amazon-web-services - AWS Kubernetes : Selecting SSL Certificate on AWS Load Balancer

Question

我正在尝试为我的 AWS EKS 集群的 AWS 负载均衡器配置 SSL。负载均衡器代理到 Traefik在我的集群上运行的实例。这在 HTTP 上运行良好。

然后我在证书管理器中创建了我的 AWS 证书，复制了 ARN 并遵循了这部分文档:Services - Kubernetes

但证书未链接到 AWS 负载均衡器中的监听器。我在网上找不到更多文档或工作示例。谁能给我指出一个？

LoadBalancer 配置如下所示:

apiVersion: v1
kind: Service
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"traefik-ingress-service","namespace":"kube-system"},"spec":{"ports":[{"name":"web","port":80,"targetPort":80},{"name":"admin","port":8080,"targetPort":8080},{"name":"secure","port":443,"targetPort":443}],"selector":{"k8s-app":"traefik-ingress-lb"},"type":"LoadBalancer"}}
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:eu-north-1:000000000:certificate/e386a77d-26d9-4608-826b-b2b3a5d1ec47
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
  creationTimestamp: 2019-01-14T14:33:17Z
  name: traefik-ingress-service
  namespace: kube-system
  resourceVersion: "10172130"
  selfLink: /api/v1/namespaces/kube-system/services/traefik-ingress-service
  uid: e386a77d-26d9-4608-826b-b2b3a5d1ec47
spec:
  clusterIP: 10.100.115.166
  externalTrafficPolicy: Cluster
  ports:
  - name: web
    port: 80
    protocol: TCP
    targetPort: 80
  - name: admin
    port: 8080
    protocol: TCP
    targetPort: 8080
  - name: secure
    port: 443
    protocol: TCP
    targetPort: 80
  selector:
    k8s-app: traefik-ingress-lb
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - hostname: e386a77d-26d9-4608-826b-b2b3a5d1ec47.eu-north-1.elb.amazonaws.com

亲切的问候，期待您的回答。

Answer 1

我遇到了类似的问题，因为我使用的是 EKS v1.14(和 nginx-ingress-controller)和网络负载均衡器，根据 Kubernetes，自从 Kubernetes v1.15 - GitHub Issue 以来就有可能.自 2020 年 3 月 10 日起 - Amazon EKS now supports Kubernetes version 1.15

因此，如果它仍然相关，请在此处阅读更多信息 - How do I terminate HTTPS traffic on Amazon EKS workloads with ACM? .