Deploy GitHub Pages
This commit is contained in:
Travis Bot
parent
7356ddd980
commit
7e487c12b5
38 changed files with 1815 additions and 276 deletions
|
|
@ -1212,7 +1212,15 @@
|
|||
<h2 id="tls-certificates">TLS certificates<a class="headerlink" href="#tls-certificates" title="Permanent link">¶</a></h2>
|
||||
<p>Unless otherwise mentioned, the TLS secret used in examples is a 2048 bit RSA
|
||||
key/cert pair with an arbitrarily chosen hostname, created as follows</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl req -x509 -nodes -days <span class="m">365</span> -newkey rsa:2048 -keyout tls.key -out tls.crt -subj <span class="s2">"/CN=nginxsvc/O=nginxsvc"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl req -x509 -nodes -days <span class="m">365</span> -newkey rsa:2048 -keyout tls.key -out tls.crt -subj <span class="s2">"/CN=nginxsvc/O=nginxsvc"</span>
|
||||
<span class="go">Generating a 2048 bit RSA private key</span>
|
||||
<span class="go">................+++</span>
|
||||
<span class="go">................+++</span>
|
||||
|
|
@ -1222,6 +1230,7 @@ key/cert pair with an arbitrarily chosen hostname, created as follows</p>
|
|||
<span class="gp">$</span> kubectl create secret tls tls-secret --key tls.key --cert tls.crt
|
||||
<span class="go">secret "tls-secret" created</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="ca-authentication">CA Authentication<a class="headerlink" href="#ca-authentication" title="Permanent link">¶</a></h2>
|
||||
<p>You can act as your very own CA, or use an existing one. As an exercise / learning, we're going to generate our
|
||||
|
|
@ -1230,7 +1239,16 @@ own CA, and also generate a client certificate.</p>
|
|||
<h3 id="generating-a-ca">Generating a CA<a class="headerlink" href="#generating-a-ca" title="Permanent link">¶</a></h3>
|
||||
<p>First of all, you've to generate a CA. This is going to be the one who will sign your client certificates.
|
||||
In real production world, you may face CAs with intermediate certificates, as the following:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl s_client -connect www.google.com:443
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl s_client -connect www.google.com:443
|
||||
<span class="go">[...]</span>
|
||||
<span class="go">---</span>
|
||||
<span class="go">Certificate chain</span>
|
||||
|
|
@ -1241,11 +1259,14 @@ In real production world, you may face CAs with intermediate certificates, as th
|
|||
<span class="go"> 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA</span>
|
||||
<span class="go"> i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>To generate our CA Certificate, we've to run the following commands:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out ca.key <span class="m">2048</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out ca.key <span class="m">2048</span>
|
||||
<span class="gp">$</span> openssl req -x509 -new -nodes -key ca.key -days <span class="m">10000</span> -out ca.crt -subj <span class="s2">"/CN=example-ca"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>This will generate two files: A private key (ca.key) and a public key (ca.crt). This CA is valid for 10000 days.
|
||||
The ca.crt can be used later in the step of creation of CA authentication secret.</p>
|
||||
|
|
@ -1253,7 +1274,13 @@ The ca.crt can be used later in the step of creation of CA authentication secret
|
|||
<p>The following steps generate a client certificate signed by the CA generated above. This client can be
|
||||
used to authenticate in a tls-auth configured ingress.</p>
|
||||
<p>First, we need to generate an 'openssl.cnf' file that will be used while signing the keys:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">[req]</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">[req]</span>
|
||||
<span class="go">req_extensions = v3_req</span>
|
||||
<span class="go">distinguished_name = req_distinguished_name</span>
|
||||
<span class="go">[req_distinguished_name]</span>
|
||||
|
|
@ -1261,47 +1288,68 @@ used to authenticate in a tls-auth configured ingress.</p>
|
|||
<span class="go">basicConstraints = CA:FALSE</span>
|
||||
<span class="go">keyUsage = nonRepudiation, digitalSignature, keyEncipherment</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Then, a user generates his very own private key (that he needs to keep secret)
|
||||
and a CSR (Certificate Signing Request) that will be sent to the CA to sign and generate a certificate.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out client1.key <span class="m">2048</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl genrsa -out client1.key <span class="m">2048</span>
|
||||
<span class="gp">$</span> openssl req -new -key client1.key -out client1.csr -subj <span class="s2">"/CN=client1"</span> -config openssl.cnf
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>As the CA receives the generated 'client1.csr' file, it signs it and generates a client.crt certificate:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client1.crt -days <span class="m">365</span> -extensions v3_req -extfile openssl.cnf
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client1.crt -days <span class="m">365</span> -extensions v3_req -extfile openssl.cnf
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Then, you'll have 3 files: the client.key (user's private key), client.crt (user's public key) and client.csr (disposable CSR).</p>
|
||||
<h3 id="creating-the-ca-authentication-secret">Creating the CA Authentication secret<a class="headerlink" href="#creating-the-ca-authentication-secret" title="Permanent link">¶</a></h3>
|
||||
<p>If you're using the CA Authentication feature, you need to generate a secret containing
|
||||
all the authorized CAs. You must download them from your CA site in PEM format (like the following):</p>
|
||||
<div class="codehilite"><pre><span></span>-----BEGIN CERTIFICATE-----
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>-----BEGIN CERTIFICATE-----
|
||||
[....]
