前言
在Kubernetes中，服务和Pod的IP地址仅可以在集群网络内部使用，对于集群外的应用是不可见的。为了使外部的应用能够访问集群内的服务，在Kubernetes中目前提供了以下几种方案：
* NodePort
* LoadBalancer
* Ingress
在之前的博文中介绍过NodePort，简单来说，就是通过service这种资源对象，为后端pod提供一个统一的访问接口，然后将service的统一访问接口映射到群集节点上，最终实现client通过映射到群集节点上的端口访问到后端pod提供的服务。
但是，这种方式有一个弊端，就是当新生成一个pod服务就需要创建对应的service将其映射到节点端口，当运行的pod过多时，我们节点暴露给client端的端口也会随之增加，这样我们整个k8s群集的危险系数就会增加，因为我们在搭建群集之处，官方明确指出，必须关闭firewalld防火墙及清空iptables规则，现在我们又暴露了那么多端口给client，安全系数可想而知。
一、Ingress-nginx介绍
1、Ingress-nginx组成
* ingress-nginx-controller：根据用户编写的ingress规则（创建的ingress的yaml文件），
动态的去更改nginx服务的配置文件，并且reload重载使其生效（是自动化的，通过lua脚本来实现）；
* ingress资源对象：将Nginx的配置抽象成一个Ingress对象，每添加一个新的Service资
源对象只需写一个新的Ingress规则的yaml文件即可（或修改已存在的ingress规则的yaml文件）
2、Ingress-nginx可以解决什么问题？
1)动态配置服务
如果按照传统方式, 当新增加一个服务时, 我们可能需要在流量入口加一个反向代理指
向我们新的k8s服务. 而如果用了Ingress-nginx, 只需要配置好这个服务, 当服务启动
时, 会自动注册到Ingress的中, 不需要而外的操作。
2)减少不必要的端口映射
配置过k8s的都清楚, 第一步是要关闭防火墙的, 主要原因是k8s的很多服务会
以NodePort方式映射出去, 这样就相当于给宿主机打了很多孔, 既不安全也不优雅.
而Ingress可以避免这个问题, 除了Ingress自身服务可能需要映射出去, 其他服务都不要
用NodePort方式
3、Ingress-nginx工作原理
1）ingress controller通过和kubernetes api交互，动态的去感知集群中ingress规则变化，
2）然后读取它，按照自定义的规则，规则就是写明了哪个域名对应哪个service，生成一段nginx配置，
3）再写到nginx-ingress-controller的pod里，这个Ingress controller的pod里运行着一个Nginx服务，控制器会把生成的nginx配置写入/etc/nginx.conf文件中，
4）然后reload一下使配置生效。以此达到域名分别配置和动态更新的问题。
2、创建namespace（也可跳过，使用默认的default名称空间也可以，但需要删除下面所有yaml文件中关于自定义的名称空间的配置字段）
[root@master ~]# kubectl create ns test-ns //创建名称空间test-ns
[root@master ~]# kubectl get ns //确认创建成功
3、创建Deployment、Service资源对象
1）创建httpd服务及其service与之关联
---
apiVersion: apps/v1
kind: Deployment
metadata:
annotations: {}
labels:
app: httpd01
k8s.kuboard.cn/name: web01
name: web01
namespace: test-ns
spec:
progressDeadlineSeconds: 600
replicas: 3
revisionHistoryLimit: 10
selector:
matchLabels:
app: httpd01
k8s.kuboard.cn/name: web01
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
creationTimestamp: null
labels:
app: httpd01
k8s.kuboard.cn/name: web01
spec:
containers:
- image: '192.168.0.140:881/library/httpd:latest'
imagePullPolicy: IfNotPresent
name: httpd
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 30
---
apiVersion: v1
kind: Service
metadata:
annotations: {}
name: httpd-svc
namespace: test-ns
spec:
internalTrafficPolicy: Cluster
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- name: httpd-svc
port: 80
protocol: TCP
targetPort: 80
selector:
app: httpd01
sessionAffinity: None
type: ClusterIP
2）创建tomcat服务及其service
---
apiVersion: apps/v1
kind: Deployment
metadata:
annotations: {}
labels:
app: tomcat01
k8s.kuboard.cn/name: web02
name: web02
name: web02
namespace: test-ns
spec:
progressDeadlineSeconds: 600
replicas: 3
revisionHistoryLimit: 10
selector:
matchLabels:
app: tomcat01
k8s.kuboard.cn/name: web02
name: web02
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
creationTimestamp: null
labels:
app: tomcat01
k8s.kuboard.cn/name: web02
name: web02
spec:
containers:
- image: '192.168.0.140:881/library/tomcat:8.5.45'
imagePullPolicy: IfNotPresent
name: tomcat
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
terminationGracePeriodSeconds: 30
---
apiVersion: v1
kind: Service
metadata:
annotations: {}
name: tomcat-svc
namespace: test-ns
spec:
internalTrafficPolicy: Cluster
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- name: tomcat-svc
port: 8080
