ingress-nginx：客戶端向 https 服務器發送 http 請求

Question

我的目標是在我的 kubernetes 集群中設置一個入口 nginx 。 部署似乎像我猜的那樣工作，日志看起來不錯。

NAME                                            READY   STATUS      RESTARTS   AGE
pod/ingress-nginx-admission-create--1-n5h28     0/1     Completed   0          4d8h
pod/ingress-nginx-admission-patch--1-czsfn      0/1     Completed   0          4d8h
pod/ingress-nginx-controller-7f7f8685b8-xvldg   1/1     Running     0          10m
pod/web-app-59555dbf95-slqc4                    1/1     Running     0          20m

NAME                                         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
service/ingress-nginx-controller             NodePort    10.97.224.250   <none>        80:32666/TCP,443:31657/TCP   4d8h
service/ingress-nginx-controller-admission   ClusterIP   10.100.7.97     <none>        443/TCP                      4d8h
service/web-app-internal                     ClusterIP   10.103.22.145   <none>        80/TCP                       20m

NAME                                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ingress-nginx-controller   1/1     1            1           4d8h
deployment.apps/web-app                    1/1     1            1           20m

NAME                                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/ingress-nginx-controller-55b65fcbff   0         0         0       22h
replicaset.apps/ingress-nginx-controller-5f7d486f4d   0         0         0       43m
replicaset.apps/ingress-nginx-controller-76bdf9b5f6   0         0         0       3h47m
replicaset.apps/ingress-nginx-controller-7d7489d947   0         0         0       44m
replicaset.apps/ingress-nginx-controller-7f7f8685b8   1         1         1       10m
replicaset.apps/ingress-nginx-controller-7fdc4896dd   0         0         0       22h
replicaset.apps/ingress-nginx-controller-86668dc4fc   0         0         0       22h
replicaset.apps/ingress-nginx-controller-8cf5559f8    0         0         0       4d8h
replicaset.apps/ingress-nginx-controller-f58499759    0         0         0       62m
replicaset.apps/web-app-59555dbf95                    1         1         1       20m

NAME                                       COMPLETIONS   DURATION   AGE
job.batch/ingress-nginx-admission-create   1/1           2s         4d8h
job.batch/ingress-nginx-admission-patch    1/1           7s         4d8h

我已經遇到了一些問題，在這個問題中有所說明。 我使用的部署如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: ingress-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
      - name: web-app
        image: registry/web-app:latest
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: web-app-internal
  namespace: ingress-nginx
spec:
  selector:
      app: web-app
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/enable-access-log: "true"
  name: web-app-ingress
  namespace: ingress-nginx
  labels:
    name: web-app-ingress
spec:
  rules:
  - host: web.app
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: web-app-internal
            port: 
              number: 80

首先，讓我解釋一下，我目前嘗試在內部通過http訪問入口。 當這工作時，下一步將是建立一個經過ssl認證的連接。

最后但並非最不重要的一點是，一些更相關的數據：

• 在入口規則中定義的主機解析為我自己網絡中集群外部的外部托管負載均衡器的 ip
• curl -v http://web.app返回以下輸出：

*   Trying x.x.x.x...
* TCP_NODELAY set
* Connected to web.app (x.x.x.x) port 80 (#0)
> GET / HTTP/1.1
> Host: web.app
> User-Agent: curl/7.64.1
> Accept: */*
> 
* HTTP 1.0, assume close after body
< HTTP/1.0 400 Bad Request
< 
Client sent an HTTP request to an HTTPS server.
* Closing connection 0

我是所有與 k8s 相關的東西的新手，你猜我想念什么嗎？

非常感謝您的建議！

Answer 1

不，解決了問題。 這是一個不正確的 nginx 負載平衡器設置。 確實傳遞了443和80流量，但沒有傳遞到分配的ingress-nginx-controller服務在我的工作節點上的http暴露端口。 在此之后，一切正常。

Answer 2

嘗試將此注釋添加到您的入口。

nginx.ingress.kubernetes.io/backend-protocol=HTTPS