kubernetes系列09—Ingress控制器詳解

本文收錄在容器技術學習系列文章總目錄

1、認識Ingress

1.1 什么是Ingress？

　　通常情況下，service和pod僅可在集群內部網絡中通過IP地址訪問。所有到達邊界路由器的流量或被丟棄或被轉發到其他地方。從概念上講，可能像下面這樣：

    internet
        |
  ------------
  [ Services ]

Ingress是授權入站連接到達集群服務的規則集合。

    internet
        |
   [ Ingress ]
   --|-----|--
   [ Services ]

　　你可以給Ingress配置提供外部可訪問的URL、負載均衡、SSL、基於名稱的虛擬主機等。用戶通過POST Ingress資源到API server的方式來請求ingress。 Ingress controller負責實現Ingress，通常使用負載平衡器，它還可以配置邊界路由和其他前端，這有助於以HA方式處理流量。

 

1.2 Ingress工作示意圖

 

1.3先決條件

　　在使用Ingress resource之前，有必要先了解下面幾件事情。Ingress是beta版本的resource，在kubernetes1.1之前還沒有。你需要一個Ingress Controller來實現Ingress，單純的創建一個Ingress沒有任何意義。

　　GCE/GKE會在master節點上部署一個ingress controller。你可以在一個pod中部署任意個自定義的ingress controller。你必須正確地annotate每個ingress，比如 運行多個ingress controller 和 關閉glbc.

　　確定你已經閱讀了Ingress controller的beta版本限制。在非GCE/GKE的環境中，你需要在pod中部署一個controller。

 

1.4 Ingress定義資源清單幾個字段

•  apiVersion： v1  版本
•  kind： Ingress  類型
•  metadata  元數據
•  spec  期望狀態
  •  backend： 默認后端，能夠處理與任何規則不匹配的請求
  •  rules：用於配置Ingress的主機規則列表
  •  tls：目前Ingress僅支持單個TLS端口443
•  status  當前狀態

 

2、部署一個Ingress

（1）在gitlab上下載yaml文件，並創建部署

gitlab ingress-nginx項目：https://github.com/kubernetes/ingress-nginx

ingress安裝指南：https://kubernetes.github.io/ingress-nginx/deploy/

因為需要拉取鏡像，所以需要等一段時間

---下載需要的yaml文件
[root@master ingress-nginx]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
---查詢下載成功
[root@master ingress-nginx]# ls
mandatory.yaml
---創建ingress
[root@master ingress-nginx]# kubectl apply -f mandatory.yaml 
namespace/ingress-nginx created
configmap/nginx-configuration created
configmap/tcp-services created
configmap/udp-services created
serviceaccount/nginx-ingress-serviceaccount created
clusterrole.rbac.authorization.k8s.io/nginx-ingress-clusterrole created
role.rbac.authorization.k8s.io/nginx-ingress-role created
rolebinding.rbac.authorization.k8s.io/nginx-ingress-role-nisa-binding created
clusterrolebinding.rbac.authorization.k8s.io/nginx-ingress-clusterrole-nisa-binding created
deployment.apps/nginx-ingress-controller created

　　

（2）如果是裸機，還需要安裝service

[root@master ingress-nginx]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/baremetal/service-nodeport.yaml
[root@master ingress-nginx]# kubectl apply -f service-nodeport.yaml 
service/ingress-nginx created

　　

（3）驗證

---查詢生產的pod
[root@master ~]# kubectl get pods -n ingress-nginx
NAME                                        READY     STATUS    RESTARTS   AGE
nginx-ingress-controller-648c7bb65b-df9qz   1/1       Running   0          34m
---查詢生產的svc
[root@master ingress-nginx]# kubectl get svc -n ingress-nginx
NAME            TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx   NodePort   10.109.244.123   <none>        80:30080/TCP,443:30443/TCP   21s
---查詢svc的詳細信息
[root@master ~]# kubectl describe svc ingress-nginx -n ingress-nginx
Name:                     ingress-nginx
Namespace:                ingress-nginx
Labels:                   app.kubernetes.io/name=ingress-nginx
                          app.kubernetes.io/part-of=ingress-nginx
Annotations:              kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"app.kubernetes.io/name":"ingress-nginx","app.kubernetes.io/part-of":"ingres...
Selector:                 app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx
Type:                     NodePort
IP:                       10.111.143.90
Port:                     http  80/TCP
TargetPort:               80/TCP
NodePort:                 http  30080/TCP
Endpoints:                10.244.1.104:80
Port:                     https  443/TCP
TargetPort:               443/TCP
NodePort:                 https  30443/TCP
Endpoints:                10.244.1.104:443
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

