Ingress简介
Ingress 功能是将集群外部的流量请求转发至集群颞部,从而使实现服务暴露
Traefik部署
可以在 github 上下载traefik。
获取traefik
的镜像文件,打标签后上传至 Harbor
私有仓库
[root@192-168-199-15 ~]# docker pull traefik:v1.7.2-alpine
[root@192-168-199-15 ~]# docker images | grep traefik
traefik v1.7.2-alpine add5fac61ae5 20 months ago 72.4MB
[root@192-168-199-15 ~]# docker tag add5fac61ae5 harbor.od.com/public/traefik:v1.7.2
[root@192-168-199-15 ~]# docker push harbor.od.com/public/traefik:v1.7.2
准备资源配置清单
[root@192-168-199-15 traefik]# pwd
/data/k8s-yaml/traefik
创建 rbac,yaml
[root@192-168-199-15 traefik]# cat rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: kube-system
创建 DaemonSet
类型资源,控制一个宿主机上跑一个副本
[root@192-168-199-15 traefik]# cat ds.yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: traefik-ingress
namespace: kube-system
labels:
k8s-app: traefik-ingress
spec:
template:
metadata:
labels:
k8s-app: traefik-ingress
name: traefik-ingress
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
containers:
- image: harbor.od.com/public/traefik:v1.7.2
name: traefik-ingress
ports:
- name: controller
containerPort: 80
hostPort: 81
- name: admin-web
containerPort: 8080
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
args:
- --api
- --kubernetes
- --logLevel=INFO
- --insecureskipverify=true
- --kubernetes.endpoint=https://192.168.199.10:7443
- --accesslog
- --accesslog.filepath=/var/log/traefik_access.log
- --traefiklog
- --traefiklog.filepath=/var/log/traefik.log
- --metrics.prometheus
注意:需要修改资源清单中所涉及到的IP地址
创建 Service
类型资源
[root@192-168-199-15 traefik]# cat svc.yaml
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress
ports:
- protocol: TCP
port: 80
name: controller
- protocol: TCP
port: 8080
name: admin-web
Ingress
资源是一组基于域名和 URL
路径,把用户的请求转发至指定 Service
资源的规则
[root@192-168-199-15 traefik]# cat ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-web-ui
namespace: kube-system
annotations:
kubernetes.io/ingress.class: traefik
spec:
rules:
- host: traefik.od.com
http:
paths:
- path: /
backend:
serviceName: traefik-ingress-service
servicePort: 8080
在任意一个运算节点应用以上 yaml
配置
[root@192-168-199-13 ~]# kubectl apply -f http://k8s-yaml.od.com/traefik/rbac.yaml
[root@192-168-199-13 ~]# kubectl apply -f http://k8s-yaml.od.com/traefik/ds.yaml
[root@192-168-199-13 ~]# kubectl apply -f http://k8s-yaml.od.com/traefik/svc.yaml
[root@192-168-199-13 ~]# kubectl apply -f http://k8s-yaml.od.com/traefik/ingress.yaml
查看 pod
的运行状态
[root@192-168-199-13 ~]# kubectl get pods -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
coredns-6b6c4f9648-44xjn 1/1 Running 0 25h 172.7.13.3 192-168-199-13.host.com <none> <none>
traefik-ingress-2hctl 1/1 Running 0 22m 172.7.13.4 192-168-199-13.host.com <none> <none>
traefik-ingress-vfh4t 1/1 Running 0 22m 172.7.14.4 192-168-199-14.host.com <none> <none>
若 STATUS 一直处于 ContainerCreating 状态,可尝试重启容器
部署七层负载均衡
在 192.168.199.11
和 192.168.199.12
上配置七层代理,无差别的将流量抛给后端的 Ingress
处理
[root@192-168-199-11 ~]# cat /etc/nginx/conf.d/od.com.conf
upstream default_backend_traefik {
server 192.168.199.13:81 max_fails=3 fail_timeout=10s;
server 192.168.199.14:81 max_fails=3 fail_timeout=10s;
}
server {
server_name *.od.com;
location / {
proxy_pass http://default_backend_traefik;
proxy_set_header Host $http_host;
proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
}
}
加载 Nginx
的配置文件
[root@192-168-199-11 ~]# nginx -t
[root@192-168-199-11 ~]# nginx -s reload
在 192.168.199.11
上配置域名解析
[root@192-168-199-11 ~]# cat /var/named/od.com.zone
$ORIGIN od.com.
$TTL 600 ; 10 minutes
@ IN SOA dns.od.com. dnsadmin.od.com. (
# 前滚一个序列号
2020052704 ; serial
10800 ; refresh (3 hours)
900 ; retry (15 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
NS dns.od.com.
$TTL 60 ; 1 minute
dns A 192.168.199.11
harbor A 192.168.199.15
k8s-yaml A 192.168.199.15
# 添加一个 A 记录
traefik A 192.168.199.10
重启 named
服务后,可通过域名访问 traefik.od.com
访问 traefik
,如下图所示: