Openshift重新加密TLS终止路由无效。申请不可用

Question

有人能帮我开一下班次吗？

我已经建立了一条用重加密TLS终止的路由。对服务端点(https://openshift-pmi-dev-reencrypt-default.apps.vapidly.os.fyre.ibm.com)的调用导致：

​

​

向URL发出的请求似乎没有到达豆荚，它正在返回503“应用程序不可用”错误。自由应用程序在端口8543上运行良好，应用程序日志看起来很干净。

我无法确定此错误的根本原因，在外部https URL上发出的请求不会到达应用程序荚。对于如何使端点url工作，有什么建议吗？

谢谢你提前帮忙！

Openshift版本4.2自由版19

Route.yaml

kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: openshift-pmi-dev-reencrypt
  namespace: default
  selfLink: >-
    /apis/route.openshift.io/v1/namespaces/default/routes/openshift-pmi-dev-reencrypt
  uid: 5de29e0d-16b6-11ea-a1ab-0a580afe00ab
  resourceVersion: '7059134'
  creationTimestamp: '2019-12-04T16:51:50Z'
  labels:
    app: apm-pm-api
  annotations:
    openshift.io/host.generated: 'true'
spec:
  host: openshift-pmi-dev-reencrypt-default.apps.vapidly.os.fyre.ibm.com
  subdomain: ''
  path: /ibm/pmi/service
  to:
    kind: Service
    name: apm-pm-api-service
    weight: 100
  port:
    targetPort: https
  tls:
    termination: reencrypt
    insecureEdgeTerminationPolicy: None
  wildcardPolicy: None
status:
  ingress:
    - host: openshift-pmi-dev-reencrypt-default.apps.vapidly.os.fyre.ibm.com
      routerName: default
      conditions:
        - type: Admitted
          status: 'True'
          lastTransitionTime: '2019-12-04T16:51:50Z'
      wildcardPolicy: None
      routerCanonicalHostname: apps.vapidly.os.fyre.ibm.com

Service.yaml

kind: Service
apiVersion: v1
metadata:
  name: apm-pm-api-service
  namespace: default
  selfLink: /api/v1/namespaces/default/services/apm-pm-api-service
  uid: 989040ed-166c-11ea-b792-00000a1003d7
  resourceVersion: '7062857'
  creationTimestamp: '2019-12-04T08:03:46Z'
  labels:
    app: apm-pm-api
spec:
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8543
  selector:
    app: apm-pm-api
  clusterIP: 172.30.122.233
  type: ClusterIP
  sessionAffinity: None
status:
  loadBalancer: {}

Answer 1

查看快照，浏览器声明连接“不安全”。这是试图通过HTTP访问应用程序，而不是HTTPS吗？

拥有spec.tls.insecureEdgeTerminationPolicy: None意味着不安全方案(HTTP)上的通信被禁用--参见这位医生中的“重新加密终止”部分。

我建议也使用这些文档来确定您是否需要配置spec.tls.destinationCACertificate。