1.Ingress概述
- Ingress 是對集群中服務的外部訪問進行管理的 API 對象，典型的訪問方式是 HTTP和HTTPS。
- Ingress 可以提供負載均衡、SSL 和基於名稱的虛擬托管。
- 必須具有 ingress 控制器【例如 ingress-nginx】才能滿足 Ingress 的要求。僅創建 Ingress 資源無效。
1.1Ingress 是什么
Ingress 公開了從集群外部到集群內 services 的 HTTP 和 HTTPS 路由。 流量路由由 Ingress 資源上定義的規則控制。
1 internet 2 | 3 [ Ingress ] 4 --|-----|-- 5 [ Services ]
可以將 Ingress 配置為提供服務外部可訪問的 URL、負載均衡流量、 SSL / TLS，以及提供基於名稱的虛擬主機。Ingress 控制器 通常負責通過負載均衡器來實現 Ingress，盡管它也可以配置邊緣路由器或其他前端來幫助處理流量。
Ingress 不會公開任意端口或協議。若將 HTTP 和 HTTPS 以外的服務公開到 Internet 時，通常使用 Service.Type=NodePort 或者 Service.Type=LoadBalancer 類型的服務。
以Nginx Ingress為例，圖如下
2.Ingress示例
2.1架構圖
2.2部署Ingress-Nginx
1）鏡像下載與重命名
docker pull registry.cn-beijing.aliyuncs.com/google_registry/nginx-ingress-controller:0.30.0 docker tag 89ccad40ce8e quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0 docker rmi registry.cn-beijing.aliyuncs.com/google_registry/nginx-ingress-controller:0.30.0
2）ingress-nginx的yaml文件修改后並啟動
# 當前目錄 [root@k8s-master ingress]# pwd /root/k8s_practice/ingress # 獲取NGINX: 0.30.0 [root@k8s-master ingress]# wget https://github.com/kubernetes/ingress-nginx/archive/nginx-0.30.0.tar.gz [root@k8s-master ingress]# tar xf nginx-0.30.0.tar.gz # yaml文件在下載包中的位置：ingress-nginx-nginx-0.30.0/deploy/static/mandatory.yaml [root@k8s-master ingress]# cp -a ingress-nginx-nginx-0.30.0/deploy/static/mandatory.yaml ./ [root@k8s-master ingress]# # yaml文件配置修改 [root@k8s-master ingress]# vim mandatory.yaml ……………… apiVersion: apps/v1 kind: DaemonSet # 從Deployment改為DaemonSet metadata: name: nginx-ingress-controller namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: #replicas: 1 # 注釋掉 ……………… nodeSelector: kubernetes.io/hostname: k8s-master # 修改處 # 如下幾行為新加行 作用【允許在master節點運行】 tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule ……………… ports: - name: http containerPort: 80 hostPort: 80 # 添加處【可在宿主機通過該端口訪問Pod】 protocol: TCP - name: https containerPort: 443 hostPort: 443 # 添加處【可在宿主機通過該端口訪問Pod】 protocol: TCP ……………… [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl apply -f mandatory.yaml namespace/ingress-nginx created configmap/nginx-configuration created configmap/tcp-services created configmap/udp-services created serviceaccount/nginx-ingress-serviceaccount created clusterrole.rbac.authorization.k8s.io/nginx-ingress-clusterrole created role.rbac.authorization.k8s.io/nginx-ingress-role created rolebinding.rbac.authorization.k8s.io/nginx-ingress-role-nisa-binding created clusterrolebinding.rbac.authorization.k8s.io/nginx-ingress-clusterrole-nisa-binding created daemonset.apps/nginx-ingress-controller created limitrange/ingress-nginx created [root@k8s-master ingress]# kubectl get ds -n ingress-nginx -o wide NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE CONTAINERS IMAGES SELECTOR nginx-ingress-controller 1 1 1 1 1 kubernetes.io/hostname=k8s-master 9m47s nginx-ingress-controller quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0 app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get pod -n ingress-nginx -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES nginx-ingress-controller-rrbh9 1/1 Running 0 9m55s 10.244.0.46 k8s-master <none> <none>
2.3deply_service1的yaml信息
1）yaml文件
[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat deply_service1.yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp-deploy1 namespace: default spec: replicas: 3 selector: matchLabels: app: myapp release: v1 template: metadata: labels: app: myapp release: v1 env: test spec: containers: - name: myapp image: registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: myapp-clusterip1 namespace: default spec: type: ClusterIP # 默認類型 selector: app: myapp release: v1 ports: - name: http port: 80 targetPort: 80
2）啟動Deployment和Service
[root@k8s-master ingress]# kubectl apply -f deply_service1.yaml deployment.apps/myapp-deploy1 created service/myapp-clusterip1 created
