Ingress概述
Ingress 是对集群中服务的外部访问进行管理的 API 对象,典型的访问方式是 HTTP和HTTPS。
Ingress 可以提供负载均衡、SSL 和基于名称的虚拟托管。
必须具有 ingress 控制器【例如 ingress-nginx】才能满足 Ingress 的要求。仅创建 Ingress 资源无效。
Ingress 是什么
Ingress 公开了从集群外部到集群内 services 的 HTTP 和 HTTPS 路由。 流量路由由 Ingress 资源上定义的规则控制。
1 internet
2 |
3 [ Ingress ]
4 --|-----|--
5 [ Services ]
可以将 Ingress 配置为提供服务外部可访问的 URL、负载均衡流量、 SSL / TLS,以及提供基于名称的虚拟主机。Ingress 控制器 通常负责通过负载均衡器来实现 Ingress,尽管它也可以配置边缘路由器或其他前端来帮助处理流量。
Ingress 不会公开任意端口或协议。若将 HTTP 和 HTTPS 以外的服务公开到 Internet 时,通常使用 Service.Type=NodePort 或者 Service.Type=LoadBalancer 类型的服务。
以Nginx Ingress为例,图如下
Ingress示例
架构图
部署Ingress-Nginx
该Nginx是经过改造的,而不是传统的Nginx。
Ingress-Nginx官网地址
https://kubernetes.github.io/ingress-nginx/
Ingress-Nginx GitHub地址
https://github.com/kubernetes/ingress-nginx
本次下载版本:nginx-0.30.0
镜像下载与重命名
1 docker pull registry.cn-beijing.aliyuncs.com/google_registry/nginx-ingress-controller:0.30.0
2 docker tag 89ccad40ce8e quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0
3 docker rmi registry.cn-beijing.aliyuncs.com/google_registry/nginx-ingress-controller:0.30.0
ingress-nginx的yaml文件修改后并启动
复制代码
1 # 当前目录
2 [root@k8s-master ingress]# pwd
3 /root/k8s_practice/ingress
4 # 获取NGINX: 0.30.0
5 [root@k8s-master ingress]# wget https://github.com/kubernetes/ingress-nginx/archive/nginx-0.30.0.tar.gz
6 [root@k8s-master ingress]# tar xf nginx-0.30.0.tar.gz
7 # yaml文件在下载包中的位置:ingress-nginx-nginx-0.30.0/deploy/static/mandatory.yaml
8 [root@k8s-master ingress]# cp -a ingress-nginx-nginx-0.30.0/deploy/static/mandatory.yaml ./
9 [root@k8s-master ingress]#
10 # yaml文件配置修改
11 [root@k8s-master ingress]# vim mandatory.yaml
12 ………………
13 apiVersion: apps/v1
14 kind: DaemonSet # 从Deployment改为DaemonSet
15 metadata:
16 name: nginx-ingress-controller
17 namespace: ingress-nginx
18 labels:
19 app.kubernetes.io/name: ingress-nginx
20 app.kubernetes.io/part-of: ingress-nginx
21 spec:
22 #replicas: 1 # 注释掉
23 ………………
24 nodeSelector:
25 kubernetes.io/hostname: k8s-master # 修改处
26 # 如下几行为新加行 作用【允许在master节点运行】
27 tolerations:
28 - key: node-role.kubernetes.io/master
29 effect: NoSchedule
30 ………………
31 ports:
32 - name: http
33 containerPort: 80
34 hostPort: 80 # 添加处【可在宿主机通过该端口访问Pod】
35 protocol: TCP
36 - name: https
37 containerPort: 443
38 hostPort: 443 # 添加处【可在宿主机通过该端口访问Pod】
39 protocol: TCP
40 ………………
41 [root@k8s-master ingress]#
42 [root@k8s-master ingress]# kubectl apply -f mandatory.yaml
43 namespace/ingress-nginx created
44 configmap/nginx-configuration created
45 configmap/tcp-services created
46 configmap/udp-services created
47 serviceaccount/nginx-ingress-serviceaccount created
48 clusterrole.rbac.authorization.k8s.io/nginx-ingress-clusterrole created
49 role.rbac.authorization.k8s.io/nginx-ingress-role created
50 rolebinding.rbac.authorization.k8s.io/nginx-ingress-role-nisa-binding created
51 clusterrolebinding.rbac.authorization.k8s.io/nginx-ingress-clusterrole-nisa-binding created
52 daemonset.apps/nginx-ingress-controller created
53 limitrange/ingress-nginx created
54 [root@k8s-master ingress]#
55 [root@k8s-master ingress]# kubectl get ds -n ingress-nginx -o wide
56 NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE CONTAINERS IMAGES SELECTOR
57 nginx-ingress-controller 1 1 1 1 1 kubernetes.io/hostname=k8s-master 9m47s nginx-ingress-controller quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0 app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx
58 [root@k8s-master ingress]#
59 [root@k8s-master ingress]# kubectl get pod -n ingress-nginx -o wide
60 NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
61 nginx-ingress-controller-rrbh9 1/1 Running 0 9m55s 10.244.0.46 k8s-master
复制代码
deply_service1的yaml信息
yaml文件
复制代码
1 [root@k8s-master ingress]# pwd
2 /root/k8s_practice/ingress
3 [root@k8s-master ingress]# cat deply_service1.yaml
4 apiVersion: apps/v1
5 kind: Deployment
6 metadata:
7 name: myapp-deploy1
8 namespace: default
9 spec:
10 replicas: 3
11 selector:
12 matchLabels:
13 app: myapp
14 release: v1
15 template:
16 metadata:
17 labels:
18 app: myapp
19 release: v1
20 env: test
21 spec:
22 containers:
23 - name: myapp
24 image: registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1
25 imagePullPolicy: IfNotPresent
26 ports:
27 - name: http
28 containerPort: 80
29 ---
30 apiVersion: v1
31 kind: Service
32 metadata:
33 name: myapp-clusterip1
34 namespace: default
35 spec:
36 type: ClusterIP # 默认类型
37 selector:
38 app: myapp
39 release: v1
40 ports:
41 - name: http
42 port: 80
43 targetPort: 80
复制代码
启动Deployment和Service
1 [root@k8s-master ingress]# kubectl apply -f deply_service1.yaml
2 deployment.apps/myapp-deploy1 created
3 service/myapp-clusterip1 created
查看Deploy状态和信息
复制代码
1 [root@k8s-master ingress]# kubectl get deploy -o wide
2 NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
3 myapp-deploy1 3/3 3 3 28s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1 app=myapp,release=v1
4 [root@k8s-master ingress]#
5 [root@k8s-master ingress]# kubectl get rs -o wide
6 NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR
7 myapp-deploy1-5695bb5658 3 3 3 30s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1 app=myapp,pod-template-hash=5695bb5658,release=v1
8 [root@k8s-master ingress]#
9 [root@k8s-master ingress]# kubectl get pod -o wide --show-labels
10 NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS
11 myapp-deploy1-5695bb5658-n6548 1/1 Running 0 36s 10.244.2.144 k8s-node02
12 myapp-deploy1-5695bb5658-rqcpb 1/1 Running 0 36s 10.244.2.143 k8s-node02
13 myapp-deploy1-5695bb5658-vv6gm 1/1 Running 0 36s 10.244.3.200 k8s-node01
复制代码
curl访问pod
复制代码
1 [root@k8s-master ingress]# curl 10.244.2.144
2 Hello MyApp | Version: v1 | Pod Name
3 [root@k8s-master ingress]#
4 [root@k8s-master ingress]# curl 10.244.2.144/hostname.html
5 myapp-deploy1-5695bb5658-n6548
6 [root@k8s-master ingress]#
7 [root@k8s-master ingress]# curl 10.244.2.143/hostname.html
8 myapp-deploy1-5695bb5658-rqcpb
9 [root@k8s-master ingress]#
10 [root@k8s-master ingress]# curl 10.244.3.200/hostname.html
11 myapp-deploy1-5695bb5658-vv6gm
复制代码
查看Service状态和信息
1 [root@k8s-master ingress]# kubectl get svc -o wide
2 NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
3 kubernetes ClusterIP 10.96.0.1
4 myapp-clusterip1 ClusterIP 10.104.146.14
curl访问svc
复制代码
1 [root@k8s-master ingress]# curl 10.104.146.14
2 Hello MyApp | Version: v1 | Pod Name
3 [root@k8s-master ingress]#
4 [root@k8s-master ingress]# curl 10.104.146.14/hostname.html
5 myapp-deploy1-5695bb5658-n6548
6 [root@k8s-master ingress]#
7 [root@k8s-master ingress]# curl 10.104.146.14/hostname.html
8 myapp-deploy1-5695bb5658-vv6gm
9 [root@k8s-master ingress]#
10 [root@k8s-master ingress]# curl 10.104.146.14/hostname.html
11 myapp-deploy1-5695bb5658-rqcpb
复制代码
deply_service2的yaml信息
yaml文件
复制代码
1 [root@k8s-master ingress]# pwd
2 /root/k8s_practice/ingress
3 [root@k8s-master ingress]# cat deply_service2.yaml
4 apiVersion: apps/v1
5 kind: Deployment
6 metadata:
7 name: myapp-deploy2
8 namespace: default
9 spec:
10 replicas: 3
11 selector:
12 matchLabels:
13 app: myapp
14 release: v2
15 template:
16 metadata:
17 labels:
18 app: myapp
19 release: v2
20 env: test
21 spec:
22 containers:
23 - name: myapp
24 image: registry.cn-beijing.aliyuncs.com/google_registry/myapp:v2
25 imagePullPolicy: IfNotPresent
26 ports:
27 - name: http
28 containerPort: 80
29 ---
30 apiVersion: v1
31 kind: Service
32 metadata:
33 name: myapp-clusterip2
34 namespace: default
35 spec:
36 type: ClusterIP # 默认类型
37 selector:
38 app: myapp
39 release: v2
40 ports:
41 - name: http
42 port: 80
43 targetPort: 80
复制代码
启动Deployment和Service
1 [root@k8s-master ingress]# kubectl apply -f deply_service2.yaml
2 deployment.apps/myapp-deploy2 created
3 service/myapp-clusterip2 created
查看Deploy状态和信息
复制代码
1 [root@k8s-master ingress]# kubectl get deploy myapp-deploy2 -o wide
2 NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
3 myapp-deploy2 3/3 3 3 9s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v2 app=myapp,release=v2
4 [root@k8s-master ingress]#
5 [root@k8s-master ingress]# kubectl get rs -o wide
6 NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR
7 myapp-deploy1-5695bb5658 3 3 3 7m23s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1 app=myapp,pod-template-hash=5695bb5658,release=v1 # 之前创建的
8 myapp-deploy2-54f48f879b 3 3 3 15s myapp registry.cn-beijing.aliyuncs.com/google_registry/myapp:v2 app=myapp,pod-template-hash=54f48f879b,release=v2 # 当前deploy创建的
9 [root@k8s-master ingress]#
10 [root@k8s-master ingress]# kubectl get pod -o wide --show-labels -l "release=v2"
11 NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS
12 myapp-deploy2-54f48f879b-7pxwp 1/1 Running 0 25s 10.244.3.201 k8s-node01
13 myapp-deploy2-54f48f879b-lqlh2 1/1 Running 0 25s 10.244.2.146 k8s-node02
14 myapp-deploy2-54f48f879b-pfvnn 1/1 Running 0 25s 10.244.2.145 k8s-node02
复制代码
查看Service状态和信息
1 [root@k8s-master ingress]# kubectl get svc -o wide
2 NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
3 kubernetes ClusterIP 10.96.0.1
4 myapp-clusterip1 ClusterIP 10.104.146.14
5 myapp-clusterip2 ClusterIP 10.110.181.62
curl访问svc
复制代码
1 [root@k8s-master ingress]# curl 10.110.181.62
2 Hello MyApp | Version: v2 | Pod Name
3 [root@k8s-master ingress]#
4 [root@k8s-master ingress]# curl 10.110.181.62/hostname.html
5 myapp-deploy2-54f48f879b-lqlh2
6 [root@k8s-master ingress]#
7 [root@k8s-master ingress]# curl 10.110.181.62/hostname.html
8 myapp-deploy2-54f48f879b-7pxwp
9 [root@k8s-master ingress]#
10 [root@k8s-master ingress]# curl 10.110.181.62/hostname.html
11 myapp-deploy2-54f48f879b-pfvnn
复制代码
Ingress HTTP代理访问
yaml文件【由于自建的service在默认default名称空间,因此这里也是default名称空间】
复制代码
1 [root@k8s-master ingress]# pwd
2 /root/k8s_practice/ingress
3 [root@k8s-master ingress]# cat ingress-http.yaml
4 apiVersion: networking.k8s.io/v1beta1
5 kind: Ingress
6 metadata:
7 name: nginx-http
8 namespace: default
9 spec:
10 rules:
11 - host: www.zhangtest.com
12 http:
13 paths:
14 - path: /
15 backend:
16 serviceName: myapp-clusterip1
17 servicePort: 80
18 - host: blog.zhangtest.com
19 http:
20 paths:
21 - path: /
