ingress实现grpc转发

最新推荐文章于 2025-04-09 23:36:14 发布

火兄

最新推荐文章于 2025-04-09 23:36:14 发布

阅读量2.2k

点赞数

文章标签：运维 kubernetes ingress grpc

本文链接：https://blog.csdn.net/qq_19344391/article/details/116382060

版权

nginx-ingress-controller配置grpc转发

nginx-ingress-controller配置grpc-明文转发

nginx-ingress-controller配置grpc-TLS转发

traefik1.x配置grpc转发

traefik1.x配置grpc-明文转发

traefik1.x配置grpc-TLS转发

准备测试环境

准备GRPC服务

在kubernetes集群上部署GRPC服务，部署步骤请看：https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/grpc

准备测试GRPC服务的命令行工具

下载地址为：https://github.com/fullstorydev/grpcurl/releases

测试gprcurl工具和grpc服务

[root@nginx-nossl ~]# kubectl get svc fortune-teller-service
NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)     AGE
fortune-teller-service   ClusterIP   172.254.66.233   <none>        50051/TCP   2d16h
[root@nginx-nossl ~]# grpcurl -plaintext 172.254.66.233:50051 list
build.stack.fortune.FortuneTeller
grpc.reflection.v1alpha.ServerReflection

生成SAN证书

配置openssl.cnf文件

mkdir /root/k8s-binary/yaml/grpc/certs
cd /root/k8s-binary/yaml/grpc/certs
cp /etc/pki/tls/openssl.cnf .
vim +126 openssl.cnf
修改第126行为:
req_extensions = v3_req
然后添加：
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = nginx-ssl.grpc-ingress
DNS.2 = traefik-ssl.grpc-ingress
修改第85行为：
countryName             = supplied
stateOrProvinceName     = supplied
organizationName        = supplied

生成密钥和证书

生成CA密钥
openssl genrsa -out ca.key 2048
生成CA根证书
openssl req -x509 -new -nodes \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=UnitedStack/OU=Devops/CN=nginx-ssl.grpc-ingress" \
	-key ca.key -subj "/CN=nginx-ssl.grpc-ingress" -days 5000 -out ca.crt
生成服务器密钥
openssl genrsa -out nginx-ssl.grpc-ingress.key 2048
生成服务器证书请求文件
openssl req -new -sha256 \
    -key nginx-ssl.grpc-ingress.key \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=UnitedStack/OU=Devops/CN=nginx-ssl.grpc-ingress" \
    -reqexts SAN \
    -config <(cat openssl.cnf \
        <(printf "[SAN]\nsubjectAltName=DNS:nginx-ssl.grpc-ingress,DNS:traefik-ssl.grpc-ingress")) \
    -out nginx-ssl.grpc-ingress.csr
CA签署服务器证书
touch /etc/pki/CA/index.txt
echo 01 | tee /etc/pki/CA/serial
openssl ca \
	-cert ca.crt \
	-keyfile ca.key \
	-in nginx-ssl.grpc-ingress.csr \
	-extensions SAN \
	-config <(cat /root/k8s-binary/yaml/grpc/certs/openssl.cnf \
        <(printf "[SAN]\nsubjectAltName=DNS:nginx-ssl.grpc-ingress,DNS:traefik-ssl.grpc-ingress")) \
	-out nginx-ssl.grpc-ingress.crt

nginx-ingress-controller配置grpc转发

nginx-ingress-controller配置grpc-明文转发

nginx-ingress-controller不支持负载grpc明文转发，详情请看：https://github.com/kubernetes/ingress-nginx/issues/6736

nginx-ingress-controller配置grpc-TLS转发

生成secret

kubectl create secret tls grpcs-secret --key nginx-ssl.grpc-ingress.key --cert nginx-ssl.grpc-ingress.crt

配置ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
  name: fortune-ingress-nginx-ssl
  namespace: kube-system
spec:
  rules:
  - host: nginx-ssl.grpc-ingress
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: fortune-teller-service
            port: 
              number: 50051
  tls:
  - secretName: grpcs-secret
    hosts:
      - nginx-ssl.grpc-ingress

测试

[root@MiWiFi-R4-srv certs]# grpcurl -cacert ca.crt nginx-ssl.grpc-ingress:443 list
build.stack.fortune.FortuneTeller
grpc.reflection.v1alpha.ServerReflection

traefik1.x配置grpc转发

traefik1.x配置grpc-明文转发

配置ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/protocol: "h2c"
  name: fortune-ingress-traefik-nossl
  namespace: kube-system
spec:
  rules:
  - host: traefik-nossl.grpc-ingress
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: fortune-teller-service
            port: 
              number: 50051

测试

[root@MiWiFi-R4-srv certs]# grpcurl -plaintext traefik-nossl.grpc-ingress:80 list
build.stack.fortune.FortuneTeller
grpc.reflection.v1alpha.ServerReflection

traefik1.x配置grpc-TLS转发

生成secret

kubectl create secret tls grpcs-secret --key nginx-ssl.grpc-ingress.key --cert nginx-ssl.grpc-ingress.crt

配置ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/protocol: "https"
  name: fortune-ingress-traefik-ssl
  namespace: kube-system
spec:
  rules:
  - host: traefik-ssl.grpc-ingress
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: fortune-teller-service
            port: 
              number: 50051
  tls:
  - secretName: grpcs-secret
    hosts:
      - traefik-ssl.grpc-ingress

traefik服务还需要增加以下启动配置

          args:
            - --defaultentrypoints=http,https
            - --entrypoints=Name:https Address::443 TLS
            - --entrypoints=Name:http Address::80
            - --insecureskipverify=true

测试

[root@MiWiFi-R4-srv certs]# grpcurl -cacert ca.crt traefik-ssl.grpc-ingress:443 list
build.stack.fortune.FortuneTeller
grpc.reflection.v1alpha.ServerReflection