k8s集群之-Ingress

1.Ingress 是什么？#

底层是nginx

Ingress 是对集群中服务的外部访问进行管理的 API 对象，典型的访问方式是 HTTP。

Ingress 可以提供负载均衡、SSL 终结和基于名称的虚拟托管。

Ingress 公开了从集群外部到集群内 services 的 HTTP 和 HTTPS 路由。 流量路由由 Ingress 资源上定义的规则控制。

1
    internet
2
        |
3
   [ Ingress ]
4
   --|-----|--
5
   [ Services ]

可以将 Ingress 配置为提供服务外部可访问的 URL、负载均衡流量、终止 SSL / TLS，以及提供基于名称的虚拟主机。Ingress 控制器 通常负责通过负载均衡器来实现 Ingress，尽管它也可以配置边缘路由器或其他前端来帮助处理流量。

Ingress 不会公开任意端口或协议。 将 HTTP 和 HTTPS 以外的服务公开到 Internet 时，通常使用 Service.Type=NodePort 或者 Service.Type=LoadBalancer 类型的服务

2.Ingress解决的痛点#

• 使用node的IP+service的端口才能访问到服务
• 域名的绑定

3.部署Ingress-controller-yaml方式#

• ingress-controller.yaml

  1
  apiVersion: v1
  2
  kind: Namespace
  3
  metadata:
  4
    name: ingress-nginx
  5
    labels:
  6
      app.kubernetes.io/name: ingress-nginx
  7
      app.kubernetes.io/part-of: ingress-nginx
  8
  
  9
  ---
  10
  kind: ConfigMap
  11
  apiVersion: v1
  12
  metadata:
  13
    name: nginx-configuration
  14
    namespace: ingress-nginx
  15
    labels:
  16
      app.kubernetes.io/name: ingress-nginx
  17
      app.kubernetes.io/part-of: ingress-nginx
  18
  
  19
  ---
  20
  kind: ConfigMap
  21
  apiVersion: v1
  22
  metadata:
  23
    name: tcp-services
  24
    namespace: ingress-nginx
  25
    labels:
  26
      app.kubernetes.io/name: ingress-nginx
  27
      app.kubernetes.io/part-of: ingress-nginx
  28
  
  29
  ---
  30
  kind: ConfigMap
  31
  apiVersion: v1
  32
  metadata:
  33
    name: udp-services
  34
    namespace: ingress-nginx
  35
    labels:
  36
      app.kubernetes.io/name: ingress-nginx
  37
      app.kubernetes.io/part-of: ingress-nginx
  38
  
  39
  ---
  40
  apiVersion: v1
  41
  kind: ServiceAccount
  42
  metadata:
  43
    name: nginx-ingress-serviceaccount
  44
    namespace: ingress-nginx
  45
    labels:
  46
      app.kubernetes.io/name: ingress-nginx
  47
      app.kubernetes.io/part-of: ingress-nginx
  48
  
  49
  ---
  50
  apiVersion: rbac.authorization.k8s.io/v1beta1
  51
  kind: ClusterRole
  52
  metadata:
  53
    name: nginx-ingress-clusterrole
  54
    labels:
  55
      app.kubernetes.io/name: ingress-nginx
  56
      app.kubernetes.io/part-of: ingress-nginx
  57
  rules:
  58
    - apiGroups:
  59
        - ""
  60
      resources:
  61
        - configmaps
  62
        - endpoints
  63
        - nodes
  64
        - pods
  65
        - secrets
  66
      verbs:
  67
        - list
  68
        - watch
  69
    - apiGroups:
  70
        - ""
  71
      resources:
  72
        - nodes
  73
      verbs:
  74
        - get
  75
    - apiGroups:
  76
        - ""
  77
      resources:
  78
        - services
  79
      verbs:
  80
        - get
  81
        - list
  82
        - watch
  83
    - apiGroups:
  84
        - "extensions"
  85
      resources:
  86
        - ingresses
  87
      verbs:
  88
        - get
  89
        - list
  90
        - watch
  91
    - apiGroups:
  92
        - ""
  93
      resources:
  94
        - events
  95
      verbs:
  96
        - create
  97
        - patch
  98
    - apiGroups:
  99
        - "extensions"
  100
      resources:
  101
        - ingresses/status
  102
      verbs:
  103
        - update
  104
  
  105
  ---
  106
  apiVersion: rbac.authorization.k8s.io/v1beta1
  107
  kind: Role
  108
  metadata:
  109
    name: nginx-ingress-role
  110
    namespace: ingress-nginx
  111
    labels:
  112
      app.kubernetes.io/name: ingress-nginx
  113
      app.kubernetes.io/part-of: ingress-nginx
  114
  rules:
  115
    - apiGroups:
  116
        - ""
  117
      resources:
  118
        - configmaps
  119
        - pods
  120
        - secrets
  121
        - namespaces
  122
      verbs:
  123
        - get
  124
    - apiGroups:
  125
        - ""
  126
      resources:
  127
        - configmaps
  128
      resourceNames:
  129
        # Defaults to "<election-id>-<ingress-class>"
  130
        # Here: "<ingress-controller-leader>-<nginx>"
  131
        # This has to be adapted if you change either parameter
  132
        # when launching the nginx-ingress-controller.
  133
        - "ingress-controller-leader-nginx"
  134
      verbs:
  135
        - get
  136
        - update
  137
    - apiGroups:
  138
        - ""
  139
      resources:
  140
        - configmaps
  141
      verbs:
  142
        - create
  143
    - apiGroups:
  144
        - ""
  145
      resources:
  146
        - endpoints
  147
      verbs:
  148
        - get
  149
  
