K8s AWS ALB Ingress Controller多域名双SSL证书同目标组配置咨询

解决方案 #

你只需要调整Ingress配置的两个部分即可实现需求：

• 调整alb.ingress.kubernetes.io/certificate-arn注解，将两个通配符证书的ARN用逗号分隔填入
• 在spec.rules下明确配置两个域名的路由规则，两个域名的路径转发规则保持一致即可指向同一目标组

修改后的完整配置示例如下：

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  namespace: gradle
  name: gradle-proxy-dev
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internal
    alb.ingress.kubernetes.io/target-type: ip
    # 逗号分隔填入两个通配符证书的ARN，顺序不影响使用
    alb.ingress.kubernetes.io/certificate-arn: "<*.internal.domain.com证书ARN>,<*.new.domain.com证书ARN>"
    alb.ingress.kubernetes.io/inbound-cidrs: "<scrubbed>"
    alb.ingress.kubernetes.io/ssl-policy: "ELBSecurityPolicy-TLS-1-2-2017-01"
    alb.ingress.kubernetes.io/healthcheck-path: /info/version
    alb.ingress.kubernetes.io/success-codes: "200"
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
    alb.ingress.kubernetes.io/load-balancer-attributes: routing.http2.enabled=true
spec:
  rules:
    # 配置第一个域名的路由规则
    - host: gradle.internal.domain.com
      http:
        paths:
          - path: /*
            backend:
              serviceName: ssl-redirect
              servicePort: use-annotation
          - path: /*
            backend:
              serviceName: gradle-proxy
              servicePort: 80
    # 配置第二个域名的路由规则，后端指向同一服务
    - host: gradle.new.domain.com
      http:
        paths:
          - path: /*
            backend:
              serviceName: ssl-redirect
              servicePort: use-annotation
          - path: /*
            backend:
              serviceName: gradle-proxy
              servicePort: 80

配置提交后，AWS Load Balancer Controller会自动完成两个证书绑定、域名转发规则配置的操作，两个域名的流量都会转发到同一个目标组，无需手动在EC2控制台调整。

内容的提问来源于stack exchange，提问作者Adam Hansen