Kubernetes Nginx HTTPs 서버 구축

---

Kubernetes설치

---

Nginx HTTPs 서버 개요

Nginx

• Documentation Root: /usr/share/nginx/html/
• Configuration File: /etc/nginx/conf.d

---

자체 서명 인증서 생성

Secret:

• Type: kubernetes.io/tls

mkdir x509 && cd x509

Private Key

openssl genrsa -out nginx-tls.key 2048

### private키를 만들어준다. out 파일명 지정 키길이를 지정해줄 수 있음

Public Key

openssl rsa -in nginx-tls.key -pubout -out nginx-tls

### 퍼블릭 키를 만들어줌

CSR

openssl req -new -key nginx-tls.key -out nginx-tls.csr

### Certificate Signing Request를 의미함 서명 요청 인증서

인증서

openssl req -x509 -days 3650 -key nginx-tls.key -in nginx-tls.csr -out nginx-tls.crt

rm nginx-tls nginx-tls.csr

• nginx-tls.key
• nginx-tls.crt

이렇게 2개만 있으면 됨

---

설정파일

ConfigMap

mkdir conf && cd conf

nginx-tls.conf

server {
    listen              80;
    listen              443 ssl;
    server_name         myapp.example.com;
    ssl_certificate     /etc/nginx/ssl/tls.crt;
    ssl_certificate_key /etc/nginx/ssl/tls.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    location / {
        root   /usr/share/nginx/html;
        index  index.html;
    }
}

---

yaml 파일

CM 생성
nginx-tls-config.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-tls-config
data:
  nginx-tls.conf: |
    server {
      listen              80;
      listen              443 ssl;
      server_name         myapp.example.com;
      ssl_certificate     /etc/nginx/ssl/tls.crt;
      ssl_certificate_key /etc/nginx/ssl/tls.key;
      ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers         HIGH:!aNULL:!MD5;
      location / {
        root   /usr/share/nginx/html;
        index  index.html;
      }
    }

Secret 생성
nginx-tls-secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: nginx-tls-secret
type: kubernetes.io/tls
data:
  # base64 x509/nginx-tls.crt -w 0
  tls.crt: |
    LS0tLS1C...
  # base64 x509/nginx-tls.key -w 0
  tls.key: |
    LS0tLS1C...

Pod 생성
nginx-https-pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: nginx-https-pod
  labels:
    app: nginx
spec:
  containers:
    - name: nginx
      image: nginx
      volumeMounts:
      - name: nginx-config
        mountPath: /etc/nginx/conf.d
      - name: nginx-certs
        mountPath: /etc/nginx/ssl
  volumes:
    - name: nginx-config
      configMap:
        name: nginx-tls-config
    - name: nginx-certs
      secret:
        secretName: nginx-tls-secret

SVC 생성
nginx-svc-lb.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc-lb
spec:
  type: LoadBalancer
  selector:
    app: nginx
  ports:
    - name: http
      port: 80
      targetPort: 80
    - name: https
      port: 443
      targetPort: 443

kubectl create -f .

---

결과 확인

curl -k https://192.168.100.X

### curl https://192.168.100.240하면
### 자체서명 인증서는 오류가 나기 때문에 안전하지않은 접속을 허용해주어야함

kubectl svc,ep,po,cm,secret