公司目前使用的helm kong kubernetes ingress作为的api gateway。使用kong来做http自动跳https本身不难做到，https://github.com/Kong/kong/issues/1946#issuecomment-272970569。然鹅，和ingress以及helm挂钩之后，显得鹅外难配置。这里参考了其他博主的做法，配合公司使用的aws服务，最终解法如下。
图解
最普通的nginx反向代理：
@startuml web
interface ip
card "domain name 1" as dn1
card "domain name 2" as dn2
card "service 1" as s1
card "service 2" as s2
agent nginx
dn1 --> ip
ip --> nginx: "port:80/443"
nginx --> s1
dn2 -[#7FFFAA]-> ip
nginx -[#7FFFAA]-> s2
@enduml
解决方案
@startuml web
card "https:// domain name" as dn1
card "http:// domain name" as dn2
agent "aws load balance" as alb
rectangle kubernetes {
agent "kong kubernetes ingress(api gateway)" as kki
card "http2https services" as hs
}
dn1 --> alb: "port:443"
dn2 -[#7FFFAA]-> alb: "prot:80"
interface ip1
interface ip2
card "k8s node 1" as kn1
card "k8s node 2" as kn2
ip1 -- kn1
ip2 -- kn2
alb --> kki
kki -- ip1
kki -- ip2
alb -[#7FFFAA]-> hs
hs -[#7FFFAA]-> dn1
@enduml
⚠️注意，这里域名为同一个，可以有很多个，拿一个举例子
http2https服务
现在就是http至https服务的跳转了。
看到一篇博客提到通过html跳转，经典例子就是百度，
$ curl baidu.com -v
得到内容
* Rebuilt URL to: baidu.com/
* Trying 220.181.57.216...
* Connected to baidu.com (220.181.57.216) port 80 (#0)
> GET / HTTP/1.1
> Host: baidu.com
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Tue, 25 Dec 2018 04:16:38 GMT
< Server: Apache
< Last-Modified: Tue, 12 Jan 2010 13:48:00 GMT
< ETag: "51-47cf7e6ee8400"
< Accept-Ranges: bytes
< Content-Length: 81
< Cache-Control: max-age=86400
< Expires: Wed, 26 Dec 2018 04:16:38 GMT
< Connection: Keep-Alive
< Content-Type: text/html
<
<html>
<meta http-equiv="refresh" content="0;url=http://www.baidu.com/">
</html>
* Connection #0 to host baidu.com left intact
可以看到它的html利用了meta标签的跳转，然鹅，meta是最先加载的，这种只能写死地址。并不能做到多域名共用，我们可以写个类似html，如下：
<html><script>window.location.href=`https://${location.host}${location.pathname}`</script></html>
⚠️然鹅这种页面跳转并不能做到http携带子路径跳转到https。
最终还是使用nginx配置文件来达到跳转目的。
文件
- defalut.conf
server {
listen 80 default_server;
return 301 https://$host$request_uri;
}
- Dockerfile
From nginx:1
ADD default.conf /etc/nginx/conf.d/default.conf
然后可以把此镜像放到k8s某ns目录下，如(这里镜像为public可以直接使用)：
echo "
---
kind: Service
apiVersion: v1
metadata:
name: http2https-service
spec:
type: NodePort
selector:
app: http2https
ports:
- protocol: TCP
port: 80
nodePort: 30080
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
name: http2https-deployment
spec:
replicas: 1
template:
metadata:
labels:
app: http2https
spec:
containers:
- name: http2https-controller
image: registry.cn-hangzhou.aliyuncs.com/goddy-test/nginx:1.1
ports:
- containerPort: 80
" | kubectl -n test apply -f -
然后，在aws load balance即alb添加listener
⚠️这里第二条为kong kubernetes ingress的proxy服务，别忘记将防火墙开启对应端口。
如果此k8s集群中有其他需要跳转的服务，都可以配置此服务的端口30080转http的80端口达到共用的目的。
至此，访问http://domain-name/xx/xxx 即可自动跳转至https://domain-name/xx/xxx
网友评论