protocol: TCP
targetPort: 8080
selector:
app: tomcat01
sessionAffinity: None
type: ClusterIP
3）确保以上资源对象成功创建
[root@master ~]# kubectl get pod -n test-ns //确定pod是正常运行状态
NAME READY STATUS RESTARTS AGE
web01-85674fbdd7-7h6cc 1/1 Running 0 9m3s
web01-85674fbdd7-9l2zm 1/1 Running 0 9m3s
web01-85674fbdd7-p9hfx 1/1 Running 0 9m3s
web02-7f8f755bc7-4qk9b 1/1 Running 0 7m22s
web02-7f8f755bc7-qhbnm 1/1 Running 0 7m22s
web02-7f8f755bc7-zr56g 1/1 Running 0 7m22s
[root@master ~]# kubectl get svc -n test-ns //确认SVC创建成功
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
httpd-svc ClusterIP 10.102.57.12 <none> 80/TCP 10m
tomcat-svc ClusterIP 10.110.25.145 <none> 8080/TCP 8m23s
[root@master ~]# curl -I 10.102.57.12:80 //访问httpd
HTTP/1.1 200 OK
Date: Sun, 23 Aug 2020 07:02:06 GMT
Server: Apache/2.4.46 (Unix)
Last-Modified: Mon, 11 Jun 2007 18:53:14 GMT
ETag: "2d-432a5e4a73a80"
Accept-Ranges: bytes
Content-Length: 45
Content-Type: text/html
[root@master ~]# curl -I 10.110.25.145:8080 //访问tomcat
HTTP/1.1 200
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Date: Sun, 23 Aug 2020 09:08:18 GMT
//OK，以上表示内部访问是没有问题的
//如果在上述访问测试中，没有访问到相应的pod，建议使用“kubectl describe svc”命令，
查看相应的service中的Endpoints列中有没有关联后端pod。
4、创建Ingress-nginx资源对象
ingress-nginx.yaml 直接apply
k apply -f ingress.nginx.yaml
apiVersion: v1
kind: Namespace
metadata:
labels:
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
name: ingress-nginx
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx
namespace: ingress-nginx
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx
namespace: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- endpoints
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resourceNames:
- ingress-nginx-leader
resources:
- leases
verbs:
- get
- update
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- create
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission
namespace: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
- secrets
- namespaces
verbs:
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- validatingwebhookconfigurations
verbs:
- get
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx
namespace: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ingress-nginx
subjects:
- kind: ServiceAccount
name: ingress-nginx
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission
namespace: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
name: ingress-nginx-admission
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: ingress-nginx
subjects:
- kind: ServiceAccount
name: ingress-nginx
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
name: ingress-nginx-admission
namespace: ingress-nginx
---
apiVersion: v1
data:
allow-snippet-annotations: "false"
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-controller
namespace: ingress-nginx
---
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-controller
namespace: ingress-nginx
spec:
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- appProtocol: http
name: http
port: 80
protocol: TCP
targetPort: http
- appProtocol: https
name: https
port: 443
protocol: TCP
targetPort: https
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
type: NodePort
---
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-controller-admission
namespace: ingress-nginx
spec:
ports:
