nginx - 如何在Kubernetes中为HashiCorp Vault UI设置入口

Question

我刚刚使用Kubernetes集群安装了HashiCorp Vault。
我希望它能够通过现有的入口 Controller 工作，因此我使用以下yaml创建了新的入口规则:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: vault-ingress
  namespace: vault
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
  rules:
  - http:
      paths:
      - path: /vault
        backend:
          serviceName: vault
          servicePort: 8200

对于我的服务，其运行方式为:

apiVersion: v1
kind: Service
metadata:
  name: vault
  namespace: vault
  labels:
    module: vault
spec:
  selector:
    module: vault
  ports:
  - port: 8200
    targetPort: 8200

但是，当我尝试访问我的URL时:http://ingress.domain/vault/ui我的页面出现错误

13.72.65.96/:24 GET http://ingress.domain/ui/assets/vendor-854d73b9f9351c0ff2e27f8821dfcd09.js net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:25 GET http://ingress.domain/ui/assets/vault-f8ac2e61e061b2fb490b6ad79fcd5c1f.js net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:15 GET http://ingress.domain/ui/assets/vendor-895fbba1663c3b4fe68755a3fb7ae7b4.css net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:16 GET http://ingress.domain/ui/assets/vault-8ed265cce923599eca663b1bb2e4a83f.css net::ERR_ABORTED 404 (Not Found)
13.72.65.96/:25 GET http://ingress.domain/ui/assets/vault-f8ac2e61e061b2fb490b6ad79fcd5c1f.js net::ERR_ABORTED 404 (Not Found)
favicon-68e1a9c89026b0efeddf718a48c282a5.png:1 
GET http://ingress.domain/ui/favicon-68e1a9c89026b0efeddf718a48c282a5.png 404 (Not Found)

我的配置图:

apiVersion: v1
kind: ConfigMap
metadata:
  name: vault
  namespace: vault
  labels:
    module: vault
data:
  config.json : '{
    "ui": "true",
    "disable_mlock": "true",
    "api_addr": "http://127.0.0.1:8200/vault",
    "listener": [
        {
            "tcp": {
                "address": "0.0.0.0:8200",
                "tls_disable": 1
            }
        }
    ]
}'

部署方式

apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault
  namespace: vault
  labels:
    module: vault
spec:
  selector:
    matchLabels:
      module: vault
  replicas: 1
  template:
    metadata:
      labels:
        module: vault
    spec:
      containers:
      - name: vault
        image: vault
        imagePullPolicy: "Always"
        command: ["/bin/sh", "-c"]
        args:
        -  vault server -config /vault/config/config.json
        securityContext:
          capabilities:
            add:
              - IPC_LOCK
        volumeMounts:
          - name: configurations
            mountPath: /vault/config/config.json
            subPath: config.json
        env:
          - name: VAULT_ADDR
            value: "http://localhost:8200/vault/"
        ports:
        - containerPort: 8200
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: configurations
          configMap:
            name: vault

我应该在Kubernetes中为Vault UI设置入口吗？
我的Ingress有一个域，因此UI(和其他服务)应为:http://ingress.domain/ {service name}。我需要Vault UI http://ingress.domain/vault

Answer 1

我对Vault forum有回应:

this is (currently) not possible. Vault's UI (and API) is not able to work with domain subpathing.