k8s中服务暴露方式---nginx-ingress实现部署（http、https形式）

超、凢脫俗 2022-02-26 19:06 185阅读 0赞

1、创建deployment部署模板

apiVersion: extensions/v1beta1
    kind: Deployment
    metadata:
      name: demo-tomcat-java-demo
      labels:
        wayne-app: demo
        wayne-ns: demo
        app: demo-tomcat-java-demo
    spec:
      selector:
        matchLabels:
          app: demo-tomcat-java-demo
      template:
        metadata:
          labels:
            wayne-app: demo
            wayne-ns: demo
            app: demo-tomcat-java-demo
        spec:
          imagePullSecrets:
            - name: demo-registry-pull-secret
          containers:
            - resources:
                limits:
                  memory: 2Gi
                  cpu: '1'
                requests:
                  memory: 1Gi
                  cpu: '0.5'
              env: []
              envFrom: []
              imagePullPolicy: IfNotPresent
              image: 'test.com/project/tomcat-java-demo:latest'
              name: tomcat-java-demo
              command: []
              args: []
      strategy:
        type: RollingUpdate
        rollingUpdate:
          maxSurge: 20%
          maxUnavailable: 1

应用ingress  
官方文档：[https://github.com/kubernetes/ingress-nginx/blob/master/docs/deploy/index.md][https_github.com_kubernetes_ingress-nginx_blob_master_docs_deploy_index.md]  
安装ingress-controller

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
    kubectl apply -f mandatory.yaml

即可继续对ingress完成部署。  
Note：  
修改deployment为daemonset，在多个node节点上部署ingress-controller。

#### Pod与ingress的关系 ####

ingress通过nginx、Haproxy进入（暴露服务）  
通过service相关联  
通过ingress Controller实现pod的负载均衡  
支持TCP/UDP 4层和HTTP 7层

kubectl get ing -n test

apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: nginx-ingress-controller
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    spec:
      replicas: 1
      selector:
        matchLabels:
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      template:
        metadata:
          labels:
            app.kubernetes.io/name: ingress-nginx
            app.kubernetes.io/part-of: ingress-nginx
          annotations:
            prometheus.io/port: "10254"
            prometheus.io/scrape: "true"
        spec:
          # 使用宿主机网络：hostNetwork: true
          hostNetwork: true
          serviceAccountName: nginx-ingress-serviceaccount
          containers:
            - name: nginx-ingress-controller
            # 镜像地址修改
              image: test.com/project/nginx-ingress-controller:0.20.0
              args:
                - /nginx-ingress-controller

查看controller部署的节点：

kubectl get po -n ingress-nginx -o wide

![在这里插入图片描述][20190428170822647.png]  
在247node节点上查看监听端口：  
![在这里插入图片描述][20190428170933482.png]

### ingress的https形式 ###

cat > ca-config.json <<EOF { "signing": { "default": { "expiry": "87600h" }, "profiles": { "kubernetes": { "expiry": "87600h", "usages": [ "signing", "key encipherment", "server auth", "client auth" ] } } } } EOF
    
    cat > ca-csr.json <<EOF { "CN": "kubernetes", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "Beijing", "ST": "Beijing" } ] } EOF
    
    cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
    # 修改json文件，名称及CN
    cat > java.zzdvlp.com-csr.json <<EOF { "CN": "java.zzdvlp.com", "hosts": [], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing" } ] } EOF
    # 使用java.zzdvlp.com-csr.json，生成java.zzdvlp.com 
    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes java.zzdvlp.com-csr.json | cfssljson -bare java.zzdvlp.com

![在这里插入图片描述][20190429120034467.png]  
生成secret，并查看

kubectl create secret tls java-zzdvlp-com --cert=java.zzdvlp.com.pem --key=java.zzdvlp.com-key.pem
    kubectl get secret

![在这里插入图片描述][20190429115817789.png]  
引用secret

# vi ingress-https.yaml
    
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: tomcat-java-demo
      namespace: test
    spec:
      tls:
      - hosts:
        - java.zzdvlp.com
        secretName: java-zzdvlp-com
      rules:
        - host: java.zzdvlp.com
          http:
            paths:
            - path: /
              backend:
                serviceName: tomcat-java-demo
                servicePort: 80

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTA4MDE5OTQ_size_16_color_FFFFFF_t_70]

### Ingress: ###

1、四层、七层负载均衡转发  
2、支持自定义service访问策略  
3、只支持局域域名的网站访问  
4、支持TLS

[https_github.com_kubernetes_ingress-nginx_blob_master_docs_deploy_index.md]: https://github.com/kubernetes/ingress-nginx/blob/master/docs/deploy/index.md
[20190428170822647.png]: /images/20220226/9362929d78b44fe5a81e0c93a3bf4572.png
[20190428170933482.png]: /images/20220226/36ac9b05522348579cea8c84e679097f.png
[20190429120034467.png]: /images/20220226/3505127f72734f3db4b97be873a095b6.png
[20190429115817789.png]: /images/20220226/0f54fbbf0cea4d07931265d5a80b2f33.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3UwMTA4MDE5OTQ_size_16_color_FFFFFF_t_70]: /images/20220226/88e121dc9c8547dcbe04fa650e28f91f.png