curl - 如何正确询问 req_ssl_sni HAproxy 定义的 Kubernetes Ingress？

Question

我试图弄清楚如何验证 Kubernetes Ingress 是否正常工作以及它是否正在检查客户端证书。目前，这部分基础设施的组成如下：

HAproxy 配置如下：

#------------------
# Global settings
#------------------
# Global and default settings here, hidden for simplicity


#------------------
# frontend instances
#------------------
frontend stats
    bind    *:80
    mode http
  
# Other frontend blocks here
  
frontend frontend_ssl_prod_publicip3
    bind    privateip4:443,privateip5:443
    log-format %Ci:%Cp\ [%t]\ %ft\ %b/%s\ %Tw/%Tc/%Tt\ %B\ %ts\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq
    mode tcp
    maxconn 4000
    stick-table type ip size 100k expire 30s store conn_rate(3s),conn_cur
    acl ingress req_ssl_sni -i api.shop.domain1.suffix
    acl ingress  req_ssl_sni -i b2b.shop.domain1.suffix
    tcp-request inspect-delay 5s
    tcp-request connection accept if { src -f /etc/haproxy/ourservice-whitelist.lst }
    tcp-request connection reject if { src_conn_rate ge 20 }
    tcp-request connection reject if { src_conn_cur ge 30 }
    tcp-request connection track-sc0 src
    tcp-request content accept if { req_ssl_hello_type 1 }
    use_backend kubernetes_ingress if ingress
    use_backend static_ssl_prod_be if www_ssl_prod
  


#------------------
# backend instances
#------------------
# other backend blocks here, hidden
  
backend kubernetes_ingress
    mode tcp
    stick-table type binary len 32 size 30k expire 30m
    acl clienthello req_ssl_hello_type 1
    acl serverhello rep_ssl_hello_type 2
    tcp-request inspect-delay 5s
    tcp-request content accept if clienthello
    tcp-response content accept if serverhello
    stick on payload_lv(43,1) if clienthello
    stick  store-response payload_lv(43,1) if serverhello
    server kube-node01 kubeip1:31443 check weight 100 send-proxy agent-check agent-port 8080
    server kube-node02 kubeip2:31443 check weight 100 send-proxy agent-check agent-port 8080
    server kube-node03 kubeip3:31443 check weight 100 send-proxy agent-check agent-port 8080
 
  
# Other backends here

在 kube-node01 上，服务 kube-proxy 正在运行。

我试图curl -vvv b2b.shop.domain1.suffix从：

1. 负载均衡器节点

2. kube0# 节点

3. kube-proxy 容器

   但我只看到：

* Rebuilt URL to: b2b.shop.domain1.suffix/
*   Trying publicip3...
* TCP_NODELAY set
* connect to publicip3 port 80 failed: Connection timed out
* Failed to connect to b2b.shop.domain1.suffix port 80: Connection timed out
* Closing connection 0
curl: (7) Failed to connect to b2b.shop.domain1.suffix port 80: Connection timed out

应该如何验证入口？

标签： curlkuberneteshaproxykubernetes-ingresskube-proxy