k8s ingress入门与实战

ingress 介绍

官方文档地址： ingress官方文档
ingress 官方解释：

Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. 
Traffic routing is controlled by rules defined on the Ingress resource.

ingress图例:

ingress 的作用： 暴露k8s集群中的服务，供外部访问，同时提供请求路由规则。

ingress controller

• ingress 是一个定义请求路由规则的组件，ingress 主要负责规则的制定。
• ingress controller 是实际的路由规则执行者，实际由 ingress controller 实现请求的转发、负载均衡等。ingress 典型的实现是 nginx ingress controller
• ingress controller 还有很多实现，nginx ingress controller 是为我们熟知的，其中封装了nginx服务，更多实现详见官网
• 工作机制： ingress controller 与 api-server 通讯，监听路由规则的变更，当ingress 变更时，将动态生成nginx 配置，并relaod nginx 的配置，相当于热部署。
• ingress-nginx-controller 图例
  

实战体验 ingress、ingress-controller

基础环境准备

1. 先准备一个k8s集群环境

# 我的环境说明
1. vmware装的3台虚拟机，都是2h2g的配置
192.168.22.50 m
192.168.22.51 w1
192.168.22.52 w2

m：主节点
w1: work节点1
w2: work节点2

ps: 要是小伙伴们搭建k8s集群有问题，可在评论区咨询我哦，后面会出一篇如何搭建k8s集群的博客

ingress实战搭建步骤

## 以 ingress-nginx-controller 为例
1. 在k8s集群中创建一组可访问的服务，本文使用whoami镜像演示
2. 搭建 ingress-nginx-controller
3. 搭建 ingress，指定路由规则
4. 测试

在k8s集群中启动一组服务

(1) 准备 whoami pod启动配置文件，文件名: whoami-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami-deployment
  labels:
    app: whoami
spec: 
  replicas: 3
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels: 
        app: whoami 
    spec:
      containers:
      - name: whoami
        image: jwilder/whoami  
        ports:
        - containerPort: 8000

（2）准备 whoami 服务配置文件，文件名: whoami-service.yaml

apiVersion: v1
kind: Service
metadata:
  name: whoami-service
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8000
  selector:
    app: whoami

（3) 创建 pod 与 service ，依次执行以下命令

# 启动pod
kunectl apply -f whoami-deployment.yaml
# 创建service
kunectl apply -f whoami-service.yaml

(4) 查看启动状态

# 查看 pod 状态
kubectl get pods -o wide
# 查看 service 
kubectl get service -o wide

# 查看单个pod的运行情况，最后面的参数为pod的name
kubectl describe pod whoami-deployment-678b64444d-4k4d5

pod 以及service 情况如下，当所有pod 的状态为Running 时，表示启动成功了。

搭建 ingress-nginx-controller

ingress-nginx github 地址：ingress-nginx-controller
（1）准备 ingress-nginx-controller 启动配置文件，文件名：mandatory.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---

kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: tcp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: udp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nginx-ingress-serviceaccount
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: nginx-ingress-clusterrole
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - endpoints
      - nodes
      - pods
      - secrets
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"
    resources:
      - ingresses/status
    verbs:
      - update

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: nginx-ingress-role
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - pods
      - secrets
      - namespaces
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      # Defaults to "<election-id>-<ingress-class>"
      # Here: "<ingress-controller-leader>-<nginx>"
      # This has to be adapted if you change either parameter
      # when launching the nginx-ingress-controller.
      - "ingress-controller-leader-nginx"
    verbs:
      - get
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - endpoints
    verbs:
      - get

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: nginx-ingress-role-nisa-binding
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: nginx-ingress-role
subjects:
  - kind: ServiceAccount
    name: nginx-ingress-serviceaccount
    namespace: ingress-nginx

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: nginx-ingress-clusterrole-nisa-binding
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: nginx-ingress-clusterrole
subjects:
  - kind: ServiceAccount
    name: nginx-ingress-serviceaccount
    namespace: ingress-nginx

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-ingress-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
      annotations:
        prometheus.io/port: "10254"
        prometheus.io/scrape: "true"
    spec:
      # wait up to five minutes for the drain of connections
      terminationGracePeriodSeconds: 300
      serviceAccountName: nginx-ingress-serviceaccount
      hostNetwork: true
      nodeSelector:
        name: ingress
        kubernetes.io/os: linux
      containers:
        - name: nginx-ingress-controller
          image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1
          args:
            - /nginx-ingress-controller
            - --configmap=$(POD_NAMESPACE)/nginx-configuration
            - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
            - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
            - --publish-service=$(POD_NAMESPACE)/ingress-nginx
            - --annotations-prefix=nginx.ingress.kubernetes.io
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            # www-data -> 33
            runAsUser: 33
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          ports:
            - name: http
              containerPort: 80
            - name: https
              containerPort: 443
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          lifecycle:
            preStop:
              exec:
                command:
                  - /wait-shutdown
---

（2）以上文件可以从 github 上获取：github部署文档，在原有基础上，做了如下修改

hostNetwork: true # 使用HostPort方式运行，增加配置
nodeSelector: # 增加一个节点选择的条件
        name: ingress 

（3）启动 ingress-nginx-controller

# 1.先在一台work节点上打一个标签，因为上面增加了节点选择条件，增加节点选择的条件是为了指定主机来启动
kubectl label node w1 name=ingress

# 启动 kubectl apply -f mandatory.yaml  
kubectl apply -f mandatory.yaml  

# 查看启动状态，注意 ingress-nginx-controller 是启动在 ingress-nginx 命名空间的
kubectl get all -n ingress-nginx

启动 ingress 指定规则

（1）准备配置文件，文件名：whoami-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: whoami-ingress
spec:
  rules:
  - host: who.yjdev.com
    http:
      paths:
      - path: /
        backend:
          serviceName: whoami-service
          servicePort: 80

(2) 启动ingress

# 启动
kubectl apply -f whoami-ingress.yaml
# 查看
kubectl get ingress
# 查看ingress详情
kubectl describe ingress whoami-ingress

测试

（1）宿主机添加一个域名 who.yjdev.com 解析

192.168.22.51   who.yjdev.com

如下图

（2）测试访问

可见访问成功了，且实现了轮训的负载均衡策略