前言nginx是用http协议工作的，那么如何添加证书呢。更新历史20200701-初稿-左成礼原文地址-https://blog.zuolinux.com/2020/07/01/nginx-https.html创建证书，可以在线申请一年免费证书，或创建您自己的证书。在下面创建您自己的证书。下载自建证书脚本wget-OMakefilehttps://raw.githubusercontent.com/kubernetes/examples/master/staging/https-nginx/Makefile创建证书文件makekeysKEY=/tmp/nginx.keyCERT=/tmp/nginx.crt将证书写入K8Ssecret#kubectlcreatesecrettlsnginxsecret--key/tmp/nginx.key--cert/tmp/nginx.crtsecret/nginxsecretcreated将nginx配置写入K8Sconfigmap#catdefault.confserver{听80default_server;听[::]:80default_serveripv6only=on;听443SSL；根/usr/share/nginx/html；索引index.html；服务器名称本地主机；/tls.crt;ssl_certificate_key/etc/nginx/ssl/tls.key;位置/{try_files$uri$uri/=404;}}#kubectlcreateconfigmapnginxconfigmap--from-file=default.confconfigmap/集成完Pod和证书后创建的nginxconfigmap，使用Service发布[root@master01~]#catnginx-app.yamlapiVersion:v1kind:Servicemetadata:name:my-nginx标签:run:my-nginx规格：类型：NodePort端口：-端口：8080targetPort：80协议：TCP名称：http-端口：443协议：TCP名称：https选择器：运行：my-nginx---apiVersion：apps/v1kind：部署元数据：名称：my-nginxspec:选择器:matchLabels:run:my-nginxreplicas:1template:metadata:labels:run:my-nginxspec:volumes:-name:secret-volumesecret:secretName:nginxsecret-name:configmap-volumeconfigMap:名称：nginxconfigmap容器：-名称：nginxhttps图像：bprashanth/nginxhttps:1.0端口：-containerPort：443-containerPort：80volumeMounts：-mountPath：/etc/nginx/ssl名称：secret-volume-mountPath：/etc/nginx/conf.dname:configmap-volume[root@master01~]#kubectlapply-fnginx-app.yamlservice/my-nginxcreateddeployment.apps/my-nginxcreated查看运行情况[root@master01~]#kubectlgetservice-owideNAMETYPECLUSTER-IPEXTERNAL-IPPORT(S)AGESELECTORmy-nginxNodePort192.20.27.173<无>8080:32529/TCP,443:32699/TCP22srun=my-nginx[root@master01~]#kubectlgetpod-owideNAMEREADYSTATUSRESTARTSAGEIPNODENOMINATEDNODEREADINESSGATESmy-nginx-85fccfd5dc-2pzvw1/1Running064s192.10.205.224work01
