使用nginx將gRPC流量從HTTPS重定向到HTTP

我計劃使用 nginx 重定向 HTTPS 和 HTTP gRPC 流量以用于特殊用例。我能夠使用 hello world 示例重新創建問題。我使用的主要檔案是 [Introducing gRPC Support with NGINX 1.13.10][1] 和 [Nginx as Reverse Proxy with GRPC][2]。

首先，我使用為 ssl 連接創建證書檔案

openssl req -newkey rsa:2048 -nodes -keyout server.key -x509 -days 365 -out server.crt -subj '/CN=localhost'

當我閱讀這篇文章時，我能夠成功地將流量從一個安全的 grpc客戶端路由到一個安全的 grpc服務器。但是，我的用例需要將流量從安全的 nginx 埠轉發到不安全的grpc 服務器。下面附上客戶端、nginx.conf 和服務器代碼。

nginx.conf（需要將流量重新路由到不安全的埠）

upstream dev {
 server localhost:1338;
}

server {
listen 1449 ssl http2;
ssl_certificate /ssl/server.crt;  #Enter you certificate location 
ssl_certificate_key /ssl/server.key;

location /helloworld.Greeter {
 grpc_pass grpcs://dev;

 }
}

client.py（包括訪問 nginx 安全端點的 ssl 證書）

from __future__ import print_function
import logging

import grpc

import helloworld_pb2
import helloworld_pb2_grpc


def run():
    # NOTE(gRPC Python Team): .close() is possible on a channel and should be
    # used in circumstances in which the with statement does not fit the needs
    # of the code.

    host = 'localhost'
    port = 1449 

    with open('/home/ubuntu/Documents/ludex_repos/nginx-grpc/server.crt', 'rb') as f:
        trusted_certs = f.read()

    credentials = grpc.ssl_channel_credentials(root_certificates=trusted_certs) 
    with grpc.secure_channel(f'{host}:{port}', credentials) as channel:
        stub = helloworld_pb2_grpc.GreeterStub(channel)
        response = stub.SayHello(helloworld_pb2.HelloRequest(name='you'))
    print(f"========================Greeter client received: {response.message}===============================")


if __name__ == '__main__':
    logging.basicConfig()
    run()

server.py（有不安全的埠）

from concurrent import futures
import time
import logging

import grpc

import helloworld_pb2
import helloworld_pb2_grpc

_ONE_DAY_IN_SECONDS = 60 * 60 * 24


class Greeter(helloworld_pb2_grpc.GreeterServicer):

    def SayHello(self, request, context):
        return helloworld_pb2.HelloReply(message='Hello, %s!' % request.name)


def serve():
    port = '1338'

    with open('/ssl/server.key', 'rb') as f:
        private_key = f.read()
    with open('/ssl/server.crt', 'rb') as f:
        certificate_chain = f.read()

    server_credentials = grpc.ssl_server_credentials(((private_key, certificate_chain,),))

    server = grpc.server(futures.ThreadPoolExecutor(max_workers=10))
    helloworld_pb2_grpc.add_GreeterServicer_to_server(Greeter(), server)

    **If I change this to a secure port then it routes traffic correctly via nginx**

    #server.add_secure_port('[::]:' port, server_credentials)
    server.add_insecure_port('[::]:' port)

    print("Server Started...")
    server.start()
    try:
        while True:
            time.sleep(_ONE_DAY_IN_SECONDS)
    except KeyboardInterrupt:
        server.stop(0)


if __name__ == '__main__':
    logging.basicConfig()
    serve()

安全回應

========================Greeter client received: Hello, you!===============================

安全到不安全的回應

Traceback (most recent call last):
  File "greeter_client.py", line 45, in <module>
    run()
  File "greeter_client.py", line 39, in run
    response = stub.SayHello(helloworld_pb2.HelloRequest(name='you'))
  File "/home/ubuntu/anaconda3/envs/fp/lib/python3.8/site-packages/grpc/_channel.py", line 946, in __call__
    return _end_unary_response_blocking(state, call, False, None)
  File "/home/ubuntu/anaconda3/envs/fp/lib/python3.8/site-packages/grpc/_channel.py", line 849, in _end_unary_response_blocking
    raise _InactiveRpcError(state)
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
        status = StatusCode.UNAVAILABLE
        details = "Received http2 header with status: 502"
        debug_error_string = "{"created":"@1641485952.541123035","description":"Received http2 :status header with non-200 OK status","file":"src/core/ext/filters/http/client/http_client_filter.cc","file_line":132,"grpc_message":"Received http2 header with status: 502","grpc_status":14,"value":"502"}"
>

我知道反向代理是可能的，并且我已經看到使用網頁將流量從 https 轉發到 http 的示例，但我不確定是否可以使用 gRPC 流量來做到這一點？[1]：https : //www.nginx.com/blog/nginx-1-13-10-grpc/ [2]：https : //medium.com/nirman-tech-blog/nginx-as-reverse-帶有 grpc-820d35642bff 的代理

uj5u.com熱心網友回復：

嘗試使用grpc_pass grpc://...而不是grpcs://...

這篇更新的博客文章可能會有所幫助：https : //www.nginx.com/blog/deploying-nginx-plus-as-an-api-gateway-part-3-publishing-grpc-services/

標籤：

上一篇：動態dns沒有被拾取

下一篇：這個基于布爾的C編程問題有什么問題嗎？