[TOC]
可以直接在 Ingress 中配置 HTTPS 证书,使得你的网站支持 HTTPS 协议。
使用openssl创建自用证书或使用acme创建免费的证书.
创建secret
默认已经已经有了ssl证书,证书为youpenglai.crt
,秘钥youpenglai.key
$ kubectl create secret tls youpenglai-tls --cert=youpenglai.crt --key=youpenglai.key
secret/youpenglai-tls created
$ kubectl describe secrets youpenglai-tls
Name: youpenglai-tls
Namespace: default
Labels: <none>
Annotations: <none>
Type: kubernetes.io/tls
Data
====
tls.key: 1679 bytes
tls.crt: 3559 bytes
ingress配置
$ cat ingress-hello-world.yaml
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
annotations:
k8s.kuboard.cn/displayName: hello-world
k8s.kuboard.cn/workload: web-hello-world
creationTimestamp: '2020-06-24T08:17:14Z'
generation: 2
labels:
k8s.kuboard.cn/layer: web
k8s.kuboard.cn/name: web-hello-world
name: web-hello-world
namespace: default
spec:
rules:
- host: helloworld-k8s.youpenglai.com
http:
paths:
- backend:
serviceName: web-hello-world
servicePort: helloworld
path: /
tls:
- hosts:
- helloworld-k8s.youpenglai.com
secretName: youpenglai-tls
重新apply一下即可更新.
$ kubectl apply -f ingress-hello-world.yaml
再次访问 https://helloworld-k8s.youpenglai.com
hello-world镜像
goang源码如下
$ cat hello-world.go
package main
import (
"fmt"
"log"
"net/http"
"os"
)
func main() {
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
log.Printf("%s %s %s %s", r.Method, r.URL, r.Host, r.RemoteAddr)
version := os.Getenv("VERSION")
if version == "" {
version = "v1.0.1"
// version = "v2" 模拟发布. v3 v4 v5 v6
}
fmt.Fprintf(w, "Hello Kubernetes ! Hello World version: %s\n", version)
})
log.Fatal(http.ListenAndServe(":8000", nil))
}
构建dockerfile
$ cat Dockerfile
FROM golang:1.14.3 AS builder
ENV GO111MODULE=on
ENV GOPROXY=https://goproxy.io
WORKDIR /root
COPY hello-world.go .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /deploy hello-world.go
FROM alpine:3.7
RUN apk add tzdata ca-certificates && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
&& echo "Asia/Shanghai" > /etc/timezone \
&& apk del tzdata && rm -rf /var/cache/apk/*
COPY --from=builder /deploy /bin/deploy
ENTRYPOINT ["/bin/deploy"]
deployment
及service
的yaml配置
---
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: default
name: web-hello-world
annotations:
k8s.kuboard.cn/workload: web-hello-world
k8s.kuboard.cn/displayName: hello-world
deployment.kubernetes.io/revision: '3'
k8s.kuboard.cn/ingress: 'true'
k8s.kuboard.cn/service: ClusterIP
labels:
k8s.kuboard.cn/layer: web
k8s.kuboard.cn/name: web-hello-world
spec:
selector:
matchLabels:
k8s.kuboard.cn/layer: web
k8s.kuboard.cn/name: web-hello-world
revisionHistoryLimit: 10
template:
metadata:
labels:
k8s.kuboard.cn/layer: web
k8s.kuboard.cn/name: web-hello-world
spec:
securityContext:
seLinuxOptions: {}
imagePullSecrets: []
restartPolicy: Always
initContainers: []
containers:
- image: louisehong/hello-world
imagePullPolicy: Always
name: hello-world
volumeMounts: []
resources:
limits:
requests:
env: []
lifecycle: {}
ports:
- name: tcp
containerPort: 8000
protocol: TCP
volumes: []
dnsPolicy: ClusterFirst
dnsConfig: {}
terminationGracePeriodSeconds: 30
progressDeadlineSeconds: 600
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 25%
maxSurge: 25%
replicas: 1
---
apiVersion: v1
kind: Service
metadata:
namespace: default
name: web-hello-world
annotations:
k8s.kuboard.cn/workload: web-hello-world
k8s.kuboard.cn/displayName: hello-world
labels:
k8s.kuboard.cn/layer: web
k8s.kuboard.cn/name: web-hello-world
spec:
selector:
k8s.kuboard.cn/layer: web
k8s.kuboard.cn/name: web-hello-world
type: ClusterIP
ports:
- port: 8000
targetPort: 8000
protocol: TCP
name: helloworld
nodePort: 0
如果使用kuboard
进行在Ingress中部署https证书。 建议参考这篇文章kuborad官网