企业运维实战--k8s学习笔记6.Ingress加密、认证以及地址重写
一、Ingress 加密
生成加密密钥
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"
创建secrets对应密钥
kubectl create secret tls tls-secret --key tls.key --cert tls.crt
kubectl get secrets
编辑ingress文件 vim ingress.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: ingress-nginx
spec:
tls:
- hosts:
- www1.westos.org
secretName: tls-secret
rules:
- host: www1.westos.org
http:
paths:
- path: /
backend:
serviceName: nginx-svc
servicePort: 80
拉起容器,查看ingress信息
kubectl apply -f ingress.yaml
kubectl get ingress
443端口已开。
测试:curl www1.westos.org 返回3开头的http返回码,表示已经重定向
curl www1.westos.org -I 查看重定向地址
-k 访问加密域名
curl -k https://www1.westos.org
二、Ingress 认证
安装生成认证整数的插件
yum install -y httpd-tools
生成证书,输入认证密码
htpasswd -c auth hyl
创建证书到k8s secret
kubectl create secret generic basic-auth --from-file=auth
kubectl get secrets
编辑文件导入证书
vim ingress-nginx/ingress.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: ingress-nginx
annotations:
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - hyl'
spec:
tls:
- hosts:
- www1.westos.org
secretName: tls-secret
rules:
- host: www1.westos.org
http:
paths:
- path: /
backend:
serviceName: nginx-svc
servicePort: 80
拉起资源清单
kubectl apply -f ingress.yaml
查看证书信息是否已添加
kubectl describe ingress
访问测试: firefox:www1.westos.org 需要认证登陆才可访问
三、Ingress 地址重写
根目录重定向到hostname.html
annotations:
nginx.ingress.kubernetes.io/app-root: /hostname.html
拉起容器,访问测试: 访问域名www1.westos.org直接跳转到指定目录的下
根目录重定向到westos,并添加地址重写
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: ingress-nginx
annotations:
nginx.ingress.kubernetes.io/app-root: /westos
nginx.ingress.kubernetes.io/rewrite-target: /$2
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - hyl'
spec:
tls:
- hosts:
- www1.westos.org
secretName: tls-secret
rules:
- host: www1.westos.org
http:
paths:
- path: /westos(/|$)(.*)
backend:
serviceName: nginx-svc
servicePort: 80
拉起资源清单,查看信息
kubectl apply -f ingress-nginx/ingress.yaml
kubectl describe ingress
测试:
逐级代理测试
域名代理到/westos
curl -I www1.westos.org
curl -I www1.westos.org/westos
-k访问443加密端口,显示需要认证;-u 后跟认证用户和密码即可查看。
curl -I -k https://www1.westos.org/westos
curl -I -k -u hyl:westos https://www1.westos.org/westos
curl -k -u hyl:westos https://www1.westos.org/westos
curl -k -u hyl:westos https://www1.westos.org/westos/hostname.html
|