kubernetes使用traefik的https方式訪問web應用

背景
以前的文章中，我已經利用kubernetes的traefik服務做爲入口，訪問了tomcat的相關服務，但以前的文章是經過http的方式來訪問的。在現實應用中，爲了安全考慮，確定有https訪問的需求，這裏咱們就經過traefik來實現https的訪問。
以前的文章連接：https://blog.51cto.com/icenycmh/2124502

實驗操做
一：想開啓https，證書是少不了的。能夠本身手動建一個證書，或者利用已經有的證書。這裏我用已經申請的一個ssl證書，對應的域名爲*.gzshapp.com。

二：建立一個secret，保存https證書。

# ll
total 12
-rw-r--r-- 1 root root 5477 Mar 30 16:32 _.gzshapp.com_bundle.crt
-rw-r--r-- 1 root root 1708 Mar 28 14:01 _.gzshapp.com.key

# kubectl create secret generic traefik-cert --from-file=_.gzshapp.com_bundle.crt --from-file=_.gzshapp.com.key -n kube-system

把證書拷貝到k8s node節點，本例中，存放證書的目錄爲：/opt/conf/k8s/ssl/。

三：建立一個configmap，保存traefix的配置。
這裏的traefix中配置了把全部http請求所有rewrite爲https的規則，並配置相應的證書位置：

# vi traefik.toml
defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      certFile = "/opt/conf/k8s/ssl/_.gzshapp.com_bundle.crt"
      keyFile = "/opt/conf/k8s/ssl/_.gzshapp.com.key"

# kubectl create configmap traefik-conf --from-file=traefik.toml -n kube-system

把traefik.toml文件拷貝到k8s node節點，本例中，traefik的存放目錄爲：/opt/conf/k8s/conf/。

四：從新部署Traefix，這裏主要是要關聯建立的secret和configMap，並掛載相對應的主機目錄。

# more traefik-deployment.yaml 
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: traefik-ingress-lb
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  replicas: 2
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      terminationGracePeriodSeconds: 60
      volumes:
      - name: ssl
        secret:
          secretName: traefik-cert
      - name: config
        configMap:
          name: traefik-conf
      hostNetwork: true
      restartPolicy: Always
      serviceAccountName: ingress
      containers:
      - image: traefik
        name: traefik-ingress-lb
        volumeMounts:
        - mountPath: "/opt/conf/k8s/ssl"
          name: "ssl"
        - mountPath: "/opt/conf/k8s/conf"
          name: "config"
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        - name: admin
          containerPort: 8580
          hostPort: 8580
        args:
        - --configFile=/opt/conf/k8s/conf/traefik.toml
        - --web
        - --web.address=:8580
        - --kubernetes

# kubectl apply -f traefik-deployment.yaml

五：測試效果。
這裏咱們能夠登錄traefik-ui界面，能夠看到本來http的訪問，traefik會直接給咱們重定向至https。

因爲traefik-ui使用的域名不是咱們證書所支持的域名，故這裏顯示了不安全的提示。這裏我修改了以前文章中建立的tomcat-test的ingress，修改其中的域名爲證書所支持的域名，再進行一次測試：

# vi ingress-tomcat.yaml 
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat-test-web
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.frontend.rule.type: PathPrefixStrip
spec:
  rules:
  - host: test.gzshapp.com
    http:
      paths:
      - path: /test1/
        backend:
          serviceName: tomcat-test1
          servicePort: 8080
      - path: /test2/
        backend:
          serviceName: tomcat-test2
          servicePort: 8080

# kubectl apply -f ingress-tomcat.yaml

這裏咱們修改ingress的域名爲test.gzshapp.com，修改一下host，再訪問測試一下：

192.168.232.129 test.gzshapp.com
192.168.232.131 test.gzshapp.com

能夠看到咱們的配置已經生效了。

其餘需求
固然，現實環境中確定針對不一樣狀況，有不少的不一樣需求。好比，訪問需同時支持http和https、只有部分域名須要https強制跳轉，後端代理https的應用等。這裏咱們能夠一個個來根據需求配置traefik。
1：同時支持http和https：(把http中的rewrite代碼改掉)

defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      certFile = "/opt/scripts/traefik/https/_.gzshapp.com_bundle.crt"
      keyFile = "/opt/scripts/traefik/https/_.gzshapp.com.key"

2：僅配置部分域名強制跳轉https：(在http.redirect中編寫對應域名的正則)

defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    regex = "^http://test.gzshapp.com/(.*)"
    replacement = "https://test.gzshapp.com/$1"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      certFile = "/opt/conf/k8s/ssl/_.gzshapp.com_bundle.crt"
      keyFile = "/opt/conf/k8s/ssl/_.gzshapp.com.key"

3：traefik代理後端https請求：
這裏我修改了一下個人tomcat服務，開放了8443的https端口，並修改了一下ingress的配置，以下：

能夠看到我新建了一個ingress，域名爲test-ssl.gzshapp.com，其中/test1/後端爲8443的https服務，/test2爲8080的http服務。修改host，用https協議分別訪問，結果以下：


能夠看到，訪問test1的時候，反回了「Bad Gateway」錯誤。訪問test2，則正常。這多是由於後端的tomcat服務的使用了自簽證書的緣由，致使了訪問失敗，也多是traefik自身的緣由，這裏不去深究。
這裏能夠修改traefik的配置，添加insecureSkipVerify = true便可解決這一個問題。這個traefik的配置禁用了對後端的證書檢查。

insecureSkipVerify = true
defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      certFile = "/opt/conf/k8s/ssl/_.gzshapp.com_bundle.crt"
      keyFile = "/opt/conf/k8s/ssl/_.gzshapp.com.key"