22 backend:
23 serviceName: myapp-clusterip2
24 servicePort: 80
复制代码
启动ingress http并查看状态
复制代码
1 [root@k8s-master ingress]# kubectl apply -f ingress-http.yaml
2 ingress.networking.k8s.io/nginx-http created
3 [root@k8s-master ingress]#
4 [root@k8s-master ingress]# kubectl get ingress -o wide
5 NAME HOSTS ADDRESS PORTS AGE
6 nginx-http www.zhangtest.com,blog.zhangtest.com 80 9s
复制代码
查看nginx配置文件
复制代码
1 [root@k8s-master ~]# kubectl get pod -A | grep 'ingre'
2 ingress-nginx nginx-ingress-controller-rrbh9 1/1 Running 0 27m
3 [root@k8s-master ~]#
4 [root@k8s-master ~]# kubectl exec -it -n ingress-nginx nginx-ingress-controller-rrbh9 bash
5 bash-5.0$ cat /etc/nginx/nginx.conf
6 …………
7 ##### 可见server www.zhangtest.com 和 server blog.zhangtest.com的配置
复制代码
浏览器访问
hosts文件修改,添加如下信息
1 文件位置:C:\WINDOWS\System32\drivers\etc\hosts
2 添加信息如下:
3 # K8S ingress学习
4 10.0.0.110 www.zhangtest.com blog.zhangtest.com
浏览器访问www.zhangtest.com
1 http://www.zhangtest.com/
2 http://www.zhangtest.com/hostname.html
浏览器访问blog.zhangtest.com
1 http://blog.zhangtest.com/
2 http://blog.zhangtest.com/hostname.html
当然:除了用浏览器访问外,也可以在Linux使用curl访问。前提是修改/etc/hosts文件,对上面的两个域名进行解析。
Ingress HTTPS代理访问
SSL证书创建
复制代码
1 [root@k8s-master cert]# pwd
2 /root/k8s_practice/ingress/cert
3 [root@k8s-master cert]# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/C=CN/ST=BJ/L=BeiJing/O=BTC/OU=MOST/CN=zhang/[email protected]"
4 Generating a 2048 bit RSA private key
5 ......................................................+++
6 ........................+++
7 writing new private key to 'tls.key'
8 -----
9 [root@k8s-master cert]# kubectl create secret tls tls-secret --key tls.key --cert tls.crt
10 secret/tls-secret created
复制代码
创建ingress https
yaml文件【由于自建的service在默认default名称空间,因此这里也是default名称空间】
复制代码
1 [root@k8s-master ingress]# pwd
2 /root/k8s_practice/ingress
3 [root@k8s-master ingress]# cat ingress-https.yaml
4 apiVersion: networking.k8s.io/v1beta1
5 kind: Ingress
6 metadata:
7 name: nginx-https
8 namespace: default
9 spec:
10 tls:
11 - hosts:
12 - www.zhangtest.com
13 - blog.zhangtest.com
14 secretName: tls-secret
15 rules:
16 - host: www.zhangtest.com
17 http:
18 paths:
19 - path: /
20 backend:
21 serviceName: myapp-clusterip1
22 servicePort: 80
23 - host: blog.zhangtest.com
24 http:
25 paths:
26 - path: /
27 backend:
28 serviceName: myapp-clusterip2
29 servicePort: 80
复制代码
启动ingress https并查看状态
复制代码
1 [root@k8s-master ingress]# kubectl apply -f ingress-https.yaml
2 ingress.networking.k8s.io/nginx-https created
3 [root@k8s-master ingress]#
4 [root@k8s-master ingress]# kubectl get ingress -o wide
5 NAME HOSTS ADDRESS PORTS AGE
6 nginx-https www.zhangtest.com,blog.zhangtest.com 80, 443 8s
复制代码
浏览器访问
hosts文件修改,添加如下信息
1 文件位置:C:\WINDOWS\System32\drivers\etc\hosts
2 添加信息如下:
3 # K8S ingress学习
4 10.0.0.110 www.zhangtest.com blog.zhangtest.com
浏览器访问www.zhangtest.com
1 https://www.zhangtest.com/
2 https://www.zhangtest.com/hostname.html
浏览器访问blog.zhangtest.com
1 https://blog.zhangtest.com/
2 https://blog.zhangtest.com/hostname.html
Ingress-Nginx实现BasicAuth认证
官网地址:
https://kubernetes.github.io/ingress-nginx/examples/auth/basic/
准备工作
复制代码
1 [root@k8s-master ingress]# pwd
2 /root/k8s_practice/ingress
3 [root@k8s-master ingress]# yum install -y httpd
4 [root@k8s-master ingress]# htpasswd -c auth foo
5 New password: #输入密码
6 Re-type new password: #重复输入的密码
