Question

我正试图围绕建议的解决方法，因为使用GLBC在ingress-gce中缺少内置的HTTP-＆gt; HTTPS重定向。我正在努力的是如何使用这个自定义后端作为克服此限制的一个选项（例如在How to force SSL for Kubernetes Ingress on GKE中）。

在我的情况下，负载均衡器后面的应用程序本身没有apache或nginx，我只是无法弄清楚如何包含例如apache或nginx。在设置中，apache（我知道比nginx更好）。我应该在应用程序前面设置apache作为代理吗？在那种情况下，我想知道在代理配置中放什么，因为那里不能使用那些方便的k8s服务名...

或者应该将apache设置为某种单独的后端，只有在客户端使用普通HTTP时才会获得流量？在那种情况下，我错过了GCE负载均衡器中协议后端的分离，虽然我可以看到如何手动完成，但是需要为此配置入口，我似乎无法找到任何资源解释如何实际做到这一点。

例如，在https://github.com/kubernetes/ingress-gce#redirecting-http-to-https＆＃34;应用程序＆＃34;负责转发（它似乎建立在nginx上），虽然这个例子工作得很漂亮，但我不能用我正在谈论的应用程序做同样的事情。

基本上，我的设置目前是：

http://<public ip>:80    -\
                           >      GCE LB     ->  K8s pod running the application
https://<public_ip>:443  -/   (ingress-gce)

我知道我可以完全阻止HTTP，但当有人在浏览器中输入域名时，这会破坏用户体验。

目前我已为LB设置了这些服务：

kind: Service
apiVersion: v1
metadata:
  name: myapp
spec:
  type: LoadBalancer
  ports:
  - name: http
    port: 80
    targetPort: myapp
    protocol: TCP
  selector:
    app: myapp

---
kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: myapp-ingress
  annotations:
    ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.global-static-ip-name: "my-ip"
    ingress.gcp.kubernetes.io/pre-shared-cert: "my-cert"
spec:
  backend:
    serviceName: myapp
    servicePort: 80
  rules:
  - host: my.domain.name
    http:
      paths:
      - path: /
        backend:
          serviceName: myapp
          servicePort: 80

此外，我将GLBC与应用程序部署捆绑在一起：

apiVersion: v1
kind: ConfigMap
metadata:
  name: glbc-configmap
data:
  gce.conf: |
    [global]
    node-tags = myapp-k8s-nodepool
    node-instance-prefix = gke-myapp-k8s-cluster

---
kind: Deployment
apiVersion: apps/v1beta2
metadata:
  name: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      name: myapp
      labels:
        app: myapp
    spec:
      containers:
      # START application container
      - name: myapp
        image: eu.gcr.io/myproject/myapp:latest
        imagePullPolicy: Always
        readinessProbe:
          httpGet:
            path: /ping
            port: 8080
        ports:
        - name: myapp
          containerPort: 8080
      # END application container
      # START GLBC container
      - name: myapp-glbc
        image: gcr.io/google_containers/glbc:0.9.7
        livenessProbe:
          httpGet:
            path: /ping
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 30
          timeoutSeconds: 5
        volumeMounts:
        - mountPath: /etc/glbc-configmap
          name: cloudconfig
          readOnly: true
        args:
        - --apiserver-host=http://localhost:8080
        - --default-backend-service=myapp
        - --sync-period=300s
        - --config-file-path=/etc/glbc-configmap/gce.conf

除了更完整的解决方案之外，我非常感谢任何指针。

Answer 1

我能够找到一个解决方案，GCE LB将流量引导到Apache（当然这适用于任何代理），它作为K8s集群中的部署运行。在Apache配置中，有一个基于X-Forwarded-Proto标头的重定向，以及一个指向集群中应用程序的反向代理规则。

apiVersion: v1
kind: ConfigMap
metadata:
  name: apache-httpd-configmap
data:
  httpd.conf: |
    # Apache httpd v2.4 minimal configuration
    # This can be reduced further if you remove the accees log and mod_log_config

