AK具有AGIC和应用程序网关

发布于 2025-02-03 18:36:02 字数 1224 浏览 5 评论 0原文

我有一个启用附加AGIC的AKS群集（将在不久的将来尝试将其转换为基于头盔的Agic）。目前，我在此群集上有一个应用程序，将入口设置为应用程序网关。目前，这在港口80上完美工作。

如果我想启用SSL，我是否只需要在App Gateway上添加证书，然后在此类部署中引用该证书？（例如，取自 https://thewindowsupdate.com/2021/10/19/what-does-it-it-mean-for-the--the--papplication-gateway-gateway-gateway-gateway-gateway-gateway-controller-controller-troller-agic-to-to-magic-magic-magic-mume -Full-Allower/

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: aspnetapp
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: <name of your certificated added to Application Gateway>
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  rules:
  - http:
      paths:
      - path: /
        backend:
          serviceName: aspnetapp
          servicePort: 80

尽管将服务端口设置为上面的80，但App GW会自动应用于80或443吗？自动加密

哪些方面

原文

I have an AKS cluster with the add-on AGIC enabled (will try and convert it into Helm based AGIC in the near future). At the moment I have an application on this cluster with the Ingress set to the Application Gateway. This works perfectly on port 80 at the moment.

If I want to enable SSL, do I just need to add the certificate at the App Gateway and then reference that in deployment as such? (example taken from https://thewindowsupdate.com/2021/10/19/what-does-it-mean-for-the-application-gateway-ingress-controller-agic-to-assume-full-ownership/

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: aspnetapp
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: <name of your certificated added to Application Gateway>
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  rules:
  - http:
      paths:
      - path: /
        backend:
          serviceName: aspnetapp
          servicePort: 80

Although the service port is set to 80 above, will the App GW apply TLS automatically? Should the service port above be 80 or 443? Or does it not matter since the SSL Redirect is set? Also what aspects does this encrypt automatically?

External -> App GW ?
App GW -> Ingress ?

Also, do I need another certificate for the external side of App GW as well? Or do I need just the one cert?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

薄荷港 2025-02-10 18:36:02

AGIC will create:

2 listeners: HTTP on port 80 and HTTPS on port 443. The HTTPS listener will be configured with the SSL certificate from appgw.ingress.kubernetes.io/appgw-ssl-certificate
2 routing规则：将HTTP侦听器流量重定向到HTTPS侦听器的规则。 HTTPS侦听器将被配置为以AKS为目标。

默认情况下，AGIC将进行TLS终止，因此App Gateway和AKS群集之间的流量将使用HTTP（不是HTTPS）协议。配置的端口将是服务的targetPort中配置的端口。

另一方面，您应该以前看过此警告：

extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress

您应该更新agic以使用最新版本并将您的清单更改为使用networking.k8s.io/v1 intress：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: aspnetapp
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: "<name of your certificate added to Application Gateway>"
spec:
  rules:
...

AGIC will create:

2 listeners: HTTP on port 80 and HTTPS on port 443. The HTTPS listener will be configured with the SSL certificate from appgw.ingress.kubernetes.io/appgw-ssl-certificate
2 routing rules: one to redirect the http listener traffic to the https listener. The https listener will be configure to target your backend on AKS.

By default AGIC will do TLS termination so the traffic between app gateway and the aks cluster will be using HTTP (not HTTPS) protocol. The port configured will be the port configured in the targetPort of your service.

On another note, you should have seen this warning before:

extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress

You should update AGIC to use latest version and change your manifest to use networking.k8s.io/v1 Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: aspnetapp
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: "<name of your certificate added to Application Gateway>"
spec:
  rules:
...

回复收藏 0 原文

~没有更多了~