在 k8s 中自動爲域名配置 https

時間 2019-11-05

標籤 k8s 自動域名配置 https 简体版

原文原文鏈接

隨着 web 的發展，https 對於現代網站來講是必不可少的。若是你想獲得一個免費的證書，那麼 Let's Encrypt 是一個不錯的選擇，它的主要目的是推動網站 https 的進程。html

感謝 Let's Encrypt 的免費證書nginx

藉助 helm，在 k8s cluster 中爲域名配置 https 將會變得很是簡單，部署資源成功後在 k8s 中爲 Ingress 配置證書將會變得很是容易: 只須要在 Ingress 中多添加兩行代碼git

本篇文章將介紹如何只須要三步爲你的域名配置上 httpsgithub

在本篇文章以前，假設此時你已經可以配置 Ingress 併成功訪問到你的域名，若是沒有，你能夠參考本系列文章的以上幾篇web

若是對你可以有所幫助，能夠幫我在 shfshanyue/op-note 上點個 star。shell

01 使用 helm 部署 cert-manager

咱們選擇這個 helm chart jetstack/cert-manager 部署 https。目前，在 github 上，該倉庫 jetstack/cert-manager 已擁有 4.4K Star。api

若是想使用 let's encrypt 自動爲 Ingress 配置 https。在部署時須要爲 helm chart 指定如下參數。瀏覽器

ingressShim.defaultIssuerName=letsencrypt-prod
ingressShim.defaultIssuerKind=Issuer
複製代碼

這裏有關於 Issuers的文檔bash

部署過程以下，這裏使用了 helm v3 進行部署app

# 部署前須要一些 crd
$ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml

# 爲 helm 添加 repo
$ helm repo add jetstack https://charts.jetstack.io

# 使用 helm v3 部署，指定參數
$ helm install cert-manager jetstack/cert-manager --set "ingressShim.defaultIssuerName=letsencrypt-prod,ingressShim.defaultIssuerKind=Issuer"
NAME: cert-manager
LAST DEPLOYED: 2019-10-26 21:27:56.488948248 +0800 CST m=+2.081581159
NAMESPACE: default
STATUS: deployed
NOTES:
cert-manager has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://docs.cert-manager.io/en/latest/reference/issuers.html

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:

https://docs.cert-manager.io/en/latest/reference/ingress-shim.html
複製代碼

校驗狀態，查看剛纔部署 crd 與 pod 的狀態，校驗是否成功

$ kubectl get crd
NAME                                  CREATED AT
certificaterequests.cert-manager.io   2019-10-26T01:16:21Z
certificates.cert-manager.io          2019-10-26T01:16:21Z
challenges.acme.cert-manager.io       2019-10-26T01:16:21Z
clusterissuers.cert-manager.io        2019-10-26T01:16:24Z
issuers.cert-manager.io               2019-10-26T01:16:24Z
orders.acme.cert-manager.io           2019-10-26T01:16:21Z

$ kubectl get pods
NAME                                             READY   STATUS    RESTARTS   AGE
cert-manager-5d8fd69d88-s7dtg                    1/1     Running   0          57s
cert-manager-cainjector-755bbf9c6b-ctkdb         1/1     Running   0          57s
cert-manager-webhook-76954fcbcd-h4hrx            1/1     Running   0          57s
複製代碼

02 配置 ACME Issuers

指定 kind 爲 Issuer，並修改如下郵箱爲本身的郵箱，Issuer 資源配置以下

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
 name: letsencrypt-prod
spec:
 acme:
    # The ACME server URL
 server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
 email: example@shanyue.tech
    # Name of a secret used to store the ACME account private key
 privateKeySecretRef:
 name: letsencrypt-prod
    # Enable the HTTP-01 challenge provider
 solvers:
 - http01:
 ingress:
 class: nginx
複製代碼

使用 kubectl apply -f 部署生效

$ kubectl apply -f letsencrypt-issue.yaml
複製代碼

03 爲 Ingress 添加 annotation

在部署 Ingress 時指定 annotations 就能夠很方便地配置證書

annotations:
  kubernetes.io/ingress.class: "nginx"
  cert-manager.io/issuer: "letsencrypt-prod"
複製代碼

關於 Ingress 的完整配置以下，你也能夠在個人github上查看 Deployment，Service 到 Ingress 完整的配置: shfshanyue/learn-k8s:/conf/nginx.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: nginx-service-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - nginx.xiange.tech
    secretName: nginx-tls
  rules:
  - host: nginx.xiange.tech
    http:
      paths:
      - backend:
          serviceName: nginx-service
          servicePort: 80
        path: /
複製代碼

校驗 certificate 狀態，Ready 爲 True

因爲鏡像在 quay.io 中，pull image 的時間過慢，有可能須要十分鐘

$ kubectl get certificate
NAME        READY   SECRET      AGE
nginx-tls   True    nginx-tls   44h

$ kubectl describe certificate nginx-tls
Name:         nginx-tls
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1alpha2
Kind:         Certificate
Metadata:
  Creation Timestamp:  2019-10-26T13:30:06Z
  Generation:          1
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  nginx-service-ingress
    UID:                   c9abc7b7-45da-431b-b732-e535a809dfdd
  Resource Version:        2822740
  Self Link:               /apis/cert-manager.io/v1alpha2/namespaces/default/certificates/nginx-tls
  UID:                     ccb3aa54-e967-4813-acbe-41d9801f29a6
Spec:
  Dns Names:
    nginx.xiange.tech
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       Issuer
    Name:       letsencrypt-prod
  Secret Name:  nginx-tls
Status:
  Conditions:
    Last Transition Time:  2019-10-26T13:43:02Z
    Message:               Certificate is up to date and has not expired
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2020-01-24T12:43:01Z
Events:                    <none>
複製代碼

訪問 Ingress 中配置的域名，Chrome 瀏覽器中左上角的小鎖提示 https 配置成功