- appProtocol: https
name: https-webhook
port: 443
targetPort: webhook
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-controller
namespace: ingress-nginx
spec:
minReadySeconds: 0
revisionHistoryLimit: 10
selector:
matchLabels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
strategy:
rollingUpdate:
maxUnavailable: 1
type: RollingUpdate
template:
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
spec:
containers:
- args:
- /nginx-ingress-controller
- --election-id=ingress-nginx-leader
- --controller-class=k8s.io/ingress-nginx
- --ingress-class=nginx
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
- --validating-webhook=:8443
- --validating-webhook-certificate=/usr/local/certificates/cert
- --validating-webhook-key=/usr/local/certificates/key
- --enable-metrics=false
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: LD_PRELOAD
value: /usr/local/lib/libmimalloc.so
image: 192.168.0.140:881/ingress-nginx/controller:v1.10.1
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
livenessProbe:
failureThreshold: 5
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: controller
ports:
- containerPort: 80
name: http
protocol: TCP
- containerPort: 443
name: https
protocol: TCP
- containerPort: 8443
name: webhook
protocol: TCP
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
resources:
requests:
cpu: 100m
memory: 90Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
readOnlyRootFilesystem: false
runAsNonRoot: true
runAsUser: 101
seccompProfile:
type: RuntimeDefault
volumeMounts:
- mountPath: /usr/local/certificates/
name: webhook-cert
readOnly: true
dnsPolicy: ClusterFirst
nodeSelector:
kubernetes.io/os: linux
serviceAccountName: ingress-nginx
terminationGracePeriodSeconds: 300
volumes:
- name: webhook-cert
secret:
secretName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission-create
namespace: ingress-nginx
spec:
template:
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission-create
spec:
containers:
- args:
- create
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
- --namespace=$(POD_NAMESPACE)
- --secret-name=ingress-nginx-admission
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: 192.168.0.140:881/ingress-nginx/kube-webhook-certgen:v1.4.1
imagePullPolicy: IfNotPresent
name: create
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65532
seccompProfile:
type: RuntimeDefault
nodeSelector:
kubernetes.io/os: linux
restartPolicy: OnFailure
serviceAccountName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission-patch
namespace: ingress-nginx
spec:
template:
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission-patch
spec:
containers:
- args:
- patch
- --webhook-name=ingress-nginx-admission
- --namespace=$(POD_NAMESPACE)
- --patch-mutating=false
- --secret-name=ingress-nginx-admission
- --patch-failure-policy=Fail
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: 192.168.0.140:881/ingress-nginx/kube-webhook-certgen:v1.4.1
imagePullPolicy: IfNotPresent
name: patch
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65532
seccompProfile:
type: RuntimeDefault
nodeSelector:
kubernetes.io/os: linux
restartPolicy: OnFailure
serviceAccountName: ingress-nginx-admission
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: nginx
spec:
controller: k8s.io/ingress-nginx
