Recipe for an https sidecar

原文链接

为非http的application实现https

kubectl create cm hello-sidecar-nginx-conf --from-file=nginx.conf=./nginx.conf

We are using the “ — from-file=key=filename” format, so the configMap and secret have the key fields specified as what we have defined.

---
apiVersion: v1
kind: Service
metadata:
  name: hello
  labels:
    app: hello
spec:
  type: NodePort
  ports:
  - port: 443
    targetPort: 443
    protocol: TCP
    name: https
  selector:
    app: hello
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
  labels:
    app: hello
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello
  template:
    metadata:
      labels:
        app: hello
    spec:
      containers:
      - name: hello
        image: zhiminwen/hello:v1
        imagePullPolicy: IfNotPresent
        env:
          - name: LISTENING_PORT
            value: "8080"
      - name: tls-sidecar
        image: nginx
        imagePullPolicy: IfNotPresent
        volumeMounts:
          - name: secret-volume
            mountPath: /app/cert
          - name: config-volume
            mountPath: /etc/nginx/nginx.conf
            subPath: nginx.conf
      volumes:
      - name: secret-volume
        secret:
          secretName: hello-sidecar-nginx-certs
          items:
            - key: hello-server-cert
              path: hello-server.pem
            - key: hello-server-key
              path: hello-server-key.pem
      - name: config-volume
        configMap:
          name: hello-sidecar-nginx-conf