kubernetes部署nginx ssl aliyun aks

ssl

kubectl create secret tls tls-test-mycom-com -n dpool \
  --cert=test.mycom.com.pem \
  --key=test.mycom.com.key \
  --dry-run -o yaml > tls-test.mycom.com.yaml
kubectl apply -f tls-test.mycom.com.yaml

test-nginx-config

apiVersion: v1
kind: ConfigMap
metadata:
  name: test-nginx-config
  namespace: dpool
data:
  default.conf: |
    server {
        listen       80;
        server_name  test.mycom.com;
        rewrite ^(.*)$  https://test.mycom.com$1 permanent;
    }

    server {
        listen 443 ssl http2;
        server_name test.mycom.com;
        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        #注意，用上面生成的secret，pem格式文件也重命名为tls.crt
        ssl_certificate     ssl/tls.crt;
        ssl_certificate_key ssl/tls.key;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 1440m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
        ssl_buffer_size 2k;

        #access_log  /var/log/nginx/test.mycom.com.log;



        location / {

            proxy_pass http://go-test:8081;
            proxy_http_version 1.1;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Origin "";
        }

    }

deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-nginx
  namespace: dpool
spec:
  selector:
    matchLabels:
      app: test-nginx
  template:
    metadata:
      annotations:
        k8s.aliyun.com/pod-eip-instanceid: eip-2222222222222222
        k8s.aliyun.com/pod-with-eip: 'true'
      labels:
        app: test-nginx
    spec:
      containers:
      - name: test-nginx
        image: nginx
        volumeMounts:
        - name: test-nginx-config
          mountPath: /etc/nginx/conf.d
        - name: test-nginx-ssl
          mountPath: /etc/nginx/ssl
        ports:
        - name: http
          containerPort: 80
        - name: https
          containerPort: 443
        imagePullPolicy: IfNotPresent
      volumes:
        - name: test-nginx-config
          configMap:
            name: test-nginx-config
        - name: test-nginx-ssl
          secret:
            secretName: tls-test-mycom-com