无 TLS 终止的 Ingress Gateway

    本任务中的 HTTPS 示例服务是一个简单的 NGINX 服务。在接下来的步骤中，您首先在 Kubernetes 集群中创建一个 NGINX 服务。接着，通过网关给这个服务配置一个域名是 的访问入口。

    对于此任务，您可以使用自己喜欢的工具来生成证书和密钥。以下命令使用

    1. 创建根证书和私钥来为您的服务签名证书：

    2. 为 nginx.example.com 创建证书和私钥：

      1. $ openssl req -out nginx.example.com.csr -newkey rsa:2048 -nodes -keyout nginx.example.com.key -subj "/CN=nginx.example.com/O=some organization"
      2. $ openssl x509 -req -sha256 -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in nginx.example.com.csr -out nginx.example.com.crt
      1. $ kubectl create secret tls nginx-server-certs --key nginx.example.com.key --cert nginx.example.com.crt

    2. 为 NGINX 服务创建一个配置文件：

      1. $ cat <<\EOF > ./nginx.conf
      2. events {
      3. }
      5. http {
      6.   log_format main '$remote_addr - $remote_user [$time_local]  $status '
      7.   '"$request" $body_bytes_sent "$http_referer" '
      8.   '"$http_user_agent" "$http_x_forwarded_for"';
      9.   access_log /var/log/nginx/access.log main;
      10.   error_log  /var/log/nginx/error.log;
      12.   server {
      13.     listen 443 ssl;
      15.     root /usr/share/nginx/html;
      16.     index index.html;
      18.     server_name nginx.example.com;
      19.     ssl_certificate /etc/nginx-server-certs/tls.crt;
      20.     ssl_certificate_key /etc/nginx-server-certs/tls.key;
      21.   }
      22. }
      23. EOF

    3. 创建一个 Kubernetes 的 ConfigMap 资源来保存 NGINX 服务的配置：

    4. 部署 NGINX 服务

      1. $ cat <<EOF | istioctl kube-inject -f - | kubectl apply -f -
      2. apiVersion: v1
      3. kind: Service
      4. metadata:
      5.   name: my-nginx
      6.   labels:
      7.     run: my-nginx
      8. spec:
      9.   ports:
      10.   - port: 443
      11.     protocol: TCP
      12.   selector:
      13.     run: my-nginx
      14. ---
      15. apiVersion: apps/v1
      16. metadata:
      17.   name: my-nginx
      18. spec:
      19.   selector:
      20.     matchLabels:
      22.   replicas: 1
      23.   template:
      24.     metadata:
      25.       labels:
      26.         run: my-nginx
      27.     spec:
      28.       containers:
      29.       - name: my-nginx
      30.         image: nginx
      31.         ports:
      32.         - containerPort: 443
      33.         volumeMounts:
      34.         - name: nginx-config
      35.           mountPath: /etc/nginx
      36.           readOnly: true
      37.         - name: nginx-server-certs
      38.           mountPath: /etc/nginx-server-certs
      39.           readOnly: true
      40.       volumes:
      41.       - name: nginx-config
      42.         configMap:
      43.           name: nginx-configmap
      44.       - name: nginx-server-certs
      45.         secret:
      46.           secretName: nginx-server-certs
      47. EOF

    5. 要测试 NGINX 服务是否已成功部署，需要从其 Sidecar 代理发送请求，并忽略检查服务端的证书（使用 curl 的 -k 选项）。确保正确打印服务端的证书，即 common name (CN) 等于 nginx.example.com。

      1. $ kubectl exec "$(kubectl get pod  -l run=my-nginx -o jsonpath={.items..metadata.name})" -c istio-proxy -- curl -sS -v -k --resolve nginx.example.com:443:127.0.0.1 https://nginx.example.com
      2. ...
      3. SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
      4. ALPN, server accepted to use http/1.1
      5. Server certificate:
      6.   subject: CN=nginx.example.com; O=some organization
      7.   start date: May 27 14:18:47 2020 GMT
      8.   expire date: May 27 14:18:47 2021 GMT
      9.   issuer: O=example Inc.; CN=example.com
      10.   SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
      12. > GET / HTTP/1.1
      13. > User-Agent: curl/7.58.0
      14. > Host: nginx.example.com
      15. ...
      16. < HTTP/1.1 200 OK
      18. < Server: nginx/1.17.10
      19. <!DOCTYPE html>
      20. <html>
      21. <head>
      22. <title>Welcome to nginx!</title>
      23. ...
      1. $ kubectl apply -f - <<EOF
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: mygateway
      6. spec:
      7.   selector:
      8.     istio: ingressgateway # use istio default ingress gateway
      9.   servers:
      10.   - port:
      11.       number: 443
      12.       name: https
      13.       protocol: HTTPS
      14.     tls:
      15.       mode: PASSTHROUGH
      16.     hosts:
      17.     - nginx.example.com
      18. EOF

    2. 为通过 Gateway 进入的流量配置路由：

    3. 根据中的指令来定义环境变量 SECURE_INGRESS_PORT 和 INGRESS_HOST。

    4. 从集群外访问 NGINX 服务。注意，服务端返回了正确的证书，并且该证书已成功验证（输出了 _SSL certificate verify ok_）。

      1. $ curl -v --resolve "nginx.example.com:$SECURE_INGRESS_PORT:$INGRESS_HOST" --cacert example.com.crt "https://nginx.example.com:$SECURE_INGRESS_PORT"
      2. Server certificate:
      3.   subject: CN=nginx.example.com; O=some organization
      4.   start date: Wed, 15 Aug 2018 07:29:07 GMT
      5.   expire date: Sun, 25 Aug 2019 07:29:07 GMT
      6.   issuer: O=example Inc.; CN=example.com
      7.   SSL certificate verify ok.
      9.   < HTTP/1.1 200 OK
      10.   < Server: nginx/1.15.2
      11.   ...
      12.   <html>
      13.   <head>
      14.   <title>Welcome to nginx!</title>

    1. 删除已创建的 Kubernetes 资源：

      1. $ kubectl delete secret nginx-server-certs
      2. $ kubectl delete configmap nginx-configmap
      3. $ kubectl delete service my-nginx
      4. $ kubectl delete deployment my-nginx
      5. $ kubectl delete gateway mygateway
      1. $ rm example.com.crt example.com.key nginx.example.com.crt nginx.example.com.key nginx.example.com.csr

    3. 删除本示例中生成的配置文件：