|
||||
-----END CERTIFICATE-----
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>You can have as many certificates as you want. If they're in the binary DER format,
|
||||
you can convert them as the following:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -in certificate.der -inform der -out certificate.crt -outform pem
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> openssl x509 -in certificate.der -inform der -out certificate.crt -outform pem
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Then, you've to concatenate them all in only one file, named 'ca.crt' as the following:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> cat certificate1.crt certificate2.crt certificate3.crt >> ca.crt
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> cat certificate1.crt certificate2.crt certificate3.crt >> ca.crt
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>The final step is to create a secret with the content of this file. This secret is going to be used in
|
||||
the TLS Auth directive:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p><strong>Note:</strong> You can also generate the CA Authentication Secret along with the TLS Secret by using:
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt> --from-file<span class="o">=</span>tls.crt<span class="o">=</span><tls.crt> --from-file<span class="o">=</span>tls.key<span class="o">=</span><tls.key>
|
||||
</pre></div></p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic caingress --namespace<span class="o">=</span>default --from-file<span class="o">=</span>ca.crt<span class="o">=</span><ca.crt> --from-file<span class="o">=</span>tls.crt<span class="o">=</span><tls.crt> --from-file<span class="o">=</span>tls.key<span class="o">=</span><tls.key>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<h2 id="test-http-service">Test HTTP Service<a class="headerlink" href="#test-http-service" title="Permanent link">¶</a></h2>
|
||||
<p>All examples that require a test HTTP Service use the standard http-svc pod,
|
||||
which you can deploy as follows</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f http-svc.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f http-svc.yaml
|
||||
<span class="go">service "http-svc" created</span>
|
||||
<span class="go">replicationcontroller "http-svc" created</span>
|
||||
|
||||
|
|
@ -1313,9 +1361,56 @@ which you can deploy as follows</p>
|
|||
<span class="go">NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE</span>
|
||||
<span class="go">http-svc 10.0.122.116 <pending> 80:30301/TCP 1d</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>You can test that the HTTP Service works by exposing it temporarily</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc http-svc -p <span class="s1">'{"spec":{"type": "LoadBalancer"}}'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37
|
||||
38
|
||||
39
|
||||
40
|
||||
41
|
||||
42
|
||||
43
|
||||
44
|
||||
45
|
||||
46
|
||||
47</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc http-svc -p <span class="s1">'{"spec":{"type": "LoadBalancer"}}'</span>
|
||||
<span class="go">"http-svc" patched</span>
|
||||
|
||||
<span class="gp">$</span> kubectl get svc http-svc
|
||||
|
|
@ -1363,6 +1458,7 @@ which you can deploy as follows</p>
|
|||
<span class="gp">$</span> kubectl patch svc http-svc -p <span class="s1">'{"spec":{"type": "NodePort"}}'</span>
|
||||
<span class="go">"http-svc" patched</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1170,12 +1170,43 @@
|
|||
</tbody>
|
||||
</table>
|
||||
<p>You can create the ingress to test this</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl create -f ingress.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl create -f ingress.yaml</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="validation">Validation<a class="headerlink" href="#validation" title="Permanent link">¶</a></h2>
|
||||
<p>You can confirm that the Ingress works.</p>
|
||||
<p><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl describe ing nginx-test
|
||||
<p><table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl describe ing nginx-test
|
||||
<span class="go">Name: nginx-test</span>
|
||||
<span class="go">Namespace: default</span>
|
||||
<span class="go">Address: </span>
|
||||
|
|
@ -1207,6 +1238,7 @@
|
|||
<span class="go">ETag: "58875e6b-264"</span>
|
||||
<span class="go">Accept-Ranges: bytes</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
In the example above, you can see a line containing the 'Set-Cookie: INGRESSCOOKIE' setting the right defined stickiness cookie.
|
||||
This cookie is created by NGINX containing the hash of the used upstream in that request.
|
||||
If the user changes this cookie, NGINX creates a new one and redirect the user to another upstream.</p>
|
||||
|
|
|
|||
|
|
@ -1085,18 +1085,33 @@
|
|||
<h1 id="basic-authentication">Basic Authentication<a class="headerlink" href="#basic-authentication" title="Permanent link">¶</a></h1>
|
||||
<p>This example shows how to add authentication in a Ingress rule using a secret that contains a file generated with <code class="codehilite">htpasswd</code>.
|
||||
It's important the file generated is named <code class="codehilite">auth</code> (actually - that the secret has a key <code class="codehilite">data.auth</code>), otherwise the ingress-controller returns a 503.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> htpasswd -c auth foo
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> htpasswd -c auth foo
|
||||
<span class="go">New password: <bar></span>
|
||||
<span class="go">New password:</span>
|
||||
<span class="go">Re-type new password:</span>
|
||||
<span class="go">Adding password for user foo</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic basic-auth --from-file<span class="o">=</span>auth
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create secret generic basic-auth --from-file<span class="o">=</span>auth
|
||||
<span class="go">secret "basic-auth" created</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl get secret basic-auth -o yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl get secret basic-auth -o yaml
|
||||
<span class="go">apiVersion: v1</span>
|
||||
<span class="go">data:</span>
|
||||
<span class="go"> auth: Zm9vOiRhcHIxJE9GRzNYeWJwJGNrTDBGSERBa29YWUlsSDkuY3lzVDAK</span>
|
||||
|
|
@ -1106,8 +1121,30 @@ It's important the file generated is named <code class="codehilite">auth</code>
|
|||
<span class="go"> namespace: default</span>
|
||||
<span class="go">type: Opaque</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="go">echo "</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">echo "</span>
|
||||
<span class="go">apiVersion: extensions/v1beta1</span>
|
||||
<span class="go">kind: Ingress</span>
|
||||
<span class="go">metadata:</span>
|
||||
|
|
@ -1130,8 +1167,32 @@ It's important the file generated is named <code class="codehilite">auth</code>
|
|||
<span class="go"> servicePort: 80</span>
|
||||
<span class="go">" | kubectl create -f -</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span>$ curl -v http://10.2.29.4/ -H 'Host: foo.bar.com'
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl -v http://10.2.29.4/ -H 'Host: foo.bar.com'
|
||||
* Trying 10.2.29.4...
|
||||
* Connected to 10.2.29.4 (10.2.29.4) port 80 (#0)
|
||||
> GET / HTTP/1.1
|
||||
|
|
@ -1156,8 +1217,51 @@ It's important the file generated is named <code class="codehilite">auth</code>
|
|||
<span class="nt"></html></span>
|
||||
* Connection #0 to host 10.2.29.4 left intact
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span>$ curl -v http://10.2.29.4/ -H <span class="s1">'Host: foo.bar.com'</span> -u <span class="s1">'foo:bar'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37
|
||||
38
|
||||
39
|
||||
40
|
||||
41
|
||||
42
|
||||
43</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl -v http://10.2.29.4/ -H <span class="s1">'Host: foo.bar.com'</span> -u <span class="s1">'foo:bar'</span>
|
||||
* Trying <span class="m">10</span>.2.29.4...
