apache - Kubernetes:无法使用apache和https部署Flask Web应用

Question

我在一台机器上有一个本地Kubernetes集群，并且我使用apache服务器成功部署了flask Web应用程序，因此集群设置应该没有任何问题。但是，我需要将网站升级到https，因此我使用letsencrypt生成ssl证书，并将它们批量映射到容器中。我还成功地在没有docker的情况下部署了该应用程序，即使用sudo /usr/sbin/apache2ctl -D FOREGROUND直接启动apache服务器。我可以毫无问题地通过https://XXX.XXX.XXX.edu访问我的网站。

但是，当我开始将所有内容放入Docker和Kubernetes中并访问https://XXX.XXX.XXX.edu:30001时，浏览器给了我这个错误:

This site can’t be reached

XXX.XXX.XXX.edu took too long to respond

这是我的部署方式:

我首先启动了 kubectl create -f web-service.yaml服务:

apiVersion: v1
kind: Service
metadata:
  name: web
  labels:
    name: web
    role: "ssl-proxy"
spec:
  type: NodePort
  ports:
    - nodePort: 30001
      name: "https"
      port: 443
      targetPort: 443
      protocol: "TCP"
    - nodePort: 30000
      name: "http"
      port: 80
      targetPort: 80
      protocol: "TCP"
  selector:
    name: web
    role: "ssl-proxy"

然后，我开始了pod kubectl create -f web-controller.yaml:

apiVersion: v1
kind: ReplicationController
metadata:
  labels:
    name: web
  name: web-controller
spec:
  replicas: 1
  selector:
    name: web
  template:
    metadata:
      labels:
        name: web
    spec:
      containers:
      - image: XXX/web_app
        command: ['/bin/sh', '-c']
        args: ['sudo a2enmod ssl && service apache2 restart && sudo /usr/sbin/apache2ctl -D FOREGROUND && python fake.py']
        name: web
        ports:
        - containerPort: 443
          name: http-server
        volumeMounts:
          - mountPath: /etc/letsencrypt/live/host
            name: test-volume
            readOnly: false
      volumes:
        - hostPath:
            path: /etc/letsencrypt/archive/XXX.XXX.XXX.edu
          name: test-volume

pods 的日志如下:

root@XXX:~# kubectl logs web-controller-ontne
Considering dependency setenvif for ssl:
Module setenvif already enabled
Considering dependency mime for ssl:
Module mime already enabled
Considering dependency socache_shmcb for ssl:
Module socache_shmcb already enabled
Module ssl already enabled
 * Restarting web server apache2
[Mon Jun 27 14:34:48.753153 2016] [so:warn] [pid 30:tid 140046645868416] AH01574: module ssl_module is already loaded, skipping
   ...done.
[Mon Jun 27 14:34:49.820047 2016] [so:warn] [pid 119:tid 139909591328640] AH01574: module ssl_module is already loaded, skipping
httpd (pid 33) already running
root@XXX:~# 

Pod正在运行，但是出现了以下Apache错误日志:

[Mon Jun 27 17:13:50.912683 2016] [ssl:warn] [pid 33:tid 140513871427456] AH01909: RSA certificate configured for 0.0.0.0i:443 does NOT include an ID which matches the server name

我认为问题在于，我正在使用NodePort并公开端口30001，因此我必须访问与 https://XXX.XXX.XXX.edu:30001不匹配的 XXX.XXX.XXX.edu(只是没有任意端口号30001的域名)。

这是我在docker容器中的 /etc/apache2/sites-available/000-default.conf:

<VirtualHost _default_:30001>
    DocumentRoot /usr/local/my_app

    LoadModule ssl_module /usr/lib64/apache2-prefork/mod_ssl.so
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/host/cert1.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/host/privkey1.pem
    SSLCertificateChainFile /etc/letsencrypt/live/host/chain1.pem

    WSGIDaemonProcess python-app user=www-data group=www-data threads=15 maximum-requests=10000 python-path=/usr/local/lib/python2.7/dist-p
ackages
    WSGIScriptAlias / /usr/local/my_app/apache/apache.wsgi
    WSGIProcessGroup python-app

    CustomLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/access.log.%Y%m%d-%H%M%S 5M" combined
    ErrorLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/error.log.%Y%m%d-%H%M%S 5M"
    LogLevel warn

    <Directory /usr/local/my_app>
        Order deny,allow
        Allow from all
        Require all granted
    </Directory>

</VirtualHost>

如何修改它，以便apache在端口30001而不是443上服务https请求？非常感谢你!

Answer 1

我自己找到了答案。原因2:(1)我忘记了在apache.wsgi中设置的特定于我的Web应用程序的环境变量； (2)原始apache配置文件中存在一些小错误。我在这里发布有效的/etc/apache2/sites-available/000-default.conf:

ServerName 0.0.0.0

<VirtualHost _default_:443>
    DocumentRoot /usr/local/my_app

    LoadModule ssl_module /usr/lib64/apache2-prefork/mod_ssl.so
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/host/cert1.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/host/privkey1.pem
    SSLCertificateChainFile /etc/letsencrypt/live/host/chain1.pem

    WSGIDaemonProcess python-app user=www-data group=www-data threads=15 maximum-requests=10000 python-path=/usr/local/lib/python2.7/dist-packages
    WSGIScriptAlias / /usr/local/my_app/apache/apache.wsgi
    WSGIProcessGroup python-app

    CustomLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/access.log.%Y%m%d-%H%M%S 5M" combined
    ErrorLog "|/usr/bin/rotatelogs /usr/local/my_app/apache/logs/error.log.%Y%m%d-%H%M%S 5M"
    LogLevel warn

    <Directory /usr/local/my_app>
        Order deny,allow
        Allow from all
        Require all granted
    </Directory>
</VirtualHost>

使用 sudo a2enmod ssl && sudo /usr/sbin/apache2ctl -D FOREGROUND命令启动pod，并且 containerPort应该为443。该服务的Kubernetes脚本非常简单，如下所示:

apiVersion: v1
kind: Service
metadata:
  name: web
  labels:
    name: web
spec:
  type: NodePort
  ports:
    - nodePort: 30001
      port: 443
      targetPort: 443
      protocol: TCP
  selector:
    name: web

现在，我可以访问我的网站 https://XXX.XXX.XXX.XXX:30001。

特别感谢 this github repo和NorbertvanNobelen的所有者。希望这可以帮助!