仪表板的入口配置

Question

我从github做了nginx入口控制器教程并公开了kubernetes仪表板

kubernetes-dashboard   NodePort    10.233.53.77    <none>        443:31925/TCP   20d

创造了入口

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.org/ssl-backends: "kubernetes-dashboard"
    kubernetes.io/ingress.allow-http: "false"
  name: dashboard-ingress
  namespace: kube-system
spec:
  tls:
  - hosts:
    - serverdnsname
    secretName: kubernetes-dashboard-certs
  rules:
  - host: serverdnsname
    http:
      paths:
      - path: /dashboard
        backend:
          serviceName: kubernetes-dashboard
          servicePort: 443

---

ingress-nginx   ingress-nginx          NodePort    10.233.21.200   <none>        80:30827/TCP,443:32536/TCP   5h

https:// serverdnsname:32536 /仪表板 但仪表板抛出错误

2018/01/18 14:42:51 http: TLS handshake error from ipWhichEndsWith.77:52686: tls: first record does not look like a TLS handshake

和入口控制器日志

2018/01/18 14:42:51 [error] 864#864: *37 upstream sent no valid HTTP/1.0 header while reading response header from upstream, client: 10.233.82.1, server: serverdnsname, request: "GET /dashboard HTTP/2.0", upstream: "http://ipWhichEndsWith.249:8443/dashboard", host: "serverdnsname:32536"
10.233.82.1 - [10.233.82.1] - - [18/Jan/2018:14:42:51 +0000] "GET /dashboard HTTP/2.0" 009 7 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36 OPR/49.0.2725.64" 25 0.001 [kube-system-kubernetes-dashboard-443] ipWhichEndsWith.249:8443 7 0.001 200

在我看来,它与上游的nginx重定向有关:" http://ipWhichEndsWith.249:8443/dashboard ".试图将控制器映像版本更新到0.9.0-beta.19 - 没有帮助

感谢您的任何帮助.

Answer 1

正如您所指出的,看起来nginx正在ipWhichEndsWith.249:8443使用http协议代理您的https请求,这是一个HTTPS端点.

您应该将以下注释添加到PodSpec:

nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

这应该使nginx使用https将您的请求转发到pod.

资料来源:https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/annotations.md#secure-backends

Answer 2

仅供代码参考。有2个gtocha。设置正确的注释，因为仪表板会讨论 https 并为入口使用正确的命名空间。tls 配置是可选的。

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: dashboard-google
  namespace: kube-system
  annotations:
    nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  tls:
    - hosts:
      - kube.mydomain.com
      secretName: tls-secret
  rules:
    - host: kube.mydomain.com
      http:
        paths:
        - path: /
          backend:
            serviceName: kubernetes-dashboard
            servicePort: 443

Answer 3

要保持此票证更新（如果用户使用 nginx 入口）以便访问 Kubernetes 仪表板，您需要应用以下注释：

annotations:
  kubernetes.io/ingress.class: "nginx"
  nginx.ingress.kubernetes.io/ssl-passthrough: "true"
  nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

不要secure-backends在高于image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1. 它被替换为backend-protocol.

如果用户在非 https 端口（例如 80）中使用入口，可以按照此处记录的TLS 终止（nging 入口文档）进行操作。

带有子域的完整代码示例：

apiVersion: networking.k8s.io/v1
      kind: Ingress
      metadata:
        name: kubernetes-dashboard-ingress
        namespace: kubernetes-dashboard
        annotations:
          kubernetes.io/ingress.class: "nginx"
          nginx.ingress.kubernetes.io/ssl-passthrough: "true"
          nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
      spec:
        tls:
        - hosts:
            - "dashboard.my.example.com"
          secretName: kubernetes-dashboard-secret
        rules:
        - host: "dashboard.my.example.com"
          http:
            paths:
            - path: /
              pathType: Prefix
              backend:
                service:
                  name: kubernetes-dashboard
                  port:
                    number: 443

希望这可以帮助像我这样的其他初学者不用花太多时间来弄清楚如何去做。此外，用户还应考虑入口控制器的外部负载均衡器配置。请记住将其设置为SSL Pass-Through您将转发的端口。

更新：如果用户想要使用另一个入口提供程序，例如Kubernetes Ingress Controller Documentation/HAProxy Kubernetes Ingress/Controller 1.4

带注释的代码示例：

apiVersion: networking.k8s.io/v1
      kind: Ingress
      metadata:
        name: kubernetes-dashboard-ingress
        namespace: kubernetes-dashboard
        annotations:
          haproxy.org/server-ssl: "true"
      spec:
        tls:
        - hosts:
            - "dashboard.my.example.com"
          secretName: kubernetes-dashboard-secret
        rules:
          - host: "dashboard.my.example.com"
            http:
              paths:
              - path: /
                pathType: Prefix
                backend:
                  service:
                    name: kubernetes-dashboard
                    port:
                      number: 443

用户不应忘记每个命名空间的秘密都是唯一的。