如何在 Kubernetes 中為 HashiCorp Vault UI 設置入口

Question

我剛剛在我的 Kubernetes 集群上安裝了一個 HashiCorp Vault。 我希望它通過我現有的入口控制器工作，所以我使用下面的 yaml 創建了一個新的入口規則：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: vault-ingress
  namespace: vault
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
  rules:
  - http:
      paths:
      - path: /vault
        backend:
          serviceName: vault
          servicePort: 8200

對於我的服務，它運行為：

apiVersion: v1
kind: Service
metadata:
  name: vault
  namespace: vault
  labels:
    module: vault
spec:
  selector:
    module: vault
  ports:
  - port: 8200
    targetPort: 8200

但是，當我嘗試訪問我的 URL 時： http://ingress.domain/vault/ui我得到了錯誤的空頁面

13.72.65.96/:24 GET http://ingress.domain/ui/assets/vendor-854d73b9f9351c0ff2e27f8821dfcd09.js net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:25 GET http://ingress.domain/ui/assets/vault-f8ac2e61e061b2fb490b6ad79fcd5c1f.js net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:15 GET http://ingress.domain/ui/assets/vendor-895fbba1663c3b4fe68755a3fb7ae7b4.css net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:16 GET http://ingress.domain/ui/assets/vault-8ed265cce923599eca663b1bb2e4a83f.css net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:25 GET http://ingress.domain/ui/assets/vault-f8ac2e61e061b2fb490b6ad79fcd5c1f.js net::ERR_ABORTED 404 (Not Found)
favicon-68e1a9c89026b0efeddf718a48c282a5.png:1 
GET http://ingress.domain/ui/favicon-68e1a9c89026b0efeddf718a48c282a5.png 404 (Not Found)

我的配置圖：

apiVersion: v1
kind: ConfigMap
metadata:
  name: vault
  namespace: vault
  labels:
    module: vault
data:
  config.json : '{
    "ui": "true",
    "disable_mlock": "true",
    "api_addr": "http://127.0.0.1:8200/vault",
    "listener": [
        {
            "tcp": {
                "address": "0.0.0.0:8200",
                "tls_disable": 1
            }
        }
    ]
}'

部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault
  namespace: vault
  labels:
    module: vault
spec:
  selector:
    matchLabels:
      module: vault
  replicas: 1
  template:
    metadata:
      labels:
        module: vault
    spec:
      containers:
      - name: vault
        image: vault
        imagePullPolicy: "Always"
        command: ["/bin/sh", "-c"]
        args:
        -  vault server -config /vault/config/config.json
        securityContext:
          capabilities:
            add:
              - IPC_LOCK
        volumeMounts:
          - name: configurations
            mountPath: /vault/config/config.json
            subPath: config.json
        env:
          - name: VAULT_ADDR
            value: "http://localhost:8200/vault/"
        ports:
        - containerPort: 8200
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: configurations
          configMap:
            name: vault

如何在 Kubernetes 中為 Vault UI 設置入口？ 我的 Ingress 有一個域，因此 UI（和其他服務）應該是： http://ingress.domain/ {service name}。 我需要 Vault UI http://ingress.domain/vault

Answer 1

我在Vault 論壇上得到了回應：

這是（目前）不可能的。 Vault 的 UI（和 API）無法與域子路徑一起使用。