在 kubernetes 中自动为域名配置 https#

随着 web 的发展，https 对于现代网站来说是必不可少的。如果你想得到一个免费的证书，那么 Let’s Encrypt 是一个不错的选择，它的主要目的是推进网站 https 的进程。

感谢 Let’s Encrypt 的免费证书

借助 helm，在 k8s cluster 中为域名配置 https 将会变得非常简单，部署资源成功后在 k8s 中为 Ingress 配置证书将会变得非常容易: 只需要在 Ingress 中多添加两行代码

本篇文章将介绍如何只需要三步为你的域名配置上 https

在本篇文章之前，假设此时你已经能够配置 Ingress 并成功访问到你的域名，如果没有，你可以参考本系列文章的以上几篇

01 使用 helm 部署 cert-manager#

我们选择这个 helm chart jetstack/cert-manager 部署 https。目前，在 github 上，该仓库 jetstack/cert-manager 已拥有 4.4K Star。

如果想使用 let's encrypt 自动为 Ingress 配置 https。在部署时需要为 helm chart 指定以下参数。

1
ingressShim.defaultIssuerName=letsencrypt-prod
2
ingressShim.defaultIssuerKind=Issuer

这里有关于 Issuers的文档

部署过程如下，这里使用了 helm v3 进行部署

1
# 部署前需要一些 crd
2
$ kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml
3

4
# 为 helm 添加 repo
5
$ helm repo add jetstack https://charts.jetstack.io
6

7
# 使用 helm v3 部署，指定参数
8
$ helm install cert-manager jetstack/cert-manager --set "ingressShim.defaultIssuerName=letsencrypt-prod,ingressShim.defaultIssuerKind=Issuer"
9
NAME: cert-manager
10
LAST DEPLOYED: 2019-10-26 21:27:56.488948248 +0800 CST m=+2.081581159
11
NAMESPACE: default
12
STATUS: deployed
13
NOTES:
14
cert-manager has been deployed successfully!
15

16
In order to begin issuing certificates, you will need to set up a ClusterIssuer
17
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
18

19
More information on the different types of issuers and how to configure them
20
can be found in our documentation:
21

22
https://docs.cert-manager.io/en/latest/reference/issuers.html
23

24
For information on how to configure cert-manager to automatically provision
25
Certificates for Ingress resources, take a look at the `ingress-shim`
26
documentation:
27

28
https://docs.cert-manager.io/en/latest/reference/ingress-shim.html

校验状态，查看刚才部署 crd 与 pod 的状态，校验是否成功

1
$ kubectl get crd
2
NAME                                  CREATED AT
3
certificaterequests.cert-manager.io   2019-10-26T01:16:21Z
4
certificates.cert-manager.io          2019-10-26T01:16:21Z
5
challenges.acme.cert-manager.io       2019-10-26T01:16:21Z
6
clusterissuers.cert-manager.io        2019-10-26T01:16:24Z
7
issuers.cert-manager.io               2019-10-26T01:16:24Z
8
orders.acme.cert-manager.io           2019-10-26T01:16:21Z
9

10
$ kubectl get pods
11
NAME                                             READY   STATUS    RESTARTS   AGE
12
cert-manager-5d8fd69d88-s7dtg                    1/1     Running   0          57s
13
cert-manager-cainjector-755bbf9c6b-ctkdb         1/1     Running   0          57s
14
cert-manager-webhook-76954fcbcd-h4hrx            1/1     Running   0          57s

02 配置 ACME Issuers#

指定 kind 为 Issuer，并修改以下邮箱为自己的邮箱，Issuer 资源配置如下

1
apiVersion: cert-manager.io/v1alpha2
2
kind: Issuer
3
metadata:
4
  name: letsencrypt-prod
5
spec:
6
  acme:
7
    # The ACME server URL
8
    server: https://acme-v02.api.letsencrypt.org/directory
9
    # Email address used for ACME registration
10
    email: example@blog.zhequtao.com
11
    # Name of a secret used to store the ACME account private key
12
    privateKeySecretRef:
13
      name: letsencrypt-prod
14
    # Enable the HTTP-01 challenge provider
15
    solvers:
16
    - http01:
17
        ingress:
18
          class: nginx

使用 kubectl apply -f 部署生效

1
$ kubectl apply -f letsencrypt-issue.yaml

03 为 Ingress 添加 annotation#

在部署 Ingress 时指定 annotations 就可以很方便地配置证书

1
annotations:
2
  kubernetes.io/ingress.class: "nginx"
3
  cert-manager.io/issuer: "letsencrypt-prod"

或者

1
annotations:
2
  kubernetes.io/ingress.class: "nginx"
3
  kubernetes.io/tls-acme: 'true'

关于 Ingress 的完整配置如下，你也可以在我的github上查看 Deployment，Service 到 Ingress 完整的配置: ChinaArJun/learn-k8s:/conf/nginx.yaml

1
apiVersion: networking.k8s.io/v1beta1
2
kind: Ingress
3
metadata:
4
  name: nginx-service-ingress
5
  annotations:
6
    kubernetes.io/ingress.class: "nginx"
7
    cert-manager.io/issuer: "letsencrypt-prod"
8
spec:
9
  tls:
10
  - hosts:
11
    - nginx.xiange.tech
12
    secretName: nginx-tls
13
  rules:
14
  - host: nginx.xiange.tech
15
    http:
16
      paths:
17
      - backend:
18
          serviceName: nginx-service
19
          servicePort: 80
20
        path: /

校验 certificate 状态，Ready 为 True

由于镜像在 quay.io 中，pull image 的时间过慢，有可能需要十分钟

1
$ kubectl get certificate
2
NAME        READY   SECRET      AGE
3
nginx-tls   True    nginx-tls   44h
4

5
$ kubectl describe certificate nginx-tls
6
Name:         nginx-tls
7
Namespace:    default
8
Labels:       <none>
9
Annotations:  <none>
10
API Version:  cert-manager.io/v1alpha2
11
Kind:         Certificate
12
Metadata:
13
  Creation Timestamp:  2019-10-26T13:30:06Z
14
  Generation:          1
15
  Owner References:
16
    API Version:           extensions/v1beta1
17
    Block Owner Deletion:  true
18
    Controller:            true
19
    Kind:                  Ingress
20
    Name:                  nginx-service-ingress
21
    UID:                   c9abc7b7-45da-431b-b732-e535a809dfdd
22
  Resource Version:        2822740
23
  Self Link:               /apis/cert-manager.io/v1alpha2/namespaces/default/certificates/nginx-tls
24
  UID:                     ccb3aa54-e967-4813-acbe-41d9801f29a6
25
Spec:
26
  Dns Names:
27
    nginx.xiange.tech
28
  Issuer Ref:
29
    Group:      cert-manager.io
30
    Kind:       Issuer
31
    Name:       letsencrypt-prod
32
  Secret Name:  nginx-tls
33
Status:
34
  Conditions:
35
    Last Transition Time:  2019-10-26T13:43:02Z
36
    Message:               Certificate is up to date and has not expired
37
    Reason:                Ready
38
    Status:                True
39
    Type:                  Ready
40
  Not After:               2020-01-24T12:43:01Z
41
Events:                    <none>

访问 Ingress 中配置的域名，Chrome 浏览器中左上角的小锁提示 https 配置成功

在 kubernetes 中自动为域名配置 https#

01 使用 helm 部署 cert-manager#

02 配置 ACME Issuers#

03 为 Ingress 添加 annotation#

参考#

相关阅读