一起来学k8s 11.ingress-controller

Ingress-controller

Kubernetes 集群内部使用 kube-dns 实现服务发现的功能，那么我们部署在 Kubernetes 集群中的应用如何暴露给外部的用户使用呢？我们知道前面我们使用 NodePort 和 LoadBlancer 类型的 Service 可以实现把应用暴露给外部用户使用，除此之外，Kubernetes 还为我们提供了一个非常重要的资源对象可以用来暴露服务给外部用户，那就是 ingress。对于小规模的应用我们使用 NodePort 或许能够满足我们的需求，但是当你的应用越来越多的时候，你就会发现对于 NodePort 的管理就非常麻烦了，这个时候使用 ingress 就非常方便了，可以避免管理大量的 Port

环境

192.168.48.101 master01
192.168.48.201 node01
192.168.48.202 node02

官方

https://github.com/kubernetes/ingress-nginx/tree/master01/deploy/static

安装ingress-controller

yaml文件下载

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master01/deploy/static/mandatory.yaml

镜像下载

需要的镜像

quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.25.0

链接: https://pan.baidu.com/s/1_n_IPRo2bojl2EIoaqqcUg 提取码: tjyt

节点导入镜像

docker load -i ingress-controller-nginx-0.25.0.tar.gz 

创建ingress-controller

[root@master01 ~]# kubectl apply -f mandatory.yaml 
namespace/ingress-nginx created
configmap/nginx-configuration created
configmap/tcp-services created
configmap/udp-services created
serviceaccount/nginx-ingress-serviceaccount created
clusterrole.rbac.authorization.k8s.io/nginx-ingress-clusterrole created
role.rbac.authorization.k8s.io/nginx-ingress-role created
rolebinding.rbac.authorization.k8s.io/nginx-ingress-role-nisa-binding created
clusterrolebinding.rbac.authorization.k8s.io/nginx-ingress-clusterrole-nisa-binding created
deployment.apps/nginx-ingress-controller created

查看

[root@master01 ~]# kubectl get pod -n ingress-nginx -o wide
NAME                                        READY   STATUS    RESTARTS   AGE   IP           NODE     NOMINATED NODE   READINESS GATES
nginx-ingress-controller-7995bd9c47-c4g5b   1/1     Running   0          16s   10.244.2.5   node02   <none>           <none>

创建ingress-crontroller的svc

官方默认的yaml文件创建的是deployment，所以得创建一个service，暴露给外网 http是30080 https是30443

vim ingress-crontroller-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: ingress-controller-svc
  namespace: ingress-nginx
spec:
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  type: NodePort
  ports:
  - name: http
    port: 80
    targetPort: 80
    protocol: TCP
    nodePort: 30080
  - name: https
    port: 443
    targetPort: 443
    protocol: TCP
    nodePort: 30443

[root@master01 ~]# kubectl apply -f ingress-crontroller-svc.yaml 
service/ingress-controller-svc created

[root@master01 ~]# kubectl get svc -n ingress-nginx 
NAME                     TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
ingress-controller-svc   NodePort   10.101.54.200   <none>        80:30080/TCP,443:30443/TCP   19s

测试一下，发现出来了，但是404，因为没写ingress

ingress

ingress实时监听着service

部署webapp

准备deployment

[root@master01 deploy_yaml]# vim myapp-deploy.yaml 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deploy
  namespace: default
  labels:
    app: myapp
    type: deploy
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
      type: deploy
  template:
    metadata:
      name: myapp-pod
      labels:
        app: myapp
        type: deploy
    spec:
      containers:
      - name: myapp
        image: ikubernetes/myapp:v1
        ports:
        - name: http
          containerPort: 80

[root@master01 deploy_yaml]# kubectl apply -f myapp-deploy.yaml 
deployment.apps/myapp-deploy created

准备service

[root@master01 svc_yaml]# vim myapp-svc.yaml 

apiVersion: v1
kind: Service
metadata:
  name: myapp-svc
  namespace: default
  labels:
    type: svc
    app: myapp
spec:
  selector:
    app: myapp
    type: deploy
  type: ClusterIP
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: http

[root@master01 svc_yaml]# kubectl apply -f myapp-svc.yaml 
service/myapp-svc created

编写ingress

vim myapp-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: myapp-ingress
  namespace: default
  labels:
    type: ingress
    app: myapp
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: myapp.tk8s.com
    http:
      paths:
      - path:
        backend:
          serviceName: myapp-svc
          servicePort: 80