　　

3、創建Ingress，代理到后端nginx服務

3.1 准備后端pod和service

（1）編寫yaml文件，並創建

創建3個nginx服務的pod，並創建一個service綁定

[root@master ingress]# vim deploy-damo.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: default
spec:
  selector:
    app: myapp
    release: canary
  ports:
  - name: http
    targetPort: 80
    port: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deploy
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      release: canary
  template:
    metadata:
      labels:
        app: myapp
        release: canary
    spec:
      containers:
      - name: myapp
        image: ikubernetes/myapp:v2
        ports:
        - name: http
          containerPort: 80
[root@master ingress]# kubectl apply -f deploy-damo.yaml 
service/myapp created
deployment.apps/myapp-deploy created

　　

（2）查詢驗證

[root@master ~]# kubectl get svc
NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP   146d
myapp        ClusterIP   10.103.137.126   <none>        80/TCP    6s
[root@master ~]# kubectl get pods
NAME                            READY     STATUS    RESTARTS   AGE
myapp-deploy-67f6f6b4dc-2vzjn   1/1       Running   0          14s
myapp-deploy-67f6f6b4dc-c7f76   1/1       Running   0          14s
myapp-deploy-67f6f6b4dc-x79hc   1/1       Running   0          14s
[root@master ~]# kubectl describe svc myapp
Name:              myapp
Namespace:         default
Labels:            <none>
Annotations:       kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"myapp","namespace":"default"},"spec":{"ports":[{"name":"http","port":80,"targe...
Selector:          app=myapp,release=canary
Type:              ClusterIP
IP:                10.103.137.126
Port:              http  80/TCP
TargetPort:        80/TCP
Endpoints:         10.244.1.102:80,10.244.1.103:80,10.244.2.109:80
Session Affinity:  None
Events:            <none>

　　

3.2 創建ingress，綁定后端nginx服務

（1）編寫yaml文件，並創建

[root@master ingress]# vim ingress-myapp.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-myapp
  namespace: default
spec:
  rules:
  - host: myapp.along.com
    http:
      paths:
      - path:
        backend:
          serviceName: myapp
          servicePort: 80
[root@master ingress]# kubectl apply -f ingress-myapp.yaml
ingress.extensions/ingress-myapp created

　　

（2）查詢驗證

[root@master ~]# kubectl get ingress
NAME            HOSTS             ADDRESS   PORTS     AGE
ingress-myapp   myapp.along.com             80        140d
[root@master ~]# kubectl describe ingress ingress-myapp
Name:             ingress-myapp
Namespace:        default
Address:          
Default backend:  default-http-backend:80 (<none>)
Rules:
  Host             Path  Backends
  ----             ----  --------
  myapp.along.com  
                      myapp:80 (<none>)
Annotations:
  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-myapp","namespace":"default"},"spec":{"rules":[{"host":"myapp.along.com","http":{"paths":[{"backend":{"serviceName":"myapp","servicePort":80},"path":null}]}}]}}

Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  CREATE  37s   nginx-ingress-controller  Ingress default/ingress-myapp

　　

（3）在集群外，查詢服務驗證

① 可以先修改一下主機的hosts，因為不是公網域名

192.168.130.103 myapp.along.com

② 訪問業務成功

 

4、創建Ingress，代理到后端tomcat服務

4.1 准備后端pod和service

（1）編寫yaml文件，並創建

創建3個tomcat服務的pod，並創建一個service綁定

[root@master ingress]# vim tomcat-deploy.yaml 
apiVersion: v1
kind: Service
metadata:
  name: tomcat
  namespace: default
spec:
  selector:
    app: tomcat
    release: canary
  ports:
  - name: http
    targetPort: 8080
    port: 8080
  - name: ajp
    targetPort: 8009
    port: 8009
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-deploy
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: tomcat
      release: canary
  template:
    metadata:
      labels:
        app: tomcat
        release: canary
    spec:
      containers:
      - name: tomcat
        image: tomcat:8.5.37-jre8-alpine
        ports:
        - name: http
          containerPort: 8080
        - name: ajp
          containerPort: 8009
[root@master ingress]# kubectl apply -f tomcat-deploy.yaml 
service/tomcat created
deployment.apps/tomcat-deploy created

　　

（2）查詢驗證

[root@master ~]# kubectl get pods
NAME                            READY     STATUS    RESTARTS   AGE
tomcat-deploy-97d6458c5-hrmrw   1/1       Running   0          1m
tomcat-deploy-97d6458c5-ngxxx   1/1       Running   0          1m
tomcat-deploy-97d6458c5-xchgn   1/1       Running   0          1m
[root@master ~]# kubectl get svc
NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP             146d
tomcat       ClusterIP   10.98.193.252    <none>        8080/TCP,8009/TCP   1m

