1.指定Ingress调度的节点
1.Ingress SLB后端只会挂载打标了node-role.kubernetes.io/ingress=true的集群Node；
2.Ingress Pod只会被部署到打标了node-role.kubernetes.io/ingress=true的集群Node；
3.不建议将Ingress Pod部署在集群Master节点上，因为Master节点承载着集群的所有管控服务，以避免集群接入流量过高时对管控服务造成影响。
# 1.主机打标签
[root@host229 yaml]# kubectl label no host214 node-role.kubernetes.io/ingress=true
node/host214 labeled
[root@host229 yaml]# kubectl label no host227 node-role.kubernetes.io/ingress=true
node/host227 labeled
[root@host229 yaml]# kubectl label no host228 node-role.kubernetes.io/ingress=true
node/host228 labeled
2.部署：Ingress-controller使用hostport
2.1.部署Ingress-controller
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: nginx-ingress-controller
labels:
app: ingress-nginx
namespace: kube-system
annotations:
component.version: '0.15.0'
component.revision: '2'
spec:
template:
metadata:
labels:
app: ingress-nginx
spec:
nodeSelector:
node-role.kubernetes.io/ingress: "true" //选择器指定
serviceAccountName: nginx-ingress-controller
serviceAccount: nginx-ingress-controller
hostNetwork: true
containers:
- name: nginx-ingress-controller
image: registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:0.15.0-2
args:
- /nginx-ingress-controller
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
- --configmap=$(POD_NAMESPACE)/nginx-configuration
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
- --annotations-prefix=nginx.ingress.kubernetes.io
- --publish-service=$(POD_NAMESPACE)/nginx-ingress-lb
- --v=2
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
ports:
- name: http
containerPort: 80
- name: https
containerPort: 443
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: nginx-ingress-controller
namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: nginx-ingress-controller
namespace: kube-system
rules:
- apiGroups:
- ""
resources:
- namespaces
- pods
- services
- nodes
- endpoints
- secrets
- configmaps
verbs:
- list
- get
- watch
- create
- update
- apiGroups:
- "networking.k8s.io"
resources:
- networkpolicies
verbs:
- list
- get
- watch
- apiGroups:
- extensions
resources:
- networkpolicies
- ingresses
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: nginx-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: nginx-ingress-controller
subjects:
- kind: ServiceAccount
name: nginx-ingress-controller
namespace: kube-system
2.2.部署tomcat测试
[root@host229 yaml]# kubectl run tomcat --image=tomcat --replicas=3
deployment.apps/tomcat created
[root@host229 yaml]# kubectl expose deployment tomcat --port=80 --target-port=8080 --session-affinity=ClientIP
service/tomcat exposed
[root@host229 yaml]# kubectl get svc,pod
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.254.0.1 <none> 443/TCP 18h
service/tomcat ClusterIP 10.254.152.190 <none> 8080/TCP 17h
NAME READY STATUS RESTARTS AGE
pod/tomcat-64f79959d8-mngnz 1/1 Running 0 18h
pod/tomcat-64f79959d8-tsnv2 1/1 Running 0 18h
pod/tomcat-64f79959d8-zdf2z 1/1 Running 0 18h
2.3.通过Ingress暴露tomcat的service到集群外
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: tomcat-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
#ingress.kubernetes.io/rewrite-target: /
ingress.kubernetes.io/ssl-passthrough: "false"
#ingress.kubernetes.io/secure-backends: "false"
kubernetes.io/ingress.allow-http: "true"
ingress.kubernetes.io/force-ssl-redirect: "false"
ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
nginx.ingress.kubernetes.io/base-url-scheme: "http"
spec:
rules:
- http:
paths:
- path: /tomcat
backend:
serviceName: tomcat
servicePort: 80
2.4.查看Ingress-controller中的变化
[root@host229 yaml]# kubectl get pod -n kube-system
NAME READY STATUS RESTARTS AGE
default-http-backend-77b4459f86-gjsjn 1/1 Running 0 18h
kube-router-4kfdz 1/1 Running 0 18h
kube-router-fbffb 1/1 Running 1 18h
kube-router-nq6b7 1/1 Running 0 18h
kube-router-rnksf 1/1 Running 0 18h
nginx-ingress-controller-bkmwp 1/1 Running 0 18h
nginx-ingress-controller-lzrhk 1/1 Running 0 18h
nginx-ingress-controller-mw4wr 1/1 Running 0 18h
[root@host229 yaml]# kubectl -n kube-system exec -it nginx-ingress-controller-bkmwp cat /etc/nginx/nginx.conf
//新增的Tomcat部分
···
//默认的backend
upstream upstream-default-backend {
least_conn;
keepalive 32;
server 192.168.2.2:8080 max_fails=0 fail_timeout=0;
}
upstream default-tomcat-8080 {
least_conn;
keepalive 32;
server 192.168.2.3:8080 max_fails=0 fail_timeout=0;
server 192.168.1.2:8080 max_fails=0 fail_timeout=0;
server 192.168.0.2:8080 max_fails=0 fail_timeout=0;
}
···
location /tomcat {
···
proxy_next_upstream_tries 0;
proxy_pass http://default-tomcat-8080;
proxy_redirect off;
}
···
//默认的
location / {
···
proxy_pass http://upstream-default-backend;
proxy_redirect off;
}
2.5.查看
http://10.20.16.214
http://10.20.16.227
http://10.20.16.228
2.6.Ingress上层增加负载均衡和统一入口方案
- LVS + keepalived + VIP
- Nginx+ keepalived + VIP
3.部署：Ingress-controller使用LoadBalancer
apiVersion: v1
kind: Service
metadata:
name: nginx-ingress-lb
namespace: kube-system
labels:
app: nginx-ingress-lb
annotations:
service.beta.kubernetes.io/alicloud-loadbalancer-backend-label: "node-role.kubernetes.io/ingress=true"
spec:
type: LoadBalancer
# do not route traffic to other nodes
externalTrafficPolicy: "Local"
ports:
- port: 80
name: http
targetPort: 80
- port: 443
name: https
targetPort: 443
selector:
# select app=ingress-nginx pods
app: ingress-nginx
4.增加prometheus对ingress-controller的监控
annotations:
prometheus.io/port: '10254'
prometheus.io/scrape: 'true'