Kubernetes-10:Ingress-nginx介绍及演示
Ingress介绍
Ingress是什么?
ingress 是除了 hostport nodeport clusterIP以及云环境专有的负载均衡器外的访问方式,官方提供了Nginx ingress controller。ingress-nginx本身就是nodeport模式
Ingress能做什么?
k8s中,不管是哪种类型的svc,不管是用iptables还是ipvs实现端口转发实现负载均衡,也只是实现了四层的负载均衡,但是,如果有需求要进行七层负载均衡呢?比如你想将你的网站设置为https呢?Ingress就是来帮你解决此问题的。
Ingress工作原理及主要组成部分?
工作原理:
类似于Nginx,可以理解为在Ingress建立一个个映射规则,Ingress Controller通过监听Ingress这个api对象里的规则并转化为Nginx/HAporxy等的配置,然后对外部提供服务。
组成部分:
ingress controller:
核心是一个deployment,实现方式有很多种,比如Nignx、HAproxy、trafik、lstio,需要编写的yaml有:Deployment、Service、ConfigMap、ServiceAccount(Auth),其中Service类型可以是NodePort或者LoadBalance
ingress resources:这个是类型为ingress的k8s api对象,主要面向开发人员。
1、下载Ingress
### 进入官网下载 https://kubernetes.github.io/ingress-nginx/deploy/
里边会有提示:
Using NodePort:
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-0.32.0/deploy/static/provider/baremetal/deploy.yaml ### 可以看到,本身就是一个yaml文件,可以先下载到本地
然后进行安装:
### 查看yaml文件中用到了那个image,可以预先下载下来,所有node都要下载 [root@Centos8 ~]# grep image /usr/local/install-k8s/ingress/deploy.yaml image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.32.0 imagePullPolicy: IfNotPresent image: jettech/kube-webhook-certgen:v1.2.0 imagePullPolicy: IfNotPresent image: jettech/kube-webhook-certgen:v1.2.0 imagePullPolicy: ### 下载完毕后,直接执行构建命令 [root@Centos8 ingress]# kubectl apply -f deploy.yaml namespace/ingress-nginx created serviceaccount/ingress-nginx created configmap/ingress-nginx-controller created clusterrole.rbac.authorization.k8s.io/ingress-nginx created clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx created role.rbac.authorization.k8s.io/ingress-nginx created rolebinding.rbac.authorization.k8s.io/ingress-nginx created service/ingress-nginx-controller-admission created service/ingress-nginx-controller created deployment.apps/ingress-nginx-controller created validatingwebhookconfiguration.admissionregistration.k8s.io/ingress-nginx-admission created clusterrole.rbac.authorization.k8s.io/ingress-nginx-admission created clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created job.batch/ingress-nginx-admission-create created job.batch/ingress-nginx-admission-patch created role.rbac.authorization.k8s.io/ingress-nginx-admission created rolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created serviceaccount/ingress-nginx-admission created ok,安装完毕 可以看到,创建了一个ingress-nginx的namespace ingress-nginx本身所有的规则全部放在ingress-nginx这个名称空间下 例如:查看pod svc [root@Centos8 k8sYaml]# kubectl get pod -n ingress-nginx NAME READY STATUS RESTARTS AGE ingress-nginx-admission-create-lrsvp 0/1 Completed 0 10m ingress-nginx-admission-patch-5hk9n 0/1 Completed 0 10m ingress-nginx-controller-5575c6cd9d-2sblm 1/1 Running 0 32m [root@Centos8 k8sYaml]# kubectl get svc -n ingress-nginx NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE ingress-nginx-controller NodePort 10.107.76.91 <none> 80:30361/TCP,443:31087/TCP 114m ingress-nginx-controller-admission ClusterIP 10.96.12.12 <none> 443/TCP 114m 可以看到ingress-nginx的svc的端口映射关系为: 80:30361/TCP,443:31087/TCP 后边的所有测试,需访问http则访问30361端口,访问https则访问31087端口
2、创建Igress HTTP代理访问
(1)首先创建deployment、Pod
(2)其次创建SVC,通过SVC来绑定与Pod之间的连接
(3)然后创建ingress,实现svc与ingress的绑定
(4)最后外网通过访问ingress映射到SVC再到具体的Pod
