14 部署Ingress
#服务反向代理
#部署Traefik 2.0版本
14.1创建 traefik-crd.yaml 文件 (yanglin1)
[root@yanglin1 ~]# mkdir /root/ingress && cd /root/ingress [root@yanglin1 ~]# vim traefik-crd.yaml ## IngressRoute apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: ingressroutes.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: IngressRoute plural: ingressroutes singular: ingressroute --- ## IngressRouteTCP apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: ingressroutetcps.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: IngressRouteTCP plural: ingressroutetcps singular: ingressroutetcp --- ## Middleware apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: middlewares.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: Middleware plural: middlewares singular: middleware --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: tlsoptions.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: TLSOption plural: tlsoptions singular: tlsoption
14.1.1 :Q创建Traefik CRD资源(yanglin1)
[root@yanglin1 ~]# cd /root/ingress [root@yanglin1 ingress]# kubectl create -f traefik-crd.yaml customresourcedefinition.apiextensions.k8s.io/ingressroutes.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/ingressroutetcps.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/middlewares.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/tlsoptions.traefik.containo.us created [root@yanglin1 ingress]# kubectl get CustomResourceDefinition NAME CREATED AT ingressroutes.traefik.containo.us 2022-06-13T08:40:56Z ingressroutetcps.traefik.containo.us 2022-06-13T08:40:56Z middlewares.traefik.containo.us 2022-06-13T08:40:56Z tlsoptions.traefik.containo.us 2022-06-13T08:40:56Z
14.2 创建Traefik RBAC文件(master-1)
[root@yanglin1 ~]# vi traefik-rbac.yaml apiVersion: v1 kind: ServiceAccount metadata: namespace: kube-system name: traefik-ingress-controller --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: traefik-ingress-controller rules: - apiGroups: [""] resources: ["services","endpoints","secrets"] verbs: ["get","list","watch"] - apiGroups: ["extensions"] resources: ["ingresses"] verbs: ["get","list","watch"] - apiGroups: ["extensions"] resources: ["ingresses/status"] verbs: ["update"] - apiGroups: ["traefik.containo.us"] resources: ["middlewares"] verbs: ["get","list","watch"] - apiGroups: ["traefik.containo.us"] resources: ["ingressroutes"] verbs: ["get","list","watch"] - apiGroups: ["traefik.containo.us"] resources: ["ingressroutetcps"] verbs: ["get","list","watch"] - apiGroups: ["traefik.containo.us"] resources: ["tlsoptions"] verbs: ["get","list","watch"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: traefik-ingress-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controller subjects: - kind: ServiceAccount name: traefik-ingress-controller namespace: kube-system
14.2.1 创建RABC 资源
[root@yanglin1 ingress]# kubectl create -f traefik-rbac.yaml serviceaccount/traefik-ingress-controller created clusterrole.rbac.authorization.k8s.io/traefik-ingress-controller created clusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created
14.3 创建Traefik ConfigMap (yanglin1)
[root@yanglin1 ~]# vi traefik-config.yaml kind: ConfigMap apiVersion: v1 metadata: name: traefik-config data: traefik.yaml: |- serversTransport: insecureSkipVerify: true api: insecure: true dashboard: true debug: true metrics: prometheus: "" entryPoints: web: address: ":80" websecure: address: ":443" providers: kubernetesCRD: "" log: filePath: "" level: error format: json accessLog: filePath: "" format: json bufferingSize: 0 filters: retryAttempts: true minDuration: 20 fields: defaultMode: keep names: ClientUsername: drop headers: defaultMode: keep names: User-Agent: redact Authorization: drop Content-Type: keep
14.3.1 创建Traefik ConfigMap资源配置
[root@yanglin1 ~]# kubectl apply -f traefik-config.yaml -n kube-system
14.4 设置节点标签
#设置节点label [root@yanglin1 ingress]# kubectl label nodes 192.168.177.155 IngressProxy=true #暂时不做 [root@yanglin1 ingress]# kubectl label nodes 192.168.177.156 IngressProxy=true
14.4.1 查看节点标签
#检查是否成功 [root@yanglin1 ingress]# kubectl get nodes --show-labels
14.5 创建 traefik 部署文件
#注意每个Node节点的80与443端口不能被占用 [root@yanglin1 ingress]# netstat -antupl | grep -E "80|443" [root@yanglin1 ingress]# vi traefik-deploy.yaml apiVersion: v1 kind: Service metadata: name: traefik spec: ports: - name: web port: 80 - name: websecure port: 443 - name: admin port: 8080 selector: app: traefik --- apiVersion: apps/v1 kind: DaemonSet metadata: name: traefik-ingress-controller labels: app: traefik spec: selector: matchLabels: app: traefik template: metadata: name: traefik labels: app: traefik spec: serviceAccountName: traefik-ingress-controller terminationGracePeriodSeconds: 1 containers: - image: traefik:latest name: traefik-ingress-lb ports: - name: web containerPort: 80 hostPort: 80 - name: websecure containerPort: 443 hostPort: 443 - name: admin containerPort: 8080 resources: limits: cpu: 2000m memory: 1024Mi requests: cpu: 1000m memory: 1024Mi securityContext: capabilities: drop: - ALL add: - NET_BIND_SERVICE args: - --configfile=/config/traefik.yaml volumeMounts: - mountPath: "/config" name: "config" volumes: - name: config configMap: name: traefik-config tolerations: - operator: "Exists" nodeSelector: IngressProxy: "true"
