Skipper https 休息端点请求返回 http url

Question

我正在尝试使用 Spring 云数据流流的 poc，并让应用程序 ii 在 Pivotal Cloud Foundry 中运行。在 kubernetes 中尝试相同并且 spring 数据流服务器仪表板未加载。调试问题并发现根本原因是当仪表板被加载时，它试图击中船长休息端点/api，这将返回带有 url 的响应skipper 中的其他端点，但返回 url 都在 http 中。我如何强制船长返回 https 网址而不是 http？以下是我尝试卷曲相同端点时的响应。

C:>curl -k https:///api

船长的回应

{
  "_links" : {
    "repositories" : {
      "href" : "http://<skipper_url>/api/repositories{?page,size,sort}",
      "templated" : true
    },
    "deployers" : {
      "href" : "http://<skipper_url>/api/deployers{?page,size,sort}",
      "templated" : true
    },
    "releases" : {
      "href" : "http://<skipper_url>/api/releases{?page,size,sort}",
      "templated" : true
    },
    "packageMetadata" : {
      "href" : "**http://<skipper_url>/api/packageMetadata{?page,size,sort,projection}**",
      "templated" : true
    },
    "about" : {
      "href" : "http://<skipper_url>/api/about"
    },
    "release" : {
      "href" : "http://<skipper_url>/api/release"
    },
    "package" : {
      "href" : "http://<skipper_url>/api/package"
    },
    "profile" : {
      "href" : "http://<skipper_url>/api/profile"
    }
  }
}

kubernetes 部署 yml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: skipper-server-network-policy
spec:
  podSelector:
    matchLabels:
      app: skipper-server
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              gkp_namespace: ingress-nginx
  egress:
    - {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: v1
kind: Secret
metadata:
  name: poc-secret
data:
  .dockerconfigjson: ewogICJhdXRocyI6
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: skipper-server
  labels:
    app: skipper-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: skipper-server
  template:
    metadata:
      labels:
        app: skipper-server
      annotations:
        kubernetes.io/psp: nonroot
    spec:
      containers:
        - name: skipper-server
          image: <image_path>
          imagePullPolicy: Always
          ports:
            - containerPort: 7577
              protocol: TCP
          resources:
            limits:
              cpu: "4"
              memory: 2Gi
            requests:
              cpu: 25m
              memory: 1Gi
          securityContext:
            runAsUser: 99        

      imagePullSecrets:
        - name: poc-secret
      serviceAccount: spark
      serviceAccountName: spark
---
apiVersion: v1
kind: Service
metadata:
  name: skipper-server
  labels:
    app: skipper-server
spec:
  ports:
    - port: 80
      targetPort: 7577
      protocol: TCP
      name: http
  selector:
    app: skipper-server
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: skipper-server
  annotations:
    ingress.kubernetes.io/ssl-passthrough: "true"
    ingress.kubernetes.io/secure-backends: "true"
    kubernetes.io/ingress.allow.http: true
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  rules:
    - host: "<skipper_url>"
      http:
        paths:
          - path: /
            backend:
              serviceName: skipper-server
              servicePort: 80
  tls:
    - hosts:
      - "<skipper_url>"

SKIPPER APPLICATION.properties

spring.datasource.url=jdbc:h2:mem:testdb
spring.datasource.driverClassName=org.h2.Driver
spring.datasource.username=sa
spring.datasource.password=
spring.server.use-forward-headers=true

Answer 1

根本原因是跳过 /api 端点为 /deployer 和 kubernetes 入口返回 http url 尝试重定向并因 308 错误而被阻止。在下面添加到船长 env 属性中，这解决了问题。

部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: skipper-server
spec:
      containers:
      env:
        - name: "server.tomcat.internal-proxies"
          value: ".*"
        - name: "server.use-forward-headers"
          value:  "true"**

入口

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: skipper-server
  annotations:
    **nginx.ingress.kubernetes.io/ssl-redirect: false**