Azure AKS部署多组件应用：外网暴露及内部连接方案咨询

以下是满足你需求的完整部署方案，涵盖三个组件的Kubernetes配置、自定义域名暴露、SSL证书配置以及内部连通验证：

前提准备 #

• 已创建并配置好Azure Kubernetes Service（AKS）集群
• 已在Azure DNS中创建abc.org域名区域
• 已将三个应用的容器镜像推送至容器仓库（如Azure Container Registry）
• 本地已安装kubectl并连接至AKS集群

1. Keycloak部署与内部服务配置 #

Keycloak Deployment #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: default # 可根据需求指定命名空间
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
      - name: keycloak
        image: quay.io/keycloak/keycloak:22.0.3
        args: ["start-dev"]
        env:
        - name: KEYCLOAK_ADMIN
          value: "admin" # 替换为你的Keycloak管理员账号
        - name: KEYCLOAK_ADMIN_PASSWORD
          value: "Admin@123" # 替换为你的管理员密码
        - name: KC_HOSTNAME
          value: "kc.abc.org"
        ports:
        - containerPort: 8080

Keycloak内部服务（ClusterIP） #

apiVersion: v1
kind: Service
metadata:
  name: keycloak
  namespace: default
spec:
  selector:
    app: keycloak
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

该服务仅集群内部可访问，Spring后端将通过此服务的DNS名称keycloak.default.svc.cluster.local连接Keycloak

2. Spring Backend部署与内部连通配置 #

Spring Backend Deployment #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backend
  template:
    metadata:
      labels:
        app: backend
    spec:
      containers:
      - name: backend
        image: your-acr-name.azurecr.io/backend:v1 # 替换为你的镜像地址
        env:
        # 配置Keycloak内部访问地址
        - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI
          value: "http://keycloak.default.svc.cluster.local/realms/your-realm-name"
        - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI
          value: "http://keycloak.default.svc.cluster.local/realms/your-realm-name/protocol/openid-connect/certs"
        ports:
        - containerPort: 8080

Backend服务 #

apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: default
spec:
  selector:
    app: backend
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

3. React Frontend部署 #

React Frontend Deployment #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
      - name: frontend
        image: your-acr-name.azurecr.io/frontend:v1 # 替换为你的镜像地址
        env:
        # 前端需访问外部Keycloak域名
        - name: REACT_APP_KEYCLOAK_URL
          value: "https://kc.abc.org"
        - name: REACT_APP_KEYCLOAK_REALM
          value: "your-realm-name"
        - name: REACT_APP_KEYCLOAK_CLIENT_ID
          value: "frontend-client" # 替换为Keycloak中创建的前端客户端ID
        - name: REACT_APP_API_URL
          value: "https://api.abc.org"
        ports:
        - containerPort: 3000

Frontend服务 #

apiVersion: v1
kind: Service
metadata:
  name: frontend
  namespace: default
spec:
  selector:
    app: frontend
  ports:
  - port: 80
    targetPort: 3000
  type: ClusterIP

4. Ingress配置（暴露自定义域名+SSL） #

安装NGINX Ingress Controller #

# 添加helm仓库
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

# 安装Ingress Controller到专用命名空间
helm install nginx-ingress ingress-nginx/ingress-nginx \
  --namespace ingress-basic \
  --create-namespace

安装Cert-Manager（自动获取Let's Encrypt SSL证书） #

# 安装Cert-Manager CRDs和控制器
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml

# 创建ClusterIssuer用于申请证书
cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: your-admin@abc.org # 替换为你的邮箱（用于证书到期提醒）
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
EOF

主Ingress资源（关联三个域名） #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/ssl-redirect: "true" # 强制HTTPS
spec:
  tls:
  - hosts:
    - api.abc.org
    - www.abc.org
    - kc.abc.org
    secretName: app-tls-secret # 自动生成的SSL证书将存储在此Secret中
  rules:
  - host: api.abc.org
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: backend
            port:
              number: 80
  - host: www.abc.org
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend
            port:
              number: 80
  - host: kc.abc.org
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: keycloak
            port:
              number: 80

5. DNS域名解析配置 #

1. 获取NGINX Ingress Controller的外部IP：

kubectl get service nginx-ingress-ingress-nginx-controller -n ingress-basic

2. 在Azure DNS的abc.org区域中添加三条A记录：
   • api.abc.org -> 上述Ingress外部IP
   • www.abc.org -> 上述Ingress外部IP
   • kc.abc.org -> 上述Ingress外部IP

6. 内部连通验证 #

进入Spring Backend的Pod，测试访问Keycloak内部服务：

# 获取Backend Pod名称
kubectl get pods -l app=backend

# 进入Pod并执行curl命令
kubectl exec -it <backend-pod-name> -- curl http://keycloak.default.svc.cluster.local/realms/your-realm-name

若返回Keycloak Realm的JSON数据，说明内部连通正常。

内容的提问来源于stack exchange，提问作者Kérdezősködő Indián