zoukankan      html  css  js  c++  java

  • kubernetes系列09—Ingress控制器详解

    kubernetes系列09—Ingress控制器详解

    1、认识Ingress

    1.1 什么是Ingress？

    　　通常情况下，service和pod仅可在集群内部网络中通过IP地址访问。所有到达边界路由器的流量或被丢弃或被转发到其他地方。从概念上讲，可能像下面这样：

    ?
    1
    2
    3
    4
      internet
          |
    ------------
    [ Services ]

    Ingress是授权入站连接到达集群服务的规则集合。

    ?
    1
    2
    3
    4
    5
    internet
         |
    [ Ingress ]
    --|-----|--
    [ Services ]

    　　你可以给Ingress配置提供外部可访问的URL、负载均衡、SSL、基于名称的虚拟主机等。用户通过POST Ingress资源到API server的方式来请求ingress。 Ingress controller负责实现Ingress，通常使用负载平衡器，它还可以配置边界路由和其他前端，这有助于以HA方式处理流量。

    1.2 Ingress工作示意图

    1.3先决条件

    　　在使用Ingress resource之前，有必要先了解下面几件事情。Ingress是beta版本的resource，在kubernetes1.1之前还没有。你需要一个Ingress Controller来实现Ingress，单纯的创建一个Ingress没有任何意义。

    　　GCE/GKE会在master节点上部署一个ingress controller。你可以在一个pod中部署任意个自定义的ingress controller。你必须正确地annotate每个ingress，比如 运行多个ingress controller 和 关闭glbc.

    　　确定你已经阅读了Ingress controller的beta版本限制。在非GCE/GKE的环境中，你需要在pod中部署一个controller。

    1.4 Ingress定义资源清单几个字段

    •  apiVersion： v1  版本
    •  kind： Ingress  类型
    •  metadata  元数据
    •  spec  期望状态
      •  backend： 默认后端，能够处理与任何规则不匹配的请求
      •  rules：用于配置Ingress的主机规则列表
      •  tls：目前Ingress仅支持单个TLS端口443
    •  status  当前状态

    2、部署一个Ingress

    （1）在gitlab上下载yaml文件，并创建部署

    gitlab ingress-nginx项目：https://github.com/kubernetes/ingress-nginx

    ingress安装指南：https://kubernetes.github.io/ingress-nginx/deploy/

    因为需要拉取镜像，所以需要等一段时间

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    ---下载需要的yaml文件
    [root@master ingress-nginx]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
    ---查询下载成功
    [root@master ingress-nginx]# ls
    mandatory.yaml
    ---创建ingress
    [root@master ingress-nginx]# kubectl apply -f mandatory.yaml
    namespace/ingress-nginx created
    configmap/nginx-configuration created
    configmap/tcp-services created
    configmap/udp-services created
    serviceaccount/nginx-ingress-serviceaccount created
    clusterrole.rbac.authorization.k8s.io/nginx-ingress-clusterrole created
    role.rbac.authorization.k8s.io/nginx-ingress-role created
    rolebinding.rbac.authorization.k8s.io/nginx-ingress-role-nisa-binding created
    clusterrolebinding.rbac.authorization.k8s.io/nginx-ingress-clusterrole-nisa-binding created
    deployment.apps/nginx-ingress-controller created

    　　

    （2）如果是裸机，还需要安装service

    ?
    1
    2
    3
    [root@master ingress-nginx]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/baremetal/service-nodeport.yaml
    [root@master ingress-nginx]# kubectl apply -f service-nodeport.yaml
    service/ingress-nginx created

    　　