|
||||
* Connected to <span class="m">10</span>.2.29.4 <span class="o">(</span><span class="m">10</span>.2.29.4<span class="o">)</span> port <span class="m">80</span> <span class="o">(</span><span class="c1">#0)</span>
|
||||
* Server auth using Basic with user <span class="s1">'foo'</span>
|
||||
|
|
@ -1201,6 +1305,7 @@ BODY:
|
|||
* Connection <span class="c1">#0 to host 10.2.29.4 left intact</span>
|
||||
-no body in request-
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1130,7 +1130,40 @@
|
|||
<h1 id="external-basic-authentication">External Basic Authentication<a class="headerlink" href="#external-basic-authentication" title="Permanent link">¶</a></h1>
|
||||
<h3 id="example-1">Example 1:<a class="headerlink" href="#example-1" title="Permanent link">¶</a></h3>
|
||||
<p>Use an external service (Basic Auth) located in <code class="codehilite">https://httpbin.org</code> </p>
|
||||
<div class="codehilite"><pre><span></span>$ kubectl create -f ingress.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl create -f ingress.yaml
|
||||
ingress <span class="s2">"external-auth"</span> created
|
||||
|
||||
$ kubectl get ing external-auth
|
||||
|
|
@ -1165,9 +1198,34 @@ status:
|
|||
- ip: <span class="m">172</span>.17.4.99
|
||||
$
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Test 1: no username/password (expect code 401)</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> curl -k http://172.17.4.99 -v -H <span class="s1">'Host: external-auth-01.sample.com'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> curl -k http://172.17.4.99 -v -H <span class="s1">'Host: external-auth-01.sample.com'</span>
|
||||
<span class="go">* Rebuilt URL to: http://172.17.4.99/</span>
|
||||
<span class="go">* Trying 172.17.4.99...</span>
|
||||
<span class="go">* Connected to 172.17.4.99 (172.17.4.99) port 80 (#0)</span>
|
||||
|
|
@ -1193,9 +1251,52 @@ $
|
|||
<span class="go"></html></span>
|
||||
<span class="go">* Connection #0 to host 172.17.4.99 left intact</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Test 2: valid username/password (expect code 200)
|
||||
<div class="codehilite"><pre><span></span>$ curl -k http://172.17.4.99 -v -H <span class="s1">'Host: external-auth-01.sample.com'</span> -u <span class="s1">'user:passwd'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37
|
||||
38
|
||||
39
|
||||
40
|
||||
41
|
||||
42
|
||||
43</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl -k http://172.17.4.99 -v -H <span class="s1">'Host: external-auth-01.sample.com'</span> -u <span class="s1">'user:passwd'</span>
|
||||
* Rebuilt URL to: http://172.17.4.99/
|
||||
* Trying <span class="m">172</span>.17.4.99...
|
||||
* Connected to <span class="m">172</span>.17.4.99 <span class="o">(</span><span class="m">172</span>.17.4.99<span class="o">)</span> port <span class="m">80</span> <span class="o">(</span><span class="c1">#0)</span>
|
||||
|
|
@ -1238,9 +1339,37 @@ x-real-ip<span class="o">=</span><span class="m">10</span>.2.60.1
|
|||
BODY:
|
||||
* Connection <span class="c1">#0 to host 172.17.4.99 left intact</span>
|
||||
-no body in request-
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>Test 3: invalid username/password (expect code 401)
|
||||
<div class="codehilite"><pre><span></span>curl -k http://172.17.4.99 -v -H 'Host: external-auth-01.sample.com' -u 'user:user'
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>curl -k http://172.17.4.99 -v -H 'Host: external-auth-01.sample.com' -u 'user:user'
|
||||
* Rebuilt URL to: http://172.17.4.99/
|
||||
* Trying 172.17.4.99...
|
||||
* Connected to 172.17.4.99 (172.17.4.99) port 80 (#0)
|
||||
|
|
@ -1268,7 +1397,8 @@ BODY:
|
|||
<span class="nt"></body></span>
|
||||
<span class="nt"></html></span>
|
||||
* Connection #0 to host 172.17.4.99 left intact
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1196,7 +1196,13 @@ One Ingress object has no special annotations and handles authentication.</p>
|
|||
authenticate against the first Ingress's endpoint, and can redirect <code class="codehilite">401</code>s to the
|
||||
same endpoint.</p>
|
||||
<p>Sample:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="nn">...</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="nn">...</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">application</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">annotations</span><span class="p p-Indicator">:</span>
|
||||
|
|
@ -1204,6 +1210,7 @@ same endpoint.</p>
|
|||
<span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/auth-signin</span><span class="p p-Indicator">:</span> <span class="s">"https://$host/oauth2/start?rd=$escaped_request_uri"</span>
|
||||
<span class="nn">...</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="example-oauth2-proxy-kubernetes-dashboard">Example: OAuth2 Proxy + Kubernetes-Dashboard<a class="headerlink" href="#example-oauth2-proxy-kubernetes-dashboard" title="Permanent link">¶</a></h3>
|
||||
<p>This example will show you how to deploy <a href="https://github.com/bitly/oauth2_proxy"><code class="codehilite">oauth2_proxy</code></a>
|
||||
|
|
@ -1212,8 +1219,9 @@ into a Kubernetes cluster and use it to protect the Kubernetes Dashboard using g
|
|||
<ol>
|
||||
<li>Install the kubernetes dashboard</li>
|
||||
</ol>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/kops/master/addons/kubernetes-dashboard/v1.5.0.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/kops/master/addons/kubernetes-dashboard/v1.5.0.yaml</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<ol>
|
||||
<li>Create a <a href="https://github.com/settings/applications/new">custom Github OAuth application</a></li>
|
||||
|
|
@ -1243,8 +1251,9 @@ into a Kubernetes cluster and use it to protect the Kubernetes Dashboard using g
|
|||
<ol>
|
||||
<li>Deploy the oauth2 proxy and the ingress rules running:</li>
|
||||
</ol>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f oauth2-proxy.yaml,dashboard-ingress.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f oauth2-proxy.yaml,dashboard-ingress.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Test the oauth integration accessing the configured URL, like <code class="codehilite">https://foo.bar.com</code></p>
|
||||
<p><img alt="Register OAuth2 Application" src="images/github-auth.png" /></p>
|
||||
|
|
|
|||
|
|
@ -1144,8 +1144,9 @@
|
|||
<h1 id="configuration-snippets">Configuration Snippets<a class="headerlink" href="#configuration-snippets" title="Permanent link">¶</a></h1>
|
||||
<h2 id="ingress">Ingress<a class="headerlink" href="#ingress" title="Permanent link">¶</a></h2>
|
||||
<p>The Ingress in this example adds a custom header to Nginx configuration that only applies to that specific Ingress. If you want to add headers that apply globally to all Ingresses, please have a look at <a href="/examples/customization/custom-headers/README">this example</a>.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl apply -f ingress.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl apply -f ingress.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="test">Test<a class="headerlink" href="#test" title="Permanent link">¶</a></h2>