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.10.1
name: ingress-nginx-admission
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: ingress-nginx-controller-admission
namespace: ingress-nginx
path: /networking/v1/ingresses
failurePolicy: Fail
matchPolicy: Equivalent
name: validate.nginx.ingress.kubernetes.io
rules:
- apiGroups:
- networking.k8s.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- ingresses
sideEffects: None
5、定义Ingress规则（编写ingress的yaml文件）
ingress.yaml
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
name: test-ingress
namespace: test-ns
spec:
ingressClassName: nginx
rules:
- host: www.test01.com
http:
paths:
- backend:
service:
name: httpd-svc
port:
number: 80
path: /
pathType: Prefix
- backend:
service:
name: tomcat-svc
port:
number: 8080
path: /tomcat
pathType: Prefix
status:
loadBalancer:
ingress:
- ip: 192.168.0.61
[root@master~]# vim ingress.yaml //编写yaml文件如下
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test-ingress
namespace: test-ns
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: www.test01.com
http:
paths:
- path: /
backend:
serviceName: httpd-svc
servicePort: 80
- path: /tomcat
backend:
serviceName: tomcat-svc
servicePort: 8080
[root@master~]# kubectl apply -f ingress.yaml //执行ingress规则的yaml文件
[root@master~]# kubectl get ingresses -n test-ns //查看ingresses规则资源对象
NAME HOSTS ADDRESS PORTS AGE
test-ingress www.test01.com 80 28s
注：其实，至此已经实现了我们想要的功能，现在就可以通过www.test01.com 来访问到我们后端httpd容器提供的服务，通过www.test01.com/tomcat 来访问我们后端tomcat提供的服务，当然，前提是自行配置DNS解析，或者直接修改client的hosts文件。访问页面如下（注意：一定要自己解决域名解析的问题，若不知道域名对应的是哪个IP，请跳过这两个图，看下面的文字解释）：
[root@master ~]# kubectl get pod -n ingress-nginx -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-ingress-controller-86cdd68cf-hndtw 1/1 Running 0 89m 192.168.45.141 node01 <none> <none>
在上面的访问测试中，虽然访问到了对应的服务，但是有一个弊端，就是在做DNS解析的时候，只能指定Ingress-nginx容器所在的节点IP。而指定k8s集群内部的其他节点IP（包括master）都是不可以访问到的，如果这个节点一旦宕机，Ingress-nginx容器被转移到其他节点上运行（不考虑节点标签的问题，其实保持Ingress-nginx的yaml文件中默认的标签的话，那么每个节点都是有那个标签的）。随之还要我们手动去更改DNS解析的IP（要更改为Ingress-nginx容器所在节点的IP，通过命令“kubectl get pod -n ingress-nginx -o wide”可以查看到其所在节点），很是麻烦。
有没有更简单的一种方法呢？答案是肯定的，就是我们为Ingress-nginx规则再创建一个类型为nodePort的Service，这样，在配置DNS解析时，就可以使用www.test01.com 绑定所有node节点，包括master节点的IP了，很是灵活。
6、为Ingress规则创建一个Service
在刚才获取Ingress-controller资源对象的yaml文件的页面，然后下拉页面，即可看到以下，可以根据k8s集群环境来选择适合自己的yaml文件。假如自己是在Azure云平台搭建的K8s集群，则选择复制Azure下面的命令即可，我这里是自己的测试环境，所以选择Bare-metal下面的yaml文件，如图：
[root@master ~]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.29.0/deploy/static/provider/baremetal/service-nodeport.yaml
//如若下载失败，直接复制粘贴编辑即可
[root@master ~]# cat service-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
type: NodePort
ports:
- name: http
port: 80
targetPort: 80
protocol: TCP
- name: https
port: 443
targetPort: 443
protocol: TCP
selector:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
//编辑完，保存退出即可
[root@master ~]# kubectl apply -f service-nodeport.yaml //执行yaml文件
[root@master ~]# kubectl get svc -n ingress-nginx //查看运行的service
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx NodePort 10.108.48.248 <none> 80:32529/TCP,443:30534/TCP 11s
//可以看到service分别将80和443端口映射到了节点的32529和30543端口（随机映射的，也可以修改yaml文件指定端口）
注：至此，这个www.test01.com 的域名即可和群集中任意节点的32529/30543端口进行绑定了。
测试如下（域名解析对应的IP可以是k8s群集内的任意节点IP）：
至此，就实现了最初的需求！！
