kubernetes-Ingress使用

基于这种现状，kubernetes提供了Ingress资源对象，Ingress只需要一个NodePort或者一个LB就可以满足暴露多个Service的需求。工作机制大致如下图表示

实际上，Ingress相当于一个7层的负载均衡器，是kubernetes对反向代理的一个抽象，它的工作原理类似于Nginx，可以理解成在Ingress里建立诸多映射规则，Ingress Controller通过监听这些配置规则并转化成Nginx的反向代理配置 , 然后对外部提供服务。在这里有两个核心概念

ngress：kubernetes中的一个对象，作用是定义请求如何转发到service的规则
ingress controller：具体实现反向代理及负载均衡的程序，对ingress定义的规则进行解析，根据配置的规则来实现请求转发，实现方式有很多，比如Nginx, Contour, Haproxy等等

Ingress（以Nginx为例）的工作原理如下

1. 用户编写Ingress规则，说明哪个域名对应kubernetes集群中的哪个Service
2. Ingress控制器动态感知Ingress服务规则的变化，然后生成一段对应的Nginx反向代理配置
3. Ingress控制器会将生成的Nginx配置写入到一个运行着的Nginx服务中，并动态更新
4. 到此为止，其实真正在工作的就是一个Nginx了，内部配置了用户定义的请求转发规则

Ingress使用

环境准备 搭建ingress环境

# 创建文件夹
[root@k8s-master ~]# mkdir ingress
[root@k8s-master ~]# cd ingress
[root@k8s-master ingress-controller]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.30.0/deploy/static/mandatory.yaml

# 查看ingress-nginx
[root@master ingress]# kubectl get po -n ingress-nginx 
NAME                                        READY   STATUS    RESTARTS   AGE
nginx-ingress-controller-65886f4f5d-87nrt   1/1     Running   0          59s

# 查看service
[root@master ingress]# kubectl get svc -n ingress-nginx 
NAME            TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx   NodePort   10.106.176.147   <none>        80:32123/TCP,443:31360/TCP   2m

准备nginx和tomcat的service和pod

创建nginx.yaml

vim nginx.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
 name: nginx-deployment
 namespace: dev
spec:
 replicas: 2
 selector:
   matchLabels:
     app: nginx-pod
 template:
   metadata:
     labels:
       app: nginx-pod
   spec:
     containers:
     - name: nginx
       image: nginx:1.17.1
       ports:
       - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
 name: nginx-service
 namespace: dev
spec:
 selector:
   app: nginx-pod
 clusterIP: None
 type: ClusterIP
 ports:
 - port: 80
   targetPort: 80

vim tomcat.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
 name: tomcat-deployment
 namespace: dev
spec:
 replicas: 2
 selector:
   matchLabels:
     app: tomcat-pod
 template:
   metadata:
     labels:
       app: tomcat-pod
   spec:
     containers:
     - name: tomcat
       image: tomcat:8.5-jre10-slim
       ports:
       - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
 name: tomcat-service
 namespace: dev
spec:
 selector:
   app: tomcat-pod
 clusterIP: None
 type: ClusterIP
 ports:
 - port: 8080
   targetPort: 8080

创建dev命名空间
[root@master ingress]# kubectl create ns dev
[root@master ingress]# kubectl apply -f tomcat.yaml 
deployment.apps/tomcat-deployment created
service/tomcat-service created

[root@master ingress]# kubectl apply -f nginx.yaml 
deployment.apps/nginx-deployment created
service/nginx-service created

# 查看
[root@master ingress]# kubectl get po -n dev
NAME                                 READY   STATUS    RESTARTS   AGE
nginx-deployment-5ffc5bf56c-gz9v6    1/1     Running   0          67s
nginx-deployment-5ffc5bf56c-jggmw    1/1     Running   0          67s
tomcat-deployment-7db86c59b7-k8kjr   1/1     Running   0          91s
tomcat-deployment-7db86c59b7-l8hrs   1/1     Running   0          91s
[root@master ingress]# kubectl get svc -n dev
NAME             TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)    AGE
nginx-service    ClusterIP   None         <none>        80/TCP     78s
tomcat-service   ClusterIP   None         <none>        8080/TCP   102s

