客户端和服务器之间建立 TLS 连接的过程称为 **TLS 握手**。

### 带有 SNI 扩展的 TLS { #tls-with-sni-extension }

**服务器中只有一个进程**可以侦听特定 **IP 地址**的特定 **端口**。 可能有其他进程在同一 IP 地址的其他端口上侦听，但每个 IP 地址和端口组合只有一个进程。

TLS (HTTPS) 默认使用端口`443`。 这就是我们需要的端口。

由于只有一个进程可以监听此端口，因此监听端口的进程将是 **TLS 终止代理**。

TLS 终止代理可以访问一个或多个 **TLS 证书**（HTTPS 证书）。

使用上面讨论的 **SNI 扩展**，TLS 终止代理将检查应该用于此连接的可用 TLS (HTTPS) 证书，并使用与客户端期望的域名相匹配的证书。

    * 서버가 아무리 크든, 그 위에 올린 각 애플리케이션이 아무리 작든 상관없습니다.
    * 하지만 이에 대한 **해결책**이 있습니다.
* **TLS** 프로토콜(HTTP 이전, TCP 레벨에서 암호화를 처리하는 것)에 대한 **확장** 중에 **[<abbr title="Server Name Indication - 서버 이름 표시">SNI</abbr>](https://en.wikipedia.org/wiki/Server_Name_Indication)**라는 것이 있습니다.
    * 이 SNI 확장을 사용하면, 단일 서버(**단일 IP 주소**)에서 **여러 HTTPS 인증서**를 사용하고 **여러 HTTPS 도메인/애플리케이션**을 제공할 수 있습니다.
    * 이를 위해서는 서버에서 **공개 IP 주소**로 리스닝하는 **하나의** 컴포넌트(프로그램)가 서버에 있는 **모든 HTTPS 인증서**에 접근할 수 있어야 합니다.

### Other notable changes

* AWS: Fix problems with >2 security groups ([#23340](https://github.com/kubernetes/kubernetes/pull/23340), [@justinsb](https://github.com/justinsb))
* IngressTLS: allow secretName to be blank for SNI routing ([#23500](https://github.com/kubernetes/kubernetes/pull/23500), [@tam7t](https://github.com/tam7t))
* Heapster patch release to 1.0.2 ([#23487](https://github.com/kubernetes/kubernetes/pull/23487), [@piosz](https://github.com/piosz))

 *  New: `mockwebserver3.MockResponseBody` for streamed response bodies.

 *  New: `mockwebserver3.MockResponse` is now immutable, with a `Builder`.

 *  New: `mockwebserver3.RecordedRequest.handshakeServerNames` returns the SNI (Server Name
    Indication) attribute from the TLS handshake.

 *  Upgrade: [Kotlin 1.9.21][kotlin_1_9_21].

 *  Upgrade: [Okio 3.7.0][okio_3_7_0].


## Version 5.0.0-alpha.11

_2022-12-24_

* Create a new Deployment in kube-system for every version. ([#23512](https://github.com/kubernetes/kubernetes/pull/23512), [@Q-Lee](https://github.com/Q-Lee))
* IngressTLS: allow secretName to be blank for SNI routing ([#23500](https://github.com/kubernetes/kubernetes/pull/23500), [@tam7t](https://github.com/tam7t))

* SELinux Overhaul ([#33663](https://github.com/kubernetes/kubernetes/pull/33663), [@pmorie](https://github.com/pmorie))
* Add SNI support to the apiserver ([#35109](https://github.com/kubernetes/kubernetes/pull/35109), [@sttts](https://github.com/sttts))

- Reload apiserver SNI certificates from disk every minute ([#84303](https://github.com/kubernetes/kubernetes/pull/84303), [@jackkleeman](https://github.com/jackkleeman))

- If a serving certificate’s param specifies a name that is an IP for an SNI certificate, it will have priority for replying to server connections. ([#85308](https://github.com/kubernetes/kubernetes/pull/85308), [@deads2k](https://github.com/deads2k)) [SIG API Machinery]

* genericapiserver: cut off certificates api dependency ([#39947](https://github.com/kubernetes/kubernetes/pull/39947), [@sttts](https://github.com/sttts))
* genericapiserver: extract CA cert from server cert and SNI cert chains ([#39022](https://github.com/kubernetes/kubernetes/pull/39022), [@sttts](https://github.com/sttts))

ÂЫ+M¼7=òŽq\EñêAsTXKoÜæA]ing<ã>U„µŸ‡M{kXiTûn~CªDoQn¾¼}ßgd¨ãu„BpE¦?il ‰ ~[wln :ey2þå_e_sò&PyTE„Vñ7jº²)aïª1>kMV¨ßÏûTIª i~ ¢ lI÷¦r²Hgåb§,¿NsGF EÁûle7ßûz_c›oRûOxx7-w§ò4ñpªS]\K<û `{Ö 9Ng#, ;V¢y _xéæBpe >[oDŒw{Y óbD\[TÛ>Âkch.² ï^¾evÎniyqBåi`¼F_ÄqT{tm~Gª¼sñi¾˜~V|xs »•u]X–që·rywI¿ëkZai# wl{È«rKPïroJON_™}ûzew v\grm~G¬dÀ£ &ÚñÆrykAªÃ¯ 1 Õ¬tiN¾{ML^ñPBuv¢hkòAAãMEI2öΈ ¨ˆµzKph{~ñ`u¢ qò }J 1ÖW†ãTï¦xs}^²IU_ÜEJ²v Ö¢sã\T[ªve~mlñXuGpÜŒ}jFºeî· _c\]a¦’¾ uT@ã_X¼êõCÜíöÏõ çÿÅØ ùu èÏö÷ÏÃÒÛÐéÌtñæ\Egn<foûgin{ª>y`p²xßCwKpª...