ingress常用配置

官方文档：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/

url重写（rewrite）

在某些场景下，后端服务中暴露的 URL 与 Ingress 规则中指定的路径不同。如果没有重写，任何请求都将返回 404。或者是一些前后端分离的项目，但是后端没有指定路径，将annotations nginx.ingress.kubernetes.io/rewrite-target 设置为服务期望的路径

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
  name: ingress-test
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: rewrite.test.com
    http:
      paths:
      - backend:
          serviceName: nginx-svc
          servicePort: 80
        path: /something(/|$)(.*)
status:
  loadBalancer: {}

访问

http://rewrite.test.com:27324/something

域名重定向（redirect）

Permanent Redirect

此annotations允许返回永久重定向（返回代码 301）。一般将http重定向到https 例如 nginx.ingress.kubernetes.io/permanent-redirect: https://www.google.com 会将所有内容重定向到 Google

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
   nginx.ingress.kubernetes.io/permanent-redirect: https://www.baidu.com
  name: ingress-redirect-test
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: redirect.test.com
    http:
      paths:
      - backend:
          servicePort: 80
        path: /
status:
  loadBalancer: {}

访问

http://redirect.test.com:27324

https访问配置

  1. 购买或生成证书
#生成证书
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=tls.test.com/O=tls.test.com"
#创建secret
kubectl create secret tls ca-cert --key tls.key --cert tls.crt
  1. 创建ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-test
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: tls.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-svc
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - tls.test.com
    secretName: ca-cert

访问

https://tls.test.com:15660

默认是开启强制跳转到https的，如果需要使用http访问需要在annotations里添加nginx.ingress.kubernetes.io/ssl-redirect: "false"

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  name: tls-test
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: tls.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-svc
            port:
              number: 80
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - tls.test.com
    secretName: ca-cert

SSL Passthrough

此功能是通过拦截配置的 HTTPS 端口（默认值：443）上的所有流量并将其移交给本地 TCP 代理来实现的（和端口转发差不多）。这完全绕过了NGINX，并引入了不可忽视的性能损失。

annotations:
  nginx.ingress.kubernetes.io/ssl-passthrough: true

backend-protocol

可以指示NGINX应该如何与后端服务通信。有效值：HTTP、HTTPS、GRPC、GRPCS、AJP 和 FCGI

annotations:
  nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

dashboard自定义证书

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubernetes-dashboard
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: normal
                operator: In
                values:
                - "true"
      containers:
      - args:
        - --auto-generate-certificates=false  # 使用默认证书改成false
        - --tls-key-file=tls.key  # 证书key
        - --tls-cert-file=tls.crt # 证书cert
        - --token-ttl=21600
        - --authentication-mode=basic,token
        - --namespace=kubernetes-dashboard
        image: kubernetesui/dashboard:v2.0.0-rc5
        imagePullPolicy: Always
        lifecycle: {}
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /
            port: 8443
            scheme: HTTPS
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 30
        name: kubernetes-dashboard
        ports:
        - containerPort: 8443
          protocol: TCP
        resources: {}
        securityContext:
          privileged: false
          procMount: Default
          runAsNonRoot: false
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /certs   #证书挂载路径
          name: kubernetes-dashboard-new
        - mountPath: /tmp
          name: tmp-volume
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: kubernetes-dashboard
      serviceAccountName: kubernetes-dashboard
      terminationGracePeriodSeconds: 30
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      volumes:   #将secret挂载进来
      - name: kubernetes-dashboard-new
        secret:
          defaultMode: 420
          secretName: kubernetes-dashboard-new
      - emptyDir: {}
        name: tmp-volume

创建ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  name: dashboard-test
  namespace: kubernetes-dashboard
spec:
  ingressClassName: nginx
  rules:
  - host: dashboard.test.com
    http:
      paths:
      - backend:
          service:
            name: kubernetes-dashboard
            port:
              number: 443
        path: /
        pathType: Prefix

黑白名单配置

Annotations：只对指定的ingress生效
ConfigMap：全局生效
黑名单可以使用ConfigMap去配置，白名单建议使用Annotations去配置。
（实测单个ip不管用，网段可以，ingrss版本1.3.1）

白名单
annotations:
  nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/24,172.10.0.1
黑名单

kubectl edit cm ingress-nginx-controller -n ingress-nginx

data:
  block-cidrs: 192.168.0.11/24

添加自定义配置

配置user_agent

如果是手机端就跳到百度

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
        set $agentflag 0;

        if ($http_user_agent ~* "(Mobile)" ){
          set $agentflag 1;
        }

        if ( $agentflag = 1 ) {
          return 301 https://m.baidu.com;
        }

速率限制

annotations:
  nginx.ingress.kubernetes.io/limit-connections: 1  #单个ip最大连接数
  nginx.ingress.kubernetes.io/limit-rps: 5  #每秒的请求数
  nginx.ingress.kubernetes.io/limit-whitelist: 192.168.0.0/24  #速率限制白名单

基本认证

  1. 创建密码文件
htpasswd -c auth foo
New password: <bar>
New password:
Re-type new password:
Adding password for user foo
  1. 生成secret
kubectl create secret generic basic-auth --from-file=auth
  1. ingress添加annotations
annotations:
    # 定义认证类型
    nginx.ingress.kubernetes.io/auth-type: basic
    # 定义用户名密码的secret
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    # 定义提示信息
    nginx.ingress.kubernetes.io/auth-realm: '请登录！'
最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
平台声明：文章内容（如有图片或视频亦包括在内）由作者上传并发布，文章内容仅代表作者本人观点，简书系信息发布平台，仅提供信息存储服务。

推荐阅读更多精彩内容