Kubernetes Ingress 深度解析

Kubernetes Ingress 深度解析

一、Ingress 基本概念

Ingress 是 Kubernetes 中管理外部访问集群服务的 API 对象，提供 HTTP/HTTPS 路由规则，实现以下功能：

• 基于域名/路径的路由
• TLS/SSL 终止
• 负载均衡
• 流量控制

与传统服务的区别

特性	Ingress	Service (NodePort/LoadBalancer)
协议支持	HTTP/HTTPS/GRPC	所有TCP/UDP协议
路由能力	基于主机名和路径的复杂路由	简单的端口转发
实现层级	L7 (应用层)	L4 (传输层)
外部依赖	需要Ingress Controller	不需要额外组件

二、核心架构组成

1. Ingress 资源 (YAML定义)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: "example.com"
    http:
      paths:
      - pathType: Prefix
        path: "/shop"
        backend:
          service:
            name: shop-service
            port:
              number: 80

2. Ingress Controller

常见实现：

• Nginx Ingress Controller
• Traefik
• HAProxy Ingress
• AWS ALB Ingress Controller
• Istio Gateway

三、Ingress 详细配置

1. 路由规则类型

路径匹配方式

paths:
- path: /static
  pathType: Prefix  # 前缀匹配
- path: /exact
  pathType: Exact    # 精确匹配
- path: /regex
  pathType: ImplementationSpecific  # 实现特定

多主机名配置

rules:
- host: "shop.example.com"
  http: {...}
- host: "blog.example.com"
  http: {...}

2. TLS 配置

spec:
  tls:
  - hosts:
    - "example.com"
    secretName: example-tls  # 存储证书的Secret

创建证书Secret：

kubectl create secret tls example-tls \
  --cert=path/to/cert.pem \
  --key=path/to/key.pem

3. 注解扩展功能（以Nginx为例）

annotations:
  # 限速设置
  nginx.ingress.kubernetes.io/limit-rpm: "100"
  
  # 跨域支持
  nginx.ingress.kubernetes.io/enable-cors: "true"
  
  # 重写规则
  nginx.ingress.kubernetes.io/rewrite-target: /$2
  
  # 会话保持
  nginx.ingress.kubernetes.io/affinity: "cookie"

四、部署实践

1. 安装Ingress Controller（以Nginx为例）

# 使用官方部署清单
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml

2. 验证安装

# 检查Controller Pod
kubectl get pods -n ingress-nginx

# 获取外部IP
kubectl get svc -n ingress-nginx

3. 完整部署示例

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: nginx:1.21
        ports:
        - containerPort: 80
---
# service.yaml
apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  selector:
    app: web
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
---
# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  rules:
  - host: "demo.example.com"
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

五、高级功能

1. 流量切分 (Canary发布)

annotations:
  nginx.ingress.kubernetes.io/canary: "true"
  nginx.ingress.kubernetes.io/canary-weight: "20"  # 20%流量

2. 基于Header的路由

annotations:
  nginx.ingress.kubernetes.io/canary-by-header: "X-Canary"
  nginx.ingress.kubernetes.io/canary-by-header-value: "true"

3. 身份认证

# 创建认证Secret
htpasswd -c auth foo
kubectl create secret generic basic-auth --from-file=auth

annotations:
  nginx.ingress.kubernetes.io/auth-type: basic
  nginx.ingress.kubernetes.io/auth-secret: basic-auth

六、性能优化

1. 配置调优

annotations:
  # 连接池设置
  nginx.ingress.kubernetes.io/upstream-keepalive-connections: "100"
  nginx.ingress.kubernetes.io/upstream-keepalive-timeout: "60"
  
  # 缓冲区设置
  nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"

2. 监控指标

# 启用Prometheus监控
annotations:
  prometheus.io/scrape: "true"
  prometheus.io/port: "10254"

七、常见问题排查

1. Ingress Controller 未分配IP

   kubectl describe ingress <ingress-name>
   kubectl get events -n ingress-nginx
   

2. 502 Bad Gateway

   # 检查后端服务
   kubectl get endpoints <service-name>
   kubectl logs <ingress-controller-pod>
   

3. 证书问题

   kubectl describe secret <tls-secret-name>
   openssl s_client -connect <host>:443 -servername <host>
   

Ingress 作为 Kubernetes 的入口网关，通过灵活的配置可以满足各种生产环境需求。实际使用时需根据业务场景选择合适的 Controller 和配置策略。