无法让kubernetes将我的tls证书传递给浏览器

Question

我一直在努力让HTTPS访问我在Kubernetes的Elasticsearch集群。

我认为问题是库伯内特斯不喜欢我尝试使用的TLS证书，这就是为什么它没有将其一直传递到浏览器。

其他一切似乎都正常，因为当我接受Kubernetes入口控制器假证书时，请求会按预期进行。

在我尝试这样做的过程中，我设置了：

• 集群本身
• 一个nginx入口控制器
• 一个入口资源

以下是相关的yaml：

>

apiVersion: v1
kind: Service
metadata:
    creationTimestamp: 2018-08-03T03:20:47Z
labels:
    run: my-es
name: my-es
namespace: default
resourceVersion: "3159488"
selfLink: /api/v1/namespaces/default/services/my-es
uid: 373047e0-96cc-11e8-932b-42010a800043
spec:
    clusterIP: 10.63.241.39
ports:
    - name: http
port: 8080
protocol: TCP
targetPort: 9200
selector:
    run: my-es
sessionAffinity: None
type: ClusterIP
status:
    loadBalancer: {}

入口资源

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
    annotations:kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/cors-allow-methods: PUT, GET, POST, OPTIONS
nginx.ingress.kubernetes.io/cors-origins: http://localhost:3425 https://mydomain.ca
    https://myOtherDomain.ca
        nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/rewrite-target: /
creationTimestamp: 2018-08-12T08:44:29Z
generation: 16
name: es-ingress
namespace: default
resourceVersion: "3159625"
selfLink: /apis/extensions/v1beta1/namespaces/default/ingresses/es-ingress
uid: ece0071d-9e0b-11e8-8a45-42001a8000fc
spec:
    rules:
        - http:
paths:
    - backend:
serviceName: my-es
servicePort: 8080
path: /
tls:
    - hosts:
- mydomain.ca
secretName: my-tls-secret
status:
    loadBalancer:
        ingress:
            - ip: 130.211.179.225

nginx入口控制器：

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: 2018-08-12T00:41:32Z
  labels:
    app: nginx-ingress
    chart: nginx-ingress-0.23.0
    component: controller
    heritage: Tiller
    release: nginx-ingress
  name: nginx-ingress-controller
  namespace: default
  resourceVersion: "2781955"
  selfLink: /api/v1/namespaces/default/services/nginx-ingress-controller
  uid: 755ee4b8-9dc8-11e8-85a4-4201a08000fc
spec:
  clusterIP: 10.63.250.256
  externalTrafficPolicy: Cluster
  ports:
  - name: http
    nodePort: 32084
    port: 80
    protocol: TCP
    targetPort: http
  - name: https
    nodePort: 31182
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    app: nginx-ingress
    component: controller
    release: nginx-ingress
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 35.212.6.131

我觉得我错过了一些基本的东西，因为暴露这么简单的东西似乎没有那么难。。。

为了获得我的证书，我只为mydomain申请了一个证书。加利福尼亚州戈达迪。

我是否需要以某种方式获取使用入口资源的集群IP作为通用名称的证书？

似乎不可能验证IP的所有权。

我见过有人提到Kubernetes为入口资源自动创建证书的方法，但这些方法似乎是自签名的。

以下是来自nginx控制器的一些日志：

这个是关于带有tls秘密的PEM，但这只是一个警告。

{
 insertId:  "1kvvhm7g1q7e0ej"
 labels: {
  compute.googleapis.com/resource_name:  "fluentd-gcp-v2.0.17-5b82n"
  container.googleapis.com/namespace_name:  "default"
  container.googleapis.com/pod_name:  "nginx-ingress-controller-58f57fc597-zl25s"
  container.googleapis.com/stream:  "stderr"
 }
 logName:  "projects/project-7d320/logs/nginx-ingress-controller"
 receiveTimestamp:  "2018-08-14T02:58:42.135388365Z"
 resource: {
  labels: {
   cluster_name:  "my-elasticsearch-cluster"
   container_name:  "nginx-ingress-controller"
   instance_id:  "2341889542400230234"
   namespace_id:  "default"
   pod_id:  "nginx-ingress-controller-58f57fc597-zl25s"
   project_id:  "project-7d320"
   zone:  "us-central1-a"
  }
  type:  "container"
 }
 severity:  "WARNING"
 textPayload:  "error obtaining PEM from secret default/my-tls-cert: error retrieving secret default/my-tls-cert: secret default/my-tls-cert was not found"
 timestamp:  "2018-08-14T02:58:37Z"
}

我有几次发生这种握手错误，这可能是最后一次警告的结果...

{
 insertId:  "148t6rfg1xmz978"
 labels: {
  compute.googleapis.com/resource_name:  "fluentd-gcp-v2.0.17-5b82n"
  container.googleapis.com/namespace_name:  "default"
  container.googleapis.com/pod_name:  "nginx-ingress-controller-58f57fc597-zl25s"
  container.googleapis.com/stream:  "stderr"
 }
 logName:  "projects/project-7d320/logs/nginx-ingress-controller"
 receiveTimestamp:  "2018-08-14T15:55:52.438035706Z"
 resource: {
  labels: {
   cluster_name:  "my-elasticsearch-cluster"
   container_name:  "nginx-ingress-controller"
   instance_id:  "2341889542400230234"
   namespace_id:  "default"
   pod_id:  "nginx-ingress-controller-58f57fc597-zl25s"
   project_id:  "project-7d320"
   zone:  "us-central1-a"
  }
  type:  "container"
 }
 severity:  "ERROR"
 textPayload:  "2018/08/14 15:55:50 [crit] 1548#1548: *860 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442"
 timestamp:  "2018-08-14T15:55:50Z"
}

上面的日志似乎表明我的tls秘密不起作用，但当我运行kubectl Descripte ingress时，它说我的秘密终止了。

aaronmw@project-7d320:~$ kubectl describe ing
Name:             es-ingress
Namespace:        default
Address:          130.221.179.212
Default backend:  default-http-backend:80 (10.61.3.7:8080)
TLS:
  my-tls-secret terminates mydomain.ca
Rules:
  Host  Path  Backends
  ----  ----  --------
  *
        /   my-es:8080 (<none>)
Annotations:
Events:  <none>

Answer 1

我想出来了！

我最终做的是在创建时使用以下命令将默认ssl证书添加到我的nginx-ingress控制器

helm install --name nginx-ingress --set controller.extraArgs.default-ssl-certificate=default/search-tls-secret stable/nginx-ingress

一旦我有了它，它就像预期的那样通过了证书，但我仍然有错误的证书，因为CN与我的负载平衡器IP不匹配。

所以我做的是：

• 使我的负载均衡器IP静态
• 将A记录添加到我的域，以将子域映射到该IP
• 重新键入我的证书以匹配新的子域

我在做生意！

感谢@Crou，他的评论提醒我查看日志，让我走上了正确的轨道。