14.5.1部署 Traefik 资源
[root@yanglin1 ingress]# kubectl apply -f traefik-deploy.yaml -n kube-system #查看运行状态 [root@yanglin1 ingress]# kubectl get DaemonSet -n kube-system NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE traefik-ingress-controller 1 1 1 1 1 IngressProxy=true 77s
14.6 Traefik 路由配置
14.6.1 配置Traefik Dashboard
[root@yanglin1 ingress]# vi traefik-dashboard-route.yaml apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: traefik-dashboard-route namespace: kube-system spec: entryPoints: - web routes: - match: Host(`ingress.abcd.com`) kind: Rule services: - name: traefik port: 8080 #创建Ingress (traefik) [root@yanglin1 ingress]# kubectl apply -f traefik-dashboard-route.yaml
14.6.2 客户端访问Traefik Dashboard
14.6.2.1 绑定物理主机Hosts文件或者域名解析
/etc/hosts
192.168.177.155 ingress.abcd.com
访问web
14.7 部署访问服务(http)
#创建nginx服务 [root@yanglin1 ingress]# kubectl run nginx-ingress-demo1 --image=nginx --replicas=1 -n kube-system [root@yanglin1 ingress]# kubectl expose deployment nginx-ingress-demo1 --port=1099 --target-port=80 -n kube-system #创建nginx路由服务 vim nginx-ingress-demo-route1.yaml apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: traefik-nginx-demo-route1 namespace: kube-system spec: entryPoints: - web routes: - match: Host(`nginx11.abcd.com`) kind: Rule services: - name: nginx-ingress-demo1 port: 1099 #创建 [root@yanglin1 ingress]# kubectl apply -f nginx-ingress-demo-route1.yaml [root@yanglin1 ingress]# kubectl get IngressRoute -A NAMESPACE NAME AGE default traefik-dashboard-route 48m kube-system traefik-nginx-demo-route 68s #访问 #绑定hosts (物理机器) 192.168.177.155 nginx11.abcd.com
14.8 创建https服务
#代理dashboard https 服务 # 创建自签名证书 [root@master-1 ingress]# cd /root/ingress [root@master-1 ingress]# openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=cloud.abcd.com" #将证书存储到 Kubernetes Secret中 [root@master-1 ingress]# kubectl create secret tls dashboard-tls --key=tls.key --cert=tls.crt -n kube-system #查看系统secret [root@master-1 ingress]# kubectl get secret NAME TYPE DATA AGE default-token-l77nw kubernetes.io/service-account-token 3 6d22h traefik-ingress-controller-token-pdbhn kubernetes.io/service-account-token 3 132m #创建路由文件 #先查询kuberbentes dashboard 的命名空间 [root@master-1 ingress]# cat kubernetes-dashboard-route.yaml #注意命名空间 apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: kubernetes-dashboard-route namespace: kube-system spec: entryPoints: - websecure tls: secretName: dashboard-tls routes: - match: Host(`cloud.abcd.com`) kind: Rule services: - name: kubernetes-dashboard port: 443 #创建 Kubernetes Dashboard 路由规则对象 [root@master-1 ingress]# kubectl apply -f kubernetes-dashboard-route.yaml #查看创建的路由 [root@master-1 ingress]# kubectl get IngressRoute -A NAMESPACE NAME AGE default traefik-dashboard-route 125m kube-system traefik-nginx-demo-route 77m kube-system traefik-nginx-demo-route1 3m5s kubernetes-dashboard kubernetes-dashboard-route 13s #绑定hosts 访问 192.168.91.21 cloud.abcd.com 配置完成后，打开浏览器输入地址：https://cloud.abcd.com打开 Dashboard Dashboard。
14.9 TCP服务访问
#修改配置文件 #traefik-config.yaml entryPoints: web: address: ":80" websecure: address: ":443" redistcp: address: ":6379" #应用配置 [root@yanglin1 ingress]# kubectl apply -f traefik-config.yaml -n kube-system #修改配置文件 #traefik-deploy.yaml containers: ports: - name: web containerPort: 80 hostPort: 80 - name: websecure containerPort: 443 hostPort: 443 - name: admin containerPort: 8080 - name: redistcp containerPort: 6379 hostPort: 6379 #应用配置 [root@yanglin1 ingress]#kubectl apply -f traefik-deploy.yaml -n kube-system #配置redis文件 [root@yanglin1 ingress]# cat redis-tcp-deploy.yaml apiVersion: extensions/v1beta1 kind: Deployment metadata: name: redis-tcp spec: template: metadata: labels: app: redis-tcp spec: containers: - name: redis-tcp image: redis ports: - containerPort: 6379 protocol: TCP --- apiVersion: v1 kind: Service metadata: name: redis-tcp-svc spec: ports: - port: 6379 targetPort: 6379 selector: app: redis-tcp #部署redis [root@yanglin1 ingress]# kubectl apply -f redis-tcp-deploy.yaml deployment.extensions/redis-tcp unchanged service/redis-tcp-svc unchanged #配置路由 [root@yanglin1 ingress]# cat traefik-redis-tcp-route.yaml apiVersion: traefik.containo.us/v1alpha1 kind: IngressRouteTCP metadata: name: redis-tcp-ingress spec: entryPoints: - redistcp routes: - match: HostSNI(`*`) services: - name: redis-tcp-svc port: 6379 weight: 10 terminationDelay: 400 #部署路由 [root@yanglin1 ingress]# kubectl apply -f traefik-redis-tcp-route.yaml #查看界面 #绑定任意主机名到node节点访问 #192.168.177.155 redis.cc.com (注意节点,也可以直接使用node Ip 访问) [root@yanglin2 ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo [root@yanglin2 ~]# redis-cli -h 192.168.177.155 -p 6379 或者 [root@yanglin2 ~]# redis-cli -h redis.cc.com -p 6379 redis.cc.com:6379> set a 12131 OK redis.cc.com:6379> get a "12131"
