企业运维实战--k8s学习笔记6.Ingress加密、认证以及地址重写

---

一、Ingress 加密

生成加密密钥

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"

创建secrets对应密钥

kubectl create secret tls tls-secret --key tls.key --cert tls.crt
kubectl get secrets

编辑ingress文件
vim ingress.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-nginx
spec:
  tls:
  - hosts:
    - www1.westos.org
    secretName: tls-secret
  rules:
  - host: www1.westos.org
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-svc
          servicePort: 80

拉起容器，查看ingress信息

kubectl apply -f ingress.yaml
kubectl get ingress

443端口已开。

测试：curl www1.westos.org 返回3开头的http返回码，表示已经重定向

curl www1.westos.org -I 查看重定向地址

-k 访问加密域名

curl -k https://www1.westos.org 

二、Ingress 认证

安装生成认证整数的插件

yum install -y httpd-tools

生成证书，输入认证密码

htpasswd -c auth hyl

创建证书到k8s secret

kubectl create secret generic basic-auth --from-file=auth
kubectl get secrets

编辑文件导入证书

vim ingress-nginx/ingress.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-nginx
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - hyl'
spec:
  tls:
  - hosts:
    - www1.westos.org
    secretName: tls-secret
  rules:
  - host: www1.westos.org
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-svc
          servicePort: 80

拉起资源清单

kubectl apply -f ingress.yaml

查看证书信息是否已添加

kubectl describe ingress

访问测试：
firefox：www1.westos.org
需要认证登陆才可访问

三、Ingress 地址重写

根目录重定向到hostname.html

  annotations:
    nginx.ingress.kubernetes.io/app-root: /hostname.html

拉起容器，访问测试：


访问域名www1.westos.org直接跳转到指定目录的下

根目录重定向到westos，并添加地址重写

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-nginx
  annotations:
    nginx.ingress.kubernetes.io/app-root: /westos
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - hyl'
spec:
  tls:
  - hosts:
    - www1.westos.org
    secretName: tls-secret
  rules:
  - host: www1.westos.org
    http:
      paths:
      - path: /westos(/|$)(.*)
        backend:
          serviceName: nginx-svc
          servicePort: 80

拉起资源清单，查看信息

kubectl apply -f ingress-nginx/ingress.yaml
kubectl describe ingress

测试：

逐级代理测试

域名代理到/westos

curl -I www1.westos.org
curl -I www1.westos.org/westos

-k访问443加密端口，显示需要认证；-u 后跟认证用户和密码即可查看。

curl -I -k https://www1.westos.org/westos
 curl -I -k -u hyl:westos https://www1.westos.org/westos

curl  -k -u hyl:westos https://www1.westos.org/westos
curl  -k -u hyl:westos https://www1.westos.org/westos/hostname.html