3）查看Deploy狀態和信息
[root@k8s-master ingress]# kubectl get deploy,rs,po -o wide --show-labels NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR LABELS deployment.apps/myapp-deploy1 3/3 3 3 2m47s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1 app=myapp,release=v1 <none> NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR LABELS replicaset.apps/myapp-deploy1-6c468d6b6c 3 3 3 2m47s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1 app=myapp,pod-template-hash=6c468d6b6c,release=v1 app=myapp,env=test,pod-template-hash=6c468d6b6c,release=v1 NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS pod/myapp-deploy1-6c468d6b6c-fbcln 1/1 Running 0 2m47s 10.244.2.5 k8s-node2 <none> <none> app=myapp,env=test,pod-template-hash=6c468d6b6c,release=v1 pod/myapp-deploy1-6c468d6b6c-shz6z 1/1 Running 0 2m47s 10.244.2.6 k8s-node2 <none> <none> app=myapp,env=test,pod-template-hash=6c468d6b6c,release=v1 pod/myapp-deploy1-6c468d6b6c-zqn7b 1/1 Running 0 2m47s 10.244.1.6 k8s-node1 <none> <none> app=myapp,env=test,pod-template-hash=6c468d6b6c,release=v1
4）curl訪問pod
[root@k8s-master ingress]# curl 10.244.2.5 Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a> [root@k8s-master ingress]# curl 10.244.2.6 Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a> [root@k8s-master ingress]# curl 10.244.1.6 Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
5）查看Service狀態和信息
1 [root@k8s-master ingress]# kubectl get svc -o wide 2 NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR 3 kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 19d <none> 4 myapp-clusterip1 ClusterIP 10.104.146.14 <none> 80/TCP 5m38s app=myapp,release=v1
6）curl訪問svc
[root@k8s-master ingress]# kubectl get svc -o wide NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 6h48m <none> myapp-clusterip1 ClusterIP 10.103.139.138 <none> 80/TCP 4m9s app=myapp,release=v1 [root@k8s-master ingress]# curl 10.103.139.138 Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a> [root@k8s-master ingress]# curl 10.103.139.138/hostname.html myapp-deploy1-6c468d6b6c-shz6z [root@k8s-master ingress]# curl 10.103.139.138/hostname.html myapp-deploy1-6c468d6b6c-zqn7b [root@k8s-master ingress]# curl 10.103.139.138/hostname.html myapp-deploy1-6c468d6b6c-fbcln
2.4deply_service2的yaml信息
1）yaml文件
[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat deply_service2.yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp-deploy2 namespace: default spec: replicas: 3 selector: matchLabels: app: myapp release: v2 template: metadata: labels: app: myapp release: v2 env: test spec: containers: - name: myapp image: registry.cn-beijing.aliyuncs.com/google_registry/myapp:v2 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: myapp-clusterip2 namespace: default spec: type: ClusterIP # 默認類型 selector: app: myapp release: v2 ports: - name: http port: 80 targetPort: 80
2）啟動Deployment和Service
[root@k8s-master ingress]# kubectl apply -f deply_service2.yaml deployment.apps/myapp-deploy2 created service/myapp-clusterip2 created
3）查看Deploy狀態和信息
[root@k8s-master ingress]# kubectl get deploy,rs,po -o wide --show-labels -l "release=v2" NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR LABELS replicaset.apps/myapp-deploy2-5fffdcccd5 3 3 3 50s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v2 app=myapp,pod-template-hash=5fffdcccd5,release=v2 app=myapp,env=test,pod-template-hash=5fffdcccd5,release=v2 NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS pod/myapp-deploy2-5fffdcccd5-4qn5c 1/1 Running 0 50s 10.244.2.7 k8s-node2 <none> <none> app=myapp,env=test,pod-template-hash=5fffdcccd5,release=v2 pod/myapp-deploy2-5fffdcccd5-gvcqp 1/1 Running 0 50s 10.244.1.8 k8s-node1 <none> <none> app=myapp,env=test,pod-template-hash=5fffdcccd5,release=v2 pod/myapp-deploy2-5fffdcccd5-pbqqp 1/1 Running 0 50s 10.244.1.7 k8s-node1 <none> <none> app=myapp,env=test,pod-template-hash=5fffdcccd5,release=v2
