如何让Bridge to Kubernetes代理HTTPS服务？问题排查求助

场景与问题 #

集群基于Rancher Desktop部署的K3S，Admission Webhook为带自签名证书的ASP.NET应用，暴露80、443端口。集群内部运行正常：Admission Controller的HTTPS请求可正常响应，busybox pod通过wget也能正常访问HTTP/HTTPS端点。

配置Bridge to Kubernetes并选择https启动配置文件后，本地调试器成功附加，通过本地端口可正常发送HTTP/HTTPS请求。但集群内busybox pod发送HTTP请求时会收到407重定向到HTTPS，发送HTTPS请求时出现连接重置：

/ # wget https://my-webhook.default.svc/review
Connecting to my-webhook.default.svc (10.43.228.214:443)
wget: note: TLS certificate validation not implemented
wget: got bad TLS record (len:0) while expecting handshake record
wget: error getting response: Connection reset by peer

反向代理日志显示连接建立后很快断开，无完整TLS交互：

2024-08-02T15:03:40.7630072Z | RemoteAgent | TRACE | ReversePortForwardConnector on port 8081 accepted incoming request as stream 3.
2024-08-02T15:03:40.7635073Z | RemoteAgent | TRACE | AgentHub connnected for 8081, id 3
2024-08-02T15:03:40.7637538Z | RemoteAgent | TRACE | ReversePortForwardConnector.HookupStreamData ReadAsync 3 returns 144 bytes.
2024-08-02T15:03:40.7638315Z | RemoteAgent | TRACE | AgentHub received for 8081, id 3, size 144
2024-08-02T15:03:42.7868736Z | RemoteAgent | TRACE | AgentHub disconnect for 8081, id 3
Operation context: <json>{"clientRequestId":"637901ec-192a-4556-b8fc-316523d2cf56","correlationId":"ca347131-affb-4b7f-925c-f0f81c400c28:19949ee2af29:c060342eca4b","requestId":null,"userSubscriptionId":null,"startTime":"2024-08-02T14:59:09.2912973+00:00","userAgent":"RemoteAgent/1.0.0.0","requestHttpMethod":null,"requestUri":null,"version":"1.0.0.0","requestHeaders":{},"loggingProperties":{"ApplicationName":"RemoteAgent","DeviceOperatingSystem":"Linux 5.15.133.1-microsoft-standard-WSL2 #1 SMP Thu Oct 5 21:02:42 UTC 2023","Framework":".NET 7.0.19","ProcessId":1,"TargetEnvironment":"Production"}}<json>
2024-08-02T15:03:42.7871167Z | RemoteAgent | TRACE | PortForwardConnector.Disconnect 3
2024-08-02T15:03:42.7872048Z | RemoteAgent | TRACE | AgentHub closed for 8081, id 3
2024-08-02T15:03:42.7877971Z | RemoteAgent | TRACE | ReversePortForwardConnector.StartReceiveDataAsync exception 'Unable to read data from the transport connection: Operation canceled.' when invoking handler. Close.

本地Kestrel服务器未记录任何HTTPS连接尝试，调试客户端无相关日志。

可能的问题根源与修复方案 #

1. Bridge端口映射与HTTPS配置不匹配 #

• 检查端口映射：确认Bridge to Kubernetes配置中，集群的443端口正确映射到本地Kestrel的HTTPS端口（如5001、7001），而非HTTP端口。
• 禁用TLS终止：Bridge默认可能会对HTTPS流量做终止后以HTTP转发到本地，导致Kestrel收到非TLS请求引发握手失败。在Bridge配置中关闭"Enable TLS termination"选项，确保原始TLS流量直接转发。

2. 本地证书的SAN不匹配 #

集群内HTTPS请求的SNI字段为my-webhook.default.svc，如果本地自签名证书的**Subject Alternative Name (SAN)**未包含该域名，Kestrel会拒绝连接：

• 重新生成证书，添加my-webhook.default.svc到SAN字段；
• 或使用通配符证书*.default.svc覆盖集群内服务域名。

3. Kestrel监听配置限制 #

确保本地Kestrel允许来自集群的连接，不要仅监听localhost：

// Program.cs 示例配置
builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(5001, listenOptions =>
    {
        listenOptions.UseHttps("path/to/cert.pfx", "cert-password");
    });
});

进一步排查方法 #

• 抓包分析TLS握手：
  • 本地用Wireshark监听Kestrel的HTTPS端口，确认是否收到集群发送的TLS Client Hello包；
  • 集群内部在busybox中执行tcpdump host 10.43.228.214 and port 443，查看Client Hello是否发出及是否收到响应。
• 本地TLS握手验证：
  用openssl测试本地Kestrel对集群域名的响应：

  openssl s_client -connect localhost:5001 -servername my-webhook.default.svc
  

  若握手失败，说明证书或Kestrel配置存在问题。
• 开启Bridge详细日志：在Visual Studio的Bridge to Kubernetes设置中，将日志级别调整为Verbose，查看是否有TLS相关的错误提示。
• 跳过SNI测试：
  在busybox中发送不带SNI的HTTPS请求，验证是否能建立连接：

  wget --no-check-certificate --header="Host: my-webhook.default.svc" https://10.43.228.214/review
  

内容的提问来源于stack exchange，提问作者Paul Turner