K8S 创建 Ingress

最新推荐文章于 2023-03-18 21:31:23 发布

Tom Ma.

最新推荐文章于 2023-03-18 21:31:23 发布

阅读量6.6k

点赞数 1

分类专栏： K8S

本文链接：https://blog.csdn.net/mshxuyi/article/details/110210380

版权

K8S 专栏收录该内容

23 篇文章 13 订阅

订阅专栏

ingress

ingress 是一个API对象，和其他对象一样，通过yaml文件来配置，作用是定义请求如何转发到 service 的规则

ingress 通过 http或https 暴露集群内部 service，给 service 提供外部URL、负载均衡、SSL/TLS能力以及基于host的方向代理

ingress-controller 是具体实现反向代理及负载均衡的程序，对 ingress 定义的规则进行解析，根据配置的规则来实现请求转发

ingress 要依靠 ingress-controller 来具体实现以上功能

ingress-controller

ingress-controller 并不是 k8s 自带的组件，实际上 ingress-controller 只是一个统称，用户可以选择不同的 ingress-controller 实现，目前，由 k8s 维护的 ingress-controller 只有google云的 GCE 与 ingress-nginx 两个，其他还有很多第三方维护的 ingress-controller，具体可以参考官方文档。但是不管哪一种 ingress-controller，实现的机制都大同小异，只是在具体配置上有差异。一般来说，ingress-controller 的形式都是一个 pod，里面跑着 daemon 程序和反向代理程序。daemon 负责不断监控集群的变化，根据 ingress 对象生成配置并应用新配置到反向代理，比如 nginx-ingress 就是动态生成 nginx 配置，动态更新 upstream，并在需要的时候reload程序应用新配置。本例子以 k8s 官方维护的 nginx-ingress 进行演示

一、安装 nginx-ingress-controller

1、下载

mkdir ingress

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.25.0/deploy/static/mandatory.yaml

# 上面可能无法下载：所以用国内的 gitee
wget https://gitee.com/mirrors/ingress-nginx/raw/nginx-0.25.0/deploy/static/mandatory.yaml

2、修改 ClusterRole

vim mandatory.yaml

# 修改
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: nginx-ingress-clusterrole
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - endpoints
      - nodes
      - pods
      - secrets
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"    # 增加
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"   # 增加
    resources:
      - ingresses/status
    verbs:
      - update

ingress 暴露服务的方式（一），Deployment+LoadBalancer 模式的 Service

如果要把ingress部署在公有云，那用这种方式比较合适。用Deployment部署ingress-controller，创建一个 type为 LoadBalancer 的 service 关联这组 pod。大部分公有云，都会为 LoadBalancer 的 service 自动创建一个负载均衡器，通常还绑定了公网地址。只要把域名解析指向该地址，就实现了集群服务的对外暴露

ingress 暴露服务的方式（二），DaemonSet+HostNetwork+nodeSelector 本例采用这种

用 DaemonSet 结合 nodeselector 来部署 ingress-controller 到特定的 node 上，然后使用 HostNetwork 直接把该 pod 与宿主机 node 的网络打通，直接使用宿主机的80/433端口就能访问服务。这时，ingress-controller所在的node机器就很类似传统架构的边缘节点，比如机房入口的nginx服务器。该方式整个请求链路最简单，性能相对NodePort模式更好。缺点是由于直接利用宿主机节点的网络和端口，一个node只能部署一个ingress-controller pod。比较适合大并发的生产环境使用。

3、指定 nginx-ingress-controller 运行在 node2 节点

# 给 node2 节点打标签
kubectl label node node2 ingress=true

# 查看
[root@master ingress]# kubectl get nodes --show-labels
NAME     STATUS   ROLES    AGE    VERSION   LABELS
master   Ready    master   158d   v1.17.2   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=master,kubernetes.io/os=linux,node-role.kubernetes.io/master=
node1    Ready    <none>   158d   v1.17.2   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=node1,kubernetes.io/os=linux
node2    Ready    <none>   158d   v1.17.2   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,ingress=true,kubernetes.io/arch=amd64,kubernetes.io/hostname=node2,kubernetes.io/os=linux

4、修改 Deployment 为 DaemonSet ，指定节点运行，并开启 hostNetwork 网络

vim mandatory.yaml

...
apiVersion: apps/v1
# 修改 kind
# kind: Deployment
kind: DaemonSet
metadata:
  name: nginx-ingress-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
# 删除Replicas
# replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
      annotations:
        prometheus.io/port: "10254"
        prometheus.io/scrape: "true"
    spec:
      # 使用主机网络
      hostNetwork: true
      # 选择节点运行
      nodeSelector:
        ingress: "true"
      serviceAccountName: nginx-ingress-serviceaccount
...

ingress 暴露服务的方式（三），Deployment+NodePort 模式的 Service

用 Deployment 模式部署 ingress-controller，并创建对应的服务，但是 type 为NodePort。这样，ingress就会暴露在集群节点ip的特定端口上。由于 Nodeport 暴露的端口是随机端口，一般会在前面再搭建一套负载均衡器来转发请求。该方式一般用于宿主机是相对固定的环境ip地址不变的场景。
NodePort方式暴露 ingress 虽然简单方便，但是 NodePort 多了一层NAT，在请求量级很大时可能对性能会有一定影响。

下面给出 Deployment+NodePort 模式的 Service

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  type: NodePort
  ports:
    - name: http
      port: 80
      targetPort: 80
      protocol: TCP
    - name: https
      port: 443
      targetPort: 443
      protocol: TCP
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