7、创建基于虚拟主机的Ingress规则
如果现在是另一种需求，我需要将www.test01.com 和www.test02.com 都对应上我后端的httpd容器提供的服务，那么此时应该怎么配置？
[root@master test]# vim ingress.yaml #修改ingress规则的yaml文件如下
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test-ingress
namespace: test-ns
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: www.test02.com //增加这一段host配置
http:
paths:
- path: /
backend:
serviceName: httpd-svc //绑定和www.test01相同的service名字即可
servicePort: 80
- host: www.test01.com
http:
paths:
- path: /
backend:
serviceName: httpd-svc
servicePort: 80
- path: /tomcat
backend:
serviceName: tomcat-svc
servicePort: 8080
//增加完上述的host字段保存退出即可
[root@master test]# kubectl apply -f ingress.yaml //重新执行yaml文件
至此，即可实现访问www.test01.com 和www.test02.com 都可以访问到后端的httpd提供的页面（自行解决域名解析问题=域名解析配置client hosts文件即可），如下：
总结上述示例的pod是如何一步一步可以使client访问到的，总结如下：
后端pod===》service====》ingress规则====》写入Ingress-nginx-controller配置文件并自动重载使更改生效===》对Ingress-nginx创建service====》实现client无论通过哪个K8节点的IP+端口都可以访问到后端pod
三、配置HTTPS
在上面的操作中，实现了使用ingress-nginx为后端所有pod提供一个统一的入口，那么，有一个非常严肃的问题需要考虑，就是如何为我们的pod配置CA证书来实现HTTPS访问？在pod中直接配置CA么？那需要进行多少重复性的操作？而且，pod是随时可能被kubelet杀死再创建的。当然这些问题有很多解决方法，比如直接将CA配置到镜像中，但是这样又需要很多个CA证书。
这里有更简便的一种方法，就拿上面的情况来说，后端有多个pod，pod与service进行关联，service又被ingress规则发现并动态写入到ingress-nginx-controller容器中，然后又为ingress-nginx-controller创建了一个Service映射到群集节点上的端口，来供client来访问。
在上面的一系列流程中，关键的点就在于ingress规则，我们只需要在ingress的yaml文件中，为域名配置CA证书即可，只要可以通过HTTPS访问到域名，至于这个域名是怎么关联到后端提供服务的pod，这就是属于k8s群集内部的通信了，即便是使用http来通信，也无伤大雅。
配置如下：
接下来的配置与上面的配置基本没什么关系，但是由于上面已经运行了Ingress-nginx-controller容器，所以这里就没有必要再运行了。只需要配置pod、service、ingress规则即可。
//创建CA证书（测试环境，自己创建吧）
[root@master https]# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"
//当前目录下会生成两个文件，如下：
[root@master https]# ls #确定当前目录下有这两个文件
tls.crt tls.key
//将生成的CA证书存储到etcd
[root@master https]# kubectl create secret tls tls-secret --key=tls.key --cert tls.crt
//创建deploy、service、ingress资源对象
[root@master https]# vim httpd03.yaml //编写yaml文件
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
name: web03
spec:
replicas: 2
template:
metadata:
labels:
app: httpd03
spec:
containers:
- name: httpd3
image: 192.168.45.129:5000/httpd:v1
---
apiVersion: v1
kind: Service
metadata:
name: httpd-svc3
spec:
selector:
app: httpd03
ports:
- protocol: TCP
port: 80
targetPort: 80
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test-ingress3
spec:
tls:
- hosts:
- www.test03.com
secretName: tls-secret //这里是指定的是etcd存储的CA证书名称
rules:
- host: www.test03.com
http:
paths:
- path: /
backend:
serviceName: httpd-svc3
servicePort: 80
[root@master https]# kubectl apply -f httpd03.yaml //执行yaml文件
确认创建的资源对象是否正常运行：
[root@master https]# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
httpd-svc3 ClusterIP 10.96.4.68 <none> 80/TCP 9s
kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 12d
[root@master https]# kubectl get pod
NAME READY STATUS RESTARTS AGE
web03-b955f886b-gjbnr 1/1 Running 0 7m23s
web03-b955f886b-w8cdn 1/1 Running 0 7m23s
[root@master https]# kubectl describe ingresses. //查看ingress规则
Name: test-ingress3
Namespace: default
Address:
Default backend: default-http-backend:80 (<none>)
TLS:
tls-secret terminates www.test03.com
Rules:
Host Path Backends
---- ---- --------
www.test03.com
/ httpd-svc3:80 (10.244.1.5:80,10.244.2.5:80)
//确定关联到对应的service及后端的pod
注：使用https://www.test03.com 进行访问（自行解决域名解析问题）