4）查看Service狀態和信息
[root@k8s-master ingress]# kubectl get svc -o wide NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 6h51m <none> myapp-clusterip1 ClusterIP 10.103.139.138 <none> 80/TCP 7m36s app=myapp,release=v1 myapp-clusterip2 ClusterIP 10.107.114.166 <none> 80/TCP 114s app=myapp,release=v2
5）curl訪問svc
[root@k8s-master ingress]# curl 10.107.114.166 Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a> [root@k8s-master ingress]# curl 10.107.114.166/hostname.html myapp-deploy2-5fffdcccd5-pbqqp [root@k8s-master ingress]# curl 10.107.114.166/hostname.html myapp-deploy2-5fffdcccd5-4qn5c [root@k8s-master ingress]# curl 10.107.114.166/hostname.html myapp-deploy2-5fffdcccd5-gvcqp
2.5Ingress HTTP代理訪問
1）yaml文件【由於自建的service在默認default名稱空間，因此這里也是default名稱空間】
[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat ingress-http.yaml apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: nginx-http namespace: default spec: rules: - host: www.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip1 servicePort: 80 - host: blog.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip2 servicePort: 80
2）啟動ingress http並查看狀態
[root@k8s-master ingress]# kubectl apply -f ingress-http.yaml Warning: networking.k8s.io/v1beta1 Ingress is deprecated in v1.19+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress ingress.networking.k8s.io/nginx-http created [root@k8s-master ingress]# kubectl get ingress -o wide Warning: extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress NAME CLASS HOSTS ADDRESS PORTS AGE nginx-http <none> www.zhangtest.com,blog.zhangtest.com 80 9s
3）查看nginx配置文件
[root@k8s-master ~]# kubectl get pod -A | grep 'ingre' ingress-nginx nginx-ingress-controller-rrbh9 1/1 Running 0 27m [root@k8s-master ~]# [root@k8s-master ~]# kubectl exec -it -n ingress-nginx nginx-ingress-controller-rrbh9 bash bash-5.0$ cat /etc/nginx/nginx.conf ………… ##### 可見server www.zhangtest.com 和 server blog.zhangtest.com的配置
4）hosts文件修改，添加如下信息
[root@k8s-master ingress]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 10.3.104.51 k8s-master 10.3.104.52 k8s-node1 10.3.104.56 k8s-node2 185.199.108.133 raw.githubusercontent.com 10.3.104.51 www.zhangtest.com blog.zhangtest.com [root@k8s-master ingress]# curl www.zhangtest.com Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a> [root@k8s-master ingress]# curl blog.zhangtest.com Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>
2.6Ingress HTTPS代理訪問
1）ssl證書創建
[root@k8s-master cert]# pwd /root/k8s_practice/ingress/cert [root@k8s-master cert]# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/C=CN/ST=BJ/L=BeiJing/O=BTC/OU=MOST/CN=zhang/emailAddress=ca@test.com" Generating a 2048 bit RSA private key ......................................................+++ ........................+++ writing new private key to 'tls.key' ----- [root@k8s-master cert]# kubectl create secret tls tls-secret --key tls.key --cert tls.crt secret/tls-secret created
2）創建ingress https
yaml文件【由於自建的service在默認default名稱空間，因此這里也是default名稱空間】
[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat ingress-https.yaml apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: nginx-https namespace: default spec: tls: - hosts: - www.zhangtest.com - blog.zhangtest.com secretName: tls-secret rules: - host: www.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip1 servicePort: 80 - host: blog.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip2 servicePort: 80
3）啟動ingress https並查看狀態
[root@k8s-master ingress]# kubectl apply -f ingress-https.yaml ingress.networking.k8s.io/nginx-https created [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get ingress -o wide NAME HOSTS ADDRESS PORTS AGE nginx-https www.zhangtest.com,blog.zhangtest.com 80, 443 8s
