kubernetes系列09—Ingress控制器详解

1、认识Ingress

1.1 什么是Ingress？

　　通常情况下，service和pod仅可在集群内部网络中通过IP地址访问。所有到达边界路由器的流量或被丢弃或被转发到其他地方。从概念上讲，可能像下面这样：

    internet

        |

  ------------

  [ Services ]

Ingress是授权入站连接到达集群服务的规则集合。

    internet

        |

   [ Ingress ]

   --|-----|--

   [ Services ]

　　你可以给Ingress配置提供外部可访问的URL、负载均衡、SSL、基于名称的虚拟主机等。用户通过POST Ingress资源到API server的方式来请求ingress。 Ingress controller负责实现Ingress，通常使用负载平衡器，它还可以配置边界路由和其他前端，这有助于以HA方式处理流量。

1.2 Ingress工作示意图

1.3先决条件

　　在使用Ingress resource之前，有必要先了解下面几件事情。Ingress是beta版本的resource，在kubernetes1.1之前还没有。你需要一个Ingress Controller来实现Ingress，单纯的创建一个Ingress没有任何意义。

　　GCE/GKE会在master节点上部署一个ingress controller。你可以在一个pod中部署任意个自定义的ingress controller。你必须正确地annotate每个ingress，比如运行多个ingress controller 和关闭glbc.

　　确定你已经阅读了Ingress controller的beta版本限制。在非GCE/GKE的环境中，你需要在pod中部署一个controller。

1.4 Ingress定义资源清单几个字段

apiVersion： v1 版本
kind： Ingress 类型
metadata 元数据
spec 期望状态
- backend：默认后端，能够处理与任何规则不匹配的请求
- rules：用于配置Ingress的主机规则列表
- tls：目前Ingress仅支持单个TLS端口443
status 当前状态

2、部署一个Ingress

（1）在gitlab上下载yaml文件，并创建部署

gitlab ingress-nginx项目：https://github.com/kubernetes/ingress-nginx

ingress安装指南：https://kubernetes.github.io/ingress-nginx/deploy/

因为需要拉取镜像，所以需要等一段时间

---下载需要的yaml文件

[root@master ingress-nginx]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml

---查询下载成功

[root@master ingress-nginx]# ls

mandatory.yaml

---创建ingress

[root@master ingress-nginx]# kubectl apply -f mandatory.yaml

namespace/ingress-nginx created

configmap/nginx-configuration created

configmap/tcp-services created

configmap/udp-services created

serviceaccount/nginx-ingress-serviceaccount created

clusterrole.rbac.authorization.k8s.io/nginx-ingress-clusterrole created

role.rbac.authorization.k8s.io/nginx-ingress-role created

rolebinding.rbac.authorization.k8s.io/nginx-ingress-role-nisa-binding created

clusterrolebinding.rbac.authorization.k8s.io/nginx-ingress-clusterrole-nisa-binding created

deployment.apps/nginx-ingress-controller created

（2）如果是裸机，还需要安装service

[root@master ingress-nginx]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/baremetal/service-nodeport.yaml

[root@master ingress-nginx]# kubectl apply -f service-nodeport.yaml

service/ingress-nginx created

（3）验证

---查询生产的pod

[root@master ~]# kubectl get pods -n ingress-nginx

NAME                                        READY     STATUS    RESTARTS   AGE

nginx-ingress-controller-648c7bb65b-df9qz   1/1       Running   0          34m

---查询生产的svc

[root@master ingress-nginx]# kubectl get svc -n ingress-nginx

NAME            TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE

ingress-nginx   NodePort   10.109.244.123   <none>        80:30080/TCP,443:30443/TCP   21s

---查询svc的详细信息

[root@master ~]# kubectl describe svc ingress-nginx -n ingress-nginx

Name:                     ingress-nginx

Namespace:                ingress-nginx

Labels:                   app.kubernetes.io/name=ingress-nginx

                          app.kubernetes.io/part-of=ingress-nginx

Annotations:              kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"app.kubernetes.io/name":"ingress-nginx","app.kubernetes.io/part-of":"ingres...

Selector:                 app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx

Type:                     NodePort

IP:                       10.111.143.90

Port:                     http  80/TCP

TargetPort:               80/TCP

NodePort:                 http  30080/TCP

Endpoints:                10.244.1.104:80

Port:                     https  443/TCP

TargetPort:               443/TCP

NodePort:                 https  30443/TCP

Endpoints:                10.244.1.104:443

Session Affinity:         None

External Traffic Policy:  Cluster

Events:                   <none>

3、创建Ingress，代理到后端nginx服务

3.1 准备后端pod和service

（1）编写yaml文件，并创建

创建3个nginx服务的pod，并创建一个service绑定

[root@master ingress]# vim deploy-damo.yaml

apiVersion: v1

kind: Service

metadata:

  name: myapp

  namespace: default

spec:

  selector:

    app: myapp

    release: canary

  ports:

  - name: http

    targetPort: 80

    port: 80

---

apiVersion: apps/v1

kind: Deployment

metadata:

  name: myapp-deploy

  namespace: default

spec:

  replicas: 3

  selector:

    matchLabels:

      app: myapp

      release: canary

  template:

    metadata:

      labels:

        app: myapp

        release: canary

    spec:

      containers:

      - name: myapp

        image: ikubernetes/myapp:v2

        ports:

        - name: http

          containerPort: 80

[root@master ingress]# kubectl apply -f deploy-damo.yaml

service/myapp created

deployment.apps/myapp-deploy created

（2）查询验证

[root@master ~]# kubectl get svc

NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE

kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP   146d

myapp        ClusterIP   10.103.137.126   <none>        80/TCP    6s

[root@master ~]# kubectl get pods

NAME                            READY     STATUS    RESTARTS   AGE

myapp-deploy-67f6f6b4dc-2vzjn   1/1       Running   0          14s

myapp-deploy-67f6f6b4dc-c7f76   1/1       Running   0          14s

myapp-deploy-67f6f6b4dc-x79hc   1/1       Running   0          14s

[root@master ~]# kubectl describe svc myapp

Name:              myapp

Namespace:         default

Labels:            <none>

Annotations:       kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"myapp","namespace":"default"},"spec":{"ports":[{"name":"http","port":80,"targe...

Selector:          app=myapp,release=canary

Type:              ClusterIP

IP:                10.103.137.126

Port:              http  80/TCP

TargetPort:        80/TCP

Endpoints:         10.244.1.102:80,10.244.1.103:80,10.244.2.109:80

Session Affinity:  None

Events:            <none>

3.2 创建ingress，绑定后端nginx服务

（1）编写yaml文件，并创建

[root@master ingress]# vim ingress-myapp.yaml

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

  name: ingress-myapp

  namespace: default

spec:

  rules:

  - host: myapp.along.com

    http:

      paths:

      - path:

        backend:

          serviceName: myapp

          servicePort: 80

[root@master ingress]# kubectl apply -f ingress-myapp.yaml

ingress.extensions/ingress-myapp created

（2）查询验证

[root@master ~]# kubectl get ingress

NAME            HOSTS             ADDRESS   PORTS     AGE

ingress-myapp   myapp.along.com             80        140d

[root@master ~]# kubectl describe ingress ingress-myapp

Name:             ingress-myapp

Namespace:        default

Address:

Default backend:  default-http-backend:80 (<none>)

Rules:

  Host             Path  Backends

  ----             ----  --------

  myapp.along.com

                      myapp:80 (<none>)

Annotations:

  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-myapp","namespace":"default"},"spec":{"rules":[{"host":"myapp.along.com","http":{"paths":[{"backend":{"serviceName":"myapp","servicePort":80},"path":null}]}}]}}

Events:

  Type    Reason  Age   From                      Message

  ----    ------  ----  ----                      -------

  Normal  CREATE  37s   nginx-ingress-controller  Ingress default/ingress-myapp

（3）在集群外，查询服务验证

① 可以先修改一下主机的hosts，因为不是公网域名

192.168.130.103 myapp.along.com

② 访问业务成功

kubernetes系列09—Ingress控制器详解

4、创建Ingress，代理到后端tomcat服务

4.1 准备后端pod和service

（1）编写yaml文件，并创建

创建3个tomcat服务的pod，并创建一个service绑定

[root@master ingress]# vim tomcat-deploy.yaml

apiVersion: v1

kind: Service

metadata:

  name: tomcat

  namespace: default

spec:

  selector:

    app: tomcat

    release: canary

  ports:

  - name: http

    targetPort: 8080

    port: 8080

  - name: ajp

    targetPort: 8009

    port: 8009

---

apiVersion: apps/v1

kind: Deployment

metadata:

  name: tomcat-deploy

  namespace: default

spec:

  replicas: 3

  selector:

    matchLabels:

      app: tomcat

      release: canary

  template:

    metadata:

      labels:

        app: tomcat

        release: canary

    spec:

      containers:

      - name: tomcat

        image: tomcat:8.5.37-jre8-alpine

        ports:

        - name: http

          containerPort: 8080

        - name: ajp

          containerPort: 8009

[root@master ingress]# kubectl apply -f tomcat-deploy.yaml

service/tomcat created

deployment.apps/tomcat-deploy created

（2）查询验证

[root@master ~]# kubectl get pods

NAME                            READY     STATUS    RESTARTS   AGE

tomcat-deploy-97d6458c5-hrmrw   1/1       Running   0          1m

tomcat-deploy-97d6458c5-ngxxx   1/1       Running   0          1m

tomcat-deploy-97d6458c5-xchgn   1/1       Running   0          1m

[root@master ~]# kubectl get svc

NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE

kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP             146d

tomcat       ClusterIP   10.98.193.252    <none>        8080/TCP,8009/TCP   1m

4.2 创建ingress，绑定后端tomcat服务

（1）编写yaml文件，并创建

[root@master ingress]# vim ingress-tomcat.yaml

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

  name: ingress-tomcat

  namespace: default

spec:

  rules:

  - host: tomcat.along.com

    http:

      paths:

      - path:

        backend:

          serviceName: tomcat

          servicePort: 8080

[root@master ingress]# kubectl apply -f ingress-tomcat.yaml

ingress.extensions/ingress-tomcat created

（2）查询验证

[root@master ~]# kubectl get ingress

NAME             HOSTS              ADDRESS   PORTS     AGE

ingress-myapp    myapp.along.com              80        17m

ingress-tomcat   tomcat.along.com             80        6s

[root@master ~]# kubectl describe ingress ingress-tomcat

Name:             ingress-tomcat

Namespace:        default

Address:

Default backend:  default-http-backend:80 (<none>)

Rules:

  Host              Path  Backends

  ----              ----  --------

  tomcat.along.com

                       tomcat:8080 (<none>)

Annotations:

  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-tomcat","namespace":"default"},"spec":{"rules":[{"host":"tomcat.along.com","http":{"paths":[{"backend":{"serviceName":"tomcat","servicePort":8080},"path":null}]}}]}}

Events:

  Type    Reason  Age   From                      Message

  ----    ------  ----  ----                      -------

  Normal  CREATE  17s   nginx-ingress-controller  Ingress default/ingress-tomcat

（3）在集群外，查询服务验证

① 可以先修改一下主机的hosts，因为不是公网域名

192.168.130.103 tomcat.along.com

② 访问业务成功

kubernetes系列09—Ingress控制器详解

4.3 使用https协议访问服务

4.3.1 创建证书、私钥和secret

（1）创建私钥

[root@master ingress]# openssl genrsa -out tls.key 2048

Generating RSA private key, 2048 bit long modulus

.............................................+++

...............+++

e is 65537 (0x10001)

[root@master ingress]# ls *key

tls.key

（2）创建证书

[root@master ingress]# openssl req -new -x509 -key tls.key -out tls.crt -subj /C=CN/ST=Beijing/L=Beijing/O=DevOps/CN=tomcat.along.com

[root@master ingress]# ls tls.*

tls.crt  tls.key

（3）创建secret

[root@master ingress]# kubectl create secret tls tomcat-ingress-secret --cert=tls.crt --key=tls.key

secret/tomcat-ingress-secret created

[root@master ingress]# kubectl get secret

NAME                              TYPE                                  DATA      AGE

tomcat-ingress-secret             kubernetes.io/tls                     2         8s

[root@master ingress]# kubectl describe secret tomcat-ingress-secret

Name:         tomcat-ingress-secret

Namespace:    default

Labels:       <none>

Annotations:  <none>

Type:  kubernetes.io/tls

Data

====

tls.key:  1675 bytes

tls.crt:  1294 bytes

4.3.2 重新创建ingress，使用https协议绑定后端tomcat服务

（1）编写yaml文件，并创建

[root@master ingress]# vim ingress-tomcat-tls.yaml

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

  name: ingress-tomcat-tls

  namespace: default

spec:

  tls:

  - hosts:

    - tomcat.along.com

    secretName: tomcat-ingress-secret

  rules:

  - host: tomcat.along.com

    http:

      paths:

      - path:

        backend:

          serviceName: tomcat

          servicePort: 8080

（2）查询验证

[root@master ~]# kubectl get ingress

NAME                 HOSTS              ADDRESS   PORTS     AGE

ingress-myapp        myapp.along.com              80        34m

ingress-tomcat       tomcat.along.com             80        16m

ingress-tomcat-tls   tomcat.along.com             80, 443   8s

[root@master ~]# kubectl describe ingress ingress-tomcat-tls

Name:             ingress-tomcat-tls

Namespace:        default

Address:

Default backend:  default-http-backend:80 (<none>)

TLS:

  tomcat-ingress-secret terminates tomcat.along.com

Rules:

  Host              Path  Backends

  ----              ----  --------

  tomcat.along.com

                       tomcat:8080 (<none>)

Annotations:

  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{},"name":"ingress-tomcat-tls","namespace":"default"},"spec":{"rules":[{"host":"tomcat.along.com","http":{"paths":[{"backend":{"serviceName":"tomcat","servicePort":8080},"path":null}]}}],"tls":[{"hosts":["tomcat.along.com"],"secretName":"tomcat-ingress-secret"}]}}

Events:

  Type    Reason  Age   From                      Message

  ----    ------  ----  ----                      -------

  Normal  CREATE  14s   nginx-ingress-controller  Ingress default/ingress-tomcat-tls

（3）在集群外，查询服务验证

使用https协议，访问业务成功

kubernetes系列09—Ingress控制器详解

秒客网

kubernetes系列09—Ingress控制器详解

1、认识Ingress

1.1 什么是Ingress？

1.2 Ingress工作示意图

1.3先决条件

1.4 Ingress定义资源清单几个字段

2、部署一个Ingress

3、创建Ingress，代理到后端nginx服务

3.1 准备后端pod和service

3.2 创建ingress，绑定后端nginx服务

4、创建Ingress，代理到后端tomcat服务

4.1 准备后端pod和service

4.2 创建ingress，绑定后端tomcat服务

4.3 使用https协议访问服务

4.3.1 创建证书、私钥和secret

4.3.2 重新创建ingress，使用https协议绑定后端tomcat服务

相关文章