7 Adding password for user foo ##### 此时会生成一个 auth文件
8 [root@k8s-master ingress]# kubectl create secret generic basic-auth --from-file=auth
9 secret/basic-auth created
10 [root@k8s-master ingress]#
11 [root@k8s-master ingress]# kubectl get secret basic-auth -o yaml
12 apiVersion: v1
13 data:
14 auth: Zm9vOiRhcHIxJFpaSUJUMDZOJDVNZ3hxdkpFNWVRTi9NdnZCcVpHaC4K
15 kind: Secret
16 metadata:
17 creationTimestamp: "2020-08-17T09:42:04Z"
18 name: basic-auth
19 namespace: default
20 resourceVersion: "775573"
21 selfLink: /api/v1/namespaces/default/secrets/basic-auth
22 uid: eef0853b-a52b-4684-922a-817e4cd9e9ca
23 type: Opaque
复制代码
ingress yaml文件
复制代码
1 [root@k8s-master ingress]# pwd
2 /root/k8s_practice/ingress
3 [root@k8s-master ingress]# cat nginx_basicauth.yaml
4 apiVersion: networking.k8s.io/v1beta1
5 kind: Ingress
6 metadata:
7 name: ingress-with-auth
8 annotations:
9 # type of authentication
10 nginx.ingress.kubernetes.io/auth-type: basic
11 # name of the secret that contains the user/password definitions
12 nginx.ingress.kubernetes.io/auth-secret: basic-auth
13 # message to display with an appropriate context why the authentication is required
14 nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
15 spec:
16 rules:
17 - host: auth.zhangtest.com
18 http:
19 paths:
20 - path: /
21 backend:
22 serviceName: myapp-clusterip1
23 servicePort: 80
复制代码
启动ingress并查看状态
复制代码
1 [root@k8s-master ingress]# kubectl apply -f nginx_basicauth.yaml
2 ingress.networking.k8s.io/ingress-with-auth created
3 [root@k8s-master ingress]#
4 [root@k8s-master ingress]# kubectl get ingress -o wide
5 NAME HOSTS ADDRESS PORTS AGE
6 ingress-with-auth auth.zhangtest.com 80 6s
复制代码
浏览器访问
hosts文件修改,添加如下信息
1 文件位置:C:\WINDOWS\System32\drivers\etc\hosts
2 添加信息如下:
3 # K8S ingress学习
4 10.0.0.110 www.zhangtest.com blog.zhangtest.com auth.zhangtest.com
浏览器访问auth.zhangtest.com
http://auth.zhangtest.com/
Ingress-Nginx实现Rewrite重写
官网地址:
https://kubernetes.github.io/ingress-nginx/examples/rewrite/
重写可以使用以下注解控制:
名称 描述 值
nginx.ingress.kubernetes.io/rewrite-target 必须重定向的目标URL String
nginx.ingress.kubernetes.io/ssl-redirect 指示位置部分是否只能由SSL访问(当Ingress包含证书时,默认为True) Bool
nginx.ingress.kubernetes.io/force-ssl-redirect 即使Ingress没有启用TLS,也强制重定向到HTTPS Bool
nginx.ingress.kubernetes.io/app-root 定义应用程序根目录,Controller在“/”上下文中必须重定向该根目录 String
nginx.ingress.kubernetes.io/use-regex 指示Ingress上定义的路径是否使用正则表达式 Bool
ingress yaml文件
复制代码
1 [root@k8s-master ingress]# pwd
2 /root/k8s_practice/ingress
3 [root@k8s-master ingress]# cat nginx_rewrite.yaml
4 apiVersion: networking.k8s.io/v1beta1
5 kind: Ingress
6 metadata:
7 annotations:
8 nginx.ingress.kubernetes.io/rewrite-target: https://www.baidu.com
9 name: rewrite
10 namespace: default
11 spec:
12 rules:
13 - host: rewrite.zhangtest.com
14 http:
15 paths:
16 - backend:
17 serviceName: myapp-clusterip1
18 servicePort: 80
复制代码
启动ingress并查看状态
复制代码
1 [root@k8s-master ingress]# kubectl apply -f nginx_rewrite.yaml
2 ingress.networking.k8s.io/rewrite created
3 [root@k8s-master ingress]#
4 [root@k8s-master ingress]# kubectl get ingress -o wide
5 NAME HOSTS ADDRESS PORTS AGE
6 rewrite rewrite.zhangtest.com 80 13s
复制代码
浏览器访问
hosts文件修改,添加如下信息
1 文件位置:C:\WINDOWS\System32\drivers\etc\hosts
2 添加信息如下:
3 # K8S ingress学习
4 10.0.0.110 www.zhangtest.com blog.zhangtest.com auth.zhangtest.com rewrite.zhangtest.com
深圳网站优化www.zg886.cn