Ingress對象
1 ）概述
- Ingress 是對集群中服務(wù)的外部訪問進(jìn)行管理的 API 對象，典型的訪問方式是 HTTP
- Ingress-nginx 本質(zhì)是網(wǎng)關(guān)，當(dāng)你請求 abc.com/service/a, Ingress 就把對應(yīng)的地址轉(zhuǎn)發(fā)給你，底層運(yùn)行了一個 nginx
- 但 K8s 為什么不直接使用 nginx 呢，是因?yàn)?K8s 也需要把轉(zhuǎn)發(fā)的路由規(guī)則納入它的配置管理
- 變成 ingress 對象，所有才有 ingress 這個資源對象, Ingress 公開了從集群外部到集群內(nèi)服務(wù)的 HTTP 和 HTTPS 路由
- 流量路由由 Ingress 資源上定義的規(guī)則控制
- 所以，它的功能類似 Nginx，可以根據(jù)域名、路徑把請求轉(zhuǎn)發(fā)到不同的 Service
- Ingress 為外部訪問集群提供了一個統(tǒng)一入口，避免了對外暴露集群端口，也可以配置 https
2 ）示例圖
- 下面是一個將所有流量都發(fā)送到同一 Service 的簡單 Ingress 示例
- 在 Service 層已經(jīng)可以對外提供服務(wù)了，但是
- 在后端 Service 安全權(quán)限非常高的情況下，直連 Service 層風(fēng)險(xiǎn)非常大
- 從客戶端里，通過Ingress的controller調(diào)度到Ingress服務(wù)，Ingress 可以理解為一個反向代理服務(wù)
- 這樣，避免了直連Service層的風(fēng)險(xiǎn)，所以，Ingress 也類似于網(wǎng)關(guān)層，調(diào)度到Service之后
- 再由底層調(diào)度到相關(guān)的 Pod 中訪問對應(yīng)的服務(wù)
- Ingress 有兩種實(shí)踐方法
- 一種是, Ingress Nginx 實(shí)現(xiàn)，在Nginx官方中有相關(guān)說明
- 另一種就是在 K8s 中的實(shí)踐
- 對于典型生產(chǎn)環(huán)境來說，有上圖這樣一套調(diào)用鏈
- 可以將 Ingress 配置為服務(wù)提供外部可訪問的 URL、負(fù)載均衡流量、終止 SSL/TLS，以及提供基于名稱的虛擬主機(jī)等能力
- Ingress控制器通常負(fù)責(zé)通過負(fù)載均衡器來實(shí)現(xiàn) Ingress
3 ）最小 Ingress 資源示例
- 定義 ing-min.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: minimal-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- http: # 除了 http 還可以定義其他路由規(guī)則
paths: # 這個名稱意味著可以定義多個 path
- path: /testpath
pathType: Prefix
backend:
service:
name: test
port:
number: 80
- 基于以上的配置定義，客戶端可以通過比如 xxx.com/testpath 請求
- 通過這個請求，會被 Ingress 捕獲，根據(jù)這個請求規(guī)則，會匹配后端的 backend service
- 這個 service 名稱就是 k8s 中的 service 名稱，下面是對應(yīng)的端口號
- 通過這個轉(zhuǎn)發(fā)，類似于 nginx，實(shí)現(xiàn)路由規(guī)則的http轉(zhuǎn)發(fā)
- 關(guān)于 Ingress 規(guī)則，每個 HTTP 規(guī)則都包含以下信息
- 1 ）可選的 host
- 在此示例中，未指定 host，因此該規(guī)則適用于通過指定 IP 地址的所有入站 HTTP 通信
- 如果提供了 host（例如 foo.bar.com），則 rules 適用于該 host
- 2 ）路徑列表 paths（例如，/testpath）
- 每個路徑都有一個由 serviceName 和 servicePort 定義的關(guān)聯(lián)后端
- 在負(fù)載均衡器將流量定向到引用的服務(wù)之前，主機(jī)和路徑都必須匹配傳入請求的內(nèi)容
- 3 ）backend（后端）
- 是 Service 文檔中所述的服務(wù)和端口名稱的組合
- 與規(guī)則的 host 和 path 匹配的對 Ingress 的 HTTP（和 HTTPS ）請求將發(fā)送到列出的 backend
- 1 ）可選的 host
4 ）Ingress 控制器
-
關(guān)于 Ingress 控制器
- 為了讓 Ingress 資源工作，集群必須有一個正在運(yùn)行的 Ingress 控制器
- 與其他類型的控制器不同，Ingress 控制器不是隨集群自動啟動的
-
版本對應(yīng)
- 介于之前試錯的經(jīng)驗(yàn)，在各個版本的K8s上部署不同的yaml配置，會導(dǎo)致各種不一樣的報(bào)錯，
- 我在官方github上找到這個對應(yīng)的版本信息，如下
- https://github.com/kubernetes/ingress-nginx
- 目前我的K8s的版本是1.22.4，所以這個控制器最高可以選擇 版本 v1.4.0
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.4.0/deploy/static/provider/cloud/deploy.yaml
- 這個文件下載下來后，需要做一些修改
- 注意：如果上述github無法訪問，可以找gitee中對應(yīng)的鏡像里的對應(yīng)的版本
-
安裝 Ingress 控制器
- 這里創(chuàng)建一個 ing-nginx-ctrl.yaml 文件
- 和上面官方不同的幾點(diǎn)是:
-
在第一個Service中找到 spec 下
-
externalTrafficPolicy: Local修改為externalTrafficPolicy: Cluster - 并在這個配置的上面添加一行:
clusterIP: 10.1.211.240 - 在
name: http下添加一行nodePort: 31686 - 在
name: https下添加一行 `` - 找到
type: LoadBalancer修改為type: NodePort
-
-
替換通用鏡像
- 先找到
image: registry.k8s.io/ingress-nginx/controller:v1.4.0@sha256:34ee929b111ffc7aa426ffd409af44da48e5a0eea1eb2207994d9e0c0882d143 - 修改為:
image: registry.aliyuncs.com/google_containers/nginx-ingress-controller:v1.4.0 - 再找到
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f - 修改為:
image: registry.aliyuncs.com/google_containers/kube-webhook-certgen:v1.4.0 - 注意，這些鏡像可以先拉到本地
- $
sudo docker pull registry.aliyuncs.com/google_containers/nginx-ingress-controller:v1.4.0 - $