|
||||
<p>Check if the contents of the annotation are present in the nginx.conf file using:
|
||||
|
|
|
|||
|
|
@ -1085,7 +1085,15 @@
|
|||
<h1 id="custom-configuration">Custom Configuration<a class="headerlink" href="#custom-configuration" title="Permanent link">¶</a></h1>
|
||||
<p>Using a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/">ConfigMap</a> is possible to customize the NGINX configuration</p>
|
||||
<p>For example, if we want to change the timeouts we need to create a ConfigMap:</p>
|
||||
<div class="codehilite"><pre><span></span>$ cat configmap.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ cat configmap.yaml
|
||||
apiVersion: v1
|
||||
data:
|
||||
proxy-connect-timeout: <span class="s2">"10"</span>
|
||||
|
|
@ -1095,10 +1103,13 @@ kind: ConfigMap
|
|||
metadata:
|
||||
name: nginx-load-balancer-conf
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span>curl https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/customization/custom-configuration/configmap.yaml \
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>curl https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/customization/custom-configuration/configmap.yaml \
|
||||
| kubectl apply -f -
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>If the Configmap it is updated, NGINX will be reloaded with the new configuration.</p>
|
||||
|
||||
|
|
|
|||
|
|
@ -1159,19 +1159,28 @@
|
|||
<p>This example demonstrates how to use a custom backend to render custom error pages.</p>
|
||||
<h2 id="customized-default-backend">Customized default backend<a class="headerlink" href="#customized-default-backend" title="Permanent link">¶</a></h2>
|
||||
<p>First, create the custom <code class="codehilite">default-backend</code>. It will be used by the Ingress controller later on.</p>
|
||||
<div class="codehilite"><pre><span></span>$ kubectl create -f custom-default-backend.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl create -f custom-default-backend.yaml
|
||||
service <span class="s2">"nginx-errors"</span> created
|
||||
deployment.apps <span class="s2">"nginx-errors"</span> created
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>This should have created a Deployment and a Service with the name <code class="codehilite">nginx-errors</code>.</p>
|
||||
<div class="codehilite"><pre><span></span>$ kubectl get deploy,svc
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl get deploy,svc
|
||||
NAME DESIRED CURRENT READY AGE
|
||||
deployment.apps/nginx-errors <span class="m">1</span> <span class="m">1</span> <span class="m">1</span> 10s
|
||||
|
||||
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT<span class="o">(</span>S<span class="o">)</span> AGE
|
||||
service/nginx-errors ClusterIP <span class="m">10</span>.0.0.12 <none> <span class="m">80</span>/TCP 10s
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="ingress-controller-configuration">Ingress controller configuration<a class="headerlink" href="#ingress-controller-configuration" title="Permanent link">¶</a></h2>
|
||||
<p>If you do not already have an instance of the the NGINX Ingress controller running, deploy it according to the
|
||||
|
|
@ -1186,10 +1195,13 @@ service/nginx-errors ClusterIP <span class="m">10</span>.0.0.12 <none&g
|
|||
</li>
|
||||
<li>
|
||||
<p>Take note of the IP address assigned to the NGINX Ingress controller Service.
|
||||
<div class="codehilite"><pre><span></span>$ kubectl get svc ingress-nginx
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl get svc ingress-nginx
|
||||
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT<span class="o">(</span>S<span class="o">)</span> AGE
|
||||
ingress-nginx ClusterIP <span class="m">10</span>.0.0.13 <none> <span class="m">80</span>/TCP,443/TCP 10m
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
</li>
|
||||
</ol>
|
||||
<div class="admonition note">
|
||||
|
|
@ -1200,7 +1212,15 @@ Make sure you can use the Service to reach NGINX before proceeding with the rest
|
|||
<h2 id="testing-error-pages">Testing error pages<a class="headerlink" href="#testing-error-pages" title="Permanent link">¶</a></h2>
|
||||
<p>Let us send a couple of HTTP requests using cURL and validate everything is working as expected.</p>
|
||||
<p>A request to the default backend returns a 404 error with a custom message:</p>
|
||||
<div class="codehilite"><pre><span></span>$ curl -D- http://10.0.0.13/
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl -D- http://10.0.0.13/
|
||||
HTTP/1.1 404 Not Found
|
||||
Server: nginx/1.13.12
|
||||
Date: Tue, 12 Jun 2018 19:11:24 GMT
|
||||
|
|
@ -1210,9 +1230,19 @@ Connection: keep-alive
|
|||
|
||||
<span class="nt"><span></span>The page you're looking for could not be found.<span class="nt"></span></span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>A request with a custom <code class="codehilite">Accept</code> header returns the corresponding document type (JSON):</p>
|
||||
<div class="codehilite"><pre><span></span>$ curl -D- -H <span class="s1">'Accept: application/json'</span> http://10.0.0.13/
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl -D- -H <span class="s1">'Accept: application/json'</span> http://10.0.0.13/
|
||||
HTTP/1.1 <span class="m">404</span> Not Found
|
||||
Server: nginx/1.13.12
|
||||
Date: Tue, <span class="m">12</span> Jun <span class="m">2018</span> <span class="m">19</span>:12:36 GMT
|
||||
|
|
@ -1223,6 +1253,7 @@ Vary: Accept-Encoding
|
|||
|
||||
<span class="o">{</span> <span class="s2">"message"</span>: <span class="s2">"The page you're looking for could not be found"</span> <span class="o">}</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>To go further with this example, feel free to deploy your own applications and Ingress objects, and validate that the
|
||||
responses are still in the correct format when a backend returns 503 (eg. if you scale a Deployment down to 0 replica).</p>
|
||||
|
|
|
|||
|
|
@ -1131,12 +1131,17 @@
|
|||
<p>This example aims to demonstrate the deployment of an nginx ingress controller and
|
||||
use a ConfigMap to configure a custom list of headers to be passed to the upstream
|
||||
server</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">curl https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/customization/custom-headers/configmap.yaml \</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">curl https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/customization/custom-headers/configmap.yaml \</span>
|
||||
<span class="go"> | kubectl apply -f -</span>
|
||||
|
||||
<span class="go">curl https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/customization/custom-headers/custom-headers.yaml \</span>
