K8S集羣Ingress https實踐

前文介紹使用ingress結合traefik實現了入口的動靜分離，本文將在前文基礎上實現ingress的https配置。

爲了簡單且高效，建議應用容器化部署以後，https卸載在ingress這一級實現。通俗一點來講就是用戶到ingress的鏈接走https協議，ingress到後端服務的鏈接走http協議。

咱們對https的配置要求也比較簡單，主要以下：
一、http自動重定向到https
二、https支持虛擬主機（TLS SNI）

1、初始環境準備

一、這裏爲了方便測試，把前文配置的網站動態部分路由規則都拿掉，僅保留靜態部分

二、配置hosts解析記錄

三、http訪問測試

2、準備證書文件和配置文件

一、這裏將兩個站點的四個證書文件統一放到一個secret裏面去維護

# kubectl create secret generic traefik-cert --from-file=star_59iedu_com.key  \
--from-file=star_59iedu_com.pem  \
--from-file=star_yingjigl_com.key  \
--from-file=star_yingjigl_com.pem -n kube-system

二、配置http重定向到https，同時支持多個https虛擬主機（TLS SNI）

# cat traefik.toml 
defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      CertFile = "/ssl/star_59iedu_com.pem"
      KeyFile = "/ssl/star_59iedu_com.key"
      [[entryPoints.https.tls.certificates]]
      certFile = "/ssl/star_yingjigl_com.pem"
      keyFile = "/ssl/star_yingjigl_com.key"

# kubectl create configmap traefik-conf --from-file=traefik.toml -n kube-system

3、修改traefik配置文件

主要須要添加config和ssl volumes,其餘的配置（例如：rabc、service、ingress等）保持不變，具體配置可參考前文，前文傳送門：http://www.javashuo.com/article/p-bsfalpsm-gv.html

# cat traefik-deployment.yaml   
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  replicas: 2
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      hostNetwork: true
      nodeSelector:
        traefik: proxy
      terminationGracePeriodSeconds: 60
      volumes:
       - name: ssl
         secret:
          secretName: traefik-cert
       - name: config
         configMap:
          name: traefik-conf
      containers:
      - image: traefik
        name: traefik-ingress-lb
        volumeMounts:
        - mountPath: "/ssl"
          name: "ssl"
        - mountPath: "/config"
          name: "config"
        ports:
        - name: web
          containerPort: 80
          hostPort: 80
        - name: admin
          containerPort: 8081
        args:
        - --configfile=/config/traefik.toml
        - --web
        - --web.address=:8081
        - --kubernetes

# kubectl apply -f traefik-deployment.yaml

4、訪問測試與驗證

參考文檔：
其餘的需求，例如gzip壓縮，tls版本和加密算法，rewrite重定向等配置也能夠參考此文檔
https://docs.traefik.io/configuration/entrypoints/#basic

5、其餘需求

一、 使用一個統一的入口地址。
二、 默認同時支持http和https方式訪問。
三、 根據實際的狀況和要求來配置http訪問請求重定向到https。
四、 兼容後端https服務（這裏以dashboard爲例）

# cat traefik.toml   
insecureSkipVerify = true
defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    regex = "^http://k8s.59iedu.com/(.*)"
    replacement = "https://k8s.59iedu.com/$1"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      CertFile = "/ssl/star_59iedu_com.pem"
      KeyFile = "/ssl/star_59iedu_com.key"
      [[entryPoints.https.tls.certificates]]
      certFile = "/ssl/star_yingjigl_com.pem"
      keyFile = "/ssl/star_yingjigl_com.key"
      [[entryPoints.https.tls.certificates]]
      certFile = "/ssl/star_huilearning_com.pem"
      keyFile = "/ssl/star_huilearning_com.key"

# cat dashboard-ingress.yaml 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  annotations:
    ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  rules:
  - host: k8s.59iedu.com
    http:
      paths:
      - path: /
        backend:
          serviceName: kubernetes-dashboard
          servicePort: 443