[英]How to create a HTTPS route to a Service that is listening on Https with Traefik, and Kubernetes
我是 kubernetes 和 Traefik 的新手。
我跟進該教程: https://docs.traefik.io/user-guides/crd-acme/
我將其更改為在 Scala 中使用我的服務,它位於 https 和 9463 端口下。 我正在嘗試使用 kubernetes 和 traefik 部署我的 Scala 服務。
當我直接轉發到服務時:
kubectl port-forward service/core-service 8001:9463
我執行curl -k 'https://localhost:8001/health'
:
我收到"{Message:Ok}"
但是當我執行端口轉發到 traefik
kubectl port-forward service/traefik 9463:9463 -n default
並執行curl -k 'https://ejemplo.com:9463/tls/health'
我得到一個"Internal server error"
我想問題是我的“核心服務”正在監聽 HTTPS 協議,這就是我添加的scheme:https
。 我試圖通過文檔找到解決方案,但它令人困惑。
這些是我的 yml 文件:
服務.yaml
apiVersion: v1
kind: Service
metadata:
name: traefik
spec:
ports:
- protocol: TCP
name: admin
port: 8080
- protocol: TCP
name: websecure
port: 9463
selector:
app: traefik
---
apiVersion: v1
kind: Service
metadata:
name: core-service
spec:
ports:
- protocol: TCP
name: websecure
port: 9463
selector:
app: core-service
部署.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: default
name: traefik-ingress-controller
---
kind: Deployment
apiVersion: apps/v1
metadata:
namespace: default
name: traefik
labels:
app: traefik
spec:
replicas: 1
selector:
matchLabels:
app: traefik
template:
metadata:
labels:
app: traefik
spec:
serviceAccountName: traefik-ingress-controller
containers:
- name: traefik
image: traefik:v2.0
args:
- --api.insecure
- --accesslog
- --entrypoints.websecure.Address=:9463
- --providers.kubernetescrd
- --certificatesresolvers.default.acme.tlschallenge
- --certificatesresolvers.default.acme.email=foo@you.com
- --certificatesresolvers.default.acme.storage=acme.json
# Please note that this is the staging Let's Encrypt server.
# Once you get things working, you should remove that whole line altogether.
- --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
ports:
- name: websecure
containerPort: 9463
- name: admin
containerPort: 8080
---
kind: Deployment
apiVersion: apps/v1
metadata:
namespace: default
name: core-service
labels:
app: core-service
spec:
replicas: 1
selector:
matchLabels:
app: core-service
template:
metadata:
labels:
app: core-service
spec:
containers:
- name: core-service
image: core-service:0.1.4-SNAPSHOT
ports:
- name: websecure
containerPort: 9463
livenessProbe:
httpGet:
port: 9463
scheme: HTTPS
path: /health
initialDelaySeconds: 10
IngressRoute2.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ingressroutetls
namespace: default
spec:
entryPoints:
- websecure
routes:
- match: Host(`ejemplo.com`) && PathPrefix(`/tls`)
kind: Rule
services:
- name: core-service
port: 9463
scheme: https
tls:
certResolver: default
從文檔
默認情況下,TLS 路由器將終止 TLS 連接。 但是,可以指定 passthrough 選項來設置請求是否應“按原樣”轉發,保持所有數據加密。
在您的情況下,需要啟用 SSL 直通,因為 pod 需要 HTTPS 流量。
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ingressroutetls
namespace: default
spec:
entryPoints:
- websecure
routes:
- match: Host(`ejemplo.com`) && PathPrefix(`/tls`)
kind: Rule
services:
- name: core-service
port: 9463
scheme: https
tls:
certResolver: default
passthrough: true
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.