kubernetes（10）Ingress

快来打我* 2024-04-03 09:23 36阅读 0赞

## 概述 ##

之前将端口号对外暴露，是通过ip+端口号进行访问

*  使用service里面的NodePort实现

NodePort缺陷：

1.  在每个节点上都会起到端口，在访问时候通过任何节点，通过节点ip+暴露端口号实现访问
2.  意味着每个端口只能使用一次，一个端口对应一个应用
3.  实际访问中都是用域名，根据不同域名跳转到不同端口服务中

Ingress便是为了弥补NodePort的不足

Pod和Ingress关系

*  pod 和 ingress 通过 service 关联的
    
     *  ingress作为统一入口，由service关联一组pod  
        ![在这里插入图片描述][09a17ce9ba1445089fa4eaeff1b77215.png]

## Ingress工作流程 ##

Ingress 里面有许多的域名，每个域名对应不同的service，每个service关联对应的pod，去做负载均衡等

![在这里插入图片描述][24326adf22d04a33908a87aef81dba78.png]

## 使用Ingress对外暴露应用 ##

### 第一步：部署Ingress Controller ###

Ingress也是一个controller部署器，我们这里选择官方维护nginx控制器，实现部署

### 第二步：创建规则 ###

## 使用Ingress对外暴露应用 ##

### 第一步：创建nginx应用，对外暴露端口 ###

创建  
![在这里插入图片描述][46b762d95ed54720916fcb941a7ce877.png]

查看  
![在这里插入图片描述][7b9a4b532abf491f8474bd6b98cb4297.png]

对外暴露端口  
![在这里插入图片描述][f061d848068b464c810892d54d618260.png]  
查看  
![在这里插入图片描述][8451431ae9bc4220b5c5d00a1802aadb.png]

### 第二步：部署ingress controller ###

从官网下载Ingress Controller的yaml文件，如下：

apiVersion: v1
    kind: Namespace
    metadata:
      name: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    
    ---
    
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: nginx-configuration
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    
    ---
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: tcp-services
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    
    ---
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: udp-services
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: nginx-ingress-serviceaccount
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRole
    metadata:
      name: nginx-ingress-clusterrole
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    rules:
      - apiGroups:
          - ""
        resources:
          - configmaps
          - endpoints
          - nodes
          - pods
          - secrets
        verbs:
          - list
          - watch
      - apiGroups:
          - ""
        resources:
          - nodes
        verbs:
          - get
      - apiGroups:
          - ""
        resources:
          - services
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - ""
        resources:
          - events
        verbs:
          - create
          - patch
      - apiGroups:
          - "extensions"
          - "networking.k8s.io"
        resources:
          - ingresses
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - "extensions"
          - "networking.k8s.io"
        resources:
          - ingresses/status
        verbs:
          - update
    
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: Role
    metadata:
      name: nginx-ingress-role
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    rules:
      - apiGroups:
          - ""
        resources:
          - configmaps
          - pods
          - secrets
          - namespaces
        verbs:
          - get
      - apiGroups:
          - ""
        resources:
          - configmaps
        resourceNames:
          # Defaults to "<election-id>-<ingress-class>"
          # Here: "<ingress-controller-leader>-<nginx>"
          # This has to be adapted if you change either parameter
          # when launching the nginx-ingress-controller.
          - "ingress-controller-leader-nginx"
        verbs:
          - get
          - update
      - apiGroups:
          - ""
        resources:
          - configmaps
        verbs:
          - create
      - apiGroups:
          - ""
        resources:
          - endpoints
        verbs:
          - get
    
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: RoleBinding
    metadata:
      name: nginx-ingress-role-nisa-binding
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: nginx-ingress-role
    subjects:
      - kind: ServiceAccount
        name: nginx-ingress-serviceaccount
        namespace: ingress-nginx
    
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: nginx-ingress-clusterrole-nisa-binding
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: nginx-ingress-clusterrole
    subjects:
      - kind: ServiceAccount
        name: nginx-ingress-serviceaccount
        namespace: ingress-nginx
    
    ---
    
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: nginx-ingress-controller
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    spec:
      replicas: 1
      selector:
        matchLabels:
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      template:
        metadata:
          labels:
            app.kubernetes.io/name: ingress-nginx
            app.kubernetes.io/part-of: ingress-nginx
          annotations:
            prometheus.io/port: "10254"
            prometheus.io/scrape: "true"
        spec:
          hostNetwork: true
          # wait up to five minutes for the drain of connections
          terminationGracePeriodSeconds: 300
          serviceAccountName: nginx-ingress-serviceaccount
          nodeSelector:
            kubernetes.io/os: linux
          containers:
            - name: nginx-ingress-controller
              image: lizhenliang/nginx-ingress-controller:0.30.0
              args:
                - /nginx-ingress-controller
                - --configmap=$(POD_NAMESPACE)/nginx-configuration
                - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
                - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
                - --publish-service=$(POD_NAMESPACE)/ingress-nginx
                - --annotations-prefix=nginx.ingress.kubernetes.io
              securityContext:
                allowPrivilegeEscalation: true
                capabilities:
                  drop:
                    - ALL
                  add:
                    - NET_BIND_SERVICE
                # www-data -> 101
                runAsUser: 101
              env:
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: POD_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
              ports:
                - name: http
                  containerPort: 80
                  protocol: TCP
                - name: https
                  containerPort: 443
                  protocol: TCP
              livenessProbe:
                failureThreshold: 3
                httpGet:
                  path: /healthz
                  port: 10254
                  scheme: HTTP
                initialDelaySeconds: 10
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 10
              readinessProbe:
                failureThreshold: 3
                httpGet:
                  path: /healthz
                  port: 10254
                  scheme: HTTP
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 10
              lifecycle:
                preStop:
                  exec:
                    command:
                      - /wait-shutdown
    