|
||||
<span class="go"> | kubectl apply -f -</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="test">Test<a class="headerlink" href="#test" title="Permanent link">¶</a></h2>
|
||||
<p>Check the contents of the configmap is present in the nginx.conf file using:
|
||||
|
|
|
|||
|
|
@ -1084,7 +1084,23 @@
|
|||
|
||||
<h1 id="custom-upstream-server-checks">Custom Upstream server checks<a class="headerlink" href="#custom-upstream-server-checks" title="Permanent link">¶</a></h1>
|
||||
<p>This example shows how is possible to create a custom configuration for a particular upstream associated with an Ingress rule.</p>
|
||||
<div class="codehilite"><pre><span></span>echo "
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>echo "
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
|
|
@ -1102,15 +1118,24 @@ spec:
|
|||
servicePort: 80
|
||||
" | kubectl create -f -
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Check the annotation is present in the Ingress rule:
|
||||
<div class="codehilite"><pre><span></span>kubectl get ingress http-svc -o yaml
|
||||
</pre></div></p>
|
||||
<p>Check the NGINX configuration is updated using kubectl or the status page:</p>
|
||||
<div class="codehilite"><pre><span></span>$ kubectl <span class="nb">exec</span> nginx-ingress-controller-v1ppm cat /etc/nginx/nginx.conf
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>kubectl get ingress http-svc -o yaml
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>Check the NGINX configuration is updated using kubectl or the status page:</p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl <span class="nb">exec</span> nginx-ingress-controller-v1ppm cat /etc/nginx/nginx.conf
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="o">....</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="o">....</span>
|
||||
<span class="nt">upstream</span> <span class="nt">default-http-svc-x-80</span> <span class="p">{</span>
|
||||
<span class="err">least_conn</span><span class="p">;</span>
|
||||
<span class="err">server</span> <span class="err">10.2.92.2:8080</span> <span class="err">max_fails=5</span> <span class="err">fail_timeout=30</span><span class="p">;</span>
|
||||
|
|
@ -1118,6 +1143,7 @@ spec:
|
|||
<span class="p">}</span>
|
||||
<span class="o">....</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1097,7 +1097,25 @@ to backend service.</p>
|
|||
</ul>
|
||||
<p>You can deploy the controller as
|
||||
follows:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f deploy/
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f deploy/
|
||||
<span class="go">deployment "demo-auth-service" created</span>
|
||||
<span class="go">service "demo-auth-service" created</span>
|
||||
<span class="go">ingress "demo-auth-service" created</span>
|
||||
|
|
@ -1117,9 +1135,27 @@ follows:</p>
|
|||
<span class="go">public-demo-echo-service public-demo-echo-service.kube.local 80 1m</span>
|
||||
<span class="go">secure-demo-echo-service secure-demo-echo-service.kube.local 80 1m</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Test 1: public service with no auth header</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: public-demo-echo-service.kube.local'</span> -v <span class="m">192</span>.168.99.100
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: public-demo-echo-service.kube.local'</span> -v <span class="m">192</span>.168.99.100
|
||||
<span class="go">* Rebuilt URL to: 192.168.99.100/</span>
|
||||
<span class="go">* Trying 192.168.99.100...</span>
|
||||
<span class="go">* Connected to 192.168.99.100 (192.168.99.100) port 80 (#0)</span>
|
||||
|
|
@ -1138,9 +1174,33 @@ follows:</p>
|
|||
<span class="go">* Connection #0 to host 192.168.99.100 left intact</span>
|
||||
<span class="go">UserID: , UserRole:</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Test 2: secure service with no auth header</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: secure-demo-echo-service.kube.local'</span> -v <span class="m">192</span>.168.99.100
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: secure-demo-echo-service.kube.local'</span> -v <span class="m">192</span>.168.99.100
|
||||
<span class="go">* Rebuilt URL to: 192.168.99.100/</span>
|
||||
<span class="go">* Trying 192.168.99.100...</span>
|
||||
<span class="go">* Connected to 192.168.99.100 (192.168.99.100) port 80 (#0)</span>
|
||||
|
|
@ -1165,9 +1225,28 @@ follows:</p>
|
|||
<span class="go"></html></span>
|
||||
<span class="go">* Connection #0 to host 192.168.99.100 left intact</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Test 3: public service with valid auth header</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: public-demo-echo-service.kube.local'</span> -H <span class="s1">'User:internal'</span> -v <span class="m">192</span>.168.99.100
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: public-demo-echo-service.kube.local'</span> -H <span class="s1">'User:internal'</span> -v <span class="m">192</span>.168.99.100
|
||||
<span class="go">* Rebuilt URL to: 192.168.99.100/</span>
|
||||
<span class="go">* Trying 192.168.99.100...</span>
|
||||
<span class="go">* Connected to 192.168.99.100 (192.168.99.100) port 80 (#0)</span>
|
||||
|
|
@ -1187,9 +1266,28 @@ follows:</p>
|
|||
<span class="go">* Connection #0 to host 192.168.99.100 left intact</span>
|
||||
<span class="go">UserID: 1443635317331776148, UserRole: admin</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Test 4: public service with valid auth header</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: secure-demo-echo-service.kube.local'</span> -H <span class="s1">'User:internal'</span> -v <span class="m">192</span>.168.99.100
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> curl -H <span class="s1">'Host: secure-demo-echo-service.kube.local'</span> -H <span class="s1">'User:internal'</span> -v <span class="m">192</span>.168.99.100
|
||||
<span class="go">* Rebuilt URL to: 192.168.99.100/</span>
|
||||
<span class="go">* Trying 192.168.99.100...</span>
|
||||
<span class="go">* Connected to 192.168.99.100 (192.168.99.100) port 80 (#0)</span>
|
||||
|
|
@ -1209,6 +1307,7 @@ follows:</p>
|
|||
<span class="go">* Connection #0 to host 192.168.99.100 left intact</span>
|
||||
<span class="go">UserID: 605394647632969758, UserRole: admin</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1160,7 +1160,17 @@
|
|||
use a ConfigMap to configure custom Diffie-Hellman parameters file to help with
|
||||
"Perfect Forward Secrecy".</p>
|
||||
<h2 id="custom-configuration">Custom configuration<a class="headerlink" href="#custom-configuration" title="Permanent link">¶</a></h2>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> cat configmap.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> cat configmap.yaml
|
||||
<span class="go">apiVersion: v1</span>
|
||||
<span class="go">data:</span>
|
||||