创建ingress

[root@master01 ingress_yaml]# kubectl apply -f myapp-ingress.yaml

[root@master01 ~]# kubectl get ingresses -o wide
NAME            HOSTS            ADDRESS   PORTS   AGE
myapp-ingress   myapp.tk8s.com             80      17s

测试

因为是域名访问，hosts写入相关内容

192.168.48.101 master01 myapp.tk8s.com
192.168.48.201 node01
192.168.48.202 node02

访问

部署tomcat

准备deployment

vim tomcat-deploy.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-deploy
  namespace: default
  labels:
    app: tomcat
    type: deploy
spec:
  replicas: 2
  selector:
    matchLabels:
      app: tomcat
      type: deploy
  template:
    metadata:
      name: tomcat-pod
      labels:
        app: tomcat
        type: deploy
    spec:
      containers:
      - name: tomcat
        image: tomcat:8.5.32-jre8-alpine
        ports:
        - name: http
          containerPort: 8080

[root@master01 deploy_yaml]# kubectl apply -f tomcat-deploy.yaml 
deployment.apps/tomcat-deploy created

准备service

vim tomcat-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: tomcat-svc
  namespace: default
  labels:
    type: svc
    app: tomcat
spec:
  selector:
    app: tomcat
    type: deploy
  type: ClusterIP
  ports:
  - port: 8080
    targetPort: 8080
    protocol: TCP
    name: http

[root@master01 svc_yaml]# kubectl apply -f tomcat-svc.yaml 
service/tomcat-svc created

编写ingress

vim tomcat-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat-ingress
  namespace: default
  labels:
    type: ingress
    app: tomcat
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: tomcat.tk8s.com
    http:
      paths:
      - path:
        backend:
          serviceName: tomcat-svc
          servicePort: 8080

创建ingress

[root@master01 ingress_yaml]# kubectl apply -f tomcat-ingress.yaml 
ingress.extensions/tomcat-ingress created

[root@master01 ~]# kubectl get ingresses.
NAME             HOSTS             ADDRESS   PORTS   AGE
myapp-ingress    myapp.tk8s.com              80      96m
tomcat-ingress   tomcat.tk8s.com             80      7s

测试

因为是域名访问，hosts写入相关内容

192.168.48.101 master01 myapp.tk8s.com   tomcat.tk8s.com
192.168.48.201 node01
192.168.48.202 node02

访问

tomcat https

做证书

[root@master01 ~]# openssl genrsa -out tomcat.key 2048
Generating RSA private key, 2048 bit long modulus
........................................+++
.............................................+++
e is 65537 (0x10001)
[root@master01 ~]# openssl req -new -x509 -key tomcat.key  -out tomcat.crt -subj /C=CN/ST=Beijing/L=Beijing/O=dev/CN=tomcat.tk8s.com

创建secret

[root@master01 ~]# kubectl create secret  tls tomcat-ingress-secret --cert=tomcat.crt  --key=tomcat.key 
secret/tomcat-ingress-secret created

[root@master01 ~]# kubectl get secrets 
NAME                    TYPE                                  DATA   AGE
default-token-56k45     kubernetes.io/service-account-token   3      19d
tomcat-ingress-secret   kubernetes.io/tls                     2      8s

编写ingress

vim tomcat-ingress-ssl.yaml 

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat-ingress-ssl
  namespace: default
  labels:
    type: ingress
    app: tomcat
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  tls:
  - hosts:
    - tomcat.tk8s.com
    secretName: tomcat-ingress-secret
  rules:
  - host: tomcat.tk8s.com
    http:
      paths:
      - path:
        backend:
          serviceName: tomcat-svc
          servicePort: 8080

创建ingress

[root@master01 ~]# kubectl apply -f tomcat-ingress-ssl.yaml 
ingress.extensions/tomcat-ingress-ssl created

[root@master01 ~]# kubectl get ingresses.
NAME                 HOSTS             ADDRESS   PORTS     AGE
myapp-ingress        myapp.tk8s.com              80        102m
tomcat-ingress       tomcat.tk8s.com             80        6m16s
tomcat-ingress-ssl   tomcat.tk8s.com             80, 443   10s

测试

因为是域名访问，本机hosts写入相关内容

192.168.48.101 master01 myapp.tk8s.com   tomcat.tk8s.com
192.168.48.201 node01
192.168.48.202 node02

访问