在同一AKS集群中通过ingress控制器TLS终止运行多HTTPS应用方案咨询

多HTTPS应用共存实现方案 #

优先推荐使用单套Ingress控制器方案，资源开销更低，维护复杂度更小，以下是可直接复用的实现示例：

1. Nginx Ingress + cert-manager 实现示例 #

前置准备

• 已部署单实例Nginx Ingress Controller
• 已部署cert-manager并配置好Let's Encrypt签发者（优先使用全局可用的ClusterIssuer）

步骤1：部署跨命名空间的测试应用

分别在ns1、ns2命名空间部署应用，示例配置如下：

# ns1命名空间应用配置
apiVersion: v1
kind: Namespace
metadata:
  name: ns1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app1
  namespace: ns1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app1
  template:
    metadata:
      labels:
        app: app1
    spec:
      containers:
      - name: nginx
        image: nginx:alpine
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: app1-svc
  namespace: ns1
spec:
  ports:
  - port: 80
    targetPort: 80
  selector:
    app: app1

同理在ns2命名空间部署app2对应的Deployment和Service即可。

步骤2：配置Ingress规则实现多HTTPS路由

每个应用对应独立域名和独立证书，cert-manager会自动完成证书签发：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app1-ingress
  namespace: ns1
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod # 替换为你的ClusterIssuer名称
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app1.yourdomain.com # 替换为app1的实际域名
    secretName: app1-tls
  rules:
  - host: app1.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app1-svc
            port:
              number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app2-ingress
  namespace: ns2
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app2.yourdomain.com # 替换为app2的实际域名
    secretName: app2-tls
  rules:
  - host: app2.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app2-svc
            port:
              number: 80

配置提交后等待1-2分钟，证书签发完成即可分别通过对应域名HTTPS访问两个应用。

2. Azure AGIC 实现示例 #

前置准备

• 已创建Azure Application Gateway，且在AKS集群中部署完成AGIC组件
• 已部署cert-manager并关联Azure DNS Zone（用于Let's Encrypt DNS01挑战签发公网证书）

示例Ingress配置

AGIC会自动将Ingress规则同步到Application Gateway的监听、路由配置：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-app-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: azure-application-gateway
  tls:
  - hosts:
    - app1.yourdomain.com
    secretName: app1-tls
  - hosts:
    - app2.yourdomain.com
    secretName: app2-tls
  rules:
  - host: app1.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app1-svc
            port:
              number: 80
  - host: app2.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app2-svc
            port:
              number: 80

配置提交后Application Gateway会自动生成对应HTTPS监听，证书自动同步到网关侧，两个域名即可正常通过HTTPS访问。

内容的提问来源于stack exchange，提问作者Franco Tiveron