最后注意:ingress是通过域名进行实现转发的,所以在测试的时候不要忘记将所有用到的域名及ip加入到hosts文件中
(1)创建Deployment与svc
### www1的创建 vim svc-deployment1.yml ... apiVersion: apps/v1 kind: Deployment metadata: name: ingress-http1 namespace: default spec: replicas: 3 selector: matchLabels: app: myapp template: metadata: labels: app: myapp spec: containers: - name: myapp1 image: hub.vfancloud.com/test/myapp:v1 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: ingress-svc1 namespace: default spec: type: ClusterIP selector: app: myapp ports: - name: http port: 80 targetPort: 80 --- apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ingress1 spec: rules: - host: www1.wuzi.com http: paths: - path: / backend: serviceName: ingress-svc1 servicePort: 80 ... kubectl apply -f svc-deployment1.yml vim svc-deployment2.yml ... apiVersion: apps/v1 kind: Deployment metadata: name: ingress-http2 namespace: default spec: replicas: 3 selector: matchLabels: app: myapp2 template: metadata: labels: app: myapp2 spec: containers: - name: myapp2 image: hub.vfancloud.com/test/myapp:v2 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: ingress-svc2 namespace: default spec: type: ClusterIP selector: app: myapp2 ports: - name: http port: 80 targetPort: 80 --- apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ingress2 spec: rules: - host: www2.wuzi.com http: paths: - path: / backend: serviceName: ingress-svc2 servicePort: 80 ... kubectl apply -f svc-deployment2.yml
两个都构建完成,测试访问:
http://www1.wuzi.com:30361
http://www2.wuzi.com:30361
一个v1版本,一个v2版本
4、Ingress HTTPS代理访问
(1)创建https证书
mkdir https cd https ## 创建私钥key [root@Centos8 https]# openssl genrsa -des3 -out server.key 2048 Generating RSA private key, 2048 bit long modulus (2 primes) ........+++++ ...............................................................+++++ e is 65537 (0x010001) Enter pass phrase for server.key: Verifying - Enter pass phrase for server.key: ## 创建csr请求 [root@Centos8 https]# openssl req -new -key server.key -out server.csr Enter pass phrase for server.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:cn State or Province Name (full name) []:bj Locality Name (eg, city) [Default City]:bj Organization Name (eg, company) [Default Company Ltd]:vfan Organizational Unit Name (eg, section) []:vfan Common Name (eg, your name or your server's hostname) []: Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: ## 去除私钥的连接密码 [root@Centos8 https]# cp server.key{,.org} [root@Centos8 https]# openssl rsa -in server.key.org -out server.key ## 生成证书文件 openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt ## 生成tls格式 [root@Centos8 https]# kubectl create secret tls tls-secret --key server.key --cert server.crt secret/tls-secret created
(2)创建deployment、svc、ingress
vim ingress-https.yaml ... apiVersion: apps/v1 kind: Deployment metadata: name: ingress-deployment spec: replicas: 3 selector: matchLabels: name: in-https template: metadata: labels: name: in-https spec: containers: - name: in-https image: hub.vfancloud.com/test/myapp:v3 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: ingress-https spec: selector: name: in-https ports: - name: http port: 80 targetPort: 80 protocol: TCP --- apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ingress-https spec: tls: - hosts: - www3.wuzi.com secretName: tls-secret rules: - host: www3.wuzi.com http: paths: - path: / backend: serviceName: ingress-https servicePort: 80 ... [root@Centos8 https]# kubectl apply -f ingress-https.yaml [root@Centos8 https]# kubectl get ingress NAME HOSTS ADDRESS PORTS AGE ingress-https www3.wuzi.com 192.168.152.253 80, 443 16m ingress1 www1.wuzi.com 192.168.152.253 80 45m ingress2 www2.wuzi.com 192.168.152.253 80 45m
