将请求代理到 HTTPS 上游服务

本文介绍如何通过 Ingress Controller 配置网关，使其通过 HTTPS 将请求代理到上游服务。

前提条件

1. 完成设置 Ingress Controller 和网关。

创建路由

如需将请求代理到 HTTPS 上游，请创建一个通过 TLS 将流量转发到上游服务的路由。以下示例配置了一个路由，将流量转发到公共上游服务 httpbin.org 的 HTTPS 端口 443。

Gateway API

https-route.yaml

apiVersion: v1
kind: Service
metadata:
  namespace: aic
  name: httpbin-external-domain
spec:
  type: ExternalName
  externalName: httpbin.org
---
apiVersion: apisix.apache.org/v1alpha1
kind: BackendTrafficPolicy
metadata:
  namespace: aic
  name: passhost-node
spec:
  targetRefs:
  - name: httpbin-external-domain
    kind: Service
    group: ""
  passHost: node
  scheme: https
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  namespace: aic
  name: httpbin-tls
spec:
  parentRefs:
  - name: apisix
  rules:
  - matches:
    - path:
        type: Exact
        value: /ip
    backendRefs:
    - name: httpbin-external-domain
      port: 443

APISIX CRD

https-route.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
  namespace: aic
  name: httpbin-external-domain
spec:
  ingressClassName: apisix
  scheme: https
  passHost: node
  externalNodes:
  - type: Domain
    name: httpbin.org
    port: 443
---
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  namespace: aic
  name: httpbin-tls
spec:
  ingressClassName: apisix
  http:
    - name: httpbin-tls
      match:
        paths:
          - /ip
      upstreams:
      - name: httpbin-external-domain

将配置应用到集群：

kubectl apply -f https-route.yaml

验证

向路由发送请求：

curl -i "http://127.0.0.1:9080/ip"

HTTP/1.1 200 OK 响应表示网关已通过 HTTPS 与上游服务成功建立连接并完成通信。