K8s部署Nginx集群,通过Ingress实现HTTPS域名访问过程

apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=dong.nginx.com"
kubectl create secret tls nginx-ssl-cert --cert=tls.crt --key=tls.key --namespace=default

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - dong.nginx.com
    secretName: nginx-tls-secret
  rules:
  - host: dong.nginx.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx
            port:
              number: 80

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  default.conf: |
    server {
      listen 80;
      server_name _;
      root /usr/share/nginx/html;
      index index.html;

      location / {
        try_files $uri $uri/ =404;
      }

      autoindex off;

      location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
        expires 30d;
        add_header Cache-Control "public";
      }
    }

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: html-pvc
spec:
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-web-cluster
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80
        volumeMounts:
        - name: config
          mountPath: /etc/nginx/conf.d
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
      - name: config
        configMap:
          name: nginx-config
      - name: html
        persistentVolumeClaim:
          claimName: html-pvc

curl -H "Host:dong.nginx.com" https://192.168.1.73:31237 -k
#证书是自签名的，不在curl的CA信任库中，需要通过-k或--insecure选项来跳过证书验证

# 1. 查看重定向信息
curl -I http://dong.nginx.com:31441

# 2. 自动跟随重定向获取最终内容
curl -L http://dong.nginx.com:31441

# 3. 或者使用详细模式查看整个过程
curl -v -L http://dong.nginx.com:31441