## 需求說明： 公司內部一些業務系統對安全性要求比較高，例如mis、bi等，這些業務系統只允許公司內部人員訪問，而且要求瀏覽器要安裝證書登錄，對公司入職有需求的人員開通證書，流失的人員注銷證書。 ## 通常我們在nginx 配置https 雙向證書有如下配置： ### Nginx HTTPS雙向認證配置參考 server { listen 443 ssl; ssl_protocols TLSv1 TLSv1.1; server_name www.example.com; #域名 ssl_certificate www.example.com.crt; #第三方或自簽發的證書 ssl_certificate_key www.example.com.key; #和證書配對的私鑰 ssl_verify_client on; #驗證請求來源 ssl_client_certificate ca.crt; #CA根證書 ssl_verify_depth 2; ssl_crl ssl/dr-crl.chain.pem; # 客戶端證書鏈 location / { root html; index index.html index.htm; } } ### 創建一個CA證書 secret 一個完整的ca.crt 證書應該包含證書鏈和根證書 cat ca-chain.cert.pem dr-crl.chain.pem >> ca.crt kubectl create secret generic auth-tls-chain --from-file=ca.crt=ca.crt -n ftc-demo - ca-chain.cert.pem 根證書 - dr-crl.chain.pem 客戶端證書鏈 [Github 參考鏈接：Creating the CA Authentication secret](https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/PREREQUISITES.md#creating-the-ca-authentication-secret) [Github 參考鏈接：Client Certificate Authentication](https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/client-certs) ### 創建一個 服務端證書secret kubectl create secret generic corp.dianrong.com-secret --from-file=tls.crt=corp.dianrong.com.crt --from-file=tls.key=corp.dianrong.com.pem.key -n dr-demo kubectl create secret tls corp.dianrong.com-secret --cert corp.dianrong.com.crt --key corp.dianrong.com.pem.key -n dr-demo ### 添加雙向證書ingress 服務 # cat saas-admin-demo.corp.dalianyun.com.yaml apiVersion: extensions/v1beta1 kind: Ingress metadata: name: saas-admin-demo.corp.dalianyun.com-ingress namespace: ftc-demo annotations: kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/auth-tls-secret: ftc-demo/auth-tls-chain nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" nginx.ingress.kubernetes.io/auth-tls-verify-depth: "2" nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "false" spec: tls: - hosts: - saas-admin-demo.corp.dalianyun.com secretName: corp-dalianyun-secret rules: - host: saas-admin-demo.corp.dalianyun.com http: paths: - path: / backend: serviceName: ftc-saas-admin servicePort: 8080 ## 注意事項 kubespray 默認部署的ingress-nginx ssl-protocols 只開啟了SSLv2 協議。 我們需要添加TLSv1 TLSv1.1 TLSv1.2完整的 ssl 協議 cat ingress-nginx-cm.yml --- apiVersion: v1 kind: ConfigMap metadata: name: ingress-nginx namespace: kube-system labels: k8s-app: ingress-nginx data: map-hash-bucket-size: '128' ssl-protocols: "SSLv2 TLSv1 TLSv1.1 TLSv1.2" ### HTTPS 證書添加 kubectl create secret generic jiedai361.com-secret --from-file=tls.crt=jiedai361.com.pem --from-file=tls.key=jiedai361.com.key -n ftc-demo