在 k8s 中自動為域名配置 https

shanyue發表於2019-10-30

隨著 web 的發展,https 對於現代網站來說是必不可少的。如果你想得到一個免費的證書,那麼 Let's Encrypt 是一個不錯的選擇,它的主要目的是推進網站 https 的程式。

感謝 Let's Encrypt 的免費證書

藉助 helm,在 k8s cluster 中為域名配置 https 將會變得非常簡單,部署資源成功後在 k8s 中為 Ingress 配置證書將會變得非常容易: 只需要在 Ingress 中多新增兩行程式碼

本篇文章將介紹如何只需要三步為你的域名配置上 https

在本篇文章之前,假設此時你已經能夠配置 Ingress 併成功訪問到你的域名,如果沒有,你可以參考本系列文章的以上幾篇

如果對你能夠有所幫助,可以幫我在 shfshanyue/op-note 上點個 star。

01 使用 helm 部署 cert-manager

我們選擇這個 helm chart jetstack/cert-manager 部署 https。目前,在 github 上,該倉庫 jetstack/cert-manager 已擁有 4.4K Star。

如果想使用 let's encrypt 自動為 Ingress 配置 https。在部署時需要為 helm chart 指定以下引數。

ingressShim.defaultIssuerName=letsencrypt-prod
ingressShim.defaultIssuerKind=Issuer
複製程式碼

這裡有關於 Issuers的文件

部署過程如下,這裡使用了 helm v3 進行部署

# 部署前需要一些 crd
$ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml

# 為 helm 新增 repo
$ helm repo add jetstack https://charts.jetstack.io

# 使用 helm v3 部署,指定引數
$ helm install cert-manager jetstack/cert-manager --set "ingressShim.defaultIssuerName=letsencrypt-prod,ingressShim.defaultIssuerKind=Issuer"
NAME: cert-manager
LAST DEPLOYED: 2019-10-26 21:27:56.488948248 +0800 CST m=+2.081581159
NAMESPACE: default
STATUS: deployed
NOTES:
cert-manager has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://docs.cert-manager.io/en/latest/reference/issuers.html

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the `ingress-shim`
documentation:

https://docs.cert-manager.io/en/latest/reference/ingress-shim.html
複製程式碼

校驗狀態,檢視剛才部署 crdpod 的狀態,校驗是否成功

$ kubectl get crd
NAME                                  CREATED AT
certificaterequests.cert-manager.io   2019-10-26T01:16:21Z
certificates.cert-manager.io          2019-10-26T01:16:21Z
challenges.acme.cert-manager.io       2019-10-26T01:16:21Z
clusterissuers.cert-manager.io        2019-10-26T01:16:24Z
issuers.cert-manager.io               2019-10-26T01:16:24Z
orders.acme.cert-manager.io           2019-10-26T01:16:21Z

$ kubectl get pods
NAME                                             READY   STATUS    RESTARTS   AGE
cert-manager-5d8fd69d88-s7dtg                    1/1     Running   0          57s
cert-manager-cainjector-755bbf9c6b-ctkdb         1/1     Running   0          57s
cert-manager-webhook-76954fcbcd-h4hrx            1/1     Running   0          57s
複製程式碼

02 配置 ACME Issuers

指定 kind 為 Issuer,並修改以下郵箱為自己的郵箱,Issuer 資源配置如下

apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: example@shanyue.tech
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx
複製程式碼

使用 kubectl apply -f 部署生效

$ kubectl apply -f letsencrypt-issue.yaml
複製程式碼

03 為 Ingress 新增 annotation

在部署 Ingress 時指定 annotations 就可以很方便地配置證書

annotations:
  kubernetes.io/ingress.class: "nginx"
  cert-manager.io/issuer: "letsencrypt-prod"
複製程式碼

關於 Ingress 的完整配置如下,你也可以在我的github上檢視 DeploymentServiceIngress 完整的配置: shfshanyue/learn-k8s:/conf/nginx.yaml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: nginx-service-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - nginx.xiange.tech
    secretName: nginx-tls
  rules:
  - host: nginx.xiange.tech
    http:
      paths:
      - backend:
          serviceName: nginx-service
          servicePort: 80
        path: /
複製程式碼

校驗 certificate 狀態,Ready 為 True

由於映象在 quay.io 中,pull image 的時間過慢,有可能需要十分鐘

$ kubectl get certificate
NAME        READY   SECRET      AGE
nginx-tls   True    nginx-tls   44h

$ kubectl describe certificate nginx-tls
Name:         nginx-tls
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1alpha2
Kind:         Certificate
Metadata:
  Creation Timestamp:  2019-10-26T13:30:06Z
  Generation:          1
  Owner References:
    API Version:           extensions/v1beta1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  nginx-service-ingress
    UID:                   c9abc7b7-45da-431b-b732-e535a809dfdd
  Resource Version:        2822740
  Self Link:               /apis/cert-manager.io/v1alpha2/namespaces/default/certificates/nginx-tls
  UID:                     ccb3aa54-e967-4813-acbe-41d9801f29a6
Spec:
  Dns Names:
    nginx.xiange.tech
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       Issuer
    Name:       letsencrypt-prod
  Secret Name:  nginx-tls
Status:
  Conditions:
    Last Transition Time:  2019-10-26T13:43:02Z
    Message:               Certificate is up to date and has not expired
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2020-01-24T12:43:01Z
Events:                    <none>
複製程式碼

訪問 Ingress 中配置的域名,Chrome 瀏覽器中左上角的小鎖提示 https 配置成功

nginx 配置成功
)

參考

相關文章