sjenning/kube-nginx-letsencrypt

镜像概述

此容器专为在Kubernetes集群中作为Job运行设计，通过ServiceAccount凭据调用Kubernetes API管理Let's Encrypt证书，无法在Kubernetes外部正常工作。

核心功能

1. 自动向Let's Encrypt申请并获取SSL/TLS证书
2. 更新存储TLS密钥的Kubernetes Secret
3. 触发Ingress对应的Deployment重新部署，使新证书生效

使用场景

适用于Kubernetes集群中需要为Ingress配置HTTPS证书的场景，尤其适合自动管理证书获取与更新的需求。

配置说明

通过环境变量配置容器行为：

• DOMAINS：逗号分隔的目标域名列表（传递给certbot的-d参数）
• EMAIL：管理员联系***（传递给certbot的--email参数）
• SECRET：存储TLS密钥（tls.key和tls.crt）的Secret名称，容器会更新此Secret
• DEPLOYMENT：Ingress对应的Deployment名称，容器会添加更新时间注解触发重新部署

部署示例

Ingress配置

yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginx
spec:
  tls:
  - hosts:
    - www.example.com
    secretName: nginx
  rules:
  - host: www.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: wordpress
          servicePort: 80
      - path: /.well-known
        backend:
          serviceName: letsencrypt
          servicePort: 80

Ingress Deployment配置

yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  strategy:
    type: Recreate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: nginx
    spec:
      containers:
      - image: nginxdemos/nginx-ingress:0.3
        imagePullPolicy: Always
        name: nginx
        ports:
        - name: http
          containerPort: 80
        - name: https
          containerPort: 443

Let's Encrypt Job配置

yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: letsencrypt
  labels:
    app: letsencrypt
spec:
  template:
    metadata:
      name: letsencrypt
      labels:
        app: letsencrypt
    spec:
      containers:
      - image: sjenning/kube-nginx-letsencrypt:0.8.1-1
        name: letsencrypt
        imagePullPolicy: Always
        ports:
        - name: letsencrypt
          containerPort: 80
        env:
        - name: DOMAINS
          value: example.com,[***]
        - name: EMAIL
          value: ***
        - name: SECRET
          value: nginx
        - name: DEPLOYMENT
          value: nginx
      restartPolicy: Never