Kubernetes的ingress服务部署、会话保持，TLS配置，认证配置、地址重写

最新推荐文章于 2024-09-18 23:07:43 发布

海蜘蛛er

最新推荐文章于 2024-09-18 23:07:43 发布

阅读量3.3k

点赞数

分类专栏： k8s 文章标签： python 网络 kubernetes

本文链接：https://blog.csdn.net/Thorne_lu/article/details/121391954

版权

本文详细介绍了Kubernetes的Ingress服务，包括其概念、部署步骤、如何创建Ingress服务，以及实现会话保持、TLS配置和地址重写。通过Ingress Controller如Nginx，实现对Service的负载均衡和反向代理。此外，还讨论了使用HostNetwork直接访问服务的优缺点，并展示了Ingress的认证配置。

摘要由CSDN通过智能技术生成

1.Ingress介绍

官网参考：https://kubernetes.github.io/ingress-nginx/

Ingress是一种全局的、为了代理不同后端 Service 而设置的负载均衡服务，就是 Kubernetes 里的 Ingress 服务。

Ingress由两部分组成：Ingress controller和Ingress服务。
Ingress Controller 会根据你定义的 Ingress 对象，提供对应的代理能力。业界常用的各种反向代理项目，比如 Nginx、HAProxy、Envoy、Traefik 等，都已经为Kubernetes 专门维护了对应的 Ingress Controller。

2. ingress服务部署

参考官网：https://kubernetes.github.io/ingress-nginx/deploy/#bare-metal
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/deploy.yaml
下载所需的镜像到镜像仓库

[root@harbor ~]# docker pull quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.33.0
[root@harbor ~]# docker pull docker.io/jettech/kube-webhook-certgen:v1.2.0
[root@harbor ~]# docker tag quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.33.0 reg.personal.org/library/nginx-ingress-controller:0.33.0
[root@harbor ~]# docker tag docker.io/jettech/kube-webhook-certgen:v1.2.0 reg.red.org/library/kube-webhook-certgen:v1.2.0
[root@harbor ~]# docker push reg.personal.org/library/nginx-ingress-controller:0.33.0
[root@harbor ~]# docker push reg.personal.org/library/kube-webhook-certgen:v1.2.0

wget 一下deploy.yaml到master节点的mainfest目录

kubectl get all -n ingress-nginx 查看ingress-nginx下的所有信息资源
kubectl get pod -n ingress-nginx -o wide 查看pod运行在那些节点
kubectl get svc -n ingress-nginx 获取到端口 31181
kubectl describe svc -n ingress-nginx ingress-nginx-controller 查看服务详细信息

[kubeadm@server1 mainfest]$ kubectl apply -f deploy.yaml 
namespace/ingress-nginx created
serviceaccount/ingress-nginx created
configmap/ingress-nginx-controller created
clusterrole.rbac.authorization.k8s.io/ingress-nginx created
clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx created
role.rbac.authorization.k8s.io/ingress-nginx created
rolebinding.rbac.authorization.k8s.io/ingress-nginx created
service/ingress-nginx-controller-admission created
service/ingress-nginx-controller created
deployment.apps/ingress-nginx-controller created
validatingwebhookconfiguration.admissionregistration.k8s.io/ingress-nginx-admission created
clusterrole.rbac.authorization.k8s.io/ingress-nginx-admission created
clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created
job.batch/ingress-nginx-admission-create created
job.batch/ingress-nginx-admission-patch created
role.rbac.authorization.k8s.io/ingress-nginx-admission created
rolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created
serviceaccount/ingress-nginx-admission created
[kubeadm@server1 mainfest]$ kubectl get namespaces 
NAME              STATUS   AGE
default           Active   7d18h
ingress-nginx     Active   35s
kube-node-lease   Active   7d18h
kube-public       Active   7d18h
kube-system       Active   7d18h
[kubeadm@server1 mainfest]$ kubectl get pod -n ingress-nginx ------------>查看pod里nginx的状态
NAME                                        READY   STATUS      RESTARTS   AGE
ingress-nginx-admission-create-xfcsd        0/1     Completed   0          57s
ingress-nginx-admission-patch-k9dcm         0/1     Completed   0          57s
ingress-nginx-controller-77b5fc5746-dq7hn   1/1     Running     0          67s
[kubeadm@server1 mainfest]$ kubectl get svc -n ingress-nginx      ------------->获取nginx服务信息
NAME                                 TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx-controller             NodePort    10.100.163.143   <none>        80:31904/TCP,443:32203/TCP   2m21s
ingress-nginx-controller-admission   ClusterIP   10.101.228.137   <none>        443/TCP                      2m21s
[kubeadm@server1 mainfest]$ kubectl describe svc -n ingress-nginx ingress-nginx-controller
Name:                     ingress-nginx-controller
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/component=controller
                          app.kubernetes.io/instance=ingress-nginx
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/version=0.33.0
                          helm.sh/chart=ingress-nginx-2.9.0
Annotations:              Selector:  app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
Type:                     NodePort
IP:                       10.100.163.143
Port:                     http  80/TCP
TargetPort:               http/TCP
NodePort:                 http  31904/TCP
Endpoints:                10.244.2.82:80
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  32203/TCP
Endpoints:                10.244.2.82:443
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

3.创建Ingress服务

参考官网：https://kubernetes.github.io/ingress-nginx/user-guide/basic-usage/
示例一

[kubeadm@server1 mainfest]$ vim ingress.yml
[kubeadm@server1 mainfest]$ cat ingress.yml
apiVersion: extensions/v1beta1
kind: Ingress   ------------------>此处类型为ingress
metadata:
  name: ingress1
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: www.personal.org
    http:
      paths:
      - path: /
        backend:
          serviceName: myservice   ------------------>需要有svc
          servicePort: 80
[kubeadm@server1 mainfest]$ kubectl apply -f ingress.yml 
ingress.extensions/ingress1 created
[kubeadm@server1 mainfest]$ kubectl get svc
NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   10.96.0.1      <none>        443/TCP        7d22h
myservice    NodePort    10.102.1.239   <none>        80:31334/TCP   6h47m
[kubeadm@server1 mainfest]$ kubectl get ingress
NAME       CLASS    HOSTS             ADDRESS      PORTS   AGE
ingress1   <none>   www.per.org   172.25.1.3   80      78s

[kubeadm@server1 mainfest]$ kubectl -n ingress-nginx get pod
NAME                                        READY   STATUS      RESTARTS   AGE
ingress-nginx-admission-create-xfcsd        0/1     Completed   0          3h20m
ingress-nginx-admission-patch-k9dcm         0/1     Completed   0          3h20m
ingress-nginx-controller-77b5fc5746-dq7hn   1/1     Running     0          3h20m   ----------->真正工作的pod
[kubeadm@server1 mainfest]$ kubectl -n ingress-nginx exec -it ingress-nginx-controller-77b5fc5746-dq7hn  -- sh
/etc/nginx $ ls
fastcgi.conf            koi-utf                 modsecurity             owasp-modsecurity-crs   uwsgi_params.default
fastcgi.conf.default    koi-win                 modules                 scgi_params             win-utf
fastcgi_params          l