mirror of https://github.com/easzlab/kubeasz.git
增加https ingress的配置和文档
gjmzj
parent
43de866aa5
commit
989433e4e2
|
|
@ -0,0 +1,73 @@
|
|||
# 使用 traefik 配置 https ingress
|
||||
|
||||
本文档基于 traefik 配置 https ingress 规则，请先阅读[配置基本 ingress](ingress.md)。与基本 ingress-controller 相比，需要额外配置 https tls 证书，主要步骤如下：
|
||||
|
||||
## 1.准备 tls 证书
|
||||
|
||||
可以使用Let's Encrypt签发的免费证书，这里为了测试方便使用自签证书 (tls.key/tls.crt)，注意CN 配置为 ingress 的域名：
|
||||
|
||||
``` bash
|
||||
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=hello.test.com"
|
||||
```
|
||||
|
||||
## 2.在 kube-system 命名空间创建 secret: traefik-cert，以便后面 traefik-controller 挂载该证书
|
||||
|
||||
``` bash
|
||||
$ kubectl -n kube-system create secret tls traefik-cert --key=tls.key --cert=tls.crt
|
||||
```
|
||||
|
||||
## 3.创建 traefik-controller，增加 traefik.toml 配置文件及https 端口暴露等，详见该 yaml 文件
|
||||
|
||||
``` bash
|
||||
$ kubectl apply -f /etc/ansible/manifests/ingress/tls/traefik-controller.yaml
|
||||
```
|
||||
|
||||
## 4.创建 https ingress 例子
|
||||
|
||||
``` bash
|
||||
# 创建示例应用
|
||||
$ kubectl run test-hello --image=nginx --port=80 --expose
|
||||
# hello-tls-ingress 示例
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: hello-tls-ingress
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
spec:
|
||||
rules:
|
||||
- host: hello.test.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: test-hello
|
||||
servicePort: 80
|
||||
tls:
|
||||
- secretName: traefik-cert
|
||||
# 创建https ingress
|
||||
$ kubectl apply -f /etc/ansible/manifests/ingress/tls/hello-tls.ing.yaml
|
||||
# 注意根据hello示例，需要在default命名空间创建对应的secret: traefik-cert
|
||||
$ kubectl create secret tls traefik-cert --key=tls.key --cert=tls.crt
|
||||
```
|
||||
|
||||
## 5.验证 https 访问
|
||||
|
||||
验证 traefik-ingress svc
|
||||
|
||||
``` bash
|
||||
$ kubectl get svc -n kube-system traefik-ingress-service
|
||||
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
||||
traefik-ingress-service NodePort 10.68.250.253 <none> 80:23456/TCP,443:23457/TCP,8080:35941/TCP 66m
|
||||
```
|
||||
|
||||
可以看到项目默认使用nodePort 23456暴露traefik 80端口，nodePort 23457暴露 traefik 443端口，因此在客户端 hosts 增加记录 `$Node_IP hello.test.com`之后，可以在浏览器验证访问如下：
|
||||
|
||||
``` bash
|
||||
https://hello.test.com:23457
|
||||
```
|
||||
|
||||
如果你已经配置了[转发 ingress nodePort](../op/loadballance_ingress_nodeport.md)，那么增加对应 hosts记录后，可以验证访问 `https://hello.test.com`
|
||||
|
||||
## 参考
|
||||
|
||||
- [Add a TLS Certificate to the Ingress](https://docs.traefik.io/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress)
|
||||
|
|
@ -166,7 +166,7 @@ listen ingress-node
|
|||
server 192.168.1.4 192.168.1.4:23456 check inter 10000 fall 2 rise 2 weight 1
|
||||
```
|
||||
|
||||
如上配置访问集群`MASTER_IP`的`80`端口时，由haproxy代理转发到实际的node节点暴露的nodePort端口上了。这时可以修改客户端本机 `hosts`文件如下：(假定 MASTER_IP=192.168.1.10)
|
||||
具体参考[配置转发 ingress nodePort](../op/loadballance_ingress_nodeport.md)，如上配置访问集群`MASTER_IP`的`80`端口时，由haproxy代理转发到实际的node节点暴露的nodePort端口上了。这时可以修改客户端本机 `hosts`文件如下：(假定 MASTER_IP=192.168.1.10)
|
||||
|
||||
``` text
|
||||
192.168.1.10 hello.test.com
|
||||
|
|
@ -174,4 +174,4 @@ listen ingress-node
|
|||
```
|
||||
打开浏览器输入域名 `http://hello.test.com` 和 `http://traefik-ui.test.com`可以正常访问。
|