    （3）验证

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    ---查询生产的pod
    [root@master ~]# kubectl get pods -n ingress-nginx
    NAME                                        READY     STATUS    RESTARTS   AGE
    nginx-ingress-controller-648c7bb65b-df9qz   1/1       Running   0          34m
    ---查询生产的svc
    [root@master ingress-nginx]# kubectl get svc -n ingress-nginx
    NAME            TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
    ingress-nginx   NodePort   10.109.244.123   <none>        80:30080/TCP,443:30443/TCP   21s
    ---查询svc的详细信息
    [root@master ~]# kubectl describe svc ingress-nginx -n ingress-nginx
    Name:                     ingress-nginx
    Namespace:                ingress-nginx
    Labels:                   app.kubernetes.io/name=ingress-nginx
                              app.kubernetes.io/part-of=ingress-nginx
    Annotations:              kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"app.kubernetes.io/name":"ingress-nginx","app.kubernetes.io/part-of":"ingres...
    Selector:                 app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx
    Type:                     NodePort
    IP:                       10.111.143.90
    Port:                     http  80/TCP
    TargetPort:               80/TCP
    NodePort:                 http  30080/TCP
    Endpoints:                10.244.1.104:80
    Port:                     https  443/TCP
    TargetPort:               443/TCP
    NodePort:                 https  30443/TCP
    Endpoints:                10.244.1.104:443
    Session Affinity:         None
    External Traffic Policy:  Cluster
    Events:                   <none>

    　　

    3、创建Ingress，代理到后端nginx服务

    3.1 准备后端pod和service

    （1）编写yaml文件，并创建

    创建3个nginx服务的pod，并创建一个service绑定

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    [root@master ingress]# vim deploy-damo.yaml
    apiVersion: v1
    kind: Service
    metadata:
      name: myapp
      namespace: default
    spec:
      selector:
        app: myapp
        release: canary
      ports:
      - name: http
        targetPort: 80
        port: 80
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: myapp-deploy
      namespace: default
    spec:
      replicas: 3
      selector:
        matchLabels:
          app: myapp
          release: canary
      template:
        metadata:
          labels:
            app: myapp
            release: canary
        spec:
          containers:
          - name: myapp
            image: ikubernetes/myapp:v2
            ports:
            - name: http
              containerPort: 80
    [root@master ingress]# kubectl apply -f deploy-damo.yaml
    service/myapp created
    deployment.apps/myapp-deploy created

    　　

    （2）查询验证

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    [root@master ~]# kubectl get svc
    NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
    kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP   146d
    myapp        ClusterIP   10.103.137.126   <none>        80/TCP    6s
    [root@master ~]# kubectl get pods
    NAME                            READY     STATUS    RESTARTS   AGE
    myapp-deploy-67f6f6b4dc-2vzjn   1/1       Running   0          14s
    myapp-deploy-67f6f6b4dc-c7f76   1/1       Running   0          14s
    myapp-deploy-67f6f6b4dc-x79hc   1/1       Running   0          14s
    [root@master ~]# kubectl describe svc myapp
    Name:              myapp
    Namespace:         default
    Labels:            <none>
    Annotations:       kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"myapp","namespace":"default"},"spec":{"ports":[{"name":"http","port":80,"targe...
    Selector:          app=myapp,release=canary
    Type:              ClusterIP
    IP:                10.103.137.126
    Port:              http  80/TCP
    TargetPort:        80/TCP
    Endpoints:         10.244.1.102:80,10.244.1.103:80,10.244.2.109:80
    Session Affinity:  None
    Events:            <none>

    　　

    3.2 创建ingress，绑定后端nginx服务

    （1）编写yaml文件，并创建

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    [root@master ingress]# vim ingress-myapp.yaml
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: ingress-myapp
      namespace: default
    spec:
      rules:
      - host: myapp.along.com
        http:
          paths:
          - path:
            backend:
              serviceName: myapp
              servicePort: 80
    [root@master ingress]# kubectl apply -f ingress-myapp.yaml
    ingress.extensions/ingress-myapp created

    　　

    （2）查询验证

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    [root@master ~]# kubectl get ingress
    NAME            HOSTS             ADDRESS   PORTS     AGE
    ingress-myapp   myapp.along.com             80        140d
    [root@master ~]# kubectl describe ingress ingress-myapp
    Name:             ingress-myapp
    Namespace:        default
    Address:         
    Default backend:  default-http-backend:80 (<none>)
    Rules:
      Host             Path  Backends
      ----             ----  --------
      myapp.along.com 
                          myapp:80 (<none>)
    Annotations:
      kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-myapp","namespace":"default"},"spec":{"rules":[{"host":"myapp.along.com","http":{"paths":[{"backend":{"serviceName":"myapp","servicePort":80},"path":null}]}}]}}
     
