Traefik Kubernetes (k3s)：使用https公开非Kubernetes服务

Question

我有两组与这个问题有关的问题。

• k3s-0 10.12.9.113
• k3s-2 10.12.9.115

这两个集群都在运行traefik 2.4.8。

我的内部域k3s.lan指向k3s-0。(我的DNS服务器是pihole)

在k3s-0中，我有以下功能非常好地工作。

---      
kind: Service
apiVersion: v1
metadata:
  name: k2-service
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
    name: http
---
kind: Endpoints
apiVersion: v1
metadata:
  name: k2-service
subsets:
  - addresses:
    - ip: 10.12.9.115
    ports:
    - protocol: TCP
      port: 80
      name: http
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx2
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`k2.k3s.lan`)
      kind: Rule
      services:
        - name: k2-service
          port: 80

当我输入http://k2.k3s.lan时，我看到了我的nginx登陆页面。

现在我想使用https而不是http访问同一个登陆页面。我试过以下几种方法，但不起作用。

kind: Service
apiVersion: v1
metadata:
  name: k2-service-sec
spec:
  ports:
  - protocol: TCP
    port: 443
    targetPort: 80
    name: https
---
kind: Endpoints
apiVersion: v1
metadata:
  name: k2-service-sec
subsets:
  - addresses:
    - ip: 10.12.9.115
    ports:
    - protocol: TCP
      port: 80
      name: https
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx2-sec
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`k2sec.k3s.lan`)
      kind: Rule
      services:
        - name: k2-service-sec
          port: 443                

当我输入https://k2sec.k3s.lan时，我会得到一个Internal Server Error。

作为参考，以下是k3s-2中ingressroute/service的设置。我在这里所做的唯一改变就是在路由中托管k2sec.k3s.lan。

apiVersion: v1
kind: Service
metadata:
  labels:
    run: nginx
  name: nginx
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    run: nginx
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`k2.k3s.lan`,`k2sec.k3s.lan`)
      kind: Rule
      services:
        - name: nginx
          port: 80        

Answer 1

我想我解决了我自己的问题，多亏了这

至少现在起作用了。作为一个真正的初学者，这一切都让人觉得很神奇。

以下是k3s-0中更新的清单。

主要变化：

• 添加了一个middleware，以将http重定向到https
• 将middleware引用到web IngressRoute
• 添加了一个ServersTransport以将insecureSkipVerify标志设置为true
• 引用了ServersTransport中的websecure IngressRoute
• 将scheme添加到https到websecure IngressRoute中。没有它我就没试过。可能没必要

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: redirectscheme
spec:
  redirectScheme:
    scheme: https
    permanent: true   
---
kind: Service
apiVersion: v1
metadata:
  name: k2-service
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
    name: http
---
kind: Endpoints
apiVersion: v1
metadata:
  name: k2-service
subsets:
  - addresses:
    - ip: 10.12.9.115
    ports:
    - protocol: TCP
      port: 80
      name: http
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: k2-service
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`k2.k3s.lan`)
      kind: Rule
      services:
        - name: k2-service
          port: 80
      middlewares:
        - name: redirectscheme      
---
kind: Service
apiVersion: v1
metadata:
  name: k2-service-sec
spec:
  ports:
  - protocol: TCP
    port: 443
    targetPort: 443
    name: https
---
kind: Endpoints
apiVersion: v1
metadata:
  name: k2-service-sec
subsets:
  - addresses:
    - ip: 10.12.9.115
    ports:
    - protocol: TCP
      port: 443
      name: https
---
apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
  name: traefik-servers-transport
spec:
  serverName: "test"
  insecureSkipVerify: true
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: k2-service-sec
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`k2.k3s.lan`)
      kind: Rule
      services:
        - name: k2-service-sec
          port: 443                
          scheme: https
          serversTransport: traefik-servers-transport

我还在k3s-2中更改了IngressRoute。

• 添加了一个middleware，以将http重定向到https
• 将middleware引用到web IngressRoute
• 创建一个新的websecure IngressRoute

下面是：

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
 name: redirectscheme
spec:
 redirectScheme:
   scheme: https
   permanent: true  
--- 
apiVersion: v1
kind: Service
metadata:
 labels:
   run: nginx
 name: nginx
spec:
 ports:
 - port: 80
   protocol: TCP
   targetPort: 80
 selector:
   run: nginx
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
 name: nginx
spec:
 entryPoints:
   - web
 routes:
   - match: Host(`k2.k3s.lan`)
     kind: Rule
     services:
       - name: nginx
         port: 80
     middlewares:
       - name: redirectscheme
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
 name: nginx-sec
spec:
 entryPoints:
   - websecure
 routes:
   - match: Host(`k2.k3s.lan`)
     kind: Rule
     services:
       - name: nginx
         port: 80