8. kubernetes ingress和ingerss Controller
[TOC]
本文基于马哥的docker和k8s视频总结, 在此致谢马哥.
- 卸载四层以上会话, 例如SSL
-
Ingress controller=> 入口控制器, 拥有七层代理和调度能力的应用程序(其实是一个pod)- Nginx
- Traefik
- Envoy
-
Ingress资源
如何在kubernetes上实现七层调度?
- 先部署一个
Ingress Controller - 根据自己的需要配置(虚拟主机或url代理)前端
- 根据
service收集到的后端pod的IP定义成upstream server并反映在Ingress中 - 由
Ingress动态注入到Ingress Controller中
ingress controller.png
如何部署一个Ingress?
kubernetes ingress-nginx-controller-架构.png
kubectl explain ing.spec
# backend <object> 定义后端有哪些主机
# rules <[]object> 定义规则
# tls <[]object> 定义https时才使用此参数, 用于卸载7层会话
kubectl explain ing.spec.rules
# host <string> 定义虚拟主机
# http.paths <[]Object> -required- 定义url
kubectl explain ing.spec.backend
# serviceName <string> -required- 定义后端pod的名称
# servicePort <string> -required- 定义后端pod的端口
nginx ingress controller
使用github上关于ingress的项目: https://github.com/kubernetes/ingress-nginx
# 1.创建文件放置目录
mkdir ~/ingress-nginx ; cd ~/ingress-nginx
# 2. 下载需要使用的yaml文件, 注意使用raw格式的url
for file in namespace.yaml configmap.yaml rbac.yaml with-rbac.yaml;do wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/$file; done
# 3. 分别创建
kubectl apply -f namespace.yaml # 注意必须要首先创建名称空间
kubectl apply -f ./ # apply可以针对目录进行, 它会自动引用目录下所有文件
# 注: 第2, 3步可以替换为引用mantadory.yaml文件
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
# 4. 查看ingress-nginx的pod是否被创建, 注意指明名称空间
kubectl get pods -n ingress-nginx
NAME READY STATUS RESTARTS AGE
nginx-ingress-controller-79f6884cf6-g8x5h 0/1 ContainerCreating 0 77s
# 注: 这一步下载的nginx-ingress-controller非常慢, 我第一次下载镜像, 创建pod花了40分钟
# 记录下载的镜像名与版本:
# quay.io/kubernetes-ingress-controller/nginx-ingress-controller 0.25.1 0439eb3e11f1 3 weeks ago 511MB
# 用以下命令查看pod情况, 注意指明名称空间!
kubectl describe pods nginx-ingress-controller-79f6884cf6-g8x5h -n ingress-nginx
# 直接连入ingress-controller中查看配置情况
kubectl exec -it -n ingress-nginx nginx-ingress-controller-79f6884cf6-g8x5h -- /bin/sh
# 5. 创建后端被代理的服务service并使用
vi deploy-demo.yml
apiVersion: v1
kind: Service
metadata:
name: myapp
namespace: default
spec:
selector:
app: nginx
release: canary
ports:
- name: http
port: 80
targetPort: 80
--- # 注意一定要使用三个横线来分割
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deploy
namespace: default
spec:
replicas: 2
selecotr:
matchLabels:
app: nginx
release: canary
template:
metadata:
labels:
app: nginx
release: canary
spec:
containers:
- name: nginx-container
image: nginx:1.14-alpine
ports:
- name: http
containerPort: 80
kubectl apply -f deploy-demo.yml
# 6. 创建Service接入集群外部流量
# 也可以直接共享node的网络名称空间, 但需要手动改造配置文件with-rbac.yaml,
# 将Deployment改为daemonSet, 去掉replicas并修改一些对应配置, 最重要的是
# 在template.spec中添加一项配置: hostNetwork
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml
vi service-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
type: NodePort
ports:
- name: http
port: 80
targetPort: 80
nodePort: 30080 # 可自定义节点对外暴露的端口
protocol: TCP
- name: https
port: 443
targetPort: 443
nodePort: 30443 # 可自定义节点对外暴露的端口
protocol: TCP
selector:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kubectl apply -f service-nodeport.yaml
# 7. 创建Ingress
vi ingress-demo.yaml
可以使用虚拟主机(主机名)的方式进行定义:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: ingress-test
namespace: default # 与Deployment和Service应属于同一个名称空间
annotations:
kubernetes.io/ingress.class: "nginx" # 写明使用nginx类型的ingress-controller
spec:
rules:
- host: myapp.test.com # 定义外部能够通过DNS解析到的主机名
http:
paths:
- path: # 前端使用url进行映射, 可以为空(此时会使用根"/")
backend: # 映射到的后端, 会根据后面哪些pod来生成upstream
serviceName: myapp
servicePort: 80
也可以使用url的方式进行定义, 以下为示例
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: ingress-test
annotations: # 此项非常重要, 指明使用的ingress-controller类型
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- http:
paths:
- path: /testpath
backend:
serviceName: myapp
servicePort: 80
kubectl apply -f ingress-demo.yml
# 8. 外部访问测试
https://192.168.200.201:30080
记录一个实操成功的案例配置
mkdir ~/ingress-nginx ; cd ~/ingress-nginx
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
vi service-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
type: NodePort
ports:
- name: http
port: 80
targetPort: 80
nodePort: 30080
protocol: TCP
selector:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
---
kubectl apply -f service-nodeport.yaml
vi tomcat-deploy.yml
apiVersion: v1
kind: Service
metadata:
name: myapp
namespace: default
spec:
selector:
app: tomcat
release: test
ports:
- name: http
port: 8080
targetPort: 8080
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: myapp-deploy
namespace: default
spec:
replicas: 3
selector:
matchLabels:
app: tomcat
release: test
template:
metadata:
labels:
app: tomcat
release: test
spec:
containers:
- name: tomcat-container
image: tomcat:8-alpine
ports:
- name: http
containerPort: 8080
kubectl apply -f tomcat-deploy.yml
vi tomcat-ingress.yml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: tomcat-ingress
namespace: default
annotations:
kubernetes.io/ingress.class: "nginx"
spec:
rules:
- host: node2
http:
paths:
- path:
backend:
serviceName: myapp
servicePort: 8080
kubectl apply -f tomcat-ingress.yml
# 测试: 在宿主机上先做好DNS解析, 然后使用浏览器访问http://虚拟机ip:8080, 可查看到在容器中运行的tomcat服务
