ingress部署使用

ingress分开K8S社区版以及Nginx社区版二种实现方式，这二者有一些区别，部署以及配置参数不同

我这里使用的是k8S社区版https://github.com/kubernetes/ingress-Nginx/blob/main/docs/user-guide/Nginx-configuration/annotations.md

环境：K8S 1.18

部署选房官方文档即可，注意ingress的SVC标签需要和ingress本身对应起来，之前我在这里犯错了，个别版本的YAML文件没有SVC，单独添加的时候需要吧标签对应起来

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-Nginx/controller-v1.3.0/deploy/static/provider/cloud/deploy.yaml

我这里使用的竟像是quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0

K8S 1.19版本之前只能使用0.X开头的版本

[root@master http-test]# kubectl get all -n ingress-Nginx
NAME READY STATUS RESTARTS AGE
pod/ingress-Nginx-admission-create-qdnzw 0/1 Completed 0 16h
pod/ingress-Nginx-admission-patch-wk9zf 0/1 Completed 1 16h
pod/ingress-Nginx-controller-57fdb6d45b-pj7t4 1/1 Running 0 16h

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/ingress-Nginx-controller LoadBalancer 10.104.255.152 <pending> 80:31450/TCP,443:31451/TCP 16h
service/ingress-Nginx-controller-admission ClusterIP 10.109.27.88 <none> 443/TCP 16h

NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/ingress-Nginx-controller 1/1 1 1 16h

NAME DESIRED CURRENT READY AGE
replicaset.apps/ingress-Nginx-controller-57fdb6d45b 1 1 1 16h

NAME COMPLETIONS DURATION AGE
job.batch/ingress-Nginx-admission-create 1/1 4s 16h
job.batch/ingress-Nginx-admission-patch 1/1 8s 16h

 

这样部署好了

接下来写入INGRESS配置

 

私有证书

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.cert -subj "/CN=demo.localdev.me/O=demo.localdev.me"

创建tls 对应的secret

kubectl create secret tls ca-cert --key tls.key --cert tls.cert

 

[root@master http-test]# cat https-ingress.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
Metadata:
name: demo
#namespace: ingress-Nginx
annotations:
kubernetes.io/ingress.class: "Nginx"
#Nginx.ingress.kubernetes.io/proxy-body-size: "200m"
spec:
rules:
- host: "demo.localdev.me"
http:
paths:
- pathType: Prefix
path: /
backend:
serviceName: demo
servicePort: 80
tls:
- hosts:
- demo.localdev.me
secretName: ca-cert

 

查看ingress

[root@master http-test]# kubectl describe ingress demo
Name: demo
Namespace: default
Address:
Default backend: default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
ca-cert terminates demo.localdev.me
Rules:
Host Path Backends
---- ---- --------
demo.localdev.me
/ demo:80 (10.32.0.7:80)
Annotations: kubernetes.io/ingress.class: Nginx
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
normal UPDATE 16m nginx-ingress-controller Ingress default/demo

这里流量已经引导到10.32.0.7:80，这样就成功了，注意INGRESS需要和后端服务以及SECRET在同一个NS

 

电脑上写入ingress所在节点的真实IP进hosts文件

 

 

 

查看日志

 

 流量已经到达INGRESS，再看下后端服务的日志

 

 

流量也到HTTD服务了

生产中，这样是不能使用的，通常有一个出口IP和服务器，在出口服务器上部署一个Nginx，反向代理到所有的后端Nginx服务器，比如我这里https -->172.20.69.102:30451,http-->172.20.69.102:30450