<span class="go"> ssl-dh-param: "ingress-nginx/lb-dhparam"</span>
|
||||
|
|
@ -1172,16 +1182,30 @@ use a ConfigMap to configure custom Diffie-Hellman parameters file to help with
|
|||
<span class="go"> app.kubernetes.io/name: ingress-nginx</span>
|
||||
<span class="go"> app.kubernetes.io/part-of: ingress-nginx</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f configmap.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f configmap.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="custom-dh-parameters-secret">Custom DH parameters secret<a class="headerlink" href="#custom-dh-parameters-secret" title="Permanent link">¶</a></h2>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span>> openssl dhparam <span class="m">1024</span> <span class="m">2</span>> /dev/null <span class="p">|</span> base64
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span>> openssl dhparam <span class="m">1024</span> <span class="m">2</span>> /dev/null <span class="p">|</span> base64
|
||||
<span class="go">LS0tLS1CRUdJTiBESCBQQVJBTUVURVJ...</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> cat ssl-dh-param.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> cat ssl-dh-param.yaml
|
||||
<span class="go">apiVersion: v1</span>
|
||||
<span class="go">data:</span>
|
||||
<span class="go"> dhparam.pem: "LS0tLS1CRUdJTiBESCBQQVJBTUVURVJ..."</span>
|
||||
|
|
@ -1193,9 +1217,11 @@ use a ConfigMap to configure custom Diffie-Hellman parameters file to help with
|
|||
<span class="go"> app.kubernetes.io/name: ingress-nginx</span>
|
||||
<span class="go"> app.kubernetes.io/part-of: ingress-nginx</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f ssl-dh-param.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f ssl-dh-param.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="test">Test<a class="headerlink" href="#test" title="Permanent link">¶</a></h2>
|
||||
<p>Check the contents of the configmap is present in the nginx.conf file using:
|
||||
|
|
|
|||
|
|
@ -1085,8 +1085,9 @@
|
|||
<h1 id="sysctl-tuning">Sysctl tuning<a class="headerlink" href="#sysctl-tuning" title="Permanent link">¶</a></h1>
|
||||
<p>This example aims to demonstrate the use of an Init Container to adjust sysctl default values
|
||||
using <code class="codehilite">kubectl patch</code></p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl patch deployment -n ingress-nginx nginx-ingress-controller --patch="$(cat patch.json)"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl patch deployment -n ingress-nginx nginx-ingress-controller --patch="$(cat patch.json)"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1183,8 +1183,9 @@
|
|||
<p>This example demonstrates how to deploy a <a href="https://github.com/docker/distribution">docker registry</a> in the cluster and configure Ingress enable access from Internet</p>
|
||||
<h2 id="deployment">Deployment<a class="headerlink" href="#deployment" title="Permanent link">¶</a></h2>
|
||||
<p>First we deploy the docker registry in the cluster:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/deployment.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/deployment.yaml</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="admonition important">
|
||||
<p class="admonition-title">Important</p>
|
||||
|
|
@ -1194,8 +1195,9 @@
|
|||
<p>The next required step is creation of the ingress rules. To do this we have two options: with and without TLS</p>
|
||||
<h3 id="without-tls">Without TLS<a class="headerlink" href="#without-tls" title="Permanent link">¶</a></h3>
|
||||
<p>Download and edit the yaml deployment replacing <code class="codehilite">registry.<your domain></code> with a valid DNS name pointing to the ingress controller:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/ingress-without-tls.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/ingress-without-tls.yaml</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="admonition important">
|
||||
<p class="admonition-title">Important</p>
|
||||
|
|
@ -1204,16 +1206,20 @@
|
|||
<p>Please check <a href="https://docs.docker.com/registry/insecure/#deploy-a-plain-http-registry">deploy a plain http registry</a></p>
|
||||
<h3 id="with-tls">With TLS<a class="headerlink" href="#with-tls" title="Permanent link">¶</a></h3>
|
||||
<p>Download and edit the yaml deployment replacing <code class="codehilite">registry.<your domain></code> with a valid DNS name pointing to the ingress controller:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/ingress-with-tls.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/docs/examples/docker-registry/ingress-with-tls.yaml</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Deploy <a href="https://github.com/jetstack/kube-lego">kube lego</a> use <a href="https://letsencrypt.org/">Let's Encrypt</a> certificates or edit the ingress rule to use a secret with an existing SSL certificate.</p>
|
||||
<h3 id="testing">Testing<a class="headerlink" href="#testing" title="Permanent link">¶</a></h3>
|
||||
<p>To test the registry is working correctly we download a known image from <a href="https://hub.docker.com">docker hub</a>, create a tag pointing to the new registry and upload the image:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">docker pull ubuntu:16.04</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">docker pull ubuntu:16.04</span>
|
||||
<span class="go">docker tag ubuntu:16.04 `registry.<your domain>/ubuntu:16.04`</span>
|
||||
<span class="go">docker push `registry.<your domain>/ubuntu:16.04`</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Please replace <code class="codehilite">registry.<your domain></code> with your domain.</p>
|
||||
|
||||
|
|
|
|||
|
|
@ -1228,21 +1228,28 @@ nginx controller.</p>
|
|||
application provided here as an example. </li>
|
||||
</ol>
|
||||
<h3 id="step-1-kubernetes-deployment">Step 1: kubernetes <code class="codehilite">Deployment</code><a class="headerlink" href="#step-1-kubernetes-deployment" title="Permanent link">¶</a></h3>
|
||||
<div class="codehilite"><pre><span></span>$ kubectl create -f app.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl create -f app.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>This is a standard kubernetes deployment object. It is running a grpc service
|
||||
listening on port <code class="codehilite">50051</code>.</p>
|
||||
<p>The sample application
|
||||
<a href="https://github.com/kubernetes/ingress-nginx/images/grpc-fortune-teller">fortune-teller-app</a>
|
||||
is a grpc server implemented in go. Here's the stripped-down implementation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="kd">func</span> <span class="nx">main</span><span class="p">()</span> <span class="p">{</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="kd">func</span> <span class="nx">main</span><span class="p">()</span> <span class="p">{</span>
|
||||