Http代理

vim http-ingres.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
 name: ingress-http
 namespace: dev
spec:
 rules:
 - host: nginx.liu.com
   http:
     paths:
     - path: /
       backend:
         serviceName: nginx-service
         servicePort: 80
 - host: tomcat.liu.com
   http:
     paths:
     - path: /
       backend:
         serviceName: tomcat-service
         servicePort: 8080

[root@master ingress]# kubectl apply -f http-ingres.yaml 
Warning: extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
ingress.extensions/ingress-http created

#查看
[root@master ingress]# kubectl get ingress -n dev
NAME           CLASS    HOSTS                                  ADDRESS          PORTS   AGE
ingress-http   <none>   nginx.liu.com,tomcat.liu.com   10.106.176.147   80      81s

#查看描述信息
[root@master ingress]# kubectl describe ingress -n dev
Name:             ingress-http
Namespace:        dev
Address:          10.106.176.147
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
Rules:
 Host                Path  Backends
 ----                ----  --------
 nginx.itheima.com   
                     /   nginx-service:80 (10.244.1.63:80,10.244.2.73:80)
 tomcat.itheima.com  
                     /   tomcat-service:8080 (10.244.1.62:8080,10.244.2.72:8080)
Annotations:          <none>
Events:
 Type    Reason  Age   From                      Message
 ----    ------  ----  ----                      -------
 Normal  CREATE  2m4s  nginx-ingress-controller  Ingress dev/ingress-http
 Normal  UPDATE  110s  nginx-ingress-controller  Ingress dev/ingress-http

#接下来,在本地电脑上配置host文件,解析上面的两个域名到192.168.253.110(master)上
#然后,就可以分别访问tomcat.liu.com:32123  和  nginx.liu.com:31360 查看效果了

Https代理

创建证书

# 生成证书
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/C=CN/ST=BJ/L=BJ/O=nginx/CN=liu.com"
# 创建密钥
kubectl create secret tls tls-secret --key tls.key --cert tls.crt

创建https-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-https
  namespace: dev
spec:
  tls:
    - hosts:
      - nginx.liu.com
      - tomcat.liu.com
      secretName: tls-secret
  rules:
  - host: nginx.liu.com
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-service
          servicePort: 80
  - host: tomcat.liu.com
    http:
      paths:
      - path: /
        backend:
          serviceName: tomcat-service
          servicePort: 8080

# 创建
[root@master ingress]# kubectl create -f ingress-https.yaml
ingress.extensions/ingress-https created

#查看
[root@master ingress]# kubectl get ingress -n dev
NAME            CLASS    HOSTS                                  ADDRESS          PORTS     AGE
ingress-http    <none>   nginx.liu.com,tomcat.liu.com   10.106.176.147   80        8m9s
ingress-https   <none>   nginx.liu.com,tomcat.liu.com                    80, 443   27s
#查看描述信息
[root@master ingress]# kubectl describe ingress -n dev ingress-https
Name:             ingress-https
Namespace:        dev
Address:          10.106.176.147
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
  tls-secret terminates nginx.liu.com,tomcat.liu.com
Rules:
  Host                Path  Backends
  ----                ----  --------
  nginx.itheima.com   
                      /   nginx-service:80 (10.244.1.63:80,10.244.2.73:80)
  tomcat.itheima.com  
                      /   tomcat-service:8080 (10.244.1.62:8080,10.244.2.72:8080)
Annotations:          <none>
Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  CREATE  61s   nginx-ingress-controller  Ingress dev/ingress-https
  Normal  UPDATE  29s   nginx-ingress-controller  Ingress dev/ingress-https

nginx进行BasicAuth

[root@master ingress]# yum -y install httpd
[root@master ingress]# htpasswd -c auth foo  //创建文件名为auth 用户名为foo
[root@master ingress]# kubectl create secret generic basic-auth --from-file=auth

vim ingress-auth.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-with-auth
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
  rules:
  - host: auth.liu.com
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-service
          servicePort: 80

nginx进行重写

示例

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginx-test
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: https://liu.com:31170
spec:
  rules:
  - host: liu1.com
    http:
      paths:
      - path:
        backend:
          serviceName: nginx-service
          servicePort: 80

访问liu1.com跳转到liu.com