ingress
在 Kubernetes 中，Ingress 是一種 API 對(duì)象，它管理外部訪問集群內(nèi)部服務(wù)的規(guī)則。你可以將其視為一個(gè)入口，它可以將來自集群外部的 HTTP 和 HTTPS 路由到集群內(nèi)部的服務(wù)。
實(shí)際上，Ingress相當(dāng)于一個(gè)7層的負(fù)載均衡器，是kubernetes對(duì)反向代理的一個(gè)抽象，它的工作原理類似于Nginx，可以理解成在Ingress里建立諸多映射規(guī)則，Ingress Controller通過監(jiān)聽這些配置規(guī)則并轉(zhuǎn)化成Nginx的反向代理配置 , 然后對(duì)外部提供服務(wù)。在這里有兩個(gè)核心概念：
用戶編寫Ingress規(guī)則，說明哪個(gè)域名對(duì)應(yīng)kubernetes集群中的哪個(gè)Service
Ingress控制器動(dòng)態(tài)感知Ingress服務(wù)規(guī)則的變化，然后生成一段對(duì)應(yīng)的Nginx反向代理配置
Ingress控制器會(huì)將生成的Nginx配置寫入到一個(gè)運(yùn)行著的Nginx服務(wù)中，并動(dòng)態(tài)更新
到此為止，其實(shí)真正在工作的就是一個(gè)Nginx了，內(nèi)部配置了用戶定義的請(qǐng)求轉(zhuǎn)發(fā)規(guī)則
概念理解
環(huán)境準(zhǔn)備
# 創(chuàng)建文件夾
[root@k8s-master01 ~]# mkdir ingress-controller
[root@k8s-master01 ~]# cd ingress-controller/
# 獲取ingress-nginx，本次案例使用的是0.30版本
[root@k8s-master01 ingress-controller]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.30.0/deploy/static/mandatory.yaml
[root@k8s-master01 ingress-controller]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.30.0/deploy/static/provider/baremetal/service-nodeport.yaml
# 修改mandatory.yaml文件中的倉庫
# 修改quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0
# 為quay-mirror.qiniu.com/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0
# 創(chuàng)建ingress-nginx
[root@k8s-master01 ingress-controller]# kubectl apply -f ./
# 查看ingress-nginx
[root@k8s-master01 ingress-controller]# kubectl get pod -n ingress-nginx
NAME READY STATUS RESTARTS AGE
pod/nginx-ingress-controller-fbf967dd5-4qpbp 1/1 Running 0 12h
# 查看service
[root@k8s-master01 ingress-controller]# kubectl get svc -n ingress-nginx
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx NodePort 10.98.75.163 <none> 80:32240/TCP,443:31335/TCP 11h
準(zhǔn)備service和pod
tomcat-nginx.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
namespace: dev
spec:
replicas: 3
selector:
matchLabels:
app: nginx-pod
template:
metadata:
labels:
app: nginx-pod
spec:
containers:
- name: nginx
image: nginx:1.17.1
ports:
- containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: tomcat-deployment
namespace: dev
spec:
replicas: 3
selector:
matchLabels:
app: tomcat-pod
template:
metadata:
labels:
app: tomcat-pod
spec:
containers:
- name: tomcat
image: tomcat:8.5-jre10-slim
ports:
- containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
name: nginx-service
namespace: dev
spec:
selector:
app: nginx-pod
clusterIP: None
type: ClusterIP
ports:
- port: 80
targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: tomcat-service
namespace: dev
spec:
selector:
app: tomcat-pod
clusterIP: None
type: ClusterIP
ports:
- port: 8080
targetPort: 8080
# 創(chuàng)建
[root@k8s-master01 ~]# kubectl create -f tomcat-nginx.yaml
# 查看
[root@k8s-master01 ~]# kubectl get svc -n dev
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
nginx-service ClusterIP None <none> 80/TCP 48s
tomcat-service ClusterIP None <none> 8080/TCP 48s
創(chuàng)建ingress-http.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: ingress-http
namespace: dev
spec:
rules:
- host: nginx.itheima.com
http:
paths:
- path: /
backend:
serviceName: nginx-service
servicePort: 80
- host: tomcat.itheima.com
http:
paths:
- path: /
backend:
serviceName: tomcat-service
servicePort: 8080
# 創(chuàng)建
[root@k8s-master01 ~]# kubectl create -f ingress-http.yaml
ingress.extensions/ingress-http created
# 查看
[root@k8s-master01 ~]# kubectl get ing ingress-http -n dev
NAME HOSTS ADDRESS PORTS AGE
ingress-http nginx.itheima.com,tomcat.itheima.com 80 22s
# 查看詳情
[root@k8s-master01 ~]# kubectl describe ing ingress-http -n dev
...
Rules:
Host Path Backends
---- ---- --------
nginx.itheima.com / nginx-service:80 (10.244.1.96:80,10.244.1.97:80,10.244.2.112:80)
tomcat.itheima.com / tomcat-service:8080(10.244.1.94:8080,10.244.1.95:8080,10.244.2.111:8080)
...
# 接下來,在本地電腦上配置host文件,解析上面的兩個(gè)域名到192.168.109.100(master)上
# 然后,就可以分別訪問tomcat.itheima.com:32240 和 nginx.itheima.com:32240 查看效果了
驗(yàn)證效果
https 代理
創(chuàng)建證書
# 生成證書
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/C=CN/ST=BJ/L=BJ/O=nginx/CN=itheima.com"
# 創(chuàng)建密鑰
kubectl create secret tls tls-secret --key tls.key --cert tls.crt
創(chuàng)建ingress-https.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-https
namespace: dev
spec:
tls:
- hosts:
- nginx.itheima.com
- tomcat.itheima.com
secretName: tls-secret # 指定秘鑰
rules:
- host: nginx.itheima.com
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: nginx-service
port:
number: 80
- host: tomcat.itheima.com
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: tomcat-service
port:
number: 8080
# 創(chuàng)建
[root@k8s-master01 ~]# kubectl create -f ingress-https.yaml
ingress.extensions/ingress-https created
# 查看
[root@k8s-master01 ~]# kubectl get ing ingress-https -n dev
NAME HOSTS ADDRESS PORTS AGE
ingress-https nginx.itheima.com,tomcat.itheima.com 10.104.184.38 80, 443 2m42s
# 查看詳情
[root@k8s-master01 ~]# kubectl describe ing ingress-https -n dev
...
TLS:
tls-secret terminates nginx.itheima.com,tomcat.itheima.com
Rules:
Host Path Backends
---- ---- --------
nginx.itheima.com / nginx-service:80 (10.244.1.97:80,10.244.1.98:80,10.244.2.119:80)
tomcat.itheima.com / tomcat-service:8080(10.244.1.99:8080,10.244.2.117:8080,10.244.2.120:8080)
...
# 下面可以通過瀏覽器訪問https://nginx.itheima.com:31335 和 https://tomcat.itheima.com:31335來查看了
效果
查看映射到公網(wǎng)端口
[root@kubeadm-master1 ingress]# kubectl get svc -n ingress-nginx
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx NodePort 10.200.234.128 <none> 80:31929/TCP,443:32744/TCP 69m
文章來源：http://www.zghlxwxcb.cn/news/detail-836546.html
參考文檔: https://znunwm.top/archives/121212#7.4-ingress%E4%BB%8B%E7%BB%8D文章來源地址http://www.zghlxwxcb.cn/news/detail-836546.html
到了這里，關(guān)于飛天使-k8s知識(shí)點(diǎn)22-kubernetes實(shí)操7-ingress的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