<span class="nx">grpcServer</span> <span class="o">:=</span> <span class="nx">grpc</span><span class="p">.</span><span class="nx">NewServer</span><span class="p">()</span>
|
||||
<span class="nx">fortune</span><span class="p">.</span><span class="nx">RegisterFortuneTellerServer</span><span class="p">(</span><span class="nx">grpcServer</span><span class="p">,</span> <span class="o">&</span><span class="nx">FortuneTeller</span><span class="p">{})</span>
|
||||
<span class="nx">lis</span><span class="p">,</span> <span class="nx">_</span> <span class="o">:=</span> <span class="nx">net</span><span class="p">.</span><span class="nx">Listen</span><span class="p">(</span><span class="s">"tcp"</span><span class="p">,</span> <span class="s">":50051"</span><span class="p">)</span>
|
||||
<span class="nx">grpcServer</span><span class="p">.</span><span class="nx">Serve</span><span class="p">(</span><span class="nx">lis</span><span class="p">)</span>
|
||||
<span class="p">}</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>The takeaway is that we are not doing any TLS configuration on the server (as we
|
||||
are terminating TLS at the ingress level, grpc traffic will travel unencrypted
|
||||
|
|
@ -1251,14 +1258,16 @@ inside the cluster and arrive "insecure").</p>
|
|||
forward encrypted traffic to your POD and terminate TLS at the gRPC server
|
||||
itself, add the ingress annotation <code class="codehilite">nginx.ingress.kubernetes.io/secure-backends:"true"</code>.</p>
|
||||
<h3 id="step-2-the-kubernetes-service">Step 2: the kubernetes <code class="codehilite">Service</code><a class="headerlink" href="#step-2-the-kubernetes-service" title="Permanent link">¶</a></h3>
|
||||
<div class="codehilite"><pre><span></span>$ kubectl create -f svc.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl create -f svc.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Here we have a typical service. Nothing special, just routing traffic to the
|
||||
backend application on port <code class="codehilite">50051</code>.</p>
|
||||
<h3 id="step-3-the-kubernetes-ingress">Step 3: the kubernetes <code class="codehilite">Ingress</code><a class="headerlink" href="#step-3-the-kubernetes-ingress" title="Permanent link">¶</a></h3>
|
||||
<div class="codehilite"><pre><span></span>$ kubectl create -f ingress.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl create -f ingress.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>A few things to note:</p>
|
||||
<ol>
|
||||
|
|
@ -1275,11 +1284,15 @@ backend application on port <code class="codehilite">50051</code>.</p>
|
|||
<p>Once we've applied our configuration to kubernetes, it's time to test that we
|
||||
can actually talk to the backend. To do this, we'll use the
|
||||
<a href="https://github.com/fullstorydev/grpcurl">grpcurl</a> utility:</p>
|
||||
<div class="codehilite"><pre><span></span>$ grpcurl fortune-teller.stack.build:443 build.stack.fortune.FortuneTeller/Predict
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ grpcurl fortune-teller.stack.build:443 build.stack.fortune.FortuneTeller/Predict
|
||||
<span class="o">{</span>
|
||||
<span class="s2">"message"</span>: <span class="s2">"Let us endeavor so to live that when we come to die even the undertaker will be sorry.\n\t\t-- Mark Twain, \"Pudd'nhead Wilson's Calendar\""</span>
|
||||
<span class="o">}</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="debugging-hints">Debugging Hints<a class="headerlink" href="#debugging-hints" title="Permanent link">¶</a></h3>
|
||||
<ol>
|
||||
|
|
|
|||
|
|
@ -1085,10 +1085,51 @@
|
|||
<ol>
|
||||
<li>Deploy the controller by creating the rc in the parent dir</li>
|
||||
<li>Create tls secrets for foo.bar.com and bar.baz.com as indicated in the yaml</li>
|
||||
<li>Create multi-tls.yaml</li>
|
||||
<li>Create <a href="multi-tls.yaml">multi-tls.yaml</a></li>
|
||||
</ol>
|
||||
<p>This should generate a segment like:
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl <span class="nb">exec</span> -it nginx-ingress-controller-6vwd1 -- cat /etc/nginx/nginx.conf <span class="p">|</span> grep <span class="s2">"foo.bar.com"</span> -B <span class="m">7</span> -A <span class="m">35</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37
|
||||
38
|
||||
39
|
||||
40
|
||||
41
|
||||
42</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl <span class="nb">exec</span> -it nginx-ingress-controller-6vwd1 -- cat /etc/nginx/nginx.conf <span class="p">|</span> grep <span class="s2">"foo.bar.com"</span> -B <span class="m">7</span> -A <span class="m">35</span>
|
||||
<span class="go"> server {</span>
|
||||
<span class="go"> listen 80;</span>
|
||||
<span class="go"> listen 443 ssl http2;</span>
|
||||
|
|
@ -1130,9 +1171,46 @@
|
|||
|
||||
<span class="go"> proxy_pass http://default-http-svc-80;</span>
|
||||
<span class="go"> }</span>
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>And you should be able to reach your nginx service or http-svc service using a hostname switch:
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl get ing
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl get ing
|
||||
<span class="go">NAME RULE BACKEND ADDRESS AGE</span>
|
||||
<span class="go">foo-tls - 104.154.30.67 13m</span>
|
||||
<span class="go"> foo.bar.com</span>
|
||||
|
|
@ -1169,7 +1247,8 @@
|
|||
|
||||
<span class="gp">$</span> curl <span class="m">104</span>.154.30.67
|
||||
<span class="go">default backend - 404</span>
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1245,7 +1245,24 @@ and that you have an ingress controller <a href="../../deploy">running</a> in yo
|
|||
<h2 id="validation">Validation<a class="headerlink" href="#validation" title="Permanent link">¶</a></h2>
|
||||
<h3 id="rewrite-target">Rewrite Target<a class="headerlink" href="#rewrite-target" title="Permanent link">¶</a></h3>
|
||||
<p>Create an Ingress rule with a rewrite annotation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> <span class="nb">echo</span> <span class="s2">"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> <span class="nb">echo</span> <span class="s2">"</span>
|
||||
<span class="go">apiVersion: extensions/v1beta1</span>
|
||||
<span class="go">kind: Ingress</span>
|
||||
<span class="go">metadata:</span>
|
||||
|
|
@ -1264,9 +1281,48 @@ and that you have an ingress controller <a href="../../deploy">running</a> in yo
|
|||
<span class="go"> path: /something</span>
|
||||
<span class="go">" | kubectl create -f -</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Check the rewrite is working</p>
|
||||
<div class="codehilite"><pre><span></span>$ curl -v http://172.17.4.99/something -H <span class="s1">'Host: rewrite.bar.com'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37
|
||||
38
|
||||
39</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl -v http://172.17.4.99/something -H <span class="s1">'Host: rewrite.bar.com'</span>
|
||||
* Trying <span class="m">172</span>.17.4.99...
