kubernetes入口TLS验证和重定向问题

Question

我有两个kubernetes环境，它们使用入口作为代理重定向请求以服务静态（前端）和后端rest服务。

在其中一个环境中，这样的请求可以由两个主机URL访问（一个主机配置了tls cert secret），在另一个环境中，我没有配置任何tls secret，只能由一个主机URL访问

在第一个环境中（只有一个主机，没有TLS机密），我有以下几点：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "70"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "1000"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "1000"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
  creationTimestamp: "XXXX"
  generation: 9
  labels:
    app: myapp
    chart: myapp-0.1.0
    heritage: Helm
    release: myapp-ingress
  name: myapp-ingress
  namespace: myapp-namespace
  resourceVersion: "25745018"
  selfLink: /apis/extensions/v1beta1/namespaces/my-app-namespace/ingresses/my-app-ingress
  uid: 34c3d902-1517
spec:
  rules:
  - host: hostOne
    http:
      paths:
      - backend:
          serviceName: myapp-front
          servicePort: 8080
        path: /(.*)
      - backend:
          serviceName: myapp-backend
          servicePort: 8080
        path: /myappapi/(.+)
  tls:
  - hosts:
    - hostOne
status:
  loadBalancer:
    ingress:
    - {}

在这个例子中，我可以通过HTTP完美地发出请求，一切正常。对于HTTPS请求，我得到了一个SSLExcepcion，因为客户端中没有安装证书（这很正常，很明显）

在第二个集群中，我有TLS secret和两个主机URL：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "70"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "1000"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "1000"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
  creationTimestamp: "XXXX"
  generation: 9
  labels:
    app: myapp
    chart: myapp-0.1.0
    heritage: Helm
    release: myapp-ingress
  name: myapp-ingress
  namespace: myapp-namespace
  resourceVersion: "25745018"
  selfLink: /apis/extensions/v1beta1/namespaces/my-app-namespace/ingresses/my-app-ingress
  uid: 34c3d902-1517
spec:
  rules:
  - host: hostOne
    http:
      paths:
      - backend:
          serviceName: myapp-front
          servicePort: 8080
        path: /(.*)
      - backend:
          serviceName: myapp-backend
          servicePort: 8080
        path: /myappapi/(.+)
  - host: hostTwo
    http:
      paths:
      - backend:
          serviceName: myapp-front
          servicePort: 8080
        path: /(.*)
      - backend:
          serviceName: myapp-backend
          servicePort: 8080
        path: /myappapi/(.+)
  tls:
  - hosts:
    - hostTwo
    secretName: tlsSecret
  - hosts:
    - hostOne
status:
  loadBalancer:
    ingress:
    - {}

在这种情况下，当使用HTTP进行请求时，我得到一个803错误，在两个URL（hostOne和hostTwo）中重定向到HTTPS

我想在仅对hostTwo使用http时进行重定向，hostTwo配置了证书和TLS机密。

为什么在响应http重定向时会出现入口，而在第一种情况下不会？我应该改变什么？

当我用RestTemplate将请求发送到https时，我得到一个SSLException：

2020-05-08 12:57:05,586 ERROR class=ExceptionHandler Received fatal alert: handshake_failure; nested exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

我尝试安装cert和ad TLS1.2，如下所述：Spring RestTemplate:SSL握手失败

但它不起作用，我不能用http发送请求，只是为了检查服务的代码是否良好。

Answer 1

我找到了。https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/

只需添加nginx.ingres.kubernetes。io/force ssl redirect：“false”，因为默认值为true@nischay，您的解决方案不起作用，因为在第一个入口中，应该需要添加nginx.ingres.kubernetes。io/force ssl redirect：“false”，拆分入口比添加注释更复杂，无论如何，非常感谢。

Answer 2

我建议您有两个单独的入口对象。一个用于SSL主机，另一个用于非SSL主机。请检查以下2个入口物体。

对于HostOne-不需要重定向的地方

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "70"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "1000"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "1000"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
  generation: 9
  labels:
    app: myapp
    chart: myapp-0.1.0
    heritage: Helm
    release: myapp-ingress
  name: myapp-ingress-non-ssl
  namespace: myapp-namespace
spec:
  rules:
  - host: hostOne
    http:
      paths:
      - backend:
          serviceName: myapp-front
          servicePort: 8080
        path: /(.*)
      - backend:
          serviceName: myapp-backend
          servicePort: 8080
        path: /myappapi/(.+)
  tls:
  - hosts:
    - hostOne
status:
  loadBalancer:
    ingress:
    - {}

对于HostTwo-需要重定向的地方#添加了重定向注释

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "70"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "1000"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "1000"
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
  generation: 9
  labels:
    app: myapp
    chart: myapp-0.1.0
    heritage: Helm
    release: myapp-ingress
  name: myapp-ingress-ssl
  namespace: myapp-namespace
spec:
  rules:
  - host: hostTwo
    http:
      paths:
      - backend:
          serviceName: myapp-front
          servicePort: 8080
        path: /(.*)
      - backend:
          serviceName: myapp-backend
          servicePort: 8080
        path: /myappapi/(.+)
  tls:
  - hosts:
    - hostTwo
    secretName: tlsSecret
status:
  loadBalancer:
    ingress:
    - {}