http自动转https配置(nginx)

公司目前使用的helm kong kubernetes ingress作为的api gateway。使用kong来做http自动跳https本身不难做到，https://github.com/Kong/kong/issues/1946#issuecomment-272970569。然鹅，和ingress以及helm挂钩之后，显得鹅外难配置。这里参考了其他博主的做法，配合公司使用的aws服务，最终解法如下。

图解

最普通的nginx反向代理：

@startuml web
interface ip
card "domain name 1" as dn1
card "domain name 2" as dn2
card "service 1" as s1
card "service 2" as s2
agent nginx

dn1 --> ip
ip --> nginx: "port:80/443"
nginx --> s1
dn2 -[#7FFFAA]-> ip
nginx -[#7FFFAA]-> s2
@enduml

解决方案

@startuml web
card "https:// domain name" as dn1
card "http:// domain name" as dn2
agent "aws load balance" as alb

rectangle kubernetes {
    agent "kong kubernetes ingress(api gateway)" as kki
    card "http2https services" as hs
}

dn1 --> alb: "port:443"
dn2 -[#7FFFAA]-> alb: "prot:80"

interface ip1
interface ip2
card "k8s node 1" as kn1
card "k8s node 2" as kn2
ip1 -- kn1
ip2 -- kn2

alb --> kki
kki -- ip1
kki -- ip2

alb -[#7FFFAA]-> hs
hs -[#7FFFAA]-> dn1
@enduml

⚠️注意，这里域名为同一个，可以有很多个，拿一个举例子

http2https服务

现在就是http至https服务的跳转了。
看到一篇博客提到通过html跳转，经典例子就是百度，

$ curl baidu.com -v

得到内容

* Rebuilt URL to: baidu.com/
*   Trying 220.181.57.216...
* Connected to baidu.com (220.181.57.216) port 80 (#0)
> GET / HTTP/1.1
> Host: baidu.com
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Tue, 25 Dec 2018 04:16:38 GMT
< Server: Apache
< Last-Modified: Tue, 12 Jan 2010 13:48:00 GMT
< ETag: "51-47cf7e6ee8400"
< Accept-Ranges: bytes
< Content-Length: 81
< Cache-Control: max-age=86400
< Expires: Wed, 26 Dec 2018 04:16:38 GMT
< Connection: Keep-Alive
< Content-Type: text/html
< 
<html>
<meta http-equiv="refresh" content="0;url=http://www.baidu.com/">
</html>
* Connection #0 to host baidu.com left intact

可以看到它的html利用了meta标签的跳转，然鹅，meta是最先加载的，这种只能写死地址。并不能做到多域名共用，我们可以写个类似html，如下：

<html><script>window.location.href=`https://${location.host}${location.pathname}`</script></html>

⚠️然鹅这种页面跳转并不能做到http携带子路径跳转到https。
最终还是使用nginx配置文件来达到跳转目的。

文件

defalut.conf

server {
    listen 80 default_server;
    return 301 https://$host$request_uri; 
}

Dockerfile

From nginx:1
ADD default.conf /etc/nginx/conf.d/default.conf

然后可以把此镜像放到k8s某ns目录下，如(这里镜像为public可以直接使用)：

echo "
---
kind: Service
apiVersion: v1
metadata:
  name: http2https-service
spec:
  type: NodePort
  selector:
    app: http2https
  ports:
    - protocol: TCP
      port: 80
      nodePort: 30080
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: http2https-deployment
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: http2https
    spec:
      containers:
      - name: http2https-controller
        image: registry.cn-hangzhou.aliyuncs.com/goddy-test/nginx:1.1
        ports:
        - containerPort: 80
" | kubectl -n test apply -f -

然后，在aws load balance即alb添加listener

⚠️这里第二条为kong kubernetes ingress的proxy服务，别忘记将防火墙开启对应端口。
如果此k8s集群中有其他需要跳转的服务，都可以配置此服务的端口30080转http的80端口达到共用的目的。

至此，访问http://domain-name/xx/xxx 即可自动跳转至https://domain-name/xx/xxx

Reference

最后编辑于：2018.12.25 12:30:22