Kubernetes之Ingress-Nginx
简介
ingress-Nginx和ingress-Nginx-Controller的区别
ingress-Nginx:是每个服务自己创建的ingress,就是nginx的转发规则,生成Nginx的配置文件
ingress-Nginx-Controller:相当于Nginx的服务,监听API Server,根据用户编写的ingress-nginx规则(ingress.yaml文件),动态的去更改Nginx服务的配置文件,并且reload使其生效,此过程是自动化的,通过lua实现
ingress-Nginx-Controller 的Service类型
NodePort:用Deployment的方式部署一个ingress-nginx-controller,再创建一个type为NodePort的Service,这样就在集群的所有Node节点暴露了ingress-nginx-controller的端口,然后找几台机器挂在公有云的ELB后面,然后把域名解析到公有云的ELB就实现的服务的对外暴露
LoadBalance:用Deployment部署一个ingress-nginx-controller,再创建一个type为LoadBalancer的Service关联这组Pod.大部分公有云,都会为LoadBalancer的Service自动创建一个负载均衡器,通常还绑定的公网地址,只要把域名指向该地址,就实现了服务的对外暴露
部署ingress-Nginx-Controller
1.ingress-Nginx-Crontoller所需的ServiceAccount,用来访问API Server
apiVersion: v1 kind: ServiceAccount metadata: labels: app: nginx-ingress chart: nginx-ingress-1.26.2 heritage: Helm release: nginx-ingress name: nginx-ingress namespace: se secrets: - name: nginx-ingress-token-9bbd4
2.ingress-Nginx-Controller中ServiceAccount所需的Secret(通过base64加密之后的ca和token)
apiVersion: v1 data: ca.crt: LS0tLS1CUJBZ0lVUXVqazcwRmhXQm43dXQ1M3liMWdLeXNkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKb3N01DVGpPK2VNd0h3WURWUjBqQkJnd0ZvQVVXYTVCSzQvSApOMjdteEVvaVB3N01DVGpPK2VNd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFJcDlveFJTb29OelNGQmJrMEMvCmIwbVNvTUFlSU5vOVYrNWFEdGg3eExjWjZPazJCYVFWV1ZLK2ZVYW45WQpjaTQ9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K namespace: c2U= token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklpSjkuZZoWTJOdmRXNTBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5dVlXMWxjM0JoWTJVaU9pSnpaU0lzSW10MVltVnlibRTRXVlSjN2U0NlcTc5S25ENFdaWnoybXBvR1RuLVZHUFI4ai1B kind: Secret metadata: name: nginx-ingress-token-9bbd4 namespace: se type: kubernetes.io/service-account-token
3.ingress-Nginx-Controller的 Deployment配置文件
apiVersion: extensions/v1beta1 kind: Deployment metadata: labels: app: nginx-ingress chart: nginx-ingress-1.26.2 component: controller heritage: Helm release: nginx-ingress name: nginx-ingress-controller namespace: se spec: replicas: 1 selector: matchLabels: app: nginx-ingress component: controller release: nginx-ingress template: metadata: labels: app: nginx-ingress component: controller release: nginx-ingress spec: containers: - args: - /nginx-ingress-controller - --default-backend-service=se/nginx-ingress-default-backend - --election-id=ingress-controller-leader - --ingress-class=nginx - --configmap=se/nginx-ingress-controller env: - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: hrb.xxxx.com/library/nginx-ingress-controller:0.26.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: nginx-ingress-controller ports: - containerPort: 80 name: http protocol: TCP - containerPort: 443 name: https protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 securityContext: allowPrivilegeEscalation: true capabilities: add: - NET_BIND_SERVICE drop: - ALL runAsUser: 33 serviceAccount: nginx-ingress serviceAccountName: nginx-ingress
4.ingress-Nginx-Controller的Service配置文件
