背景
之前的文章中,我已經利用kubernetes的traefik服務作爲入口,訪問了tomcat的相關服務,但之前的文章是通過http的方式來訪問的。在現實應用中,爲了安全考慮,肯定有https訪問的需求,這裏我們就通過traefik來實現https的訪問。
之前的文章鏈接:http://blog.51cto.com/icenycmh/2124502
實驗操作
一:想開啓https,證書是少不了的。可以自己手動建一個證書,或者利用已經有的證書。這裏我用已經申請的一個ssl證書,對應的域名爲*.gzshapp.com。
二:創建一個secret,保存https證書。
# ll
total 12
-rw-r--r-- 1 root root 5477 Mar 30 16:32 _.gzshapp.com_bundle.crt
-rw-r--r-- 1 root root 1708 Mar 28 14:01 _.gzshapp.com.key
# kubectl create secret generic traefik-cert --from-file=_.gzshapp.com_bundle.crt --from-file=_.gzshapp.com.key -n kube-system
把證書拷貝到k8s node節點,本例中,存放證書的目錄爲:/opt/conf/k8s/ssl/。
三:創建一個configmap,保存traefix的配置。
這裏的traefix中配置了把所有http請求全部rewrite爲https的規則,並配置相應的證書位置:
# vi traefik.toml
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[[entryPoints.https.tls.certificates]]
certFile = "/opt/conf/k8s/ssl/_.gzshapp.com_bundle.crt"
keyFile = "/opt/conf/k8s/ssl/_.gzshapp.com.key"
# kubectl create configmap traefik-conf --from-file=traefik.toml -n kube-system
把traefik.toml文件拷貝到k8s node節點,本例中,traefik的存放目錄爲:/opt/conf/k8s/conf/。
四:重新部署Traefix,這裏主要是要關聯創建的secret和configMap,並掛載相對應的主機目錄。
# more traefik-deployment.yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: traefik-ingress-lb
namespace: kube-system
labels:
k8s-app: traefik-ingress-lb
spec:
replicas: 2
template:
metadata:
labels:
k8s-app: traefik-ingress-lb
name: traefik-ingress-lb
spec:
terminationGracePeriodSeconds: 60
volumes:
- name: ssl
secret:
secretName: traefik-cert
- name: config
configMap:
name: traefik-conf
hostNetwork: true
restartPolicy: Always
serviceAccountName: ingress
containers:
- image: traefik
name: traefik-ingress-lb
volumeMounts:
- mountPath: "/opt/conf/k8s/ssl"
name: "ssl"
- mountPath: "/opt/conf/k8s/conf"
name: "config"
ports:
- name: http
containerPort: 80
hostPort: 80
- name: admin
containerPort: 8580
hostPort: 8580
args:
- --configFile=/opt/conf/k8s/conf/traefik.toml
- --web
- --web.address=:8580
- --kubernetes
# kubectl apply -f traefik-deployment.yaml
五:測試效果。
這裏我們可以登陸traefik-ui界面,可以看到原本http的訪問,traefik會直接給我們重定向至https。
由於traefik-ui使用的域名不是我們證書所支持的域名,故這裏顯示了不安全的提示。這裏我修改了之前文章中創建的tomcat-test的ingress,修改其中的域名爲證書所支持的域名,再進行一次測試:
# vi ingress-tomcat.yaml
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: tomcat-test-web
namespace: default
annotations:
kubernetes.io/ingress.class: traefik
traefik.frontend.rule.type: PathPrefixStrip
spec:
rules:
- host: test.gzshapp.com
http:
paths:
- path: /test1/
backend:
serviceName: tomcat-test1
servicePort: 8080
- path: /test2/
backend:
serviceName: tomcat-test2
servicePort: 8080
# kubectl apply -f ingress-tomcat.yaml
這裏我們修改ingress的域名爲test.gzshapp.com,修改一下host,再訪問測試一下:
192.168.232.129 test.gzshapp.com
192.168.232.131 test.gzshapp.com
可以看到我們的配置已經生效了。
其他需求
當然,現實環境中肯定針對不同情況,有很多的不同需求。比如,訪問需同時支持http和https、只有部分域名需要https強制跳轉,後端代理https的應用等。這裏我們可以一個個來根據需求配置traefik。
1:同時支持http和https:(把http中的rewrite代碼改掉)
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[[entryPoints.https.tls.certificates]]
certFile = "/opt/scripts/traefik/https/_.gzshapp.com_bundle.crt"
keyFile = "/opt/scripts/traefik/https/_.gzshapp.com.key"
2:僅配置部分域名強制跳轉https:(在http.redirect中編寫對應域名的正則)
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
regex = "^http://test.gzshapp.com/(.*)"
replacement = "https://test.gzshapp.com/$1"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[[entryPoints.https.tls.certificates]]
certFile = "/opt/conf/k8s/ssl/_.gzshapp.com_bundle.crt"
keyFile = "/opt/conf/k8s/ssl/_.gzshapp.com.key"
3:traefik代理後端https請求:
這裏我修改了一下我的tomcat服務,開放了8443的https端口,並修改了一下ingress的配置,如下:
可以看到我新建了一個ingress,域名爲test-ssl.gzshapp.com,其中/test1/後端爲8443的https服務,/test2爲8080的http服務。修改host,用https協議分別訪問,結果如下:
可以看到,訪問test1的時候,反回了“Bad Gateway”錯誤。訪問test2,則正常。這可能是因爲後端的tomcat服務的使用了自簽證書的原因,導致了訪問失敗,也可能是traefik自身的原因,這裏不去深究。
這裏可以修改traefik的配置,添加insecureSkipVerify = true即可解決這一個問題。這個traefik的配置禁用了對後端的證書檢查。
insecureSkipVerify = true
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[[entryPoints.https.tls.certificates]]
certFile = "/opt/conf/k8s/ssl/_.gzshapp.com_bundle.crt"
keyFile = "/opt/conf/k8s/ssl/_.gzshapp.com.key"