|
||||
* Connected to <span class="m">172</span>.17.4.99 <span class="o">(</span><span class="m">172</span>.17.4.99<span class="o">)</span> port <span class="m">80</span> <span class="o">(</span><span class="c1">#0)</span>
|
||||
> GET /something HTTP/1.1
|
||||
|
|
@ -1306,10 +1362,28 @@ BODY:
|
|||
* Connection <span class="c1">#0 to host 172.17.4.99 left intact</span>
|
||||
-no body in request-
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="app-root">App Root<a class="headerlink" href="#app-root" title="Permanent link">¶</a></h3>
|
||||
<p>Create an Ingress rule with a app-root annotation:
|
||||
<div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s2">"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s2">"</span>
|
||||
<span class="s2">apiVersion: extensions/v1beta1</span>
|
||||
<span class="s2">kind: Ingress</span>
|
||||
<span class="s2">metadata:</span>
|
||||
|
|
@ -1327,9 +1401,17 @@ BODY:
|
|||
<span class="s2"> servicePort: 80</span>
|
||||
<span class="s2"> path: /</span>
|
||||
<span class="s2">"</span> <span class="p">|</span> kubectl create -f -
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>Check the rewrite is working</p>
|
||||
<div class="codehilite"><pre><span></span>$ curl -I -k http://approot.bar.com/
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl -I -k http://approot.bar.com/
|
||||
HTTP/1.1 <span class="m">302</span> Moved Temporarily
|
||||
Server: nginx/1.11.10
|
||||
Date: Mon, <span class="m">13</span> Mar <span class="m">2017</span> <span class="m">14</span>:57:15 GMT
|
||||
|
|
@ -1338,6 +1420,7 @@ Content-Length: <span class="m">162</span>
|
|||
Location: http://stickyingress.example.com/app1
|
||||
Connection: keep-alive
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1196,25 +1196,48 @@ nodes get static IPs, the IPs are not retained across upgrade.</p>
|
|||
<p>To acquire a static IP for the nginx ingress controller, simply put it
|
||||
behind a Service of <code class="codehilite">Type=LoadBalancer</code>.</p>
|
||||
<p>First, create a loadbalancer Service and wait for it to acquire an IP</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f static-ip-svc.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f static-ip-svc.yaml
|
||||
<span class="go">service "nginx-ingress-lb" created</span>
|
||||
|
||||
<span class="gp">$</span> kubectl get svc nginx-ingress-lb
|
||||
<span class="go">NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE</span>
|
||||
<span class="go">nginx-ingress-lb 10.0.138.113 104.154.109.191 80:31457/TCP,443:32240/TCP 15m</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>then, update the ingress controller so it adopts the static IP of the Service
|
||||
by passing the <code class="codehilite">--publish-service</code> flag (the example yaml used in the next step
|
||||
already has it set to "nginx-ingress-lb").</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f nginx-ingress-controller.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f nginx-ingress-controller.yaml
|
||||
<span class="go">deployment "nginx-ingress-controller" created</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="assigning-the-ip-to-an-ingress">Assigning the IP to an Ingress<a class="headerlink" href="#assigning-the-ip-to-an-ingress" title="Permanent link">¶</a></h2>
|
||||
<p>From here on every Ingress created with the <code class="codehilite">ingress.class</code> annotation set to
|
||||
<code class="codehilite">nginx</code> will get the IP allocated in the previous step</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f nginx-ingress.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl create -f nginx-ingress.yaml
|
||||
<span class="go">ingress "nginx-ingress" created</span>
|
||||
|
||||
<span class="gp">$</span> kubectl get ing nginx-ingress
|
||||
|
|
@ -1231,10 +1254,19 @@ already has it set to "nginx-ingress-lb").</p>
|
|||
<span class="go">request_uri=http://104.154.109.191:8080/</span>
|
||||
<span class="go">...</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="retaining-the-ip">Retaining the IP<a class="headerlink" href="#retaining-the-ip" title="Permanent link">¶</a></h2>
|
||||
<p>You can test retention by deleting the Ingress</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl delete ing nginx-ingress
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl delete ing nginx-ingress
|
||||
<span class="go">ingress "nginx-ingress" deleted</span>
|
||||
|
||||
<span class="gp">$</span> kubectl create -f nginx-ingress.yaml
|
||||
|
|
@ -1244,6 +1276,7 @@ already has it set to "nginx-ingress-lb").</p>
|
|||
<span class="go">NAME HOSTS ADDRESS PORTS AGE</span>
|
||||
<span class="go">nginx-ingress * 104.154.109.191 80, 443 13m</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<blockquote>
|
||||
<p>Note that unlike the GCE Ingress, the same loadbalancer IP is shared amongst all
|
||||
|
|
@ -1252,14 +1285,29 @@ controllers.</p>
|
|||
</blockquote>
|
||||
<h2 id="promote-ephemeral-to-static-ip">Promote ephemeral to static IP<a class="headerlink" href="#promote-ephemeral-to-static-ip" title="Permanent link">¶</a></h2>
|
||||
<p>To promote the allocated IP to static, you can update the Service manifest</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc nginx-ingress-lb -p <span class="s1">'{"spec": {"loadBalancerIP": "104.154.109.191"}}'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl patch svc nginx-ingress-lb -p <span class="s1">'{"spec": {"loadBalancerIP": "104.154.109.191"}}'</span>
|
||||
<span class="go">"nginx-ingress-lb" patched</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>and promote the IP to static (promotion works differently for cloudproviders,
|
||||
provided example is for GKE/GCE)
|
||||
`
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> gcloud compute addresses create nginx-ingress-lb --addresses <span class="m">104</span>.154.109.191 --region us-central1
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> gcloud compute addresses create nginx-ingress-lb --addresses <span class="m">104</span>.154.109.191 --region us-central1
|
||||
<span class="go">Created [https://www.googleapis.com/compute/v1/projects/kubernetesdev/regions/us-central1/addresses/nginx-ingress-lb].</span>
|
||||
<span class="go">---</span>
|
||||
<span class="go">address: 104.154.109.191</span>
|
||||
|
|
@ -1273,7 +1321,8 @@ provided example is for GKE/GCE)
|
|||
<span class="go">status: IN_USE</span>
|
||||
<span class="go">users:</span>
|
||||
<span class="go">- us-central1/forwardingRules/a09f6913ae80e11e6a8c542010af0000</span>
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>Now even if the Service is deleted, the IP will persist, so you can recreate the
|
||||
Service with <code class="codehilite">spec.loadBalancerIP</code> set to <code class="codehilite">104.154.109.191</code>.</p>
|
||||
|
||||
|
|
|
|||
|
|
@ -54,5 +54,4 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
args:
|
||||
- /nginx-ingress-controller
|
||||
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
|
||||
- --publish-service=$(POD_NAMESPACE)/nginx-ingress-lb
|
||||
|
|
|
|||
|
|
@ -1160,12 +1160,59 @@
|
|||
<h2 id="deployment">Deployment<a class="headerlink" href="#deployment" title="Permanent link">¶</a></h2>
|
||||
<p>The following command instructs the controller to terminate traffic using the provided
|
||||
TLS cert, and forward un-encrypted HTTP traffic to the test HTTP service.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl apply -f ingress.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl apply -f ingress.yaml</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h2 id="validation">Validation<a class="headerlink" href="#validation" title="Permanent link">¶</a></h2>
|
||||
<p>You can confirm that the Ingress works.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl describe ing nginx-test
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29
|
||||
30
|
||||
31
|
||||
32
|
||||
33
|
||||
34
|
||||
35
|
||||
36
|
||||
37
|
||||
38
|
||||
39
|
||||
40
|
||||
41
|
||||
42
|
||||
43
|
||||
44
|
||||
45
|
||||
46
|
||||
47</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="gp">$</span> kubectl describe ing nginx-test
|
||||
<span class="go">Name: nginx-test</span>
|
||||
<span class="go">Namespace: default</span>
|
||||
<span class="go">Address: 104.198.183.6</span>
|
||||
|
|
@ -1213,6 +1260,7 @@ TLS cert, and forward un-encrypted HTTP traffic to the test HTTP service.</p>
|
|||
<span class="go">x-forwarded-proto=https</span>
|
||||
<span class="go">BODY:</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue