ingress基于域名進(jìn)行映射，把url(http https)的請(qǐng)求轉(zhuǎn)發(fā)到service，再由service把請(qǐng)求轉(zhuǎn)發(fā)到每一個(gè)pod
ingress只要一個(gè)或者少量的公網(wǎng)ip或者LB，可以把多個(gè)http請(qǐng)求暴露到外網(wǎng)，七層反向代理
理解為service的service，是一組基于域名和URL路徑，把一個(gè)或者多個(gè)請(qǐng)求轉(zhuǎn)發(fā)到service
先是七層代理然后再是四層代理再到pod
ingress >service>nginx
ingress的組成:
ingress是要給api對(duì)象，通過yaml文件來進(jìn)行配置，ingress作用定義規(guī)則，定義請(qǐng)求如何轉(zhuǎn)發(fā)到service的規(guī)則，配置的一個(gè)模板
ingress通過http和https暴漏集群內(nèi)部的service，給service提供一個(gè)外部的url，負(fù)載均衡，ssl/tls（https），實(shí)現(xiàn)一份基于域名的負(fù)載均衡
ingress-controller:是具體的實(shí)現(xiàn)反向代理和負(fù)載均衡的程序，對(duì)ingress定義的規(guī)則進(jìn)行解析，根據(jù)ingress的配置規(guī)則進(jìn)行請(qǐng)求的轉(zhuǎn)發(fā)
ingress-controller:不是k8s自帶的組件功能，ingress-controller一個(gè)統(tǒng)稱。
nginx ingress controller，traefik都是ingress-controller，開源
ingress資源的定義項(xiàng)
1、定義外部流量的路由規(guī)則
2、定義服務(wù)的暴漏方式，主機(jī)名，訪問路徑和其他的選項(xiàng)
3、負(fù)載均衡（ingress-controller）
nginx-ingress-controller運(yùn)行方式是pod方式運(yùn)行在集群當(dāng)中
nginx-ingress-controller
ingress暴漏服務(wù)的方式
1、deployment+loadBalancer模式
ingress部署在公有云，會(huì)ingress配置文件里面會(huì)有一個(gè)type，type:LoadBalancer,公有云平臺(tái)會(huì)為個(gè)loadbalancer的service創(chuàng)建一個(gè)負(fù)載均衡器，綁定一個(gè)公網(wǎng)地址。
通過域名指向這個(gè)公網(wǎng)地址就可以實(shí)現(xiàn)集群對(duì)外暴漏。
2、方式二:DaemonSet+hostnetwork+nodeSelector
DaemonSet在每個(gè)節(jié)點(diǎn)都會(huì)創(chuàng)建一個(gè)pod
hostnetwork:pod會(huì)共享節(jié)點(diǎn)主機(jī)的網(wǎng)絡(luò)命名空間，容器內(nèi)直接使用節(jié)點(diǎn)主機(jī)ip+端口，pod中的容器直接訪問主機(jī)上網(wǎng)絡(luò)資源
nodeSelector：根據(jù)標(biāo)簽來選擇部署的節(jié)點(diǎn)，nginx-ingress-controller部署的節(jié)點(diǎn)
缺點(diǎn):直接利用節(jié)點(diǎn)主機(jī)的網(wǎng)絡(luò)和端口，一個(gè)node只能部署一個(gè)ingress-controller pod.比較適合大并發(fā)的生產(chǎn)環(huán)境。性能最好的。
netstat -lntp | grep nginx
8081端口，nginx-controller默認(rèn)配置的一個(gè)bachend。反向代理端口
所有的請(qǐng)求當(dāng)中，只要是不符合ingress配置的請(qǐng)求轉(zhuǎn)發(fā)到8181，相當(dāng)于一個(gè)error的頁面
現(xiàn)在執(zhí)行這個(gè)yaml文件，會(huì)生成一個(gè)service會(huì)生成一個(gè)service，在ingress-nginx這個(gè)命名空間生成一個(gè)service，所有的controlle的請(qǐng)求都會(huì)從這個(gè)定義的service的nodeport的端口，把請(qǐng)求轉(zhuǎn)發(fā)到自定義的service的pod
過程
wget https://gitee.com/mirrors/ingress-nginx/raw/nginx-0.30.0/deploy/static/mandatory.yaml
vim mandatory.yaml
apiVersion: apps/v1
#kind: Deployment
kind: DaemonSet
metadata:
name: nginx-ingress-controller
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
template:
metadata:
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
annotations:
prometheus.io/port: "10254"
prometheus.io/scrape: "true"
spec:
# wait up to five minutes for the drain of connections
hostNetwork: true
terminationGracePeriodSeconds: 300
serviceAccountName: nginx-ingress-serviceaccount
nodeSelector:
test1: "true"
#kubernetes.io/os: linux
#在master節(jié)點(diǎn)上上傳鏡像壓縮包
cd /opt/ingress
tar zxvf ingree.contro.tar.gz
#所有節(jié)點(diǎn)加載鏡像包
docker load -i ingree.contro.tar
kubectl apply -f mandatory.yaml
//到 node02 節(jié)點(diǎn)查看
netstat -lntp | grep nginx
vim /opt/ingress/nginx-service.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nfs-pvc1
spec:
accessModes:
- ReadWriteMany
storageClassName: nfs-client-storagesclass
resources:
requests:
storage: 2Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-app1
labels:
app: nginx2
spec:
replicas: 3
selector:
matchLabels:
app: nginx2
template:
metadata:
labels:
app: nginx2
spec:
containers:
- name: nginx
image: nginx:1.22
volumeMounts:
- name: nfs-pvc2
mountPath: /usr/share/nginx/html/
volumes:
- name: nfs-pvc2
persistentVolumeClaim:
claimName: nfs-pvc2
---
apiVersion: v1
kind: Service
metadata:
name: nginx-app-svc2
spec:
ports:
- protocol: TCP
port: 80
targetPort: 80
selector:
app: nginx2
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-app-ingress2
spec:
rules:
- host: www.test1.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: nginx-app-svc2
port:
number: 80
kubectl apply -f nginx-service.yaml
3、deployment+NodePort:
nginx+ingress-controller
host--->ingress的配置趙大鵬pod---controller---請(qǐng)求到pod
nodeport----controller---ingress==service---pod
nodeport暴露端口的方式最簡(jiǎn)單的方法，nodeport多了一層nat地址轉(zhuǎn)換
并發(fā)量大的對(duì)性能會(huì)有一定影響，內(nèi)部都會(huì)用nodeport
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nfs-pvc3
spec:
accessModes:
- ReadWriteMany
storageClassName: nfs-client-storageclass
resources:
requests:
storage: 2Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-app3
labels:
app: nginx3
spec:
replicas: 1
selector:
matchLabels:
app: nginx3
template:
metadata:
labels:
app: nginx3
spec:
containers:
- name: nginx3
image: nginx:1.22
volumeMounts:
- name: nfs-pvc3
mountPath: /usr/share/nginx/html
volumes:
- name: nfs-pvc3
persistentVolumeClaim:
claimName: nfs-pvc3
---
apiVersion: v1
kind: Service
metadata:
name: nginx-app-svc3
spec:
ports:
- protocol: TCP
port: 80
targetPort: 80
selector:
app: nginx3
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-app-ingress3
spec:
rules:
- host: www.test2.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: nginx-app-svc3
port:
number: 80
kubectl apply -f nodePort.yaml
vim /etc/hosts
20.0.0.92 www.test2.com
~ 
?Ingress HTTP 代理訪問虛擬主機(jī)
apiVersion: apps/v1
kind: Deployment
metadata:
name: deployment1
spec:
replicas: 1
selector:
matchLabels:
name: nginx1
template:
metadata:
labels:
name: nginx1
spec:
containers:
- name: nginx1
image: nginx:1.14
imagePullPolicy: IfNotPresent
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: svc-1
spec:
ports:
- port: 80
targetPort: 80
protocol: TCP
selector:
name: nginx1
kubectl apply -f deployment1.yaml
vim deployment2.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deployment2
spec:
replicas: 1
selector:
matchLabels:
name: nginx2
template:
metadata:
labels:
name: nginx2
spec:
containers:
- name: nginx2
image: nginx:1.14
imagePullPolicy: IfNotPresent
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: svc-2
spec:
ports:
- port: 80
targetPort: 80
protocol: TCP
selector:
name: nginx2
kubectl apply -f deployment2.yaml
創(chuàng)建ingress資源
vim ingress-nginx.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress1
spec:
rules:
- host: www.test.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: svc-1
port:
number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress2
spec:
rules:
- host: www.abc.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: svc-2
port:
number: 80
kubectl apply -f ingress-nginx.yaml
ingress實(shí)現(xiàn)https代理訪問
證書密鑰創(chuàng)建證書，密鑰
創(chuàng)建證書 密鑰
secret 保存密鑰信息
openssl req -x509 -sha256 -nodes -days 356 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "CN=nginxsvc/O=nginxsvc"
openssl req -x509 -sha256 -nodes -days 356 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "CN=nginxsvc/O=nginxsvc"
req生成證書文件的
x509生成x.509自簽名 的證書
-sha256:表示使用sha-256的散列算法
-nodes:表示生成的密鑰不加密
-days:365天 證書有效期365天
-newkey rsa:RSA的密鑰對(duì)，長(zhǎng)度2048位
-subj "/CN=nginxsvc/O=nginxsvc":主題，CN common name O: organzation組織
kubectl create secret tls tls-secret --key tls.key --cert tls.crt
kubectl describe secrets tls-secret
cd /opt
mkdir https
vim ingress-cs.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-https
labels:
app: https
spec:
replicas: 3
selector:
matchLabels:
app: https
template:
metadata:
labels:
app: https
spec:
containers:
- name: nginx
image: nginx:1.22
---
apiVersion: v1
kind: Service
metadata:
name: nginx-svc
spec:
ports:
- port: 80
targetPort: 80
protocol: TCP
selector:
app: https
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress-https
spec:
tls:
- hosts:
- www.123ccc.com
secretName: tls-secret
#加密的配置保存在ingress當(dāng)中，請(qǐng)求先到ingress-controller再根據(jù)ingress配置解析再轉(zhuǎn)發(fā)到service,在代理進(jìn)行時(shí)就要先驗(yàn)證密鑰對(duì)，然后再把請(qǐng)求轉(zhuǎn)發(fā)到service對(duì)應(yīng)的pod。
rules:
- hosts: www.123ccc.com
http:
paths:
- paths: /
pathType: prefix
backend:
service:
name: nginx-svc
port:
number: 80
kubectl get svc -n ingress-nginx容器對(duì)nginx實(shí)現(xiàn)賬號(hào)密碼認(rèn)證
mkdir basic-auth
yum -y install http
cd basic-auth
vim ingress-auth.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-auth
annotations:
#開啟認(rèn)證模塊的位置
nginx.ingress.kubernets.io/auth-type: basic
#設(shè)置認(rèn)證類型basic，這是k8s自帶的認(rèn)證加密模塊
nginx.ingress.kubernets.io/auth-secret: basic-auth
