MTLS（客户端）每kubernetes traefik Ingress路线
我有多个使用Traefik 2.6工作入口路线的服务，
所有入口路由使用注释都按预期工作，并且在使用args应用args的配置时，我没有出现错误的错误，请在pod本身中签到pod，traefik正在运行，traefik正在运行有了正确的参数，并且dynamic.conf文件和cert.pem已正确安装。
#dynamic.yml
tls:
options:
default:
clientAuth:
caFiles:
- /opt/traefik/cert.pem
clientAuthType: RequireAndVerifyClientCert
上面的配置将TLS选项应用于所有入口路由。
在为服务应用以下入学注释时，客户端不会提示证书：
将配置更改为以下内容：
#dynamic.yml
tls:
options:
mtls:
clientAuth:
caFiles:
- /opt/traefik/cert.pem
clientAuthType: RequireAndVerifyClientCert
...
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/tls.options: mtls
...
Ingress路由功能功能，但是，客户端可以在没有TLS的特定入口路由上查看网站而没有证书身份验证。选项“ mtls”。
I have multiple services with working ingress routes using traefik 2.6
All ingress routes work as expected using annotations and I get no errors showing when applying the configuration with args regarding file provider to "dynamic.yml" After checking in the pod itself, traefik is running with the correct arguments and that the dynamic.conf file and cert.pem are mounted correctly.
#dynamic.yml
tls:
options:
default:
clientAuth:
caFiles:
- /opt/traefik/cert.pem
clientAuthType: RequireAndVerifyClientCert
The configurations above applies the tls options to all ingress routes.
When applying the following ingress annotations for the service, clients do not get prompted for certs:
Changing the configuration to the following:
#dynamic.yml
tls:
options:
mtls:
clientAuth:
caFiles:
- /opt/traefik/cert.pem
clientAuthType: RequireAndVerifyClientCert
...
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/tls.options: mtls
...
The ingress routes function, however, clients are able to view the site without certificate authentication on the specific ingress route with tls.option "mtls".
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在这里找到答案：
httpps://doc.traefik.io/traefik.io/traefik/traefik/traefik/routing/routing/routing/routing/routing/profering/profering/proversprovers /kubernetes-ingress/＃注释
Found the answer here:
https://doc.traefik.io/traefik/routing/providers/kubernetes-ingress/#annotations