测试访问ingress https
注意,访问的是svc的443相对应的端口
导航栏输入:https://www3.wuzi.com:31087
ok,访问到了
5、Nginx进行BasicAuth
### 首先使用htpasswd命令创建BasicAuth用户,切记,保存的文件名一定要是auth [root@Centos8 auth]# htpasswd -c auth vfan New password: Re-type new password: Adding password for user vfan ### 创建secret [root@Centos8 auth]# kubectl create secret generic basic-auth --from-file=auth secret/basic-auth created ### 创建yaml文件 vim auth.yaml ... apiVersion: apps/v1 kind: Deployment metadata: name: ingress-auth spec: replicas: 3 selector: matchLabels: name: auth template: metadata: labels: name: auth spec: containers: - name: ingress-auth image: hub.vfancloud.com/test/myapp:v4 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: svc-auth spec: selector: name: auth ports: - name: http port: 80 targetPort: 80 protocol: TCP --- apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: ingress-with-auth annotations: nginx.ingress.kubernetes.io/auth-type: basic nginx.ingress.kubernetes.io/auth-secret: basic-auth nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - vfan' spec: rules: - host: www4.wuzi.com http: paths: - path: / backend: serviceName: auth-svc servicePort: 80 ... [root@Centos8 auth]# kubectl apply -f auth.yaml [root@Centos8 auth]# kubectl get ingress NAME HOSTS ADDRESS PORTS AGE ingress-with-auth www4.wuzi.com 192.168.152.253 80 94s ingress-https www3.wuzi.com 192.168.152.253 80, 443 33m ingress1 www1.wuzi.com 192.168.152.253 80 62m ingress2 www2.wuzi.com 192.168.152.253 80 62m
测试访问:
6、Ingress-Nginx重写
Name |
Description |
Values |
nginx.ingress.kubernetes.io/rewrite-target |
必须将流量重定向到的目标URI |
string |
nginx.ingress.kubernetes.io/ssl-redirect |
指示位置部分是否仅可访问SSL(Ingress包含证书时默认为True) |
bool |
nginx.ingress.kubernetes.io/force-ssl-redirect |
即使未启用TLS,也强制将重定向到HTTPS |
bool |
nginx.ingress.kubernetes.io/app-root |
定义如果在“ /”上下文中,控制器必须重定向的应用程序根 |
string |
nginx.ingress.kubernetes.io/use-regex |
指示在Ingress上定义的路径是否使用正则表达式 |
bool |
示例:
将访问www5.wuzi.com 访问 / 目录的流量全部转发至https://www3.wuzi.com:31087
vim rewrite.yaml ... apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: annotations: nginx.ingress.kubernetes.io/rewrite-target: https://www3.wuzi.com:31087 name: rewrite namespace: default spec: rules: - host: www5.wuzi.com http: paths: - backend: serviceName: ingress-svc1 servicePort: 80 path: / ... [root@Centos8 rewrite]# kubectl create -f rewrite.yaml ingress.networking.k8s.io/rewrite created [root@Centos8 rewrite]# kubectl get ingress NAME HOSTS ADDRESS PORTS AGE ingress-https www3.wuzi.com 192.168.152.253 80, 443 148m ingress-with-auth www4.wuzi.com 192.168.152.253 80 20m ingress1 www1.wuzi.com 192.168.152.253 80 177m ingress2 www2.wuzi.com 192.168.152.253 80 177m rewrite www5.wuzi.com 192.168.152.253 80 41s
测试访问:
http://www5.wuzi.com:30361
已跳转