一、概述
Ingress-nginx:它是由Kubernetes社区基于Nginx Web服务器开发的,并补充了一组用于实现额外功能的Lua插件,作为“官方”默认控制器支持当然最优。
Github:https://github.com/kubernetes/ingress-nginx
说明文档:https://kubernetes.github.io/ingress-nginx/deploy/
Nginx-ingress:这是Nginx官方社区开发产品,Nginx ingress具有很高的稳定性,持续的向后兼容性,没有任何第三方模块,并且由于消除了Lua代码而保证了较高的速度。
Github:https://github.com/nginxinc/kubernetes-ingress
说明文档:https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/
差异对比:
更多详情:https://github.com/nginxinc/kubernetes-ingress/blob/master/docs/nginx-ingress-controllers.md
二、自定义配置
Ingress-nginx:
apiVersion: v1 kind: ConfigMap metadata: labels: helm.sh/chart: ingress-nginx-2.13.0 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 0.35.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx-controller namespace: ingress-nginx data: proxy-connect-timeout: 5 proxy-read-timeout: 60 client-body-buffer-size: "8k" worker-processes: "4" max-worker-connections: 16384
更多公共配置参考:https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
特定Ingress配置:https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/
Nginx-ingress:
apiVersion: v1 metadata: name: nginx-config namespace: nginx-ingress data: proxy-connect-timeout: "60s" proxy-read-timeout: "60s" client-max-body-size: "80m" worker-processes: "4" worker-connections: "10240" external-status-address: "10.88.88.108"
常用配置说明:
proxy-connect-timeout: 定义与代理服务器建立连接的超时,默认60s。请注意,此超时通常不能超过75秒。
proxy-read-timeout: 定义用于从代理服务器读取响应的超时,默认60s。超时仅在两次连续的读取操作之间设置,而不用于传输整个响应。
如果代理服务器在此时间内未传输任何内容,则连接将关闭。
client-max-body-size: 设置客户端请求正文的最大允许大小,默认1m,在“ Content-Length”请求标头字段中指定。
如果请求中的大小超过配置的值,则会向客户端返回413(请求实体太大)错误。
请注意,浏览器无法正确显示此错误。设置size
为0将禁用客户端请求主体大小的检查。
worker-processes: 定义工作进程数。最佳值取决于许多因素,包括(但不限于)CPU内核数,存储数据的硬盘驱动器数以及加载模式。
如有疑问,将其设置为可用的CPU内核数将是一个不错的开始(默认值“auto
”将尝试自动检测)。worker-connections: 设置工作进程可以打开的最大同时连接数,默认1024。
应当记住,该数目包括所有连接(例如,与代理服务器的连接等),而不仅包括与客户端的连接。
另一个需要考虑的因素是,并发连接的实际数量不能超过打开文件最大数量的当前限制,可以通过worker_rlimit_nofile进行更改 。external-status-address: 设置要在Ingress资源状态下负载的地址,需要-report-status
命令行参数,并且将覆盖-external-service
参数。
三、资源定义
1) 同一域名,不同URL被转发不同服务
Ingress-nginx:
apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: ymtapi namespace: ymt annotations: kubernetes.io/ingress.class: "nginx" spec: rules: - host: k8s.ymtapi.org http: paths: - path: /wxapi backend: serviceName: apprestserver servicePort: 8114 - path: /api backend: serviceName: appsocialmanservice servicePort: 8113
Nginx-ingress:
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ymtapi namespace: ymt annotations: kubernetes.io/ingress.class: "nginx" spec: rules: - host: k8s.ymtapi.org http: paths: - path: /wxapi backend: serviceName: apprestserver servicePort: 8114 - path: /api backend: serviceName: appsocialmanservice servicePort: 8113
2) 不同域名被转发不同服务
Ingress-nginx:
apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: prometheus namespace: monitoring annotations: kubernetes.io/ingress.class: "nginx" spec: rules: - host: k8s.grafana.com http: paths: - path: / backend: serviceName: grafana servicePort: 3000 - host: k8s.prometheus.com http: paths: - path: / backend: serviceName: prometheus-k8s servicePort: 9090 - host: k8s.alertmanager.com http: paths: - path: / backend: serviceName: alertmanager-main servicePort: 9093
Nginx-ingress:
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: prometheus namespace: monitoring spec: rules: - host: k8s.grafana.com http: paths: - path: / backend: serviceName: grafana servicePort: 3000 - host: k8s.prometheus.com http: paths: - path: / backend: serviceName: prometheus-k8s servicePort: 9090 - host: k8s.alertmanager.com http: paths: - path: / backend: serviceName: alertmanager-main servicePort: 9093
3)不使用域名的转发
Ingress-nginx:
apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: ymtapi namespace: ymt annotations: kubernetes.io/ingress.class: "nginx" spec: rules: - http: paths: - path: /WxTransWeb backend: serviceName: wxtransweb servicePort: 8080
Nginx-ingress:
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ymtapi namespace: ymt annotations: kubernetes.io/ingress.class: "nginx" nginx.org/server-snippets: "server_name ~^.*$;" spec: rules: - host: k8s.ymtapi.org http: paths: - path: /WxTransWeb backend: serviceName: wxtransweb servicePort: 8080
注意:Nginx-ingress要求host必须存在,也就是必须使用域名,如果想直接使用IP访问,则只能通过设置"server_name ~^.*$;"实现,即同时支持域名和IP访问,但是仅能设置一个Ingress。
Github issue:https://github.com/nginxinc/kubernetes-ingress/issues/209#issuecomment-581691384
4)基于TLS的安全设置
Ingress-nginx:
apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: dashboard namespace: kubernetes-dashboard annotations: kubernetes.io/ingress.class: "nginx" nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" spec: tls: - hosts: - k8s.dashboard.com secretName: tls-secret rules: - host: k8s.dashboard.com http: paths: - path: / backend: serviceName: kubernetes-dashboard servicePort: 443
Nginx-ingress:
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: dashboard namespace: kubernetes-dashboard annotations: nginx.org/redirect-to-https: "true" ingress.kubernetes.io/ssl-redirect: "true" nginx.org/ssl-services: "kubernetes-dashboard" spec: tls: - hosts: - k8s.dashboard.com secretName: tls-secret rules: - host: k8s.dashboard.com http: paths: - path: / backend: serviceName: kubernetes-dashboard servicePort: 443
作者:Leozhanggg
出处:https://www.cnblogs.com/leozhanggg/p/13603215.html
本文版权归作者和博客园共有,欢迎转载,但未经作者同意必须保留此段声明,且在文章页面明显位置给出原文连接,否则保留追究法律责任的权利。