Question

美好的一天，我是kubernetes的新人，请尝试设置我的第一个环境。我要遵循以下方案：

我的组织拥有公共IP（x.x.x.x）
此IP已路由到带有Win Server + IIS的专用LAN（即192.168.0.10）中的服务器。在IIS上，我有URL重写模块，它充当反向代理
我有kubernetes集群
我已经将一些服务部署到了k8s
我想使用SSL来从Internet上访问此服务，这是从我们进行加密获得的

我已经设置了k8s集群，部署了traefik（v1.7）入口，并对其进行配置以进行加密（设置http->https重定向，设置acme挑战）。效果很好-我可以从LAN或WAN观察到它，并且没有关于证书的警告-我看到绿色锁定。现在，我部署服务（在我的情况下，这是Graylog）。再次-我可以从LAN和WAN观察到它，但是在这种情况下，我看到有关证书的警告（它是由TRAEFIK_DEFAULT_CERT发出的）。看到此消息后，我尝试搜索更多信息，并发现我需要证书管理器。我部署了cert-manager，创建了一个加密的颁发者（具有ClusterIssuer角色），但是随后我尝试颁发证书时遇到以下错误（在挑战说明中找到）：

Waiting for http-01 challenge propagation: wrong status code '404', expected '200'

我的traefik配置图：

apiVersion: v1
kind: ConfigMap
metadata:
  name: traefik-conf
  namespace: kube-system
data:
  traefik.toml: |
    # traefik.toml
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      [entryPoints.http.redirect]
        regex = "^http://(.*)"
        replacement = "https://$1"
      [entryPoints.https]
      address = ":443"
        [entryPoints.https.tls]
    [acme]
      email = "mymail@example.xyz"
      storage = "/acme/acme.json"
      entryPoint = "https"
      onHostRule = true
        [acme.httpChallenge]
        entryPoint = "http"
    [[acme.domains]]
      main = "my-public-domain.com"

我也尝试在其中使用通配符：

apiVersion: v1
kind: ConfigMap
metadata:
  name: traefik-conf
  namespace: kube-system
data:
  traefik.toml: |
    # traefik.toml
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      [entryPoints.http.redirect]
        regex = "^http://(.*)"
        replacement = "https://$1"
      [entryPoints.https]
      address = ":443"
        [entryPoints.https.tls]
    [acme]
      email = "mymail@example.xyz"
      storage = "/acme/acme.json"
      entryPoint = "https"
      onHostRule = true
        [acme.httpChallenge]
        entryPoint = "http"
    [[acme.domains]]
      main = "*.my-public-domain.com"
      sans = ["my-public-domain.com"]

我的集群发行人：

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dev
spec:
  acme:
    email: mymail@example.xyz
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      # Secret resource used to store the account's private key.
      name: example-issuer-account-key
    # Add a single challenge solver, HTTP01 using nginx
    solvers:
    - http01:
        ingress:
          class: traefik

我的测试证书：

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: example-com
  namespace: default
spec:
  secretName: example-com-tls
  renewBefore: 360h # 15d
  commonName: logger.my-public-domain.com
  dnsNames:
  - logger.my-public-domain.com
  issuerRef:
    name: letsencrypt-dev
    kind: ClusterIssuer

我有通配域的DNS条目，可以ping通

我的证书停留在状态OrderCreated：

Status:
  Conditions:
    Last Transition Time:  2019-10-08T09:40:30Z
    Message:               Certificate issuance in progress. Temporary certificate issued.
    Reason:                TemporaryCertificate
    Status:                False
    Type:                  Ready
Events:
  Type    Reason        Age   From          Message
  ----    ------        ----  ----          -------
  Normal  OrderCreated  47m   cert-manager  Created Order resource "example-com-3213698372"

订单停留在状态Created：

Status:
  Challenges:
    Authz URL:  <url>
    Dns Name:   logger.my-public-domain.com
    Issuer Ref:
      Kind:  ClusterIssuer
      Name:  letsencrypt-dev
    Key:     <key>
    Solver:
      http01:
        Ingress:
          Class:  traefik
    Token:        <token>
    Type:         http-01
    URL:          <url>
    Wildcard:     false
  Finalize URL:   <url>
  State:          pending
  URL:            <url>
Events:
  Type    Reason   Age   From          Message
  ----    ------   ----  ----          -------
  Normal  Created  48m   cert-manager  Created Challenge resource "example-com-3213698372-0" for domain "logger.my-public-domain.com"

最后，通过挑战：

Spec:
  Authz URL:  <url>
  Dns Name:   logger.my-public-domain.com
  Issuer Ref:
    Kind:  ClusterIssuer
    Name:  letsencrypt-dev
  Key:     <key>
  Solver:
    http01:
      Ingress:
        Class:  traefik
  Token:        <token>
  Type:         http-01
  URL:          <url>
  Wildcard:     false
Status:
  Presented:   true
  Processing:  true
  Reason:      Waiting for http-01 challenge propagation: wrong status code '404', expected '200'
  State:       pending
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Started    55m   cert-manager  Challenge scheduled for processing
  Normal  Presented  55m   cert-manager  Presented challenge using http-01 challenge mechanism

我看到有404响应，但我不明白它的原因。在我的IIS上，我具有以下重写规则：让我们加密绕过-与.well-known/*匹配的所有url都重写为kubernetes主机。 http到https-所有不匹配的url都将加密重定向到https 子域重定向-所有子域请求都被重写为kubernetes。

在我的局域网中，我拥有自己的DNS服务器，my-public-domain.com中的所有域都已映射到内部地址，因此我可以将公共主机名logger.my-public-domain.com (x.x.x.x)重定向到内部logger.my-public-domain.com (192.168.0.y)。

在挑战赛中，我在traefik仪表板中看到了新的后端和前端。

也许我误解了它的工作方式，但是我希望cert-manager颁发带有我们加密的证书，并且我可以观察我的服务。

Answer 1

在您的 traefik.toml ConfigMap 中，您正在重定向到 HTTPS：

[entryPoints.http.redirect]
regex = "^http://(.*)"
replacement = "https://$1"

使用 kubectl edit configmap -n kube-system traefik 删除该替换，保存更改然后重新启动 Traefik pod。那你应该很高兴去。使用您的 Ingress 来管理带有注释的重定向，而不是将它们放在 Traefik 配置中。

让我们为kubernetes服务加密证书

1 个答案: