在 Admin Router 前配置 HAProxy

    使用 HAProxy 为 DC/OS Admin Router 设置 HTTP 代理

    HTTP 代理必须执行即时 HTTP 请求和响应标头修改，因为 DC/OS 不知道用户代理程序用于寻址 HTTP 代理的自定义主机名和端口。

    1. 安装 HAProxy 。

    2. 您可以使用代理 IP 地址 DNS 条目找到您的任务 IP。

      • ：任务名称。
      • framework_name：框架名称，如果您不确定，则可能是 marathon。
      1. global
      2.   daemon
      3.   log 127.0.0.1 local0
      4.   log 127.0.0.1 local1 notice
      5.   maxconn 20000
      6.   pidfile /var/run/haproxy.pid
      7. defaults
      8.   log            global
      9.   option         dontlog-normal
      10.   mode         http
      11.   retries             3
      12.   maxconn          20000
      13.   timeout connect  5000
      14.   timeout client  50000
      15.   timeout server  50000
      17. frontend http
      18.   # Bind on port 9090. HAProxy will listen on port 9090 on each
      19.   # available network for new HTTP connections.
      20.   bind 0.0.0.0:9090
      21.   # Specify your own server certificate chain and associated private key.
      22.   # See https://cbonte.github.io/haproxy-dconv/configuration-1.6.html#5.1-crt
      23.   # bind *:9091 ssl crt /path/to/browser-trusted.crt
      24.   #
      25.   # Name of backend configuration for DC/OS.
      28.   # so that its value is accessible during response processing.
      29.   # Note: RFC 7230 requires clients to send the Host header and
      30.   # specifies it to contain both, host and port information.
      31.   http-request set-var(txn.request_host_header) req.hdr(Host)
      33.   # Overwrite Host header to 'dcoshost'. This makes the Location
      34.   # header in DC/OS Admin Router upstream responses contain a
      35.   # predictable hostname (NGINX uses this header value when
      36.   # constructing absolute redirect URLs). That value is used
      37.   # in the response Location header rewrite logic (see regular
      38.   # expression-based rewrite in the backend section below).
      39.   http-request set-header Host dcoshost
      41. backend dcos
      42.   # Option 1: use TLS-encrypted communication with DC/OS Admin Router and
      43.   # perform server certificate verification (including hostname verification).
      44.   # If you are using the community-supported version of DC/OS, you must
      45.   # configure Admin Router with a custom TLS server certificate, see
      46.   # /mesosphere/dcos/2.1/administering-clusters/. This step
      47.   # is not required for DC/OS Enterprise.
      48.   #
      49.   # Explanation for the parameters in the following `server` definition line:
      50.   #
      51.   # 1.2.3.4:443
      52.   #
      53.   #   IP address and port that HAProxy uses to connect to DC/OS Admin
      54.   #   Router. This needs to be adjusted to your setup.
      55.   #
      57.   #
      58.   #   Instruct HAProxy to use TLS, and to error out if server certificate
      59.   #   verification fails.
      60.   #
      61.   # ca-file dcos-ca.crt
      62.   #
      63.   #   The local file `dcos-ca.crt` is expected to contain the CA certificate
      64.   #   that Admin Router's certificate will be verified against. It must be
      65.   #   retrieved out-of-band (on Mesosphere DC/OS Enterprise this can be
      66.   #   obtained via https://dcoshost/ca/dcos-ca.crt)
      67.   #
      68.   # verifyhost frontend-xxx.eu-central-1.elb.amazonaws.com
      69.   #
      70.   #   When verifying the TLS certificate presented by DC/OS Admin Router,
      71.   #   perform hostname verification using the hostname specified here
      72.   #   (expect the server certificate to contain a DNSName SAN that is
      73.   #   equivalent to the hostname defined here). The hostname shown here is
      74.   #   just an example and needs to be adjusted to your setup.
      76.   server dcos-1 1.2.3.4:443 ssl verify required ca-file dcos-ca.crt verifyhost frontend-xxx.eu-central-1.elb.amazonaws.com
      78.   # Option 2: use TLS-encrypted communication with DC/OS Admin Router, but do
      79.   # not perform server certificate verification (warning: this is insecure, and
      80.   # we hope that you know what you are doing).
      81.   # server dcos-1 1.2.3.4:443 ssl verify none
      82.   #
      83.   # Rewrite response Location header if it contains an absolute URL
      84.   # pointing to the 'dcoshost' host: replace 'dcoshost' with original
      85.   # request Host header (containing hostname and port).

    3. 使用这些设置启动 HAProxy。