k8s部署ingress-nginx以及配置http/https访问

ingress概述:

Ingress代理并不是pod的service,而是pod,之所以在配置的时候是配置的service,是为了通过service来获取所有pod的信息

ingress-nginx组成:

1)反向代理负载均衡器:通常以service的port方式运行,接收并按照ingress定义的规则进行转发,常用的有nginx,Haproxy,Traefik等

2)ingress-nginx-Controller:
监听APIServer,根据用户编写的ingress规则(编写ingress的yaml文件),动态地去更改nginx服务的配置文件,并且reload重载使其生效,此过程是自动化的(通过lua脚本来实现)。

3)Ingress:将nginx的配置抽象成一个Ingress对象,当用户每添加一个新的服务,只需要编写一个新的ingress的yaml文件即可。

ingress-nginx的工作原理:

1)ingress controller通过和kubernetes api交互,动态的去感知集群中ingress规则变化。

2)然后读取它,按照自定义的规则,规则就是写明了那个域名对应哪个service,生成一段nginx配置。

3)在写到nginx-ingress-controller的pod里,这个Ingress controller的pod里运行着一个Nginx服务,控制器会把生成的nginx配置写入/etc/nginx.conf文件中。
4)然后reload一下使配置生效,以此达到分配和动态更新问题。

ingress-nginx部署:

DaemonSet+HostNetwork+nodeSelector:
用DaemonSet结合nodeselector来部署ingress-controller到特定的node上,然后使用HostNetwork直接把该pod与宿主机node的网络打通,直接使用宿主机的80/433端口就能访问服务。

给node1以及node2打标签

kubectl label nodes node1 ingress-nginx=true 

kubectl label nodes node2 ingress-nginx=true 

#查看node标签:

kubectl get nodes –show-labels 

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.46.0/deploy/static/provider/baremetal/deploy.yaml


kind: DaemonSet
template:
    spec:
       hostNetwork: true
       nodeSelector:   
           ingress-nginx: "true"

测试:

1、创建后端服务:

[root@master1 ingress-nginx]# cat nginx-app.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
    labels:
      app: nginx
  spec:
    containers:
      - name: nginx
        image: nginx
        ports:
     - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-app-svc
spec:
  type: ClusterIP
  ports:
    - protocol: TCP
      port: 80
  targetPort: 80
    selector:
      app: nginx

2、创建ingress规则:

[root@master1 ingress-nginx]# cat ingress-nginx.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: test-ingress
spec:
  rules:
  - host: test.myapp.com
    http:
paths:
  - path: /
    backend:
      serviceName: nginx-app-svc
      servicePort: 80

3、测试验证:

配置hosts: 10.5.77.58或者10.5.77.59
k8s部署ingress-nginx以及配置http/https访问_第1张图片

ingress配置https访问:

1、创建证书存放目录:

mkdir cert && cd cert

2、生成私钥nginx.key

[root@master1 cert]# openssl genrsa -out nginx.key 2048
Generating RSA private key, 2048 bit long modulus
.......+++
..................+++
e is 65537 (0x10001)

3、使用nginx.key生成自签证书

[root@master1 cert]# openssl req -new -x509 -key nginx.key -days 10000 -out nginx.crt -subj /C=CN/ST=Shanghai/L=Shanghai/O=DevOps/CN=ingressnginx.com

4、创建secret:

[root@master1 cert]# kubectl create secret tls ingress-nginx-secret --cert=nginx.crt --key=nginx.key
secret/ingress-nginx-secret created


[root@master1 cert]# kubectl get secret
NAME                            TYPE                      DATA           AGE
ingress-nginx-secret      kubernetes.io/tls     2                 8s


[root@master1 cert]# kubectl describe secret ingress-nginx-secret
Name: ingress-nginx-secret
Namespace: default
Labels: 
Annotations: 

Type: kubernetes.io/tls

Data
====
tls.crt: 1298 bytes
tls.key: 1679 bytes

5、创建ingress规则:

[root@master1 ingress-nginx]# cat ingress-nginx.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: test-ingress
spec:
tls:
- hosts:
- test.myapp.com
secretName: ingress-nginx-secret
rules:
- host: test.myapp.com
http:
paths:
- path: /
backend:
serviceName: nginx-app-svc
servicePort: 80

6、测试验证:
k8s部署ingress-nginx以及配置http/https访问_第2张图片

你可能感兴趣的:(k8s从入门到放弃,redis,数据库,缓存)