kubernetes之ingress及ingress controller

冷不防 2023-03-12 12:10 7阅读 0赞

## 什么是ingress ##

Ingress是授权入站连接到达集群服务的规则集合。

*  从外部流量调度到nodeprot上的service
 *  从service调度到ingress-controller
 *  ingress-controller根据ingress中的定义（虚拟主机或者后端的url）
 *  根据虚拟主机名调度到后端的一组pod中

![format_png][]

## Ingress资源定义 ##

kubectl explain ingress.spec

*  rules 定义成虚拟主机调度还是url调度
 *  backend  知道后端主机

##  部署ingress ##

以下文件是[kubenetes][]的官方提供

创建namespace

apiVersion: v1
    kind: Namespace
    metadata:
      name: ingress-nginx

创建role

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

---
    
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: nginx-ingress-serviceaccount
      namespace: ingress-nginx
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRole
    metadata:
      name: nginx-ingress-clusterrole
    rules:
      - apiGroups:
          - ""
        resources:
          - configmaps
          - endpoints
          - nodes
          - pods
          - secrets
        verbs:
          - list
          - watch
      - apiGroups:
          - ""
        resources:
          - nodes
        verbs:
          - get
      - apiGroups:
          - ""
        resources:
          - services
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - "extensions"
        resources:
          - ingresses
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - ""
        resources:
            - events
        verbs:
            - create
            - patch
      - apiGroups:
          - "extensions"
        resources:
          - ingresses/status
        verbs:
          - update
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: Role
    metadata:
      name: nginx-ingress-role
      namespace: ingress-nginx
    rules:
      - apiGroups:
          - ""
        resources:
          - configmaps
          - pods
          - secrets
          - namespaces
        verbs:
          - get
      - apiGroups:
          - ""
        resources:
          - configmaps
        resourceNames:
          # Defaults to "<election-id>-<ingress-class>"
          # Here: "<ingress-controller-leader>-<nginx>"
          # This has to be adapted if you change either parameter
          # when launching the nginx-ingress-controller.
          - "ingress-controller-leader-nginx"
        verbs:
          - get
          - update
      - apiGroups:
          - ""
        resources:
          - configmaps
        verbs:
          - create
      - apiGroups:
          - ""
        resources:
          - endpoints
        verbs:
          - get
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: RoleBinding
    metadata:
      name: nginx-ingress-role-nisa-binding
      namespace: ingress-nginx
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: nginx-ingress-role
    subjects:
      - kind: ServiceAccount
        name: nginx-ingress-serviceaccount
        namespace: ingress-nginx
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: nginx-ingress-clusterrole-nisa-binding
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: nginx-ingress-clusterrole
    subjects:
      - kind: ServiceAccount
        name: nginx-ingress-serviceaccount
        namespace: ingress-nginx

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

创建confmap

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

---
    
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: nginx-configuration
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

创建ingress服务

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

---
    
    apiVersion: extensions/v1beta1
    kind: Deployment
    metadata:
      name: nginx-ingress-controller
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    spec:
      replicas: 1
      selector:
        matchLabels:
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
      template:
        metadata:
          labels:
            app.kubernetes.io/name: ingress-nginx
            app.kubernetes.io/part-of: ingress-nginx
          annotations:
            prometheus.io/port: '10254'
            prometheus.io/scrape: 'true'
        spec:
          serviceAccountName: nginx-ingress-serviceaccount
          containers:
            - name: nginx-ingress-controller
              image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.19.0
              args:
                - /nginx-ingress-controller
                - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
                - --configmap=$(POD_NAMESPACE)/nginx-configuration
                - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
                - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
                - --publish-service=$(POD_NAMESPACE)/ingress-nginx
                - --annotations-prefix=nginx.ingress.kubernetes.io
              securityContext:
                capabilities:
                    drop:
                    - ALL
                    add:
                    - NET_BIND_SERVICE
                # www-data -> 33
                runAsUser: 33
              env:
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: POD_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
              ports:
              - name: http
                containerPort: 80
              - name: https
                containerPort: 443
              livenessProbe:
                failureThreshold: 3
                httpGet:
                  path: /healthz
                  port: 10254
                  scheme: HTTP
                initialDelaySeconds: 10
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 1
              readinessProbe:
                failureThreshold: 3
                httpGet:
                  path: /healthz
                  port: 10254
                  scheme: HTTP
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 1

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

创建TCP服务的confmap

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

---
    
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: tcp-services
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

创建UDP服务的confmap

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

---
    
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: udp-services
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