6、启动

kubectl apply -f mandatory.yaml

7、查看

# ingress-nginx 已经运行 node2 节点
[root@master ingress]# kubectl get pod -n ingress-nginx -o wide
NAME                                        READY   STATUS    RESTARTS   AGE   IP              NODE    NOMINATED NODE   READINESS GATES
nginx-ingress-controller-647bc555d8-z2s69   1/1     Running   0          39m   192.168.2.102   node2   <none>           <none>


# 查看其它创建的资源类型
[root@master ingress]# kubectl get cm,deploy -n ingress-nginx -o wide
NAME                                        DATA   AGE
configmap/ingress-controller-leader-nginx   0      40m
configmap/nginx-configuration               0      40m
configmap/tcp-services                      0      40m
configmap/udp-services                      0      40m

NAME                       READY   CONTAINERS                 SELECTOR
nginx-ingress-controller   1/1     nginx-ingress-controller   app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx

8、登陆 node2 节点查看

# 成功监听 80,443,8181 端口,其中 8181 是 nginx-controller 默认配置的一个 default backend
[root@node2 ~]# netstat -lntp | grep nginx
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      90590/nginx: master 
tcp        0      0 0.0.0.0:8181            0.0.0.0:*               LISTEN      90590/nginx: master 
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      90590/nginx: master 
tcp6       0      0 :::10254                :::*                    LISTEN      90546/nginx-ingress 
tcp6       0      0 :::80                   :::*                    LISTEN      90590/nginx: master 
tcp6       0      0 :::8181                 :::*                    LISTEN      90590/nginx: master 
tcp6       0      0 :::443                  :::*                    LISTEN      90590/nginx: master

到上面为止，nginx-ingress-controller 部署完毕

二、接下来创建 ingress 规则

1、创建一个 deploy 和 svc

[root@master yaml]# vim service-nginx.yaml 

# 内容
apiVersion: apps/v1
kind: Deployment
metadata:
 name: nginx-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-app-svc
spec:
  type: ClusterIP
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  selector:
    app: nginx

2、创建 ingress

vim ingress-app.yaml

# 内容
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginx-app-ingress
spec:
  rules:
  - host: app.mshxuyi.com
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-app-svc
          servicePort: 80

3、查看 ingress

[root@master yaml]# kubectl get ing
NAME          HOSTS             ADDRESS   PORTS   AGE
ingress-app   app.mshxuyi.com             80      105m

4、本地 host 添加域名解析

vim /etc/hosts

# 内容
master     192.168.2.100
node1      192.168.2.101
node2      192.168.2.102

# 新增
192.168.2.102 app.mshxuyi.com

5、成功访问

[root@master yaml]# curl app.mshxuyi.com
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

三、查看 nginx-ingress-controller

1、进入 pod

kubectl exec -it nginx-ingress-controller-pdg5j -n ingress-nginx /bin/bash

2、查看

cat /etc/nginx/nginx.conf | more

3、里面其实是一个 openresty 的 nginx

# Configuration checksum: 6569674521986087429

# setup custom paths that do not require root access
pid /tmp/nginx.pid;

daemon off;

worker_processes 2;

worker_rlimit_nofile 523264;

worker_shutdown_timeout 10s ;

events {
	multi_accept        on;
	worker_connections  16384;
	use                 epoll;
}

http {
	lua_package_path	"/usr/local/openresty/site/lualib/?.ljbc;/usr/local/openresty/site/lualib/?/init.ljbc;/usr/local/openresty/lualib/?.ljbc;/usr/local/openresty/lualib/?/init.ljbc;/usr/local/openresty/site/lualib/?.lua;/usr/local/openresty/site/lualib/?/
init.lua;/usr/local/openresty/lualib/?.lua;/usr/local/openresty/lualib/?/init.lua;./?.lua;/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/?/init.lua;/usr/local/openresty/luajit/share/lua/5.1/?.lua;/us
r/local/openresty/luajit/share/lua/5.1/?/init.lua;/usr/local/lib/lua/?.lua;;";
	lua_package_cpath 	"/usr/local/openresty/site/lualib/?.so;/usr/local/openresty/lualib/?.so;./?.so;/usr/local/lib/lua/5.1/?.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so;/usr/local/lib/lua/5.1/loadall.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so;;";


----

www-data@node2:/etc/nginx$ cat /etc/nginx/nginx.conf | grep app.mshxuyi.com -A 20
	## start server app.mshxuyi.com
	server {
		server_name app.mshxuyi.com ;
		
		listen 80;
		
		listen [::]:80;
		
		set $proxy_upstream_name "-";
		set $pass_access_scheme $scheme;
		set $pass_server_port $server_port;
		set $best_http_host $http_host;
		set $pass_port $pass_server_port;
		
		location / {
			
			set $namespace      "default";
			set $ingress_name   "nginx-app-ingress";
			set $service_name   "nginx-app-svc";
			set $service_port   "80";
			set $location_path  "/";
			
			rewrite_by_lua_block {

Tom Ma.

关注

1
点赞
踩
11

收藏

觉得还不错? 一键收藏
1
评论
K8S 创建 Ingress

1、下载mkdir ingresswget https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.25.0/deploy/static/mandatory.yaml# 上面可能无法下载：所以用国内的 giteewget https://gitee.com/mirrors/ingress-nginx/raw/nginx-0.25.0/deploy/static/mandatory.yaml2、修改manda..
复制链接

扫一扫