库伯内特斯|公开HTTPS服务

Question

我是Kubernetes平台的新手，尝试启用部署在Kubernetes平台上的tomcat web app的HTTPS安全连接。我对舱单感到困惑。与部署、服务和入口控制器相关的yml。

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-webapp
spec:
  selector:
    matchLabels:
      app: tomcat-webapp
  replicas: 1
  template:
    metadata:
      labels:
        app: tomcat-webapp
    spec:
      containers:
        - name: tomcat-webapp
          image: registry.central/*****
          imagePullPolicy: Always
          securityContext:
            runAsUser: 13113
            runAsGroup: 602
          ports:
            - containerPort: 8080
          env:
            - name: JAVA_OPTS
              value: "-Xms128M -Xmx256M -XX:MetaspaceSize=128m -XX:MaxMetaspaceSize=256m"
            - name: CATALINA_OPTS
              value: "-Djavax.net.ssl.trustStore=/opt/apache-tomcat-8.5.32/webapps/ROOT/tomcat.jks -Djavax.net.ssl.trustStorePassword=****"
---
apiVersion: v1
kind: Service
metadata:
  name: tomcat-webapp
  labels:
    app: tomcat-webapp
spec:
  ports:
    - port: 80
      targetPort: 8080
      #nodePort: 30010
      protocol: TCP
      name: http
  selector:
    app: tomcat-webapp
---
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat-webapp
spec:
  rules:
    - host: "tomcat-webapp.apps.net"
      http:
        paths:
          - path: /
            backend:
              serviceName: tomcat-webapp
              servicePort: 80
  tls:
    - hosts:
        # dont forget to update this url too
        - "tomcat-webapp.apps.net"

那么，我是否也必须在部署（在端口：-containerPort:8080）服务（如端口：-端口：80 targetPort:8080协议：TCP名称：http）和入口（在后端：serviceName:tomcat webapp servicePort:80）中指定端口8443（Https端口）？

Answer 1

保持简单：

apiVersion: v1
kind: Service
metadata:
  name: tomcat-webapp
  labels:
    app: tomcat-webapp
spec:
  ports:
    - port: 8080
  selector:
    app: tomcat-webapp
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat-webapp
spec:
  rules:
    - host: "tomcat-webapp.apps.net"
      http:
        paths:
          - path: /
            backend:
              serviceName: tomcat-webapp
              servicePort: 8080
  tls:
    - hosts:
        - "tomcat-webapp.apps.net"`

据我从部署配置中了解，Java应用程序运行在端口8080上，需要https流量。这不适用于上述入口配置-您的Java应用程序应该侦听端口8080，并期望http流量。

如果确实希望Java应用程序侦听HTTPS，可以通过以下方式配置入口：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat-webapp
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
... # the rest is the same