  150
  ---
  151
  apiVersion: rbac.authorization.k8s.io/v1beta1
  152
  kind: RoleBinding
  153
  metadata:
  154
    name: nginx-ingress-role-nisa-binding
  155
    namespace: ingress-nginx
  156
    labels:
  157
      app.kubernetes.io/name: ingress-nginx
  158
      app.kubernetes.io/part-of: ingress-nginx
  159
  roleRef:
  160
    apiGroup: rbac.authorization.k8s.io
  161
    kind: Role
  162
    name: nginx-ingress-role
  163
  subjects:
  164
    - kind: ServiceAccount
  165
      name: nginx-ingress-serviceaccount
  166
      namespace: ingress-nginx
  167
  
  168
  ---
  169
  apiVersion: rbac.authorization.k8s.io/v1beta1
  170
  kind: ClusterRoleBinding
  171
  metadata:
  172
    name: nginx-ingress-clusterrole-nisa-binding
  173
    labels:
  174
      app.kubernetes.io/name: ingress-nginx
  175
      app.kubernetes.io/part-of: ingress-nginx
  176
  roleRef:
  177
    apiGroup: rbac.authorization.k8s.io
  178
    kind: ClusterRole
  179
    name: nginx-ingress-clusterrole
  180
  subjects:
  181
    - kind: ServiceAccount
  182
      name: nginx-ingress-serviceaccount
  183
      namespace: ingress-nginx
  184
  
  185
  ---
  186
  apiVersion: apps/v1
  187
  kind: DaemonSet
  188
  metadata:
  189
    name: nginx-ingress-controller
  190
    namespace: ingress-nginx
  191
    labels:
  192
      app.kubernetes.io/name: ingress-nginx
  193
      app.kubernetes.io/part-of: ingress-nginx
  194
  spec:
  195
    selector:
  196
      matchLabels:
  197
        app.kubernetes.io/name: ingress-nginx
  198
        app.kubernetes.io/part-of: ingress-nginx
  199
    template:
  200
      metadata:
  201
        labels:
  202
          app.kubernetes.io/name: ingress-nginx
  203
          app.kubernetes.io/part-of: ingress-nginx
  204
        annotations:
  205
          prometheus.io/port: "10254"
  206
          prometheus.io/scrape: "true"
  207
      spec:
  208
        hostNetwork: true
  209
        serviceAccountName: nginx-ingress-serviceaccount
  210
        containers:
  211
          - name: nginx-ingress-controller
  212
            image: siriuszg/nginx-ingress-controller:0.20.0
  213
            args:
  214
              - /nginx-ingress-controller
  215
              - --configmap=$(POD_NAMESPACE)/nginx-configuration
  216
              - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
  217
              - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
  218
              - --publish-service=$(POD_NAMESPACE)/ingress-nginx
  219
              - --annotations-prefix=nginx.ingress.kubernetes.io
  220
            securityContext:
  221
              allowPrivilegeEscalation: true
  222
              capabilities:
  223
                drop:
  224
                  - ALL
  225
                add:
  226
                  - NET_BIND_SERVICE
  227
              # www-data -> 33
  228
              runAsUser: 33
  229
            env:
  230
              - name: POD_NAME
  231
                valueFrom:
  232
                  fieldRef:
  233
                    fieldPath: metadata.name
  234
              - name: POD_NAMESPACE
  235
                valueFrom:
  236
                  fieldRef:
  237
                    fieldPath: metadata.namespace
  238
            ports:
  239
              - name: http
  240
                containerPort: 80
  241
              - name: https
  242
                containerPort: 443
  243
            livenessProbe:
  244
              failureThreshold: 3
  245
              httpGet:
  246
                path: /healthz
  247
                port: 10254
  248
                scheme: HTTP
  249
              initialDelaySeconds: 10
  250
              periodSeconds: 10
  251
              successThreshold: 1
  252
              timeoutSeconds: 10
  253
            readinessProbe:
  254
              failureThreshold: 3
  255
              httpGet:
  256
                path: /healthz
  257
                port: 10254
  258
                scheme: HTTP
  259
              periodSeconds: 10
  260
              successThreshold: 1
  261
              timeoutSeconds: 10
  262
  
  263
  ---
  264
  apiVersion: v1
  265
  kind: Service
  266
  metadata:
  267
    name: ingress-nginx
  268
    namespace: ingress-nginx
  269
  spec:
  270
    #type: NodePort
  271
    ports:
  272
      - name: http
  273
        port: 80
  274
        targetPort: 80
  275
        protocol: TCP
  276
      - name: https
  277
        port: 443
  278
        targetPort: 443
  279
        protocol: TCP
  280
    selector:
  281
      app.kubernetes.io/name: ingress-nginx
  282
      app.kubernetes.io/part-of: ingress-nginx

  展开收起

• 部署

  1
  kubectl apply -f ingress-controller.yaml

• 查看

  1
  kubectl get pods --all-namespaces

  

  ​

  

4.暴露一个ingress服务 使项目(tomcat8)支持域名访问#

• 准备ingress-tomcat8.yaml

  servicePort: 80 是之前pods的端口

  1
  apiVersion: extensions/v1beta1
  2
  kind: Ingress
  3
  metadata:
  4
    name: web
  5
  spec:
  6
    rules:
  7
    - host: example.tianch.com
  8
      http:
  9
        paths:
  10
          - backend:
  11
              serviceName: tomcat8
  12
              servicePort: 80

• 部署

  1
  kubectl apply -f ingress-tomcat8.yaml

• 修改本地hosts文件

  1
  172.16.10.68  example.tianch.com

• 访问测试 自行测试