目录
1.什么是service
2.pod和service关系
3.常用的service类型
4.service总结
5.ingress跟pod之间的关系
6.ingress工作流程
7.使用ingress
7.1.部署ingress controller
7.2.创建ingress规则
7.3.在windows系统hosts文件中添加域名访问规则
1) 定义一组pod的访问规则
2) 防止pod失联(服务发现),pod的重新创建,滚动升级等操作时,pod的ip地址会发生改变,因此,每一个pod的ip发生变化的时候,都会注册到service中,进行服务发现
3) 定义一组pod访问策略(负载均衡)
根据label和selector标签建立关联
通过service实现pod的负载均衡,service存在一个虚拟IP,外界通过service的虚拟IP访问pod
ClusterIP,NodePort,LoadBalancer
1)ClusterIP:集群内部使用(默认)
2)NodePort:对外访问应用使用
3)LoadBalancer:对外访问应用使用,公有云中的对外访问
1.把端口对外暴露,通过ip+端口号进行访问 (使用Service里面的NodePort实现)
2.NodePort缺陷:
在每个节点上都会起到端口,在访问的时候通过任意节点,通过节点ip+暴露端口号实现访问,这就意味着每个端口只能使用一次,一个端口对应一个应用,实际访问都是用域名,根据不同域名跳转到不同端口服务中,这里就用到了ingress了。
pod和ingress通过service关联的,ingress作为统一入口,由service关联一组pod
如图所示:
ingress维护很多域名,每个域名访问不同的service,每个service维护一组pod
ingress不是k8s内置的,需要单独安装插件进行部署
Ingress也是一个Controller控制器,不是官方k8s内置的,需要安装插件
这里就选择官方推荐的nginx控制器来实现部署Ingress
1.使用ingress对外暴露应用,这里用nginx举例,下面都是前期的准备工作
//创建pod
kubectl create deployment web --image=nginx
//创建service,暴露应用
kubectl expose deployment web --port=80 --target-port=80 --type=NodePort
//查看service
kubectl get svc
2.再加一层ingress应用,部署ingress controller
ingress-controller.yaml的内容如下:
apiVersion: v1
kind: Namespace
metadata:
name: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kind: ConfigMap
apiVersion: v1
metadata:
name: nginx-configuration
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kind: ConfigMap
apiVersion: v1
metadata:
name: tcp-services
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kind: ConfigMap
apiVersion: v1
metadata:
name: udp-services
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: nginx-ingress-clusterrole
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
- secrets
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- "extensions"
- "networking.k8s.io"
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- "extensions"
- "networking.k8s.io"
resources:
- ingresses/status
verbs:
- update
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
name: nginx-ingress-role
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- configmaps
resourceNames:
# Defaults to "-"
# Here: "-"
# This has to be adapted if you change either parameter
# when launching the nginx-ingress-controller.
- "ingress-controller-leader-nginx"
verbs:
- get
- update
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- apiGroups:
- ""
resources:
- endpoints
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: nginx-ingress-role-nisa-binding
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: nginx-ingress-role
subjects:
- kind: ServiceAccount
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: nginx-ingress-clusterrole-nisa-binding
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: nginx-ingress-clusterrole
subjects:
- kind: ServiceAccount
name: nginx-ingress-serviceaccount
namespace: ingress-nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-ingress-controller
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
template:
metadata:
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
annotations:
prometheus.io/port: "10254"
prometheus.io/scrape: "true"
spec:
hostNetwork: true
# wait up to five minutes for the drain of connections
terminationGracePeriodSeconds: 300
serviceAccountName: nginx-ingress-serviceaccount
nodeSelector:
kubernetes.io/os: linux
containers:
- name: nginx-ingress-controller
image: lizhenliang/nginx-ingress-controller:0.30.0
args:
- /nginx-ingress-controller
- --configmap=$(POD_NAMESPACE)/nginx-configuration
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
- --publish-service=$(POD_NAMESPACE)/ingress-nginx
- --annotations-prefix=nginx.ingress.kubernetes.io
securityContext:
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
# www-data -> 101
runAsUser: 101
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
ports:
- name: http
containerPort: 80
protocol: TCP
- name: https
containerPort: 443
protocol: TCP
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
---
apiVersion: v1
kind: LimitRange
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
limits:
- min:
memory: 90Mi
cpu: 100m
type: Container
其中注意:hostNetwork: true,不然访问不到
//创建ingress
kubectl apply -f ingress-con.yaml
//查看ingress controller的状态
kubectl get pods -n ingress-nginx
需要创建ingress的规则,包括service的名称和端口
ingress-http.yaml文件内容如下:
可以配置多个service,注意serviceName跟servicePort的值跟service匹配
kubectl apply -f ingress-http.yaml
kubectl get pods -n ingress-nginx -o wide
//查看当前监听的端口
netstat -antp | grep 80
netstat -antp | grep 443
目录:C:\Windows\System32\drivers\etc
在文件hosts中增加,其中ip是ingress部署到的物理机节点ip
kubectl get svc
kubectl get ing
效果如图所示
上一章:kubernetes集群核心技术---Controller(Deployment)(五)
https://blog.csdn.net/weixin_42211693/article/details/115230592
下一章:kubernetes集群核心技术---Controller(StatefulSet,DaemonSet,Job和Cronjob)(七)
https://blog.csdn.net/weixin_42211693/article/details/115249687