[kubernetes]-通过nginx + ingress处理外网请求

淡淡的烟草味﹌ 2022-12-04 01:29 487阅读 0赞

需求:

通过nginx + nginx-ingress 模拟slb+ingress 处理外网请求，直接请求到ingress服务器觉得不是太好。

先在阿里云添加一条dns 解析test-jenkins.ihaozhuo.com到公司的公网ip

![format_png][]

网关映射域名到内网192.168.1.108的80端口 即nginx端口

![format_png 1][]

在108上通过nginx 转发请求 到kubernetes的ingress node ip为192.168.1.203

conf.d/test-jenkins.conf 如下

#server(主机设置)----------------------------------------------------------------------
    server {
        listen       80;
        server_name  test-jenkins.ihaozhuo.com;
    
    #location(url配置)----------------------------------------------------------------------
    location  / {
         # proxy_pass http://192.168.1.205:30002;
         proxy_set_header HOST $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_pass http://192.168.1.203;
                }
    }
    
    server {
        listen       443 ssl;
        server_name   test-jenkins.ihaozhuo.com;
    
        ssl_certificate      /usr/local/nginx/certs/3486560__ihaozhuo.com.pem;
        ssl_certificate_key  /usr/local/nginx/certs/3486560__ihaozhuo.com.key;
    
    location  / {
         proxy_pass http://192.168.1.203;
                }
    }

> 不能单单只配置proxy\_pass http 否则访问域名会提示backend 404 需要带上header

创建svc

---
    apiVersion: v1
    kind: Service
    metadata:
      name: test-jenkins
      namespace: devops
    spec:
      ports:
      - port: 80
        protocol: TCP
        targetPort: 8080
      selector:
        app: jenkins

创建ingress

apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
    # 通过添加下面的annotations 来开启白名单
    # 关闭80强制跳转443 为ingress配置增加注解（annotations）：nginx.ingress.kubernetes.io/ssl-redirect: 'false' 就可以禁止http强制跳转至https
      annotations:
        #nginx.ingress.kubernetes.io/whitelist-source-range: "60.191.70.64/29, xx.xxx.0.0/16"
        nginx.ingress.kubernetes.io/ssl-redirect: 'false'
      name: test-jenkins
      namespace: devops
    spec:
      tls:
       - hosts:
         - test-jenkins.ihaozhuo.com
        # secretName: aircourses
      rules:
        - host: test-jenkins.ihaozhuo.com
          http:
            paths:
            - path: /
              backend:
                serviceName: test-jenkins
                servicePort: 80

应用

kubectl apply jenkins-svc.yaml
    kubectl apply jenkins-ingress.yaml

访问http://test-jenkins.ihaozhuo.com/

![format_png 2][]

![format_png 3][]

[format_png]: /images/20221123/aaf53bb682464f289c5fa5f66e14fff1.png
[format_png 1]: /images/20221123/4e9694ff02f84fd3b60a4d7ae3e5289a.png
[format_png 2]: /images/20221123/bb504960f905430ebf035775763b0ac8.png
[format_png 3]: /images/20221123/94ca3de7eea346c98f2d0a854b066cd3.png