一、准备证书

1、有证书，上传证书文件至服务器

2、无证书（申请证书），上传证书文件至服务器

阿里云申请证书：https://www.aliyun.com/product/cas

腾讯云申请证书：https://cloud.tencent.com/product/ssl

注：免费申请一个单域名证书，有效期一年

3、创建 secret

例如：8623350_www.yangxingzhen.com_nginx.zip（这是从阿里云下载下来的证书文件）

[root@XiaoQiBoKe_120 ~]# unzip 8623350_www.yangxingzhen.com_nginx.zip

[root@XiaoQiBoKe_120 ~]# mv 8623350_www.yangxingzhen.com.pem www.yangxingzhen.com.pem

[root@XiaoQiBoKe_120 ~]# mv 8623350_www.yangxingzhen.com.key www.yangxingzhen.com.key

[root@XiaoQiBoKe_120 ~]# kubectl -n monitor create secret tls yangxingzhen-secret --key ./www.yangxingzhen.com.key --cert ./www.yangxingzhen.com.pem

4、Ingress中引用secret，配置https

[root@XiaoQiBoKe_120 ~]# vim ingress-grafana-secret.yaml


  1. apiVersion: networking.k8s.io/v1
  2. kind: Ingress
  3. metadata:
  4. name: ingress-grafana
  5. namespace: monitor
  6. annotations:
  7. nginx.ingress.kubernetes.io/rewrite-target: / # 重写路径
  8. nginx.ingress.kubernetes.io/ssl-redirect: 'true' # 访问http跳转https
  9. nginx.ingress.kubernetes.io/proxy-connect-timeout: "600" # 修改代理超时时间，默认是60s
  10. nginx.ingress.kubernetes.io/proxy-read-timeout: "600" # 接收代理数据超时时间，默认60s
  11. nginx.ingress.kubernetes.io/proxy-send-timeout: "600" # 发送数据至代理超时时间，默认60s
  12. spec:
  13. ingressClassName: nginx
  14. tls:
  15. - hosts:
  16. - 'grafana.yangxingzhen.com'
  17. secretName: yangxingzhen-secret
  18. rules:
  19. - host: grafana.yangxingzhen.com
  20. http:
  21. paths:
  22. - path: /
  23. pathType: Prefix
  24. backend:
  25. service:
  26. name: grafana
  27. port:
  28. number: 3000

[root@XiaoQiBoKe_120 ~]# kubectl get ingress -n monitor

[root@XiaoQiBoKe_120 ~]# kubectl apply -f ingress-grafana-secret.yaml

5、创建成功后，通过https://grafana.yangxingzhen.com访问服务