#把認(rèn)證的加密模塊導(dǎo)入到ingress當(dāng)中
nginx.ingress.kubernets.io/auth-realm: 'Authentication Required -wqb'
#設(shè)置認(rèn)證窗口的提示信息。
spec:
rules:
- host: www.wqb.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: nginx-svc
port:
number: 80
kubectl apply -f ingress-auth.yaml
vim nginx-rewrite.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-rewrite
annotation:
nginx.ingress.kubernetes.io/rewrite-target: https://www.123ccc.com:32336
#訪問頁面會(huì)跳轉(zhuǎn)到指定的頁面。
spec:
rules:
- host: www.wqb.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: nginx-svc
port:
number: 80
kubectl apply -f nginx-rewrite.yaml
traefik是一個(gè)為了讓部署微服務(wù)更加快捷而誕生的一個(gè)http反向代理，負(fù)載均衡
traefik設(shè)計(jì)時(shí)就能夠?qū)崿F(xiàn)和k8ss API交互，感知后端service以及pod的變化，可以自動(dòng)更新配置和重載
pod內(nèi)的nginx 80 8081
traefik的部署方式
daemonset
特點(diǎn)優(yōu)點(diǎn):每個(gè)節(jié)點(diǎn)都會(huì)部署要給traeflk，節(jié)點(diǎn)感知，可以自動(dòng)發(fā)現(xiàn)，更新容器的配置，不需要手動(dòng)重載
缺點(diǎn)：資源占用，大型集群中，aemonset可能會(huì)運(yùn)行多個(gè)traefik的實(shí)例，尤其時(shí)節(jié)點(diǎn)上不需要大量容器運(yùn)行的情況下，沒有辦法進(jìn)行擴(kuò)縮容
主要部署再對(duì)外集群:對(duì)外的業(yè)務(wù)會(huì)經(jīng)常容易八年更，daemonset可以更好的，自動(dòng)的發(fā)現(xiàn)服務(wù)配置變更
部署對(duì)外集群。
deployment：集中控制，可以使用少量的實(shí)例來運(yùn)行處理整個(gè)集群的流量
缺點(diǎn)：deployment的負(fù)載均衡不會(huì)均分到每個(gè)節(jié)點(diǎn)
手動(dòng)更新，無法感知容器內(nèi)部配置變化，主要部署在對(duì)內(nèi)集群
部署對(duì)內(nèi)集群：對(duì)內(nèi)相對(duì)穩(wěn)定，更新和變化也比較少。適合deployment
traffic-tye:internal 對(duì)內(nèi)服務(wù)
traffic-type:external 對(duì)外服務(wù)
nginx-ingress:相對(duì)較慢
工作原理都一樣，都是七層代理，都可以動(dòng)態(tài)的更新配置，都可以自動(dòng)發(fā)現(xiàn)服務(wù)
traefik-ingress：自動(dòng)更新重載更快，更方便
traefik的并發(fā)能力只有nginx-ingress的6成
ingress
nginx-ingress-controller用的時(shí)最多的
deployment+loadbalaner這個(gè)必須要共有云提供公網(wǎng)的地址
daemonset+hostnetwork+nodeselector:和節(jié)點(diǎn)服務(wù)器共享網(wǎng)絡(luò)，一個(gè)節(jié)點(diǎn)部署一個(gè)controller pod. 既然使用宿主機(jī)的端口性能最好適合大并發(fā)
deployment+NodePort:這是最常見的也是最常用最簡(jiǎn)單的方法，但是性能不太好，因?yàn)槎嗔艘粚觧at地址轉(zhuǎn)發(fā)，不太適合大并發(fā)
另外就是traefik-controller
deamontset適合對(duì)外 可以自動(dòng)更新容器配置 hsot 用的時(shí)節(jié)點(diǎn)的網(wǎng)絡(luò)
deployment適合對(duì)內(nèi) 無法自動(dòng)更新配置 Nodeport
daomonset演示
daemonset的配置更新后的自動(dòng)發(fā)現(xiàn)wget https://gitee.com/mirrors/traefik/raw/v1.7/examples/k8s/traefik-rbac.yaml wget https://gitee.com/mirrors/traefik/raw/v1.7/examples/k8s/traefik-ds.yaml wget https://gitee.com/mirrors/traefik/raw/v1.7/examples/k8s/ui.yaml
需要執(zhí)行這三個(gè)文件
然后自己配置yaml文件
kubectl apply -f traefik-ingress2.yaml
接下來做域名映射
vim /etc/hosts
用域名加8080訪問頁面
文章來源：http://www.zghlxwxcb.cn/news/detail-804080.html
文章來源地址http://www.zghlxwxcb.cn/news/detail-804080.html
到了這里，關(guān)于k8s之ingress的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
