kubernetes的ingress实现同时支持http和https

生产环境中对外的服务一般需要配置https服务，使用ingress也可以很方面的添加https的证书。默认情况下，如果为该 Ingress 启用了 TLS，控制器会使用 308 永久重定向响应将 HTTP 客户端重定向到 HTTPS 端口 443。（ Ingress 里配置了 https 证书的话，默认就一定会走 https）。即默认情况下，如果在ingress 规则中配置了tls，所有http的流量都会重定向到https。在一些特殊场景下，有请求地址是http访问就走http，请求地址是https访问就走https。

1.ingress的http规则

---
apiVersion: networking.k8s.io/v1beta1   #版本低于1.19的使用
kind: Ingress
metadata:
  name: test-ingress
spec:
  rules:
  - host: www.test.com
    http:
      paths:
      - path:
        backend:
          serviceName: test-svc
          servicePort: 8080




---
apiVersion: networking.k8s.io/v1 
kind: Ingress
metadata:
  name: test-ingress
spec:
  rules:
  - host: www.test.com
    http:
      paths:
      - path:
        backend:
          service:
            name: test-svc
            port: 
              number:8080

apiVersion: networking.k8s.io/v1beta1和apiVersion: networking.k8s.io/v1也就backend的地方不一样

2.https的规则

---
apiVersion: networking.k8s.io/v1beta1   #版本低于1.19的使用
kind: Ingress
metadata:
  name: test-ingress
spec:
tls:
  - hosts:
    - www.test.com
    secretName: wzlinux-secret
  rules:
    - host: www.test.com
    http:
      paths:
      - path:
        backend:
          serviceName: test-svc
          servicePort: 8080




---
apiVersion: networking.k8s.io/v1 
kind: Ingress
metadata:
  name: test-ingress
spec:
tls:
  - hosts:
    - www.test.com
    secretName: wzlinux-secret
  rules:
  - host: www.test.com
    http:
      paths:
      - path:
        backend:
          service:
            name: test-svc
            port: 
              number:8080

http和https规则只是添加tls规则，hosts是证书所授权的域名列表，secretName是证书的secret的名字。

3.实现http访问不强制跳转到https

---
apiVersion: networking.k8s.io/v1beta1   #版本低于1.19的使用
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
tls:
  - hosts:
    - www.test.com
    secretName: test-secret
  rules:
    - host: www.test.com
    http:
      paths:
      - path:
        backend:
          serviceName: test-svc
          servicePort: 8080




---
apiVersion: networking.k8s.io/v1 
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
tls:
  - hosts:
    - www.test.com
    secretName: test-secret
  rules:
  - host: www.test.com
    http:
      paths:
      - path:
        backend:
          service:
            name: test-svc
            port: 
              number:8080

每个应用服务的Ingress.规则中，添加注解nginx.ingress.kubernetes.io/ssl-redirect: "false"。或者在全局配置中，使用全局禁用ssl-redirect: "false"参数。