在nginx-ingress后面的aks上托管django [英] Hosting django on aks behind nginx-ingress

问题描述

我正在尝试在Azure kubernetes服务behide nginx-ingress上托管一个django网站，我希望我的django网络节目在某个路径下.

I am trying to host a django website on Azure kubernetes service behide nginx-ingress, and I would like my django web show under a path.

例如当访问默认管理站点时，我想在http://example.com/django/admin而不是http://example.com/admin

e.g. when access the default admin site, I would like to access it at http://example.com/django/admin instead of http://example.com/admin

我尝试了以下配置，当我访问http://example.com/django/admin时，它将转发我到http://example.com/admin并显示默认入口后端的404错误，因为我将django debug设置为ture，我认为这意味着入口未发送我的请求到我的Django服务

I tried the configure below, when I access http://example.com/django/admin it will forward me to http://example.com/admin and show me 404 error from default ingress backend, as I set django debug to ture I assume this mean ingress did not send my request to my django service

# path example
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: django-ingress
  labels:
    app: django
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: django-service
          servicePort: 80
        path: /django(/|$)(.*)

所以我尝试curl -I -k http://example.com/django/admin，它显示如下所示的内容

so I try to curl -I -k http://example.com/django/admin, and it show something like below

HTTP/1.1 301 Moved Permanently
Server: openresty/1.15.8.2
Date: Wed, 06 Nov 2019 04:14:14 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Location: /admin/

如果我curl -I -k http://example.com/django/any_valid_page显示在网站上，则该网站上的任何有效页面都会发生相同的情况:

The same thing happen to any valid page in the site, if I curl -I -k http://example.com/django/any_valid_page it show below:

HTTP/1.1 301 Moved Permanently
Server: openresty/1.15.8.2
Date: Wed, 06 Nov 2019 04:14:14 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Location: /any_valid_page/

我想知道这是由我使用默认的django开发Web服务器进行测试引起的吗? (即python manage.py runserver)

I wonder it is caused by I am doing the test with the default django development web server? (i.e. python manage.py runserver)

如果我尝试像下面这样在根目录下托管它，一切都很好...

If I try to host it at root like below, everything is fine...

# root example
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: django-ingress
  labels:
    app: django
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: django-service
          servicePort: 80
        path: /

推荐答案

从版本0.22.0开始，使用注释进入定义 nginx.ingress.kubernetes.io/rewrite-target不向后 与以前的版本兼容.在0.22.0及更高版本中，任何 请求URI中需要传递给 必须在捕获组中显式定义重写的路径.所以做 确保您使用的版本正确.

Starting in Version 0.22.0, ingress definitions using the annotation nginx.ingress.kubernetes.io/rewrite-target are not backwards compatible with previous versions. In Version 0.22.0 and beyond, any substrings within the request URI that need to be passed to the rewritten path must explicitly be defined in a capture group. So make sure you have right version.

在群集外部使用SSL卸载时，即使没有可用的TLS证书，强制执行到HTTPS的重定向也是有用的.这可以通过在特定资源中使用nginx.ingress.kubernetes.io/force-ssl-redirect: "true"批注来实现.

When using SSL offloading outside of cluster it may be useful to enforce a redirect to HTTPS even when there is no TLS certificate available. This can be achieved by using the nginx.ingress.kubernetes.io/force-ssl-redirect: "true" annotation in the particular resource.

我认为您的Ingress配置文件应如下所示:

I think your Ingress configuration file should look like this:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: django-ingress
  labels:
    app: django
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /django(/|$)(.*)
            backend:
              serviceName: django-service
              servicePort: 80

如果出现404错误，则可能有解决方案:

If you get 404 error, there is possible solution:

请在curl命令中将https更改为http?

Please change https to http in the curl command?:

curl --resolve your-host:80:xx.xxx.xx.xxx http://my-host:80

要从kubectl get ing命令获取IP，必须 启用报告入口状态功能.看一看: reporting-ingress-status .

To get the IP from kubectl get ing command, it is necessary to enable the reporting Ingress status feature. Take a look on: reporting-ingress-status.

Ingress控制器中有默认服务器.它返回 未找到页面，其中包含 404 状态代码 没有为其定义Ingress规则的域.这些要求 不会显示在访问日志中.

There is the default server in the Ingress controller. It returns the Not Found page with the 404 status code for all requests for domains for which there are no Ingress rules defined. Those requests are not shown in the access log.

由于得到的是 404 ，因此这意味着您的主机标头 请求与Ingress资源中的主机字段不匹配. 要将主机头设置为curl，请参见先前的curl 命令.您也可以选择执行以下操作:

Since you're getting a 404, this means that the host header of your requests doesn't match with the host field in the Ingress resource. To set the host header in curl, please see previous curl commands. Optionally, you can also do:

curl http://<ip> -H "host: example.com"

请查看 ngnix-ingress ，服务器端- https-enforcement-nginx .

这篇关于在nginx-ingress后面的aks上托管django的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！