创建backend

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

---
    
    apiVersion: extensions/v1beta1
    kind: Deployment
    metadata:
      name: default-http-backend
      labels:
        app.kubernetes.io/name: default-http-backend
        app.kubernetes.io/part-of: ingress-nginx
      namespace: ingress-nginx
    spec:
      replicas: 1
      selector:
        matchLabels:
          app.kubernetes.io/name: default-http-backend
          app.kubernetes.io/part-of: ingress-nginx
      template:
        metadata:
          labels:
            app.kubernetes.io/name: default-http-backend
            app.kubernetes.io/part-of: ingress-nginx
        spec:
          terminationGracePeriodSeconds: 60
          containers:
          - name: default-http-backend
            # Any image is permissible as long as:
            # 1. It serves a 404 page at /
            # 2. It serves 200 on a /healthz endpoint
            image: gcr.io/google_containers/defaultbackend:1.4
            livenessProbe:
              httpGet:
                path: /healthz
                port: 8080
                scheme: HTTP
              initialDelaySeconds: 30
              timeoutSeconds: 5
            ports:
            - containerPort: 8080
            resources:
              limits:
                cpu: 10m
                memory: 20Mi
              requests:
                cpu: 10m
                memory: 20Mi
    ---
    
    apiVersion: v1
    kind: Service
    metadata:
      name: default-http-backend
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: default-http-backend
        app.kubernetes.io/part-of: ingress-nginx
    spec:
      ports:
      - port: 80
        targetPort: 8080
      selector:
        app.kubernetes.io/name: default-http-backend
        app.kubernetes.io/part-of: ingress-nginx

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

## 部署一个ingress-controller的service nodePort ##

如果需要集群外部访问，就需要部署一个NodePort的service 用来提供外部访问

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: v1
    kind: Service
    metadata:
      name: ingress-nginx
      namespace: ingress-nginx
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
    spec:
      type: NodePort
      ports:
      - name: http
        port: 80
        targetPort: 80
        protocol: TCP
        nodePort: 30080
      - name: https
        port: 443
        targetPort: 443
        protocol: TCP
        nodePort: 30443
      selector:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

尝试访问

![format_png 1][]

## 部署一个应用通过ingress访问 ##

部署一个myapp的测试应用

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: v1
    kind: Service
    metadata:
      name: myapp
      namespace: default
    spec:
      selector:
        app: myapp
        release: dev
      ports:
      - name: http
        targetPort: 80
        port: 80
    
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: myapp-deploy
      namespace: default
    spec:
      replicas: 3
      selector:
        matchLabels:
          app: myapp
          release: dev
      template:
        metadata:
          labels:
            app: myapp
            release: dev
        spec:
          containers:
          - name: myapp-containers
            image: ikubernetes/myapp:v2
            ports:
            - name: http
              containerPort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

部署myapp的ingress

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: ingress-myapp
      namespace: default
      annotations:
        kubernetes.io/ingress.class: "nginx"
    spec:
      rules:
      - host: myapp.jaxzhai.com
        http:
          paths:
          - backend:
              serviceName: myapp
              servicePort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

查看结果

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

$  kubectl get ing
    NAME            HOSTS               ADDRESS   PORTS     AGE
    ingress-myapp   myapp.jaxzhai.com             80        2m
    $ kubectl describe ing  ingress-myapp
    Name:             ingress-myapp
    Namespace:        default
    Address:          
    Default backend:  default-http-backend:80 (<none>)
    Rules:
      Host               Path  Backends
      ----               ----  --------
      myapp.jaxzhai.com  
                            myapp:80 (<none>)
    Annotations:
      kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{"kubernetes.io/ingress.class":"nginx"},"name":"ingress-myapp","namespace":"default"},"spec":{"rules":[{"host":"myapp.jaxzhai.com","http":{"paths":[{"backend":{"serviceName":"myapp","servicePort":80}}]}}]}}
    
      kubernetes.io/ingress.class:  nginx
    Events:
      Type    Reason  Age   From                      Message
      ----    ------  ----  ----                      -------
      Normal  CREATE  2m    nginx-ingress-controller  Ingress default/ingress-myapp

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

部署完成后，生成的规则会自动注入到ingress-controller中，意思会生成nginx配置文件，验证：

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

$ kubectl exec -it -n ingress-nginx nginx-ingress-controller-6bd7c597cb-8qm9x -- /bin/sh
    
    $ cat nginx.conf 
    .........
        ## start server myapp.jaxzhai.com
        server {
            server_name myapp.jaxzhai.com ;
            
            listen 80;
            
            listen [::]:80;
            
            set $proxy_upstream_name "-";
            
            location / {
                
                set $namespace      "default";
                set $ingress_name   "ingress-myapp";
                set $service_name   "myapp";
                set $service_port   "80";
                set $location_path  "/";
                
                rewrite_by_lua_block {
                    
                    balancer.rewrite()
                    
                }
                
                log_by_lua_block {
                    
                    balancer.log()
                    
                    monitor.call()
                }
                
                port_in_redirect off;
                
                set $proxy_upstream_name "default-myapp-80";
    .......

