1.配了一個證書，發現報錯：

 kubectl logs  ingress-nginx-controller-96fnv   -n ingress-nginx

 unexpected error validating SSL certificate gscommon/https-secret for host oa2https01.mz.abc.com. Reason: x509: certificate is valid for *.idcsec.com, not oa2https01.mz.abc.com

基本可以確定是證書有問題

2.參考思路：

2.1生成證書檔案：

openssl req -x509 -nodes -days 2920 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=*.idcsec.com/O=nginxsvc"

2.2 匯入證書檔案到k8s secret

kubectl create secret tls https-secret --key tls.key --cert tls.crt

我的配置：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
ingress.kubernetes.io/ssl-redirect: "True"
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{"ingress.kubernetes.io/ssl-redirect":"True"},"name":"pispower-oa-https","namespace":"gscommon"},"spec":{"rules":[{"host":"oahttps02.mz.pispower.com","http":{"paths":[{"backend":{"serviceName":"oa2gs","servicePort":80},"path":"/"}]}}],"tls":[{"hosts":["oahttps02.mz.pispower.com"],"secretName":"https-secret-02"}]}}
creationTimestamp: 2018-12-22T15:42:08Z
generation: 3
name: pispower-oa-https
namespace: gscommon
resourceVersion: "7947760"
selfLink: /apis/extensions/v1beta1/namespaces/gscommon/ingresses/pispower-oa-https
uid: 2425b1df-0600-11e9-9cd0-020050e80095

spec:
rules:
- host: oahttps02.mz.abc.com
http:
paths:
- backend:
serviceName: oa2gs
servicePort: 80
path: /
tls:
- hosts:
- oahttps02.mz.abc.com
secretName: https-secret04
status:
loadBalancer:
ingress:
- {}

參考：http://idcsec.com/articles/2018/09/28/1538105157281.html

關鍵： kubectl create secret tls https-secret04 --key mz.abc.key --cert mz.abc.com.crt -n gscommon