如何在nginx的443端口启用grpc，而不中断kubernetes的80端口的http？

Question

我在Kubernetes1.19上使用Nginx (同时尝试docker桌面和GKE)，并试图公开gRPC服务。我已经使用以下命令安装了Nginx，并确认我可以在端口80上公开REST服务，在端口443上通过正确的配置公开gRPC服务。

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.41.2/deploy/static/provider/cloud/deploy.yaml

但是，在创建gRPC入口之后，我不能再访问端口80上的标准REST服务。当nginx试图将这个HTTP/1流量推送到我的gRPC服务时，我遇到了一个502。如果我执行kubectl get ingress，我可以看到入口在端口80和443上可用，而我只想要443。这里是入口(很抱歉有这么多注释--试试看)。

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    allowed-values: CN=client
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
    nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "false"
    nginx.ingress.kubernetes.io/auth-tls-secret: default/localhost
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
    nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
    nginx.ingress.kubernetes.io/grpc-backend: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 64ms
  name: tfserving-ingress
  namespace: default
spec:
  rules:
  - host: localhost
    http:
      paths:
      - backend:
          serviceName: tfserving-service
          servicePort: 8500
  tls:
  - secretName: localhost
    hosts:
      - localhost

如何使用TLS为该域创建入口，而不会将http流量重定向到我的gRPC服务？

Answer 1

您可以尝试在同一主机上添加多个入口，一个使用tls，另一个不使用tls。

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    allowed-values: CN=client
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
    nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "false"
    nginx.ingress.kubernetes.io/auth-tls-secret: default/localhost
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
    nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
    nginx.ingress.kubernetes.io/grpc-backend: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 64ms
  name: tfserving-ingress
  namespace: default
spec:
  rules:
  - host: localhost
    http:
      paths:
      - backend:
          serviceName: gRPC-service
          servicePort: 8500
  tls:
  - secretName: localhost
    hosts:
      - localhost

---

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    allowed-values: CN=client
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/proxy-body-size: 64ms
  name: rest-http-ingress
  namespace: default
spec:
  rules:
  - host: localhost
    http:
      paths:
      - backend:
          serviceName: http-rest-service
          servicePort: 8080