Как исправить "плохую ошибку сертификата" в traefik 2.0? - PullRequest
Новая
       36

Как исправить "плохую ошибку сертификата" в traefik 2.0?

2 голосов
/ 03 мая 2019

Я настраиваю traefik 2.0-alpha с сертификатами Let's Encrypt внутри GKE, но теперь я нахожусь в тупике с "server.go: 3012: http: ошибка рукопожатия TLS от 10.32.0.1:2244: удаленная ошибка: tls: плохой сертификат "ошибка в журналах контейнеров.

Соединения через http работают нормально.Когда я пытаюсь подключиться через https, traefik возвращает 404 со своими сертификатами по умолчанию.Я нашел такую ​​же проблему для traefik v1 на github.Решение было в добавлении в конфиг: 

InsecureSkipVerify = true
passHostHeader = true

Это мне не помогает.

Вот мой configmap 

apiVersion: v1
kind: ConfigMap
metadata:
  name: traefik-ingress-configmap
  namespace: kube-system
data:
  traefik.toml: |
    [Global]
    sendAnonymousUsage = true
    debug = true
    logLevel = "DEBUG"

    [ServersTransport]
      InsecureSkipVerify = true

    [entrypoints]
      [entrypoints.web]
          address = ":80"
      [entryPoints.web-secure]
          address = ":443"
      [entrypoints.mongo-port]
          address = ":11111"

    [providers]
    [providers.file]
    [tcp] # YAY!
      [tcp.routers]
          [tcp.routers.everything-to-mongo]
            entrypoints = ["mongo-port"]
            rule = "HostSNI(`*`)" # Catches every request
            service = "database"
      [tcp.services]
        [tcp.services.database.LoadBalancer]
          [[tcp.services.database.LoadBalancer.servers]]
            address = "mongodb-service.default.svc:11111"

    [http]
      [http.routers]
        [http.routers.for-jupyterx-https]
          entryPoints = ["web-secure"] # won't listen to entrypoint mongo-port
          # rule = "Host(`clients-ui.ddns.net`)"
          # rule = "Path(`/jupyterx`)" # abo /jupyterx/*
          rule = "PathPrefix(`/jupyterx`)"
          service = "jupyterx"
          [http.routers.for-jupyterx.tls]

        [http.routers.for-jupyterx-http]
          entryPoints = ["web"] # won't listen to entrypoint mongo-port
          # rule = "Host(`clients-ui.ddns.net`)"
          # rule = "Path(`/jupyterx`)" # abo /jupyterx/*
          rule = "PathPrefix(`/jupyterx`)"
          service = "jupyterx"

      [http.services]
        [http.services.jupyterx.LoadBalancer]
        PassHostHeader = true
        # InsecureSkipVerify = true
        [[http.services.jupyterx.LoadBalancer.servers]]
        url = "http://jupyter-service.default.svc/"
        weight = 100

    [acme] # every router with TLS enabled will now be able to use ACME for its certificates
      email = "account@mail.com"
      storage = "acme.json"
    #   onHostRule = true # dynamic generation based on the Host() & HostSNI() matchers
      caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
      [acme.httpChallenge]
          entryPoint = "web" # used during the challenge

И DaemonSet yaml: 

# ---
# apiVersion: v1
# kind: ServiceAccount
# metadata:
#   name: traefik-ingress-controller
#   namespace: kube-system
---
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      volumes:
        # - name: traefik-ui-tls-cert
        #   secret:
        #     secretName: traefik-ui-tls-cert
        - name: traefik-ingress-configmap
          configMap:
            name: traefik-ingress-configmap
      containers:
      - image: traefik:2.0 # The official v2.0 Traefik docker image
        name: traefik-ingress-lb
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        - name: web-secure
          containerPort: 443
          hostPort: 443
        - name: admin
          containerPort: 8080
        - name: mongodb
          containerPort: 11111
        volumeMounts:
          - mountPath: "/config"
            name: "traefik-ingress-configmap"
        args:
        - --api
        - --configfile=/config/traefik.toml
---
kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 443
      name: web-secure
    - protocol: TCP
      port: 8080
      name: admin
    - port: 11111
      protocol: TCP
      name: mongodb
  type: LoadBalancer
  loadBalancerIP: 1.1.1.1

Есть какие-нибудь предложения, как это исправить?

1 Ответ

1 голос
/ 06 мая 2019

Из-за отсутствия руководств для traefik2.0-alpha файл конфигурации был написан с использованием только руководства с официальной страницы traefik.Вот пример конфигурации «маршрутизаторы для HTTP и HTTPS» https://docs.traefik.io/v2.0/routing/routers/ выглядит так: 

[http.routers]
   [http.routers.Router-1-https]
      rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
      service = "service-id"
      [http.routers.Router-1.tls] # will terminate the TLS request

   [http.routers.Router-1-http]
      rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
      service = "service-id"

Но рабочий конфиг выглядит так: 

[http.routers]
   [http.routers.Router-1-https]
      rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
      service = "service-id"
      [http.routers.Router-1-https.tls] # will terminate the TLS request

   [http.routers.Router-1-http]
      rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
      service = "service-id"

Итак, в моемстрока конфигурации 

[http.routers.for-jupyterx.tls]

должна быть изменена на 

[http.routers.for-jupyterx-https.tls]
...