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

访问应用

![format_png 2][]

碎片化时间学习和你一起终身学习

分类: [Linux-运维][Linux-], [容器技术][Link 1]

[format_png]: /images/20230312/7c573bbf34924d398646edecb3a0ae9f.png
[kubenetes]: https://github.com/kubernetes/ingress-nginx/tree/master/deploy
[aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]: /images/20230312/8275001d068e44a9bbe5e4ecd1700c71.png
[format_png 1]: /images/20230312/1861f3f6a64b40369e7ed32498b07090.png
[format_png 2]: /images/20230312/f97d1f3ef34743e080c9b70ab6283118.png
[Linux-]: https://www.cnblogs.com/xzkzzz/category/1059261.html
[Link 1]: https://www.cnblogs.com/xzkzzz/category/1247889.html

发表评论取消回复

表情：

评论列表（有 0 条评论，7人围观）

还没有评论，来说两句吧...

相关阅读

相关 kubernetes之ingress和Ingress Controller

文博客： [https://www.cnblogs.com/linuxk/p/9706720.html][https_www.cnblogs.com_linuxk_p_...

古城微笑少年丶/ 2024年04月18日 17:29/ 0 赞/ 60 阅读

相关 kubernetes（10）Ingress

概述之前将端口号对外暴露，是通过ip+端口号进行访问使用service里面的NodePort实现 NodePort缺陷： 1. 在每个节点上都会起到端口

快来打我*/ 2024年04月03日 09:23/ 0 赞/ 63 阅读

相关【Kubernetes】Kubernetes对外服务之Ingress

Ingress 一、Ingress 的概念 1. Ingress 简介 2. K8S 对外提供服务的方案 2.1 No

「爱情、让人受尽委屈。」/ 2024年03月24日 18:17/ 0 赞/ 31 阅读

相关 kubernetes Ingress、Ingress controller

前言 `拥抱开源，无私分享，共享技术，相互学习，共同进步，分享更多有深度的文章，欢迎转发分享` 四层负载均衡调度器service回顾使用四层负载均衡调度

谁践踏了优雅/ 2023年07月20日 10:37/ 0 赞/ 123 阅读

相关 kubernetes之ingress及ingress controller

什么是ingress Ingress是授权入站连接到达集群服务的规则集合。从外部流量调度到nodeprot上的service 从service调度到

冷不防/ 2023年03月12日 12:10/ 0 赞/ 8 阅读

相关 Kubernetes Ingress Nginx使用

在此我们不讲述如何部署ingress-controller，只演示如何使用ingress之nginx使用。主要演示如何使用ingress nginx实现我们nginx的多样化配

红太狼/ 2022年09月14日 14:21/ 0 赞/ 169 阅读

相关 Kubernetes Ingress解析

前言这是kubernete官方文档中[Ingress Resource][]的翻译，因为最近工作中用到，文章也不长，也很好理解，索性翻译一下，也便于自己加深理解，同时造

素颜马尾好姑娘i/ 2022年06月15日 05:56/ 0 赞/ 203 阅读

相关【kubernetes 系列5】Kubernetes服务发现 ingress & ingress controller

Kubernetes服务发现 ingress & ingress controller 1、介绍 kubernetes Ingess 是有2部分组成，Ingress

迈不过友情╰/ 2022年01月28日 04:27/ 0 赞/ 225 阅读

相关 kubernetes Ingress实战

服务发现与负载均衡 Ingress实战一、服务发现与负载均衡在前面的安装部署kubernetes集群中已经简单用示例来演示了Pod和Service，Kube

女爷i/ 2021年10月23日 14:18/ 0 赞/ 387 阅读

相关 kubernetes Ingress

1、Ingress 在Kubernetes中，服务和Pod的IP地址仅可以在集群网络内部使用，对于集群外的应用是不可见的。为了使外部的应用能够访问集群内的服务，在Kube

雨点打透心脏的1/2处/ 2021年10月23日 14:18/ 0 赞/ 421 阅读