSL证书

Question

我正在尝试为我的AWS EKS群集的AWS负载平衡器配置SSL。负载平衡器正在代理我的群集上运行的Traefik实例。这在HTTP上运行良好。

然后，我在Cert Manager中创建了我的AWS证书，复制了ARN并遵循了文档的这一部分：服务-Kubernetes

但是证书没有链接到AWS负载平衡器中的侦听器。我在网上找不到更多的文档或工作示例。有人能给我指出一个吗？

LoadBalancer配置如下所示：

apiVersion: v1
kind: Service
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"traefik-ingress-service","namespace":"kube-system"},"spec":{"ports":[{"name":"web","port":80,"targetPort":80},{"name":"admin","port":8080,"targetPort":8080},{"name":"secure","port":443,"targetPort":443}],"selector":{"k8s-app":"traefik-ingress-lb"},"type":"LoadBalancer"}}
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:eu-north-1:000000000:certificate/e386a77d-26d9-4608-826b-b2b3a5d1ec47
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
  creationTimestamp: 2019-01-14T14:33:17Z
  name: traefik-ingress-service
  namespace: kube-system
  resourceVersion: "10172130"
  selfLink: /api/v1/namespaces/kube-system/services/traefik-ingress-service
  uid: e386a77d-26d9-4608-826b-b2b3a5d1ec47
spec:
  clusterIP: 10.100.115.166
  externalTrafficPolicy: Cluster
  ports:
  - name: web
    port: 80
    protocol: TCP
    targetPort: 80
  - name: admin
    port: 8080
    protocol: TCP
    targetPort: 8080
  - name: secure
    port: 443
    protocol: TCP
    targetPort: 80
  selector:
    k8s-app: traefik-ingress-lb
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - hostname: e386a77d-26d9-4608-826b-b2b3a5d1ec47.eu-north-1.elb.amazonaws.com

谨致问候，期待您的回答。

Answer 1

由于使用EKS v1.14（和nginx ingress controller）和网络负载平衡器，我也遇到了类似的问题，根据Kubernetes的说法，这可能是因为Kubernetes v1.15-GitHub问题。自2020年3月10日起，亚马逊EKS现在支持Kubernetes版本1.15

因此，如果它仍然相关，请在此处阅读更多信息-如何使用ACM终止Amazon EKS工作负载上的HTTPS流量？。