K8S集群Ingress https实践

前文介绍使用ingress结合traefik实现了入口的动静分离，本文将在前文基础上实现ingress的https配置。

为了简单且高效，建议应用容器化部署以后，https卸载在ingress这一级实现。通俗一点来讲就是用户到ingress的链接走https协议，ingress到后端服务的链接走http协议。

咱们对https的配置要求也比较简单，主要以下：
一、http自动重定向到https
二、https支持虚拟主机（TLS SNI）

1、初始环境准备

一、这里为了方便测试，把前文配置的网站动态部分路由规则都拿掉，仅保留静态部分

二、配置hosts解析记录

三、http访问测试

2、准备证书文件和配置文件

一、这里将两个站点的四个证书文件统一放到一个secret里面去维护

# kubectl create secret generic traefik-cert --from-file=star_59iedu_com.key  \
--from-file=star_59iedu_com.pem  \
--from-file=star_yingjigl_com.key  \
--from-file=star_yingjigl_com.pem -n kube-system

二、配置http重定向到https，同时支持多个https虚拟主机（TLS SNI）

# cat traefik.toml 
defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      CertFile = "/ssl/star_59iedu_com.pem"
      KeyFile = "/ssl/star_59iedu_com.key"
      [[entryPoints.https.tls.certificates]]
      certFile = "/ssl/star_yingjigl_com.pem"
      keyFile = "/ssl/star_yingjigl_com.key"

# kubectl create configmap traefik-conf --from-file=traefik.toml -n kube-system

3、修改traefik配置文件

主要须要添加config和ssl volumes,其余的配置（例如：rabc、service、ingress等）保持不变，具体配置可参考前文，前文传送门：http://www.javashuo.com/article/p-bsfalpsm-gv.html

# cat traefik-deployment.yaml   
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  replicas: 2
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      hostNetwork: true
      nodeSelector:
        traefik: proxy
      terminationGracePeriodSeconds: 60
      volumes:
       - name: ssl
         secret:
          secretName: traefik-cert
       - name: config
         configMap:
          name: traefik-conf
      containers:
      - image: traefik
        name: traefik-ingress-lb
        volumeMounts:
        - mountPath: "/ssl"
          name: "ssl"
        - mountPath: "/config"
          name: "config"
        ports:
        - name: web
          containerPort: 80
          hostPort: 80
        - name: admin
          containerPort: 8081
        args:
        - --configfile=/config/traefik.toml
        - --web
        - --web.address=:8081
        - --kubernetes

# kubectl apply -f traefik-deployment.yaml

4、访问测试与验证

参考文档：
其余的需求，例如gzip压缩，tls版本和加密算法，rewrite重定向等配置也能够参考此文档
https://docs.traefik.io/configuration/entrypoints/#basic

5、其余需求

一、 使用一个统一的入口地址。
二、 默认同时支持http和https方式访问。
三、 根据实际的状况和要求来配置http访问请求重定向到https。
四、 兼容后端https服务（这里以dashboard为例）

# cat traefik.toml   
insecureSkipVerify = true
defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    regex = "^http://k8s.59iedu.com/(.*)"
    replacement = "https://k8s.59iedu.com/$1"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      CertFile = "/ssl/star_59iedu_com.pem"
      KeyFile = "/ssl/star_59iedu_com.key"
      [[entryPoints.https.tls.certificates]]
      certFile = "/ssl/star_yingjigl_com.pem"
      keyFile = "/ssl/star_yingjigl_com.key"
      [[entryPoints.https.tls.certificates]]
      certFile = "/ssl/star_huilearning_com.pem"
      keyFile = "/ssl/star_huilearning_com.key"

# cat dashboard-ingress.yaml 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  annotations:
    ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  rules:
  - host: k8s.59iedu.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kubernetes-dashboard
          servicePort: 443