　　

4.2 創建ingress，綁定后端tomcat服務

（1）編寫yaml文件，並創建

[root@master ingress]# vim ingress-tomcat.yaml 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-tomcat
  namespace: default
spec:
  rules:
  - host: tomcat.along.com
    http:
      paths:
      - path:
        backend:
          serviceName: tomcat
          servicePort: 8080
[root@master ingress]# kubectl apply -f ingress-tomcat.yaml 
ingress.extensions/ingress-tomcat created

 

（2）查詢驗證

[root@master ~]# kubectl get ingress
NAME             HOSTS              ADDRESS   PORTS     AGE
ingress-myapp    myapp.along.com              80        17m
ingress-tomcat   tomcat.along.com             80        6s
[root@master ~]# kubectl describe ingress ingress-tomcat
Name:             ingress-tomcat
Namespace:        default
Address:          
Default backend:  default-http-backend:80 (<none>)
Rules:
  Host              Path  Backends
  ----              ----  --------
  tomcat.along.com  
                       tomcat:8080 (<none>)
Annotations:
  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-tomcat","namespace":"default"},"spec":{"rules":[{"host":"tomcat.along.com","http":{"paths":[{"backend":{"serviceName":"tomcat","servicePort":8080},"path":null}]}}]}}

Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  CREATE  17s   nginx-ingress-controller  Ingress default/ingress-tomcat

　　

（3）在集群外，查詢服務驗證

① 可以先修改一下主機的hosts，因為不是公網域名

192.168.130.103 tomcat.along.com

② 訪問業務成功

 

4.3 使用https協議訪問服務

4.3.1 創建證書、私鑰和secret

（1）創建私鑰

[root@master ingress]# openssl genrsa -out tls.key 2048
Generating RSA private key, 2048 bit long modulus
.............................................+++
...............+++
e is 65537 (0x10001)
[root@master ingress]# ls *key
tls.key

　　

（2）創建證書

[root@master ingress]# openssl req -new -x509 -key tls.key -out tls.crt -subj /C=CN/ST=Beijing/L=Beijing/O=DevOps/CN=tomcat.along.com
[root@master ingress]# ls tls.*
tls.crt  tls.key

　　

（3）創建secret

[root@master ingress]# kubectl create secret tls tomcat-ingress-secret --cert=tls.crt --key=tls.key
secret/tomcat-ingress-secret created
[root@master ingress]# kubectl get secret
NAME                              TYPE                                  DATA      AGE
tomcat-ingress-secret             kubernetes.io/tls                     2         8s
[root@master ingress]# kubectl describe secret tomcat-ingress-secret
Name:         tomcat-ingress-secret
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/tls

Data
====
tls.key:  1675 bytes
tls.crt:  1294 bytes

　　

4.3.2 重新創建ingress，使用https協議綁定后端tomcat服務

（1）編寫yaml文件，並創建

[root@master ingress]# vim ingress-tomcat-tls.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-tomcat-tls
  namespace: default
spec:
  tls:
  - hosts:
    - tomcat.along.com
    secretName: tomcat-ingress-secret
  rules:
  - host: tomcat.along.com
    http:
      paths:
      - path:
        backend:
          serviceName: tomcat
          servicePort: 8080

　　

（2）查詢驗證

[root@master ~]# kubectl get ingress
NAME                 HOSTS              ADDRESS   PORTS     AGE
ingress-myapp        myapp.along.com              80        34m
ingress-tomcat       tomcat.along.com             80        16m
ingress-tomcat-tls   tomcat.along.com             80, 443   8s
[root@master ~]# kubectl describe ingress ingress-tomcat-tls
Name:             ingress-tomcat-tls
Namespace:        default
Address:          
Default backend:  default-http-backend:80 (<none>)
TLS:
  tomcat-ingress-secret terminates tomcat.along.com
Rules:
  Host              Path  Backends
  ----              ----  --------
  tomcat.along.com  
                       tomcat:8080 (<none>)
Annotations:
  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-tomcat-tls","namespace":"default"},"spec":{"rules":[{"host":"tomcat.along.com","http":{"paths":[{"backend":{"serviceName":"tomcat","servicePort":8080},"path":null}]}}],"tls":[{"hosts":["tomcat.along.com"],"secretName":"tomcat-ingress-secret"}]}}

Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  CREATE  14s   nginx-ingress-controller  Ingress default/ingress-tomcat-tls

　　

（3）在集群外，查詢服務驗證

使用https協議，訪問業務成功