1.Ingress服務簡介
一種全域的、為了代理不同后端 Service 而設定的負載均衡服務，就是 Kubernetes 里的Ingress 服務，
Ingress由兩部分組成：Ingress controller和Ingress服務，
Ingress Controller 會根據你定義的 Ingress 物件，提供對應的代理能力，業界常用的各種反向代理專案，比如 Nginx、HAProxy、Envoy、Traefik 等，都已經為Kubernetes 專門維護了對應的 Ingress Controller，
ingress服務的使用必須在策略網路中才能實作，如calico網路
ingress相當于一個7層的負載均衡器，是k8s對反向代理的一個抽象，大概的作業原理也確實類似于Nginx，可以理解成在 Ingress 里建立一個個映射規則 , ingress Controller 通過監聽 Ingress這個api物件里的配置規則并轉化成 Nginx 的配置（kubernetes宣告式API和控制回圈） , 然后對外部提供服務，ingress包括：ingress controller和ingress resources
ingress controller：核心是一個deployment，實作方式有很多，比如nginx, Contour, Haproxy, trafik, Istio，需要撰寫的yaml有：Deployment, Service, ConfigMap, ServiceAccount（Auth），其中service的型別可以是NodePort或者LoadBalancer，
ingress resources：這個就是一個型別為Ingress的k8s api物件了，這部分則是面向開發人員，
2.ingress部署
mkdir ingress
cd ingress/
下載所需要的deploy.yaml
vi deploy.yaml
image: ingress-nginx/controller:v1.0.3
image: ingress-nginx/kube-webhook-certgen:v1.5.1
在自己的倉庫中添加公開專案ingress-nginx專門存放相關的鏡像
執行deploy.yaml清單，查看ns狀態
kubectl apply -f deploy.yaml
kubectl get ns
查看ingress-nginx的所有資訊，可以看到ingress-nginx-controller已經running
kubectl -n ingress-nginx get all
查看svc暴露埠
kubectl -n ingress-nginx get svc
測驗：訪問server1ip地址加上埠
3.域名訪問+ingress-nginx(配置ingress-nginx七層均衡)
3.1創建pod：nginx myapp
vi deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
app: nginx
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: myapp:v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: myapp-deployment
labels:
app: myapp
spec:
replicas: 3
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: myapp
image: myapp:v2
拉起deployment，通過標簽來鎖定域名
3.2配置添加svc服務
vi svc.yaml
apiVersion: v1
kind: Service
metadata:
name: nginx-svc
spec:
ports:
- protocol: TCP
port: 80
targetPort: 80
selector:
app: nginx
---
apiVersion: v1
kind: Service
metadata:
name: myapp-svc
spec:
ports:
- protocol: TCP
port: 80
targetPort: 80
selector:
app: myapp
拉起服務并查看endpoint
應用yaml檔案，創建服務
kubectl apply -f svc.yaml
查看服務資訊
kubectl get svc
修改svc組態檔為負載均衡
kubectl -n ingress-nginx edit svc ingress-nginx-controller
查看修改內容
kubectl -n ingress-nginx get svc
external-ip 為 172.25.76.10
3.3服務與ingress連接，并給定域名 ,用于匹配service
vi ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-nginx
spec:
rules:
- host: www1.westos.org
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: nginx-svc
port:
number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-myapp
spec:
rules:
- host: www2.westos.org
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: myapp-svc
port:
number: 80
拉起資源清單
kubectl apply -f ingress.yaml
查看ingress反向代理資訊
kubectl get ingress
測驗機添加決議到服務節點172.25.76.10
vi /etc/hosts
172.25.76.10 www1.westos.org www2.westos.org
訪問測驗：
[root@foundation76 ingress]# curl www2.westos.org
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>
[root@foundation76 ingress]# curl www1.westos.org
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
4.Ingress 認證
因為認證需要系統自帶的認證功能！
所以需要安裝生成認證整數的插件
yum install -y httpd-tools
4.1.生成證書
生成證書，輸入認證密碼
創建證書到k8s secret
htpasswd -c auth lcf #生成證書，輸入認證密碼
kubectl create secret generic basic-auth --from-file=auth
# 創建證書到k8s secret
kubectl get secrets
編輯檔案ingress.yaml匯入證書
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-nginx
annotations:
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - lcf'
spec:
tls:
- hosts:
- www1.westos.org
secretName: tls-secret
rules:
- host: www1.westos.org
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: nginx-svc
port:
number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-myapp
annotations:
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - lcf'
spec:
tls:
- hosts:
- www2.westos.org
secretName: tls-secret
rules:
- host: www2.westos.org
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: myapp-svc
port:
number: 80
執行ingress.yaml檔案
kubectl apply -f ingress.yaml
訪問測驗
curl -k https://www1.westos.org -u lcf:westos
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
5. 重定向
5.1.重定向到 /hostname.html
修改檔案ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-nginx
annotations:
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - lcf'
nginx.ingress.kubernetes.io/app-root: /hostname.html
spec:
tls:
- hosts:
- www1.westos.org
secretName: tls-secret
rules:
- host: www1.westos.org
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: nginx-svc
port:
number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-myapp
annotations:
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - lcf'
nginx.ingress.kubernetes.io/app-root: /hostname.html
spec:
tls:
- hosts:
- www2.westos.org
secretName: tls-secret
rules:
- host: www2.westos.org
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: myapp-svc
port:
number: 80
再次執行檔案ingress.yaml,查看資訊：
kubectl apply -f ingress.yaml
kubectl describe ingress
訪問www1.westos.org發現自動重定向到了www1.westos.org/hostname.html
轉載請註明出處，本文鏈接：https://www.uj5u.com/ruanti/333654.html
標籤：其他
上一篇：django+uwsgi+nginx部署訪問出現問題（無法解決尋求幫助)
下一篇：ospf基礎