    ServerRoot "/usr/local/apache2"

    # Minimum modules needed
    LoadModule mpm_event_module modules/mod_mpm_event.so
    LoadModule log_config_module modules/mod_log_config.so
    LoadModule mime_module modules/mod_mime.so
    LoadModule dir_module modules/mod_dir.so
    LoadModule authz_core_module modules/mod_authz_core.so
    LoadModule unixd_module modules/mod_unixd.so
    LoadModule alias_module modules/mod_alias.so
    LoadModule proxy_module modules/mod_proxy.so
    LoadModule proxy_http_module modules/mod_proxy_http.so

    TypesConfig conf/mime.types

    PidFile logs/httpd.pid

    # Comment this out if running httpd as a non root user
    User nobody

    # Port to Listen on
    Listen 8081

    # In a basic setup httpd can only serve files from its document root
    DocumentRoot "/usr/local/apache2/htdocs"

    # Default file to serve
    DirectoryIndex index.html

    # Errors go to stderr
    ErrorLog /proc/self/fd/2

    # Access log to stdout
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    CustomLog /proc/self/fd/1 common

    Mutex posixsem proxy

    # Never change this block
    <Directory />
      AllowOverride None
      Require all denied
    </Directory>

    # Deny documents to be served from the DocumentRoot
    <Directory "/usr/local/apache2/htdocs">
      Require all denied
    </Directory>

    <VirtualHost *:8081>
      ServerName my.domain.name
      # Redirect HTTP to load balancer HTTPS URL
      <If "%{HTTP:X-Forwarded-Proto} -strcmatch 'http'">
        Redirect / https://my.domain.name:443/
      </If>

      # Proxy the requests to the application
      # "myapp" in the rules relies a K8s cluster add-on for DNS aliases
      # see https://kubernetes.io/docs/concepts/services-networking/service/#dns
      ProxyRequests Off
      ProxyPass         "/"    "http://myapp:80/"
      ProxyPassReverse  "/"    "http://myapp:80/"
    </VirtualHost>

---
kind: Service
apiVersion: v1
metadata:
  name: apache-httpd
spec:
  type: NodePort
  ports:
  - name: http
    port: 80
    targetPort: apache-httpd
    protocol: TCP
  selector:
    app: apache-httpd

---
kind: Deployment
apiVersion: apps/v1beta2
metadata:
  name: apache-httpd
spec:
  replicas: 1
  selector:
    matchLabels:
      app: apache-httpd
  template:
    metadata:
      name: apache-httpd
      labels:
        app: apache-httpd
    spec:
      containers:
      # START apache httpd container
      - name: apache-httpd
        image: httpd:2.4-alpine
        imagePullPolicy: Always
        readinessProbe:
          httpGet:
            path: /
            port: 8081
        command: ["/usr/local/apache2/bin/httpd"]
        args: ["-f", "/etc/apache-httpd-configmap/httpd.conf", "-DFOREGROUND"]
        ports:
        - name: apache-httpd
          containerPort: 8081
        volumeMounts:
        - mountPath: /etc/apache-httpd-configmap
          name: apacheconfig
          readOnly: true
      # END apache container
      # END containers
      volumes:
        - name: apacheconfig
          configMap:
            name: apache-httpd-configmap
      # END volumes
    # END template spec
  # END template

除了上面的新清单yaml之外，“myapp-ingress”的规则需要更改，以便serviceName: myapp代替serviceName: apache-httpd使LB直接流向Apache。

似乎这个相当小的Apache设置只需要非常少的CPU和RAM，因此它在现有集群中非常合适，因此不会造成任何直接的额外成本。

Answer 2

快速更新：here

您可以使用 FrontEndConfig 来配置用于重定向的 Ingress。

使用GLBC在ingress-gce中实现缺少http-＆gt; https重定向的解决方法

2 个答案: