1.4. 通过入口对象保护路由

流程

1. 输入以下命令为目标 CA 证书创建 secret：

   $ oc create secret generic dest-ca-cert --from-file=tls.crt=<file_path>

   例如：

   $ oc -n test-ns create secret generic dest-ca-cert --from-file=tls.crt=tls.crt

   输出示例

   secret/dest-ca-cert created

2. 将 route.openshift.io/destination-ca-certificate-secret 添加到 Ingress 注解中：

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: frontend
     annotations:
       route.openshift.io/termination: "reencrypt"
       route.openshift.io/destination-ca-certificate-secret: secret-ca-cert
   ...

   其中：

   destination-ca-certificate-secret

   指定 route.openshift.io/destination-ca-certificate-secret 注解。该注解引用 Kubernetes secret。

   Ingress Controller 将注解中引用的 secret 插入到生成的路由中。

   输出示例

   apiVersion: route.openshift.io/v1
   kind: Route
   metadata:
     name: frontend
     annotations:
       route.openshift.io/termination: reencrypt
       route.openshift.io/destination-ca-certificate-secret: secret-ca-cert
   spec:
   ...
     tls:
       insecureEdgeTerminationPolicy: Redirect
       termination: reencrypt
       destinationCACertificate: |
         -----BEGIN CERTIFICATE-----
         [...]
         -----END CERTIFICATE-----
   ...