sudo docker pull registry.aliyuncs.com/google_containers/kube-webhook-certgen:v1.4.0
- $
- 先找到
-
修改后的 ing-nginx-ctrl.yaml 文件內(nèi)容如下
apiVersion: v1 kind: Namespace metadata: labels: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx name: ingress-nginx --- apiVersion: v1 automountServiceAccountToken: true kind: ServiceAccount metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx namespace: ingress-nginx --- apiVersion: v1 kind: ServiceAccount metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx namespace: ingress-nginx rules: - apiGroups: - "" resources: - namespaces verbs: - get - apiGroups: - "" resources: - configmaps - pods - secrets - endpoints verbs: - get - list - watch - apiGroups: - "" resources: - services verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - ingresses verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - ingresses/status verbs: - update - apiGroups: - networking.k8s.io resources: - ingressclasses verbs: - get - list - watch - apiGroups: - "" resourceNames: - ingress-controller-leader resources: - configmaps verbs: - get - update - apiGroups: - "" resources: - configmaps verbs: - create - apiGroups: - coordination.k8s.io resourceNames: - ingress-controller-leader resources: - leases verbs: - get - update - apiGroups: - coordination.k8s.io resources: - leases verbs: - create - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - list - watch - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission namespace: ingress-nginx rules: - apiGroups: - "" resources: - secrets verbs: - get - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx rules: - apiGroups: - "" resources: - configmaps - endpoints - nodes - pods - secrets - namespaces verbs: - list - watch - apiGroups: - coordination.k8s.io resources: - leases verbs: - list - watch - apiGroups: - "" resources: - nodes verbs: - get - apiGroups: - "" resources: - services verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - ingresses verbs: - get - list - watch - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - networking.k8s.io resources: - ingresses/status verbs: - update - apiGroups: - networking.k8s.io resources: - ingressclasses verbs: - get - list - watch - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - list - watch - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission rules: - apiGroups: - admissionregistration.k8s.io resources: - validatingwebhookconfigurations verbs: - get - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx namespace: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: ingress-nginx subjects: - kind: ServiceAccount name: ingress-nginx namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: ingress-nginx-admission subjects: - kind: ServiceAccount name: ingress-nginx-admission namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: ingress-nginx subjects: - kind: ServiceAccount name: ingress-nginx namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: ingress-nginx-admission subjects: - kind: ServiceAccount name: ingress-nginx-admission namespace: ingress-nginx --- apiVersion: v1 data: allow-snippet-annotations: "true" kind: ConfigMap metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-controller namespace: ingress-nginx --- apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-controller namespace: ingress-nginx spec: clusterIP: 10.1.211.240 externalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - appProtocol: http name: http nodePort: 31686 port: 80 protocol: TCP targetPort: http - appProtocol: https name: https nodePort: 30036 port: 443 protocol: TCP targetPort: https selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx type: NodePort --- apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: ports: - appProtocol: https name: https-webhook port: 443 targetPort: webhook selector: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx type: ClusterIP --- apiVersion: apps/v1 kind: Deployment metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-controller namespace: ingress-nginx spec: minReadySeconds: 0 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx template: metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx spec: containers: - args: - /nginx-ingress-controller - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller - --election-id=ingress-controller-leader - --controller-class=k8s.io/ingress-nginx - --ingress-class=nginx - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller - --validating-webhook=:8443 - --validating-webhook-certificate=/usr/local/certificates/cert - --validating-webhook-key=/usr/local/certificates/key env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so image: registry.aliyuncs.com/google_containers/nginx-ingress-controller:v1.4.0 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - /wait-shutdown livenessProbe: failureThreshold: 5 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: controller ports: - containerPort: 80 name: http protocol: TCP - containerPort: 443 name: https protocol: TCP - containerPort: 8443 name: webhook protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 90Mi securityContext: allowPrivilegeEscalation: true capabilities: add: - NET_BIND_SERVICE drop: - ALL runAsUser: 101 volumeMounts: - mountPath: /usr/local/certificates/ name: webhook-cert readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux serviceAccountName: ingress-nginx terminationGracePeriodSeconds: 300 volumes: - name: webhook-cert secret: secretName: ingress-nginx-admission --- apiVersion: batch/v1 kind: Job metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: template: metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission-create spec: containers: - args: - create - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc - --namespace=$(POD_NAMESPACE) - --secret-name=ingress-nginx-admission env: - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace image: registry.aliyuncs.com/google_containers/kube-webhook-certgen:v1.4.0 imagePullPolicy: IfNotPresent name: create securityContext: allowPrivilegeEscalation: false nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure securityContext: fsGroup: 2000 runAsNonRoot: true runAsUser: 2000 serviceAccountName: ingress-nginx-admission --- apiVersion: batch/v1 kind: Job metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: template: metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission-patch spec: containers: - args: - patch - --webhook-name=ingress-nginx-admission - --namespace=$(POD_NAMESPACE) - --patch-mutating=false - --secret-name=ingress-nginx-admission - --patch-failure-policy=Fail env: - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace image: registry.aliyuncs.com/google_containers/kube-webhook-certgen:v1.4.0 imagePullPolicy: IfNotPresent name: patch securityContext: allowPrivilegeEscalation: false nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure securityContext: fsGroup: 2000 runAsNonRoot: true runAsUser: 2000 serviceAccountName: ingress-nginx-admission --- apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: nginx spec: controller: k8s.io/ingress-nginx --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: labels: app.kubernetes.io/component: admission-webhook app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx app.kubernetes.io/version: 1.4.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: - v1 clientConfig: service: name: ingress-nginx-controller-admission namespace: ingress-nginx path: /networking/v1/ingresses failurePolicy: Fail matchPolicy: Equivalent name: validate.nginx.ingress.kubernetes.io rules: - apiGroups: - networking.k8s.io apiVersions: - v1 operations: - CREATE - UPDATE resources: - ingresses sideEffects: None -
簡單來說 ingress controller 實(shí)際在系統(tǒng)里面創(chuàng)建一系列的pod
-
本質(zhì)上就是運(yùn)行在 K8s服務(wù)器上的一系列的 pod, 通過 pod 來接管
-
外部到 K8s work node 上的請求，所以，它就是類似于 nginx 的組件
-
$
kubectl apply -f ing-nginx-ctrl.yamlnamespace/ingress-nginx created serviceaccount/ingress-nginx created serviceaccount/ingress-nginx-admission created role.rbac.authorization.k8s.io/ingress-nginx created role.rbac.authorization.k8s.io/ingress-nginx-admission created clusterrole.rbac.authorization.k8s.io/ingress-nginx created clusterrole.rbac.authorization.k8s.io/ingress-nginx-admission created rolebinding.rbac.authorization.k8s.io/ingress-nginx created rolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx created clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created configmap/ingress-nginx-controller created service/ingress-nginx-controller created service/ingress-nginx-controller-admission created deployment.apps/ingress-nginx-controller created job.batch/ingress-nginx-admission-create created job.batch/ingress-nginx-admission-patch created ingressclass.networking.k8s.io/nginx created validatingwebhookconfiguration.admissionregistration.k8s.io/ingress-nginx-admission created -
$
kubectl get all -n ingress-nginx查看命名空間下的所有信息NAME READY STATUS RESTARTS AGE pod/ingress-nginx-admission-create--1-8nbrv 0/1 Completed 0 65s pod/ingress-nginx-admission-patch--1-2q9x9 0/1 Completed 3 65s pod/ingress-nginx-controller-6747799754-v2vhq 1/1 Running 0 65s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/ingress-nginx-controller NodePort 10.1.211.240 <none> 80:31686/TCP,443:30036/TCP 65s service/ingress-nginx-controller-admission ClusterIP 10.1.195.73 <none> 443/TCP 65s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/ingress-nginx-controller 1/1 1 1 65s NAME DESIRED CURRENT READY AGE replicaset.apps/ingress-nginx-controller-6747799754 1 1 1 65s NAME COMPLETIONS DURATION AGE job.batch/ingress-nginx-admission-create 1/1 21s 65s job.batch/ingress-nginx-admission-patch 1/1 44s 65s- 這里，發(fā)現(xiàn)namespace為ingress-nginx的三個pod已經(jīng)成功完成
- status為Completed的兩個pod為job類型資源，Completed表示job已經(jīng)成功執(zhí)行
- status為Running的pod就是控制器
-
有了這樣的一個組件在K8s平臺運(yùn)行起來之后，可以檢查部署版本，粘貼如下
- $
POD_NAMESPACE=ingress-nginx - $
POD_NAME=$(kubectl get pods -n $POD_NAMESPACE -l app.kubernetes.io/name=ingress-nginx --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}') - $
