Question

设置服务的方式如下：

部署（2个吊舱）->负载均衡器路由到此部署->入口点终止https，指向负载均衡器作为后端。

到目前为止，它提供的是正确的证书，但是由于某些原因，它指向的是“错误的”后端。在GKE wbeconsole上，它只是说我的后端服务不健康，一旦我单击它们就不存在。我在这里做什么错了？

[stupifatcatslaptop poc (dev)]$  kubectl get pods -o wide | grep my_project
my_project-flask-poc-696f7b57c5-54n6r         1/1       Running            0          13d       10.236.1.228   gke-qus1-shared-1-prod-default-pool-44da43de-vq4c
my_project-flask-poc-696f7b57c5-m57h7         1/1       Running            0          13d       10.236.0.16    gke-qus1-shared-1-prod-default-pool-b27de1c2-2h63

[stupifatcatslaptop poc (dev)]$ kubectl get services | grep my_project
my_project-flask-poc-lb                     LoadBalancer   {internal_ip_0}   {internal_ip_1}   8080:32133/TCP               33d

[stupifatcatslaptop poc (dev)]$ kubectl get ingress
NAME                       HOSTS                          ADDRESS          PORTS     AGE
my_project-flask-poc-ingress   my_project-flask-poc.mydomain.com   {external_ip}   80, 443   1d

这是我的入口Yaml文件

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my_project-flask-poc-ingress
spec:
  tls:
  - secretName: my_project-poc-tls
  rules:
  - host: my_project-flask-poc.mydomain.com
    http:
      paths:
      - backend:
          serviceName: my_project-flask-poc-lb
          servicePort: 8080

部署Yaml

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: my_project-flask-poc
  labels:
    app: my_project-flask-poc
spec:
  replicas: 2
  template:
    metadata:
      labels:
        app: my_project-flask-poc
    spec:
      containers:
        - name: my_project-flask-poc
          image: gcr.io/myprojectid/my_project-flask-poc
          ports:
            - containerPort: 8080
          volumeMounts:
          - name: secrets
            mountPath: "/etc/secrets"
            readOnly: true
      volumes:
      - name: secrets
        secret:
          secretName: my_project-secret-poc

lb service yaml

apiVersion: v1
kind: Service
metadata:
  name: my_project-flask-poc-lb
  annotations:
    cloud.google.com/load-balancer-type: "Internal"
spec:
  type: LoadBalancer
  loadBalancerIP: {someinternalip} 
  selector:
    app: my_project-flask-poc
  ports:
  - protocol: TCP
    port: 8080
    targetPort: 8080

Answer 1

对于GKE，only GCE ingress type manages your SSL certificates因此是唯一具有LB级SSL终止的选项。

对于Kubernetes的service type load balancer，您会发现网络负载均衡器已连接到集群。对于这种类型的负载均衡器，SSL termination must be handled in the backend。

这是因为SSL证书由第7层应用程序管理，并且网络负载平衡器在第4层（如pointed in a previously shared answer）工作。

是否可以将GKE K8入口点指向LB后端

1 个答案: