Traefik V2获得通配符证书

Question

遵循此tutorial

之后，我的基本设置正在运行

但是努力从Let's Encrypt获取域的通配符证书。

traefik配置：

traefik.toml: |
  ## static configuration
  [global]
    checkNewVersion = true

  [entryPoints]
    [entryPoints.web]
      address = ":80"
    [entryPoints.websecure]
      address = ":443"

  [providers]
    [providers.kubernetesCRD]
    [providers.file]
      directory = "/etc/traefik/providers/"
      watch = true

  [log]
    level = "INFO"

  [accessLog]

  [api]
    insecure = true
    dashboard = true
    debug = true

  [metrics]
    [metrics.prometheus]
      buckets = [0.1,0.3,1.2,5.0]
      addEntryPointsLabels = true
      addServicesLabels = true
      entryPoint = "web"

  [ping]
    entryPoint = "web"

  [certificatesResolvers]
    [certificatesResolvers.default]
      [certificatesResolvers.default.acme]
        email = "admin@domain.com"
        caServer = "https://acme-v02.api.letsencrypt.org/directory"
        storage = "acme.json"
        [certificatesResolvers.default.acme.dnsChallenge]
          provider = "route53"
          delayBeforeCheck = 0
          resolvers = ["1.1.1.1:53", "8.8.8.8:53"]

dynamic.toml: |
  ## dynamic configuration
  (Empty)

和路由配置：

---

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-admin
  namespace: kube-system
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`traefik.domain.ca`)
    kind: Rule
    services:
    - name: traefik
      port: 8080

---

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: whoami-notls
  namespace: kube-system
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`traefik.domain.ca`) && PathPrefix(`/notls`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: whoami-tls
  namespace: kube-system
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`traefik.domain.ca`) && PathPrefix(`/tls`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    certResolver: default

我能够获得traefik.domain.ca的证书，但需要获得整个域（*.domain.ca）的通配符证书。我找不到为此的任何直接参考配置。

我在这里想念什么？

Answer 1

更新tls块有效。

tls:
  certResolver: default
  domains:
    - main: dev.domain.ca
      sans:
        - "dev.domain.ca"
        - "*.dev.domain.ca"