kubernetes - 在 Kubernetes 上覆盖 CORS 会导致连接错误

Question

我正在尝试为所有域启用 CORS 的测试(在我让用例正常工作后受到限制)。

据我所知，我应该添加 --cors-allowed-origins=["http://*"]给我的kube-apiserver.manifest
但是，当我尝试这样做时:

spec:
  containers:
  - command:
    - /bin/sh
    - -c
    - /usr/local/bin/kube-apiserver --address=127.0.0.1 --admission-control=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,ResourceQuota
      --allow-privileged=true --anonymous-auth=false --apiserver-count=1 --authorization-mode=AlwaysAllow
      --basic-auth-file=/srv/kubernetes/basic_auth.csv --client-ca-file=/srv/kubernetes/ca.crt
      --cloud-provider=aws --etcd-servers-overrides=/events#http://127.0.0.1:4002
      --etcd-servers=http://127.0.0.1:4001 --insecure-port=8080 --kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP
      --proxy-client-cert-file=/srv/kubernetes/apiserver-aggregator.cert --proxy-client-key-file=/srv/kubernetes/apiserver-aggregator.key
      --requestheader-allowed-names=aggregator --requestheader-client-ca-file=/srv/kubernetes/apiserver-aggregator-ca.cert
      --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group
      --requestheader-username-headers=X-Remote-User --secure-port=443 --service-cluster-ip-range=100.64.0.0/13
      --storage-backend=etcd2 --tls-cert-file=/srv/kubernetes/server.cert --tls-private-key-file=/srv/kubernetes/server.key
      --token-auth-file=/srv/kubernetes/known_tokens.csv --v=2 2>&1 | /bin/tee -a
      --cors-allowed-origins=["https://*"]

尝试使用 kubectl get pods 时出现以下错误:

The connection to the server 127.0.0.1 was refused - did you specify the right host or port?

我到底做错了什么设置？如何将 CORS 域添加到 Kubernetes？

编辑:我现在正在尝试这个:

- kube-apiserver
  --cors-allowed-origins=["https://*"]

我的 pod 不再崩溃，但是我的应用程序中仍然存在 CORS 问题。

我收到这样的错误:

[Error] Origin http://localhost:8080 is not allowed by Access-Control-Allow-Origin.
[Error] XMLHttpRequest cannot load https://example.com/auth/realms/name/protocol/openid-connect/token due to access control checks.
[Error] Failed to load resource: Origin http://localhost:8080 is not allowed by Access-Control-Allow-Origin. (token, line 0)
[Error] Preflight response is not successful
[Error] XMLHttpRequest cannot load https://example.com/api/v1/users/me/profile? due to access control checks.

Answer 1

看起来您正在尝试使用 http 协议(protocol)访问您的 api-server，请尝试:

--cors-allowed-origins=["http://*"]