---

前言

在实际项目中，考虑安全问题，可能需要使用https方式访问应用。

---

流程

·1、创建ca.key

[root@k8s-master 2]# openssl genrsa -out ca.key 4096
Generating RSA private key, 4096 bit long modulus
.....................................................................................................++
.........................................................................................................................................................................................................................................++
e is 65537 (0x10001)

2、创建ca.crt

[root@k8s-master 2]# openssl req -x509 -new -nodes -sha512 -days 3650 \
>   -subj "/C=CN/ST=Beijing/L=Beijing/O=iscas/OU=IT/CN=www.iscas.com" \
>   -key ca.key \
>   -out ca.crt

3、创建secret app-tls

[root@k8s-master 2]# kubectl create secret tls app-tls --cert=ca.crt --key=ca.key

4、创建service

使用nginx作为后台服务
（1）

[root@k8s-master 2]# cat nginx-service.yaml
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  labels:
    app: nginx-deployment-test-04
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 32001
  selector:
    app: nginx-deployment-test-04
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-04
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx-deployment-test-04
  template:
    metadata:
      labels:
        app: nginx-deployment-test-04
    spec:
      containers:
      - name: nginx-deployment-test-04
        image: nginx:1.20
        ports:
        - containerPort: 80

（2）创建

[root@k8s-master 2]# kubectl create -f nginx-service.yaml
service/nginx-service created
deployment.apps/nginx-deployment-04 created

5、创建 IngressRoute

（1）nginx-ingressroute.yaml

[root@k8s-master 2]# cat nginx-ingressroute.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx-route
  annotations:
    kubernetes.io/ingress.class: traefik-v2.5
spec:
  entryPoints:
    - websecure   ## 使用https方式
  routes:
  - match: Host(`www.iscas.com`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: nginx-service
      port: 80
  tls:
    secretName: app-tls  ## 配置证书

（2）创建

[root@k8s-master 2]# kubectl create -f nginx-ingressroute.yaml
ingressroute.traefik.containo.us/nginx-route created

6、配置hosts

172.16.10.158   www.iscas.com

7、访问

https://www.iscas.com/