如何使用 Traefik 和 Kubernetes 创建到正在侦听 Https 的服务的 HTTPS 路由

Question

我是 kubernetes 和 Traefik 的新手。

我跟进那个教程： https://docs.traefik.io/user-guides/crd-acme/

我将其更改为在 Scala 中使用我的服务，它位于 https 和 9463 端口下。我正在尝试使用 kubernetes 和 traefik 部署我的 Scala 服务。

当我直接转发到服务时:

kubectl port-forward service/core-service 8001:9463

然后我执行 curl -k 'https://localhost:8001/health' :

我得到 "{Message:Ok}"

但是当我执行到 traefik 的端口转发时

kubectl port-forward service/traefik 9463:9463 -n default

并执行 curl -k 'https://ejemplo.com:9463/tls/health' 我得到一个 "Internal server error"

我想问题是我的 "core-service" 正在侦听 HTTPS 协议，这就是我添加的 scheme:https。我试图通过文档找到解决方案，但它令人困惑。

这些是我的 yml 文件：

Services.yaml

apiVersion: v1  
kind: Service  
metadata:  
  name: traefik

spec:  
  ports:
    - protocol: TCP
      name: admin
      port: 8080
    - protocol: TCP
      name: websecure
      port: 9463
  selector:
    app: traefik

---
apiVersion: v1  
kind: Service  
metadata:  
  name: core-service

spec:  
  ports:
    - protocol: TCP
      name: websecure
      port: 9463
  selector:
    app: core-service

Deployment.yaml

apiVersion: v1  
kind: ServiceAccount  
metadata:  
  namespace: default
  name: traefik-ingress-controller

---
kind: Deployment  
apiVersion: apps/v1  
metadata:  
  namespace: default
  name: traefik
  labels:
    app: traefik

spec:  
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v2.0
          args:
            - --api.insecure
            - --accesslog
            - --entrypoints.websecure.Address=:9463
            - --providers.kubernetescrd
            - --certificatesresolvers.default.acme.tlschallenge
            - --certificatesresolvers.default.acme.email=foo@you.com
            - --certificatesresolvers.default.acme.storage=acme.json
            # Please note that this is the staging Let's Encrypt server.
            # Once you get things working, you should remove that whole line altogether.
            - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
          ports:
            - name: websecure
              containerPort: 9463
            - name: admin
              containerPort: 8080

---
kind: Deployment  
apiVersion: apps/v1  
metadata:  
  namespace: default
  name: core-service
  labels:
    app: core-service

spec:  
  replicas: 1
  selector:
    matchLabels:
      app: core-service
  template:
    metadata:
      labels:
        app: core-service
    spec:
      containers:
        - name: core-service
          image: core-service:0.1.4-SNAPSHOT
          ports:
            - name: websecure
              containerPort: 9463
          livenessProbe:
            httpGet:
              port: 9463
              scheme: HTTPS
              path: /health
            initialDelaySeconds: 10

IngressRoute2.yaml

apiVersion: traefik.containo.us/v1alpha1  
kind: IngressRoute  
metadata:  
  name: ingressroutetls
  namespace: default
spec:  
  entryPoints:
    - websecure
  routes:
  - match: Host(`ejemplo.com`) && PathPrefix(`/tls`)
    kind: Rule
    services:
    - name: core-service
      port: 9463
      scheme: https
  tls:
    certResolver: default

Answer 1

来自docs

A TLS router will terminate the TLS connection by default. However, the passthrough option can be specified to set whether the requests should be forwarded "as is", keeping all data encrypted.

在您的情况下，需要启用 SSL 直通，因为 pod 需要 HTTPS 流量。

apiVersion: traefik.containo.us/v1alpha1  
kind: IngressRoute  
metadata:  
  name: ingressroutetls
  namespace: default
spec:  
  entryPoints:
    - websecure
  routes:
  - match: Host(`ejemplo.com`) && PathPrefix(`/tls`)
    kind: Rule
    services:
    - name: core-service
      port: 9463
      scheme: https
  tls:
    certResolver: default
    passthrough: true

如何使用 Traefik 和 Kubernetes 创建到正在侦听 Https 的服务的 HTTPS 路由

How to create a HTTPS route to a Service that is listening on Https with Traefik, and Kubernetes

kubernetes

traefik