    Events:
      Type    Reason  Age   From                      Message
      ----    ------  ----  ----                      -------
      Normal  CREATE  37s   nginx-ingress-controller  Ingress default/ingress-myapp

    　　

    （3）在集群外，查询服务验证

    ① 可以先修改一下主机的hosts，因为不是公网域名

    192.168.130.103 myapp.along.com

    ② 访问业务成功

    4、创建Ingress，代理到后端tomcat服务

    4.1 准备后端pod和service

    （1）编写yaml文件，并创建

    创建3个tomcat服务的pod，并创建一个service绑定

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    [root@master ingress]# vim tomcat-deploy.yaml
    apiVersion: v1
    kind: Service
    metadata:
      name: tomcat
      namespace: default
    spec:
      selector:
        app: tomcat
        release: canary
      ports:
      - name: http
        targetPort: 8080
        port: 8080
      - name: ajp
        targetPort: 8009
        port: 8009
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: tomcat-deploy
      namespace: default
    spec:
      replicas: 3
      selector:
        matchLabels:
          app: tomcat
          release: canary
      template:
        metadata:
          labels:
            app: tomcat
            release: canary
        spec:
          containers:
          - name: tomcat
            image: tomcat:8.5.37-jre8-alpine
            ports:
            - name: http
              containerPort: 8080
            - name: ajp
              containerPort: 8009
    [root@master ingress]# kubectl apply -f tomcat-deploy.yaml
    service/tomcat created
    deployment.apps/tomcat-deploy created

    　　

    （2）查询验证

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    [root@master ~]# kubectl get pods
    NAME                            READY     STATUS    RESTARTS   AGE
    tomcat-deploy-97d6458c5-hrmrw   1/1       Running   0          1m
    tomcat-deploy-97d6458c5-ngxxx   1/1       Running   0          1m
    tomcat-deploy-97d6458c5-xchgn   1/1       Running   0          1m
    [root@master ~]# kubectl get svc
    NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
    kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP             146d
    tomcat       ClusterIP   10.98.193.252    <none>        8080/TCP,8009/TCP   1m

    　　

    4.2 创建ingress，绑定后端tomcat服务

    （1）编写yaml文件，并创建

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    [root@master ingress]# vim ingress-tomcat.yaml
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: ingress-tomcat
      namespace: default
    spec:
      rules:
      - host: tomcat.along.com
        http:
          paths:
          - path:
            backend:
              serviceName: tomcat
              servicePort: 8080
    [root@master ingress]# kubectl apply -f ingress-tomcat.yaml
    ingress.extensions/ingress-tomcat created

    （2）查询验证

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    [root@master ~]# kubectl get ingress
    NAME             HOSTS              ADDRESS   PORTS     AGE
    ingress-myapp    myapp.along.com              80        17m
    ingress-tomcat   tomcat.along.com             80        6s
    [root@master ~]# kubectl describe ingress ingress-tomcat
    Name:             ingress-tomcat
    Namespace:        default
    Address:         
    Default backend:  default-http-backend:80 (<none>)
    Rules:
      Host              Path  Backends
      ----              ----  --------
      tomcat.along.com 
                           tomcat:8080 (<none>)
    Annotations:
      kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-tomcat","namespace":"default"},"spec":{"rules":[{"host":"tomcat.along.com","http":{"paths":[{"backend":{"serviceName":"tomcat","servicePort":8080},"path":null}]}}]}}
     
    Events:
      Type    Reason  Age   From                      Message
      ----    ------  ----  ----                      -------
      Normal  CREATE  17s   nginx-ingress-controller  Ingress default/ingress-tomcat

    　　

    （3）在集群外，查询服务验证

    ① 可以先修改一下主机的hosts，因为不是公网域名

    192.168.130.103 tomcat.along.com

    ② 访问业务成功

    4.3 使用https协议访问服务

    4.3.1 创建证书、私钥和secret

    （1）创建私钥

    ?
    1
    2
    3
    4
    5
    6
    7
    [root@master ingress]# openssl genrsa -out tls.key 2048
    Generating RSA private key, 2048 bit long modulus
    .............................................+++
    ...............+++
    e is 65537 (0x10001)
    [root@master ingress]# ls *key
    tls.key

    　　

    （2）创建证书

    ?
    1
    2
    3
    [root@master ingress]# openssl req -new -x509 -key tls.key -out tls.crt -subj /C=CN/ST=Beijing/L=Beijing/O=DevOps/CN=tomcat.along.com
    [root@master ingress]# ls tls.*
    tls.crt  tls.key

    　　

    （3）创建secret

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    [root@master ingress]# kubectl create secret tls tomcat-ingress-secret --cert=tls.crt --key=tls.key
    secret/tomcat-ingress-secret created
    [root@master ingress]# kubectl get secret
    NAME                              TYPE                                  DATA      AGE
    tomcat-ingress-secret             kubernetes.io/tls                     2         8s
    [root@master ingress]# kubectl describe secret tomcat-ingress-secret
    Name:         tomcat-ingress-secret
    Namespace:    default
    Labels:       <none>
    Annotations:  <none>
     
    Type:  kubernetes.io/tls
     
    Data
    ====
    tls.key:  1675 bytes
    tls.crt:  1294 bytes

    　　

    4.3.2 重新创建ingress，使用https协议绑定后端tomcat服务

    （1）编写yaml文件，并创建

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    [root@master ingress]# vim ingress-tomcat-tls.yaml
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: ingress-tomcat-tls
      namespace: default
    spec:
      tls:
      - hosts:
        - tomcat.along.com
        secretName: tomcat-ingress-secret
      rules:
      - host: tomcat.along.com
        http:
          paths:
          - path:
            backend:
              serviceName: tomcat
              servicePort: 8080

    　　

    （2）查询验证

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    [root@master ~]# kubectl get ingress
    NAME                 HOSTS              ADDRESS   PORTS     AGE
    ingress-myapp        myapp.along.com              80        34m
    ingress-tomcat       tomcat.along.com             80        16m
    ingress-tomcat-tls   tomcat.along.com             80, 443   8s
    [root@master ~]# kubectl describe ingress ingress-tomcat-tls
    Name:             ingress-tomcat-tls
    Namespace:        default
    Address:         
    Default backend:  default-http-backend:80 (<none>)
    TLS:
      tomcat-ingress-secret terminates tomcat.along.com
    Rules:
      Host              Path  Backends
      ----              ----  --------
      tomcat.along.com 
                           tomcat:8080 (<none>)
    Annotations:
      kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-tomcat-tls","namespace":"default"},"spec":{"rules":[{"host":"tomcat.along.com","http":{"paths":[{"backend":{"serviceName":"tomcat","servicePort":8080},"path":null}]}}],"tls":[{"hosts":["tomcat.along.com"],"secretName":"tomcat-ingress-secret"}]}}
     
    Events:
      Type    Reason  Age   From                      Message
      ----    ------  ----  ----                      -------
      Normal  CREATE  14s   nginx-ingress-controller  Ingress default/ingress-tomcat-tls

    　　

    （3）在集群外，查询服务验证

    使用https协议，访问业务成功

     
  • 相关阅读:
    thinkpa R61i安装XP SATA的解决方法
    成都港宏4S店买的日产，送的无牌DVD 和可视倒车品牌是路特仕 80007
    设计模式之：解剖观察者模式
    java使用siger 获取服务器硬件信息（CPU 内存 网络 io等）
    lephone 壁纸(裸婚时代 童佳倩姚笛壁纸)
    C# 让程序自动以管理员身份运行
    项目管理的5大过程组、9大知识域、44个管理流程的映射关系
    Spring Security 中如何让用户名不存在的错误显示出来（用户名不存在显示Bad credentials）
    eclipse老是报ThreadPoolExecutor$Worker.run()
    Unison文件夹同步工具
  • 原文地址：https://www.cnblogs.com/dengbingbing/p/10399196.html
Copyright © 2011-2022 走看看