如何使用 Amazon EKS 上的 Kubernetes 入口控制器将 HTTP 重定向到 HTTPS

Question

我已经为我的应用程序配置了 amazon 证书管理器、ALB 入口控制器和域名。我可以通过端口 80 和端口 443 访问我的应用程序(所有证书都可以正常工作(。但是，我想将所有来自HTTP的流量自动重定向到HTTPS，以便将自己输入域名的人重定向到HTTPS。我已经关注了这个页面和这个页面但我无法让它工作

这是我的入口.yaml文件：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: metabase
namespace: bigdata
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:***:certificate/***
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
alb.ingress.kubernetes.io/scheme: internet-facing
labels:
app: metabase
spec:
rules:
- http:
paths:
- path: /*
backend:
serviceName: ssl-redirect
servicePort: use-annotation
- path: /*
backend:
serviceName: metabase
servicePort: 3000

这是我的服务：

apiVersion: v1
kind: Service
metadata:
name: metabase
annotations:
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:****:certificate/****
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
namespace: bigdata
labels:
app: metabase
spec:
ports:
- name: https
protocol: TCP
port: 443
targetPort: http-server
- name: http
protocol: TCP
port: 80
targetPort: http-server
selector:
app: metabase
type: LoadBalancer

广告 这是我的部署：

apiVersion: apps/v1
kind: Deployment
metadata:
name: metabase-deployment
namespace: bigdata
labels:
app: metabase
spec:
replicas: 2
selector:
matchLabels:
app: metabase
template:
metadata:
labels:
app: metabase
spec:
containers:
- name: metabase
image: metabase/metabase
ports:
- containerPort: 3000
name: http-server
resources:
limits:
cpu: "1"
memory: "2Gi"

感谢您的支持！ ：-(

Answer 1

我能够让它工作！！ 基本上我修改了ingress.yaml和service.yaml文件

ingress.yaml 看起来像这样：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: metabase
namespace: bigdata
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-2:***:certificate/****
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/group: metabase # name of my app
labels:
app: metabase
spec:
rules:
- http:
paths:
- path: /*
backend:
serviceName: ssl-redirect
servicePort: use-annotation
- path: /*
backend:
serviceName: metabase
servicePort: 443

我的服务如下所示：

apiVersion: v1
kind: Service
metadata:
name: metabase
annotations:
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-east-2:***:certificate/***
namespace: bigdata
labels:
app: metabase
spec:
ports:
- name: https
protocol: TCP
port: 443
targetPort: http-server
- name: http
protocol: TCP
port: 80
targetPort: http-server
selector:
app: metabase
type: LoadBalancer

Answer 2

您需要使用nginx.ingress.kubernetes.io/force-ssl-redirect: "true"注释：

在集群外部使用 SSL 卸载(例如 AWS ELB(时，它可能是 即使没有 TLS 也可用于强制重定向到 HTTPS 证书可用。这可以通过使用nginx.ingress.kubernetes.io/force-ssl-redirect: "true"批注 特定资源。

Answer 3

以防万一您正在寻找正确的新语法(其余的都是一样的(

- path: /
pathType: Prefix
backend:
service:
name: ssl-redirect
port:
name: use-annotation

Answer 4

我花了相当长的时间尝试完成这项工作，最终成功了。可能有人会发现它很有用。我将尝试逐步描述使用 HTTP 到 HTTPs 重定向设置 ALB 的方法。

1. 检查您的 ALB 控制器是否已启动并正在运行：

kubectl get deployment -n kube-system aws-load-balancer-controller

打印输出应类似于以下内容：

NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
aws-load-balancer-controller   1/1     1            1           18h

如果控制器不工作，则不会创建负载均衡器。

2. 检查您的 yaml 文件是否正常。下面我提供了一个简单的Yaml文件，该文件适用于我的情况。 关于此文件的一些评论：
   a( 请使用您的 SSL/TLS 证书 ARN(我使用了 XXXXXXX(.
   b( 请使用您的图像(我使用了 YYYYYYYYYY(。我的容器映像存储在 ECR(弹性容器注册表(中.
   c( 请注意，根据注释规范创建了标记为带有 servicePort：
   use-annotations 的 ssl-redirects 的奇怪服务.
   https://kubernetes-sigs.github.io/aws-load-balancer-controller/guide/ingress/annotations/

3. 运行后：kubectl apply -f service.yaml请检查两件事：
   a(kubectl -n default describe ingress
   此命令应显示对帐成功：打印输出的末尾应显示：
   Normal SuccessfullyReconciled 11s (x3 over 18m) ingress Successfully reconciled
   在同一打印输出(打印输出顶部(中不要注意日志条目：
   /* ssl-redirect:use-annotation (<error: endpoints "ssl-redirect" not found>)
   b(aws elbv2 describe-load-balancers --query "LoadBalancers[?contains(LoadBalancerArn,'default-nginx')].{Arn: LoadBalancerArn}" --output text | xargs -I {} aws elbv2 describe-listeners --load-balancer-arn {}
   此命令应向您显示已创建新的 ALB 并创建了两个侦听器。不要注意 HTTP 侦听器所做的 似乎没有正确的重定向配置。

<小时 />--

亚姆 --

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
namespace: default
name: nginx-ingress
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/tags: createdBy=aws-controller
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-central-1:XXXXXXXXXXXX:certificate/XXXXXXXXXXXXXXXXXXXXXXXXXX
labels:
app: nginx-ingress
spec:
rules:
- http:
paths:
- path: /*
backend:
serviceName: ssl-redirect
servicePort: use-annotation
- path: /*
backend:
serviceName: nginx-service
servicePort: 80
---
apiVersion: v1
kind: Service
metadata:
namespace: default
name: nginx-service
spec:
selector:
app: nginx
ports:
- name: http
protocol: TCP
port: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
namespace: default
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: YYYYYYYYYYYY.dkr.ecr.eu-central-1.amazonaws.com/webfe:latest
ports:
- containerPort: 80

Answer 5

AWS 负载均衡器控制器 v2.4 文档

示例入口清单

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
namespace: default
name: ingress
annotations:
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:xxxx:certificate/xxxxxx
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/ssl-redirect: '443'
spec:
ingressClassName: alb
rules:
- http:
paths:
- path: /users/*
pathType: ImplementationSpecific
backend:
service:
name: user-service
port:
number: 80
- path: /*
pathType: ImplementationSpecific
backend:
service:
name: default-service
port:
number: 80

Answer 6

如果有人正在寻找更新的语法：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
alb.ingress.kubernetes.io/actions.ssl-redirect:
'{"Type": "redirect", "RedirectConfig":
{ "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
alb.ingress.kubernetes.io/certificate-arn: <cert arn>
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: instance
external-dns.alpha.kubernetes.io/hostname: <your domain>
kubernetes.io/ingress.class: alb
spec:
rules:
- http:
paths:
- backend:
service:
name: ssl-redirect
port:
name: use-annotation
path: /
pathType: Prefix
- backend:
service:
name: nginx-service
port:
number: 80
path: /
pathType: Prefix
---
apiVersion: v1
kind: Service
metadata:
namespace: default
name: nginx-service
spec:
selector:
app: nginx
type: NodePort
ports:
- name: http
protocol: TCP
port: 80
targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
namespace: default
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: YYYYYYYYYYYY.dkr.ecr.eu-central-1.amazonaws.com/webfe:latest
ports:
- containerPort: 80