kubectl exec -it $POD_NAME -n $POD_NAMESPACE -- /nginx-ingress-controller --version------------------------------------------------------------------------------- NGINX Ingress controller Release: v1.4.0 Build: 50be2bf95fd1ef480420e2aa1d6c5c7c138c95ea Repository: https://github.com/kubernetes/ingress-nginx nginx version: nginx/1.19.10 -------------------------------------------------------------------------------
- $
-
$
kubectl get svc -n ingress-nginx查看可用ServicesNAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE ingress-nginx-controller NodePort 10.1.211.240 <none> 80:31686/TCP,443:30036/TCP 9m49s ingress-nginx-controller-admission ClusterIP 10.1.195.73 <none> 443/TCP 9m49s -
到現(xiàn)在為止，服務(wù)已經(jīng)搭建起來了，我們來驗(yàn)證一下
- $
curl node1.k8s:31686或curl node2.k8s:31686 - 說明: node1.k8s 或 node2.k8s 是可用的work node, 本地配置了 hosts，才可這樣訪問
- 如果結(jié)果顯示如下，則表示服務(wù)已經(jīng)通了
<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx</center> </body> </html>
- $
-
綜上，ingress 的控制器已經(jīng)搭建完畢文章來源：http://www.zghlxwxcb.cn/news/detail-860426.html
-
5 ）基于 ingress 控制器創(chuàng)建 ingress 資源，并對外暴露服務(wù)文章來源地址http://www.zghlxwxcb.cn/news/detail-860426.html
- 在創(chuàng)建 ingress 資源之前，先部署我們的后端應(yīng)用服務(wù)，這里做最簡單的示例
- $
kubectl create deployment web --image=registry.cn-beijing.aliyuncs.com/qingfeng666/hello-app:1.0基于 development 維護(hù)一個poddeployment.apps/web created - $
kubectl get po -w監(jiān)控pod的狀態(tài)，等待 RunningNAME READY STATUS RESTARTS AGE web-6db77f5fdb-qkk6n 1/1 Running 0 7s - $
kubectl expose deployment web --type=NodePort --port=8080將 development 服務(wù)暴露出來service/web exposed - $
kubectl get svc獲取目前的服務(wù)NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE kubernetes ClusterIP 10.1.0.1 <none> 443/TCP 5d8h web NodePort 10.1.47.34 <none> 8080:32041/TCP 8s - $
curl node1.k8s:32041或curl node2.k8s:32041Hello, world! Version: 1.0.0 Hostname: web-6db77f5fdb-65wfv- 可見，在集群內(nèi)部，我們的服務(wù)已經(jīng)啟動起來了
- 現(xiàn)在內(nèi)部pod和Service已經(jīng)就緒，現(xiàn)在可以進(jìn)行創(chuàng)建 ingress 資源了
- $
vi ing-demo.yamlapiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ingress-nginx annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: ingressClassName: nginx rules: - host: hello-world.info http: paths: - path: / pathType: Prefix backend: service: name: web port: number: 8080 - $
kubectl apply -f ing-demo.yaml創(chuàng)建 ingress 資源ingress.networking.k8s.io/ingress-nginx created - $
kubectl get ing查看 ingress 資源NAME CLASS HOSTS ADDRESS PORTS AGE ingress-nginx nginx hello-world.info 10.1.211.240 80 2m13s - $
sudo vi /etc/hosts添加一行, 對當(dāng)前ip進(jìn)行域名的配置10.1.211.240 hello-world.info - $
curl hello-world.info訪問域名，發(fā)現(xiàn)通了Hello, world! Version: 1.0.0 Hostname: web-6db77f5fdb-65wfv - 這樣，就完成了集群外的暴露，但是還需要再客戶端機(jī)器或云服務(wù)器的域名解析，這里選擇前者
- 比如，在 我的Mac電腦上連接當(dāng)前 hello-world服務(wù)，這里前提是: Mac電腦和Centos可以連通
- 在 Mac 上配置某個 Centos 的work node的host, $
sudo vi /etc/hosts10.211.55.11 hello-world.info - 這里的 10.211.55.11 對應(yīng) work node 的 ip
- 在我的 Mac 上瀏覽器訪問: http://hello-world.info:31686，如下
- 像是這種訪問不方便:
http://hello-world.info:31686這個端口比較麻煩 - 可以修改成 80端口, 這樣，就可以這樣訪問了：
http://hello-world.info, 這里不演示了，參考如下 - 參考: https://blog.csdn.net/qq_32060101/article/details/135691179
- k8s修改NodePort支持80端口
- 參考: https://blog.csdn.net/qq_32060101/article/details/135691441
- ingress控制器修改NodePort成80端口
- 像是這種訪問不方便:
- $
到了這里，關(guān)于K8s: Ingress對象, 創(chuàng)建Ingress控制器, 創(chuàng)建Ingress資源并暴露服務(wù)的文章就介紹完了。如果您還想了解更多內(nèi)容，請?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