apiVersion: v1 kind: Service metadata: labels: app: nginx-ingress chart: nginx-ingress-1.26.2 component: controller heritage: Helm release: nginx-ingress name: nginx-ingress-controller namespace: se spec: ports: - name: http nodePort: 30080 port: 80 protocol: TCP targetPort: http - name: https nodePort: 30443 port: 443 protocol: TCP targetPort: https selector: app: nginx-ingress component: controller release: nginx-ingress type: NodePort
5.查看ingress-Nginx-Controller的Service
kubectl get svc nginx-ingress-controller -n se NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE nginx-ingress-controller NodePort 192.168.2.67 <none> 80:30080/TCP,443:30443/TCP 1d
进行到这步,ingress-Nginx-Controller已经部署完了,所有的集群Node节点都已经监听30080和30443端口
AWS上申请ELB,然后找两个固定的Node节点,专门做转发用,不做Pod调度
- ELB的80端口-->Node节点的NodePort30080端口
- ELB的443端口-->Node节点的NodePort30443端口
部署一个测试用的服务
1.测试服务的Deployment配置文件
apiVersion: extensions/v1beta1 kind: Deployment metadata: labels: app: test-docker env: stg name: test-docker namespace: test spec: replicas: 1 selector: matchLabels: app: test-docker template: metadata: labels: app: test-docker env: stg spec: containers: - env: - name: K8S_ENV value: stg - name: K8S_CLUSTER value: aws - name: CPU_REQUEST valueFrom: resourceFieldRef: containerName: test-docker divisor: "0" resource: requests.cpu - name: MEM_REQUEST valueFrom: resourceFieldRef: containerName: test-docker divisor: "0" resource: requests.memory - name: CPU_LIMIT valueFrom: resourceFieldRef: containerName: test-docker divisor: "0" resource: limits.cpu - name: MEM_LIMIT valueFrom: resourceFieldRef: containerName: test-docker divisor: "0" resource: limits.memory - name: TZ value: Asia/Shanghai - name: POD_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP image: hrb.xxx.com/test-docker:1.0.428.7eb2128 imagePullPolicy: IfNotPresent name: test-docker ports: - containerPort: 8025 protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /status port: 8025 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: cpu: "1" memory: 2000Mi requests: cpu: 100m memory: 2000Mi volumeMounts: - mountPath: /etc/localtime name: host-time readOnly: true - mountPath: /data/logs name: log - mountPath: /app/conf name: config-volume readOnly: true volumes: - hostPath: path: /etc/localtime type: "" name: host-time - hostPath: path: /data/logs/test-docker-stg type: "" name: log - configMap: defaultMode: 420 name: test-docker name: config-volume
2.测试服务的Service配置文件
apiVersion: v1 kind: Service metadata: name: test-docker namespace: test spec: ports: - name: http-8025 port: 8025 protocol: TCP targetPort: 8025 selector: app: test-docker type: ClusterIP
3.测试服务的ingress配置文件
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: test-docker namespace: test spec: rules: - host: test.baidu.com http: paths: - backend: serviceName: test-docker servicePort: 8025 path: /
到这里,测试服务部署完成,测试服务的域名可以解析到ELB,然后就完成通过域名访问了.
服务怎么通过ingress暴露出去,然后用域名访问的?
1.先创建ingress-nginx-controller,ingress-nginx-controller的Server通过NodePort方式暴露端口,这样所有K8S集群的Node节点全部监听NodePort端口,这个就相当于是Nginx的服务
那Nginx的配置文件怎么来呢,ingress-nginx-controller监听API Server,用户在K8S集群内创建完服务的ingress之后,ingress-nginx-controller就会加载这个ingress里面的规则信息,并更新到ingress-nginx-controller的配置文件里
2.创建一个AWS的ELB,解析到随便两台Node节点
3.用户创建一个服务,先创建Deployment、Service、ingress,然后ingress里写上域名 转发到 某个Service上，然后service会转发到 具体的Pod上的
4.ingress里配置的域名解析到ELB的地址,就行了,就能通过域名访问K8S集群的服务了.
