Recipe for an https sidecar

原文链接

为非http的application实现https

kubectl create cm hello-sidecar-nginx-conf --from-file=nginx.conf=./nginx.conf

We are using the “ — from-file=key=filename” format, so the configMap and secret have the key fields specified as what we have defined.

---
apiVersion: v1
kind: Service
metadata:
  name: hello
  labels:
    app: hello
spec:
  type: NodePort
  ports:
    - port: 443
      targetPort: 443
      protocol: TCP
      name: https
  selector:
    app: hello
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
  labels:
    app: hello
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello
  template:
    metadata:
      labels:
        app: hello
    spec:
      containers:
        - name: hello
          image: zhiminwen/hello:v1
          imagePullPolicy: IfNotPresent
          env:
            - name: LISTENING_PORT
              value: "8080"
        - name: tls-sidecar
          image: nginx
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - name: secret-volume
              mountPath: /app/cert
            - name: config-volume
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
      volumes:
        - name: secret-volume
          secret:
            secretName: hello-sidecar-nginx-certs
            items:
              - key: hello-server-cert
                path: hello-server.pem
              - key: hello-server-key
                path: hello-server-key.pem
        - name: config-volume
          configMap:
            name: hello-sidecar-nginx-conf