Ambassador LoadBalancerのHTTP Portを無効にする。
上書き用Helm Chartに下記追加
service:
type: LoadBalancer
ports:
- name: https
port: 443
targetPort: 8443helm upgrade
helm upgrade ambassador datawire/ambassador --namespace ambassador -f ./ambassador-values.yamlk8s lb status
kubectl -n ambassador get svc ambassador
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ambassador LoadBalancer 10.245.60.56 104.248.97.204 443:31642/TCP 11ddoctl lb status
doctl compute load-balancer list --format IP,ID,Name,Status,ForwardingRules
IP ID Name Status Forwarding Rules
104.248.97.204 b7cd3e8f-eb87-46b0-b30e-2e5a098ee1f9 a8c3a763c92e841d2968f5505cd203c5 active entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:31642,certificate_id:,tls_passthrough:falseHTTP無効にした場合の注意点
HTTP無効状態でLet’s Encryptのサーバー証明書を作成しようとするとエラーになる。
Status:
Error Backoff: 10m0s
Error Reason: obtaining tlsSecret "dok8s-apps-tls2-cert"."ambassador" (hostnames=["apps.dok8s.net"]): acme: Error -> One or more domains had a problem:
[apps.dok8s.net] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Fetching http://apps.dok8s.net/.well-known/acme-challenge/qNpUBNowOvXNPiRGydSIGi-YEcVmvAJmJN4gJohLUSg
Error Timestamp: 2022-01-18T02:41:22Z
Phase Completed: ACMEUserRegistered
Phase Pending: ACMECertificateChallenge
State: Error
Tls Certificate Source: ACMEなので、新規Host/TLSContext作成時はHTTPを有効化する必要がある。