    ---
    
    apiVersion: v1
    kind: LimitRange
    metadata:
      name: ingress-nginx
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    spec:
      limits:
      - min:
          memory: 90Mi
          cpu: 100m
        type: Container

注意：yaml文件中的如下位置需要改为true，否则外面不能访问

> ![在这里插入图片描述][77abe2d5dd2d43a0a360dd3ded8b6ad9.png]

创建并执行  
![在这里插入图片描述][0f2c2e173ead4201936fe647b0e8bee5.png]

### 查看Ingress controller状态 ###

之前起名为ingress-nginx

![在这里插入图片描述][cc99233aef9648229460efba6a2ad2ce.png]

### 第三步：创建Ingress规则 ###

规则如下yaml文件所示：定义了域名和servicenName等

apiVersion: networking.k8s.io/v1beta1
    kind: Ingress
    metadata:
      name: example-ingress
    spec:
      rules:
      - host: example.ingredemo.com
        http:
          paths:
          - path: /
            backend:
              serviceName: web
              servicePort: 80

创建并执行  
![在这里插入图片描述][54385e252da94ce8b352087270da2ab0.png]  
查看  
![在这里插入图片描述][6896366ba769498b95a954126a678eb3.png]  
在node1上查看监听的端口  
![在这里插入图片描述][83343c003b6c4898b11b4e2c481fe9b1.png]  
![在这里插入图片描述][8dee45a1a3de49968305627172fb45cb.png]

### 第四步：在windows里的hosts文件中添加域名访问规则 ###

![在这里插入图片描述][8f8c79b613354db9987255a05272b998.png]

![在这里插入图片描述][e587361ad4114fcc8ca5f5e51116820c.png]

在master节点上面查看pods，当前的nginx存在  
![在这里插入图片描述][dfcdd1b9a60442eeaf080772c88b0e17.png]  
查看svc  
![在这里插入图片描述][b08cadd8f71d4682a0c833d178ef344d.png]

查看ingress  
![在这里插入图片描述][e83fd3b6b6654f8a87d2f299847079a0.png]  
使用该域名访问  
![在这里插入图片描述][4ac24973e5034a289771d06235ca8606.png]

[09a17ce9ba1445089fa4eaeff1b77215.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/e4a6093f433749d0a6fc0179a21cc594.png
[24326adf22d04a33908a87aef81dba78.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/587ca68135b54674840e501a0a7efe1f.png
[46b762d95ed54720916fcb941a7ce877.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/2b3fcdecc9f74d05a7dcf2424fffb5e8.png
[7b9a4b532abf491f8474bd6b98cb4297.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/aae83ef4e1be4b1f8114a5a5671eae19.png
[f061d848068b464c810892d54d618260.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/e537110f4e7142a8bc46a22ce4b3bd8e.png
[8451431ae9bc4220b5c5d00a1802aadb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/79e23000039c419dbf79e589aadc2c48.png
[77abe2d5dd2d43a0a360dd3ded8b6ad9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/8dd47f02c676462eae8d7f32df8c666b.png
[0f2c2e173ead4201936fe647b0e8bee5.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/97407fe9f2704e3c9acb2cc36aaed624.png
[cc99233aef9648229460efba6a2ad2ce.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/726dc8b6684f412088782a6d05628627.png
[54385e252da94ce8b352087270da2ab0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/cb35fadb04924bc3990b0da09edc005b.png
[6896366ba769498b95a954126a678eb3.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/ececb44fb2c34602b1ce687aae4539e1.png
[83343c003b6c4898b11b4e2c481fe9b1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/476211ea69b84fb1a091f33f07182ada.png
[8dee45a1a3de49968305627172fb45cb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/af2cf730cb704b56bd0f40806dcf310b.png
[8f8c79b613354db9987255a05272b998.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/a842ae5e71bf48a1bbc2bf0d4dbded76.png
[e587361ad4114fcc8ca5f5e51116820c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/9f82695032cc49979ac1168dc95739c6.png
[dfcdd1b9a60442eeaf080772c88b0e17.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/04155d6a9eba4614bc7f9d6c6aecb354.png
[b08cadd8f71d4682a0c833d178ef344d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/62b6abf1d1644a0b918d05321116f6af.png
[e83fd3b6b6654f8a87d2f299847079a0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/e9f9d55753ae4a8c8798e810fec40a01.png
[4ac24973e5034a289771d06235ca8606.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/03/f363f1623c244455b48adb944befef6d.png