前言

最近为了参加比赛总是在到处搭建 Kubernetes，前期图省事直接签了个证书用 Nginx 做四层反向代理，顺便进行了 SSL 安全保护，但是现在需要 SSL 保护的域名越来越多，手动签发证书实在是太累人了，而且这些东西需要多次使用， 便想着记录下来方便下次使用。

实践

四层负载均衡

四层负载均衡方面，我选择了自己最熟悉的 Nginx + Stream 对七层反向代理 Traefik 进行负载均衡。

Nginx Stream 模块并不是默认安装模块，我们有两种方案安装它：

1. 编译安装 Nginx
2. 通过包管理器动态安装模块 (推荐)

这里我们介绍下通过包管理器动态安装模块的方案，在 Centos 下直接无脑安装即可：

yum -y install nginx-mod-stream

安装完成后我们来编写配置文件：

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

stream {
    log_format basic '$remote_addr [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time';
    access_log /var/log/nginx/stream-access.log basic buffer=32k;
    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.stream;
}

upstream flowersay@80 {

    server 192.168.10.117:31655;
    server 192.168.10.34:31655;
    server 192.168.10.62:31655;
  
}

server {

    listen 80;
    proxy_pass flowersay@80;
  
}

upstream flowersay@443 {

    server 192.168.10.117:31721;
    server 192.168.10.34:31721;
    server 192.168.10.62:31721;
  
}

server {

    listen 443;
    proxy_pass flowersay@443;
  
}

七层负载均衡

请通过 Helm 无脑安装 Traefik 即可 (/狗头保命)

CertManager

请通过 Helm 无脑安装 CertManager (/梅开二度)

嗷，对了，记得 installCRDs 要设置为 true 要不然创建 ClusterIssuer 会报错！

创建一个 ClusterIssuer，以 Let's encrypt 为签发者：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: 1340761826@qq.com
    preferredChain: ''
    privateKeySecretRef:
      name: letsencrypt-prod
    server: 'https://acme-v02.api.letsencrypt.org/directory'
    solvers:
      - http01:
          ingress:
            ingressTemplate:
              metadata:
                annotations:
                  kubernetes.io/ingress.class: traefik
            serviceType: ClusterIP

创建一个证书试验下吧！

kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: keycloak
  namespace: flowersay
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubesphere.io/creator: admin
    traefik.ingress.kubernetes.io/router.middlewares: flowersay-keycloak@kubernetescrd
spec:
  tls:
    - hosts:
        - iam.api.liusuyun.com
      secretName: iam.api.liusuyun.com
  rules:
    - host: iam.api.liusuyun.com
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: keycloak
                port:
                  number: 8080

撒花~