Naeel
368ff060a2
The platform (185.247.187.147) terminates TLS externally before nginx. HTTP-01 ACME challenge was stuck for 8 days because the platform globally redirects HTTP→HTTPS before reaching nginx ingress. Changes: - Remove cert-manager.io/cluster-issuer: letsencrypt-prod annotation - Remove tls section (iot-kube5s-ru-tls secret was never created) - Set ssl-redirect: false (TLS termination is at the edge, not nginx) - Update comment to document the actual TLS architecture
66 lines
2.2 KiB
YAML
66 lines
2.2 KiB
YAML
# Создано: 2026-04-12
|
||
# MQTT over WebSocket через Ingress с TLS termination.
|
||
# Причина: порт 1883 заблокирован NSX-T Edge firewall на уровне облака.
|
||
# Решение: EMQX WebSocket listener (8083) проксируется через nginx-ingress с TLS.
|
||
#
|
||
# IoT устройство подключается: wss://iot.kube5s.ru/mqtt
|
||
# IoT Консоль (UI): https://iot.kube5s.ru/console
|
||
#
|
||
# DNS A-запись: iot.kube5s.ru → 185.247.187.147
|
||
# TLS: терминируется внешним слоем платформы (185.247.187.147).
|
||
# cert-manager НЕ используется — HTTP-01 challenge недоступен т.к. платформа
|
||
# глобально редиректит HTTP→HTTPS до nginx.
|
||
#
|
||
# Применение: kubectl apply -f deployments/k8s/emqx-ws-ingress.yaml
|
||
|
||
---
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: emqx-ws
|
||
namespace: sless
|
||
# Отдельный Service — WebSocket порт для Ingress
|
||
spec:
|
||
selector:
|
||
app: emqx
|
||
ports:
|
||
- name: mqtt-ws
|
||
port: 8083
|
||
targetPort: 8083
|
||
protocol: TCP
|
||
---
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: emqx-mqtt-websocket
|
||
namespace: sless
|
||
annotations:
|
||
kubernetes.io/ingress.class: nginx
|
||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||
# WebSocket: nginx-ingress добавляет Upgrade/Connection при proxy-http-version=1.1
|
||
nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
|
||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||
spec:
|
||
ingressClassName: nginx
|
||
rules:
|
||
- host: iot.kube5s.ru
|
||
http:
|
||
paths:
|
||
# MQTT over WebSocket — wss://iot.kube5s.ru/mqtt
|
||
- path: /mqtt
|
||
pathType: Exact
|
||
backend:
|
||
service:
|
||
name: emqx-ws
|
||
port:
|
||
number: 8083
|
||
# IoT Консоль (UI) — https://iot.kube5s.ru/console
|
||
- path: /console
|
||
pathType: Exact
|
||
backend:
|
||
service:
|
||
name: iot-operator
|
||
port:
|
||
number: 9090
|