时间戳

首页 > 解决方案 > Hostname (SNI) missing while using nginx ingress SSL Passtrough to underlying service

nginx - Hostname (SNI) missing while using nginx ingress SSL Passtrough to underlying service

问题描述

I'm trying to implement SSL Passtrough with nginx-ingress-controller. This is my Ingress Object:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  labels:
    my-label: example
  name: example
  namespace: example
spec:
  rules:
  - host: '*.example.com'
    http:
      paths:
      - backend:
          serviceName: example
          servicePort: 8443
        path: /

The --enable-ssl-passtrough flag is present in the controller args.

When request is coming trough ingress controller to my underlying service I'm trying to parse the SNI to find out what domain was used to find out the certificate I should present, but the service cannot find the SNI and returns this error:

{"level":"debug","ts":1592992137.1836417,"msg":"Error getting server name","error":"No hostname"}

Does nginx-ingress-controller remove the SNI when parsing? Or what may be the reason for such behavior?

Thanks in advance for help

标签： nginxkubernetesnginx-ingress

解决方案

我直接联系了 nginx-ingress 开发人员，我得到的信息是这不起作用的原因是通配符域，它不受nginx-ingress.

其他所有内容都已正确配置，并且在更改*.example.com为特定内容（例如whatever.example.com）时，它可以正常工作。

推荐阅读