||||
|
||||
|
||||
## 下一步[配置https ingress](ingress-tls.md)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,16 @@
|
|||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: hello-tls-ingress
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
spec:
|
||||
rules:
|
||||
- host: hello.test.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: test-hello
|
||||
servicePort: 80
|
||||
tls:
|
||||
- secretName: traefik-cert
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: traefik-conf
|
||||
namespace: kube-system
|
||||
data:
|
||||
traefik.toml: |
|
||||
defaultEntryPoints = ["http", "https"]
|
||||
[entryPoints]
|
||||
[entryPoints.http]
|
||||
address = ":80"
|
||||
# 配置http 强制跳转 https
|
||||
#[entryPoints.http.redirect]
|
||||
# entryPoint = "https"
|
||||
[entryPoints.https]
|
||||
address = ":443"
|
||||
[entryPoints.https.tls]
|
||||
[[entryPoints.https.tls.certificates]]
|
||||
CertFile = "/ssl/tls.crt"
|
||||
KeyFile = "/ssl/tls.key"
|
||||
---
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1beta1
|
||||
metadata:
|
||||
name: traefik-ingress-controller
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: traefik-ingress-lb
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: traefik-ingress-lb
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: traefik-ingress-lb
|
||||
name: traefik-ingress-lb
|
||||
spec:
|
||||
serviceAccountName: traefik-ingress-controller
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: ssl
|
||||
secret:
|
||||
secretName: traefik-cert
|
||||
- name: config
|
||||
configMap:
|
||||
name: traefik-conf
|
||||
containers:
|
||||
- image: traefik:v1.7.4
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: traefik-ingress-lb
|
||||
volumeMounts:
|
||||
- mountPath: "/ssl"
|
||||
name: "ssl"
|
||||
- mountPath: "/config"
|
||||
name: "config"
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 800Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 600Mi
|
||||
args:
|
||||
- --configfile=/config/traefik.toml
|
||||
- --api
|
||||
- --kubernetes
|
||||
- --logLevel=INFO
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: traefik-ingress-service
|
||||
namespace: kube-system
|
||||
spec:
|
||||
selector:
|
||||
k8s-app: traefik-ingress-lb
|
||||
ports:
|
||||
- protocol: TCP
|
||||
# 该端口为 traefik ingress-controller的服务端口
|
||||
port: 80
|
||||
# 集群hosts文件中设置的 NODE_PORT_RANGE 作为 NodePort的可用范围
|
||||
# 从默认20000~40000之间选一个可用端口，让ingress-controller暴露给外部的访问
|
||||
nodePort: 23456
|
||||
name: http
|
||||
- protocol: TCP
|
||||
#
|
||||
port: 443
|
||||
nodePort: 23457
|
||||
name: https
|
||||
- protocol: TCP
|
||||
# 该端口为 traefik 的管理WEB界面
|
||||
port: 8080
|
||||
name: admin
|
||||
type: NodePort
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: traefik-ingress-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- endpoints
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: traefik-ingress-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: traefik-ingress-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-ingress-controller
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: traefik-ingress-controller
|
||||
namespace: kube-system
|
||||
Loading…
Reference in New Issue