让 HTTPS 与 Traefik 和 GCE Ingress 一起工作

Question

我追求一个非常简单的要求 - 但在外部负载均衡器后面时，似乎不可能让 Traefik 将流量从 HTTP 重定向到 HTTPS。

这是我的 GCE 入口

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  namespace: platform
  name: public-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "kubernetes-cluster-dev-ip"
    kubernetes.io/ingress.class: "gce"
    ingress.gcp.kubernetes.io/pre-shared-cert: "application-dev-ssl,application-dev-graphql-ssl"
spec:
  backend:
    serviceName: traefik-ingress-service
    servicePort: 80

从 HTTP(S) 接收流量然后转发到 Traefik 到端口 80。

我最初尝试使用 Traefik 的重定向方式匹配架构与此配置：

[entryPoints]
  [entryPoints.http]
    address = ":80"
    compress = true
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
    address = ":443"
    compress = true
    [entryPoints.https.tls] 

但显然会进入无限重定向循环，因为负载均衡器总是将流量代理到 Traefik 端口 80。

完成这项工作的简单解决方案正是 GCE 所建议的 https://github.com/kubernetes/ingress-gce#ingress-cannot-redirect-http-to-https

能够检查http_x_forwarded_proto 标头并基于此进行重定向。

Nginx 等效

# Replace '_' with your hostname.
server_name _;
if ($http_x_forwarded_proto = "http") {
    return 301 https://$host$request_uri;
}

请有人建议使用 Traefik 处理此问题的最佳方法是什么！

Answer 1

回顾一下，您有一个 GCE L7（第 7 层）负载平衡器代理 Traefik 中的另一个 L7 负载平衡器，您可以使用它来代理另一个后端服务。所以看起来你有这样的东西：

GCE L7 LB HTTP 80
=> Forwarded to Traefik HTTP 80
=> Redirect initial request to HTTPS 443 
=> The client thinks it needs to talk to GCE L7 LB HTTPS 443
=> GCE L7 LB HTTP 443
=> Forwarded to Traefik HTTP 80
=> Infinite loop

你需要有这样的东西：

GCE L7 LB HTTP 80
=> Forwarded to Traefik HTTP 80
=> Redirect initial request to HTTPS 443 
=> The client thinks it needs to talk to GCE L7 LB HTTPS 443
=> GCE L7 LB HTTP 443
=> Forwarded to Traefik HTTP 443

如果 Traefik 基于 http_x_forwarded_proto 的值为 http 重定向到 HTTPS，则没有任何记录，但这是一般假设。无论如何，Ingress 对 HTTPS 后端一无所知（您没有指定如何配置 HTTPS GCE LB 端点）。

您可以看到它记录了here 如何使 GCE LB 直接创建一个 HTTPS 端点，该端点直接转发到您的 HTTPS 后端。基本上，您可以尝试在 HTTPS Traefik 服务中添加service.alpha.kubernetes.io/app-protocols 注解：

apiVersion: v1
kind: Service
metadata:
  name: traefik-https
  annotations:
      service.alpha.kubernetes.io/app-protocols: '{"my-https-port":"HTTPS"}'
  labels:
    app: echo
spec:
  type: NodePort
  ports:
  - port: 443
    protocol: TCP
    name: my-https-port
  selector:
    app: traefik

所以你会有这样的东西：

GCE L7 LB HTTP 80
=> Forwarded to Traefik HTTP 80
=> Redirect initial request to HTTPS 443 
=> The client thinks it needs to talk to GCE L7 LB HTTPS 443
=> GCE L7 LB HTTP 443
=> Forwarded to Traefik HTTPS service
=> Service forward to Traefik port 443

希望这会有所帮助。