[쿠버네티스] Ingress TLL/SSL 설정

1. CA 인증서 개인 키를 생성합니다.
openssl genrsa -out ca.key 4096
2. CA 인증서를 생성합니다.
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Korea/L=Osong/O=invako/OU=Personal/CN=localhost" \
 -key ca.key \
 -out ca.crt

3. 서버 인증서를 생성합니다.
 1) 개인키(비밀키) 생성
openssl genrsa -out invako.kro.kr.key 4096
2) 인증서 서명 요청 CA루트인증서 (CSR)을 생성합니다.
openssl req -sha512 -new \
    -subj "/C=CN/ST=South/L=Osong/O=invako/OU=Personal/CN=invako.kro.kr" \
    -key invako.kro.kr.key \
    -out invako.kro.kr.csr
 3) x509 v3 확장 파일을 생성합니다.
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=invako.kro.kr
DNS.2=invako
DNS.3=master
EOF

 4) v3.ext 파일을 사용하여 Harbor 호스트에 대한 인증서를 생성한다
openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in invako.kro.kr.csr \
    -out invako.kro.kr.crt

4. 생성된 서버 인증서 키를 이용하여 시크릿을 생성합니다.

명령어 : kubectl create secret tls (시크릿 이름) --key (키네임).key --cert (키네임).crt

1) 시크릿 생성

  kubectl create secret tls tlssecret --key invako.kro.kr.key --cert invako.kro.kr.crt

root@master:~/certs# kubectl create secret tls tlssecret --key invako.kro.kr.key --cert invako.kro.kr.crt
secret/tlssecret created
/* 상세 */
root@master:~/certs# kubectl describe secrets tlssecret
Name:         tlssecret
Namespace:    ingress-nginx
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/tls

Data
====
tls.crt:  2130 bytes
tls.key:  3268 bytes

2) NGINX Ingress Controller 설치

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml

3) LoadBalancer 타입변경 LoadBalancer는 클라우드 public 업체에서만 지원

vi deploy.yaml

 spec:
347   externalTrafficPolicy: Local
348   ipFamilies:
349   - IPv4
350   ipFamilyPolicy: SingleStack
351   ports:
352   - appProtocol: http
353     name: http
354     port: 80
355     protocol: TCP
356     targetPort: http
# nodePort 추가
357     nodePort: 30100
358   - appProtocol: https
359     name: https
360     port: 443
361     protocol: TCP
362     targetPort: https
# nodePort 추가
363     nodePort: 30200
364   selector:
365     app.kubernetes.io/component: controller
366     app.kubernetes.io/instance: ingress-nginx
367     app.kubernetes.io/name: ingress-nginx
# type : NodePort 로 변경
368   type: NodePort

실행

kubectl create -f deploy.yaml

4) 설치확인

kubectl get all -n ingress-nginx

root@master:~/ingress# kubectl get all -n ingress-nginx
NAME                                            READY   STATUS      RESTARTS      AGE
pod/ingress-nginx-admission-create-9lf9s        0/1     Completed   0             3d
pod/ingress-nginx-admission-patch-27mdk         0/1     Completed   0             3d
pod/ingress-nginx-controller-68cf785489-58w26   1/1     Running     0             23h
pod/rabbitmq-deployment-5dbc5f7b99-pqbpr        1/1     Running     2 (25h ago)   3d17h

NAME                                         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                          AGE
service/ingress-nginx-controller             NodePort    10.110.66.239    <none>        80:30100/TCP,443:30200/TCP       3d
service/ingress-nginx-controller-admission   ClusterIP   10.104.76.166    <none>        443/TCP                          3d
service/rabbitmq                             NodePort    10.111.179.199   <none>        5672:30003/TCP,15672:30004/TCP   24h

NAME                                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ingress-nginx-controller   1/1     1            1           3d
deployment.apps/rabbitmq-deployment        1/1     1            1           3d17h

NAME                                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/ingress-nginx-controller-68cf785489   1         1         1       3d
replicaset.apps/rabbitmq-deployment-5dbc5f7b99        1         1         1       3d17h

NAME                                       COMPLETIONS   DURATION   AGE
job.batch/ingress-nginx-admission-create   1/1           8s         3d
job.batch/ingress-nginx-admission-patch    1/1           8s         3d

root@master:~/ingress# kubectl get pod -n ingress-nginx -o wide
NAME                                        READY   STATUS      RESTARTS      AGE     IP            NODE    NOMINATED NODE   READINESS GATES
ingress-nginx-admission-create-9lf9s        0/1     Completed   0             3d      <none>        node2   <none>           <none>
ingress-nginx-admission-patch-27mdk         0/1     Completed   0             3d      <none>        node2   <none>           <none>
ingress-nginx-controller-68cf785489-58w26   1/1     Running     0             23h     10.1.104.41   node2   <none>           <none>
rabbitmq-deployment-5dbc5f7b99-pqbpr        1/1     Running     2 (25h ago)   3d17h   10.1.135.29   node3   <none>           <none>

 

ingress 설치완료