证书创建

在阿里云--> SSL证书管理 的控制台 --> 上传证书 即可

上传证书后,会得到一个CertIdentifier,这里的值会被alb的配置使用。

公网类型

默认购买ack集群时,就已经自动创建了公网类型的alb以及相关的k8s配置,仅需要简单配置后alb新增tls的配置即可使用.

在集群中编辑默认的alb配置

kubectl edit albconfig alb

大概配置如下：

apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
  finalizers:
  - ingress.k8s.alibaba/resources
  ...
  name: alb
  ...
spec:
  config:
    addressAllocatedMode: Fixed
    addressType: Internet
  ...
  listeners:
    - port: 80
      protocol: HTTP
    # 新增
    - caEnabled: false
      certificates:
         # 证书id 在第一步上传的证书获取到的CertIdentifier值
        - CertificateId: 524711-ap-southeast-1
          IsDefault: true
      port: 443
      protocol: HTTPS

这里修改后，保存退出即可，其他配置不需要修改。

私网类型

新增一个alb描述文件alb-internal.yaml；具体配置项可参考注释

# alb配置描述
apiVersion: alibabacloud.com/v1
kind: AlbConfig
metadata:
  name: alb-internal
spec:
  config:
    # alb实例名
    name: "app-zt-prd-intrnal"
    # alb实例id(不指定会自动创建)
    id: alb-e7kdeskmvdicc0evgh
    # 不强制覆盖alb实例属性及监听属性
    forceOverride: false
    # 不强制覆盖监听属性
    listenerForceOverride: false
    # alb地址类型
    addressType: Intranet
    zoneMappings:               
    # 集群交换机id
    - vSwitchId: vsw-8ps5cbdf39m8b333ldru6
    - vSwitchId: vsw-8psela5nju83w1nipy1sc
  listeners:
    - port: 80
      protocol: HTTP
    - port: 443
      protocol: HTTPS
      caEnabled: false
      certificates:
        # 证书id 在第一步上传的证书获取到的CertIdentifier值
        - CertificateId: 524711-ap-southeast-1
          IsDefault: true
---
# ingressclass配置描述
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: alb-internal
spec:
  controller: ingress.k8s.alibabacloud/alb
  parameters:
    apiGroup: alibabacloud.com
    kind: AlbConfig
     # 与AlbConfig的名称对应
    name: alb-internal

之后 kubectl apply -f 即可

集群资源

alicloud:/# kubectl get albconfig
NAME           ALBID                    DNSNAME                                                         PORT&PROTOCOL   CERTID                  AGE
alb            alb-bvkc1a97hmg05c4tc0   alb-xxx-public.ap-southeast-3.alb.aliyuncsslbintl.com   443/HTTPS       524711-ap-southeast-1   4d15h
alb-internal   alb-e7kdeskmvdicc0evgh   alb-xxx-internal.ap-southeast-3.alb.aliyuncsslbintl.com   443/HTTPS       524711-ap-southeast-1   4m41s

alicloud:/# kubectl get ingressclass
NAME           CONTROLLER                     PARAMETERS                                AGE
alb            ingress.k8s.alibabacloud/alb   AlbConfig.alibabacloud.com/alb            4d15h
alb-internal   ingress.k8s.alibabacloud/alb   AlbConfig.alibabacloud.com/alb-internal   5m25s

alb: 集群默认的公网型alb实例
alb-internal: 新增的私网型alb实例

ingress中配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: xxx-service-ingress
  annotations:
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
spec:
  # 这里使用集群默认的公网型alb实例,发布公网地址
  ingressClassName: alb
  ...
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: xxx-service-ingress-internal
  annotations:
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
spec:
  # 这里使用集群新增的的私网型alb实例,发布内网地址
  ingressClassName: alb-internal
  ...

应用上述描述文件后,查看集群Ingress资源是否生效

alicloud:/# kubectl get ingress -n production
NAME                                    CLASS          HOSTS                           ADDRESS                                                         PORTS     AGE
xxx-service-ingress            alb            fm-gateway.ql.com.my            alb-xxx-public.ap-southeast-3.alb.aliyuncsslbintl.com   80, 443   4d4h
xxx-service-ingress-internal   alb-internal   fm-gateway-internal.ql.com.my   alb-xxx-internal.ap-southeast-3.alb.aliyuncsslbintl.com    80, 443   39m