k8s nginx入口kibana

Question

我有一個k8s集群，上面已經部署了ELK，我的kibana部署和服務看起來像

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    service: kibana
  name: kibana
spec:
  replicas: 1
  selector:
    matchLabels:
      service: kibana
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        service: kibana
    spec:
      containers:
        - image: docker.elastic.co/kibana/kibana:6.6.0
          name: kibana
          ports:
            - containerPort: 5601
          resources:
            requests:
              memory: 1Gi
            limits:
              memory: 1Gi
      restartPolicy: Always
      imagePullSecrets:
        - name: regcred
---
apiVersion: v1
kind: Service
metadata:
  labels:
    service: kibana
  name: kibana
spec:
  ports:
    - name: "5601"
      port: 5601
      targetPort: 5601
  selector:
    service: kibana
  type: NodePort

Nginx入口看起來像

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: loadbalancer-https
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: true
    nginx.ingress.kubernetes.io/force-ssl-redirect: true
    nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/app-root: /
    nginx.org/ssl-services: "kibana"
    kubernetes.io/ingress.class: nginx
spec:
  tls:
    - hosts:
        - kibana.some.com
      secretName: secret
  rules:
    - host: kibana.some.com
      http:
        paths:
          - path: /
            backend:
              serviceName: kibana
              servicePort: 5601

但是我得到502 Bad Gateway，如果我查看nginx入口日志，我會看到

2019/03/02 01:25:09 [error] 875#875: *470787 upstream prematurely closed connection while reading response header from upstream, client: 10.138.82.98, server: kibana.some.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://10.244.2.86:5601/favicon.ico", host: "kibana.some.com", referrer: "https://kibana.some.com/"

似乎很簡單，但我不知道我在這里缺少什么。 我將不勝感激。

謝謝

Answer 1

它應該與您的nginx.ingress.kubernetes.io/secure-backends: "true"入口中的nginx.ingress.kubernetes.io/secure-backends: "true"配置。 您是否在Pod中為您的Kibana配置了HTTPS / TLS支持？ 否則，我建議刪除此注釋。

另外，請注意，不建議使用nginx.ingress.kubernetes.io/secure-backends: "true"批注。

參考：

• https://docs.giantswarm.io/guides/advanced-ingress-configuration/
• https://github.com/kubernetes/ingress-nginx/issues/3416