Ingress-Nginx使用指南上篇

一.部署Ingress-Nginx
二.Ingress Nginx初体验实战案例
三.Ingress Nginx实现域名重定向
四.Ingress Nginx区分移动端和pc端
五.Ingress Nginx基本认证
六.Ingress Nginx实现前后端分离
七.Ingress Nginx https

一.部署Ingress-Nginx

1.Ingress-Nginx和nginx-Ingress的区别对比

Ingress-Nginx是K8S官方写的一个Ingress Controller，而"nginx-Ingress"是Nginx官方写的资源清单。

注意，部署时要观察对比一下K8S和Ingress-Nginx对应的版本以来关系哟。

github地址:
	https://github.com/kubernetes/ingress-nginx

2.Ingress-Nginx的安装方式

安装文档:
	https://kubernetes.github.io/ingress-nginx/deploy/#installation-guide
	
	
如上图所示，官方推荐了三种安装方式:
	- 使用"helm"安装;
	- 使用"kubectl apply"创建yaml资源清单的方式进行安装;
	- 使用第三方插件的方式进行安装;

3.基于helm安装Ingress-nginx

	1.添加Ingress-nginx的官方仓库
[root@master231 ~]# helm repo add yinzhengjie-ingress-nginx  https://kubernetes.github.io/ingress-nginx
"yinzhengjie-ingress-nginx" has been added to your repositories
[root@master231 ~]# 
[root@master231 ~]# helm repo list
NAME                     	URL                                       
yinzhengjie-ingress-nginx	https://kubernetes.github.io/ingress-nginx
[root@master231 ~]# 

·
	2.更新软件源
[root@master231 ~]# helm repo update
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "yinzhengjie-ingress-nginx" chart repository
Update Complete. ⎈Happy Helming!⎈
[root@master231 ~]# 


	3.下载指定版本的ingres-nginx软件包
[root@master231 ~]# helm search repo ingress-nginx
NAME                                   	CHART VERSION	APP VERSION	DESCRIPTION                                       
yinzhengjie-ingress-nginx/ingress-nginx	4.9.0        	1.9.5      	Ingress controller for Kubernetes using NGINX a...
[root@master231 ~]# 
[root@master231 ~]# helm pull yinzhengjie-ingress-nginx/ingress-nginx --version 4.2.5


	4.解压软件包
[root@master231 ~]# tar xf ingress-nginx-4.2.5.tgz 


	5.修改配置文件
[root@master231 ~]# sed -i '/registry:/s#registry.k8s.io#registry.cn-hangzhou.aliyuncs.com#g' ingress-nginx/values.yaml
[root@master231 ~]# sed -i 's#ingress-nginx/controller#yinzhengjie-k8s/ingress-nginx#' ingress-nginx/values.yaml 
[root@master231 ~]# sed -i 's#ingress-nginx/kube-webhook-certgen#yinzhengjie-k8s/ingress-nginx#' ingress-nginx/values.yaml
[root@master231 ~]# sed -i 's#v1.3.0#kube-webhook-certgen-v1.3.0#' ingress-nginx/values.yaml
[root@master231 ~]# sed -ri '/digest:/s@^@#@' ingress-nginx/values.yaml
[root@master231 ~]# sed -i '/hostNetwork:/s#false#true#' ingress-nginx/values.yaml
[root@master231 ~]# sed -i  '/dnsPolicy/s#ClusterFirst#ClusterFirstWithHostNet#' ingress-nginx/values.yaml
[root@master231 ~]# sed -i '/kind/s#Deployment#DaemonSet#' ingress-nginx/values.yaml 
[root@master231 ~]# sed -i '/default:/s#false#true#'  ingress-nginx/values.yaml

温馨提示:
	- 修改镜像为国内的镜像，否则无法下载海外镜像，除非你会FQ;
	- 如果使用我提供的镜像需要将digest注释掉，因为我的镜像是从海外同步过来的，被重新构建过，其digest不一致;
	- 建议大家使用宿主机网络效率最高，但是使用宿主机网络将来DNS解析策略会直接使用宿主机的解析;
	- 如果还想要继续使用K8S内部的svc名称解析，则需要将默认的"ClusterFirst"的DNS解析策略修改为"ClusterFirstWithHostNet";
	- 建议将Deployment类型改为DaemonSet类型，可以确保在各个节点部署一个Pod，也可以修改"nodeSelector"字段让其调度到指定节点;
	- 如果仅有一个ingress controller，可以考虑将"ingressClassResource.default"设置为true，表示让其成为默认的ingress controller;


	6.创建Ingress专用的名称空间
[root@master231 ~]# kubectl create ns yinzhengjie-ingress
namespace/yinzhengjie-ingress created
[root@master231 ~]# 


	7.使用helm一键安装Ingress
[root@master231 ~]# helm install myingress ingress-nginx -n yinzhengjie-ingress 
NAME: myingress
LAST DEPLOYED: Fri Jan 19 20:43:01 2024
NAMESPACE: yinzhengjie-ingress
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
The ingress-nginx controller has been installed.
It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status by running 'kubectl --namespace yinzhengjie-ingress get services -o wide -w myingress-ingress-nginx-controller'

An example Ingress that makes use of the controller:
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: example
    namespace: foo
  spec:
    ingressClassName: nginx
    rules:
      - host: www.example.com
        http:
          paths:
            - pathType: Prefix
              backend:
                service:
                  name: exampleService
                  port:
                    number: 80
              path: /
    # This section is only required if TLS is to be enabled for the Ingress
    tls:
      - hosts:
        - www.example.com
        secretName: example-tls

If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:

  apiVersion: v1
  kind: Secret
  metadata:
    name: example-tls
    namespace: foo
  data:
    tls.crt: <base64 encoded cert>
    tls.key: <base64 encoded key>
  type: kubernetes.io/tls
[root@master231 ~]# 

	7.查看创建的创建的资源
[root@master231 manifests]# kubectl get all -n yinzhengjie-ingress  -o wide
NAME                                           READY   STATUS    RESTARTS   AGE   IP           NODE        NOMINATED NODE   READINESS GATES
pod/myingress-ingress-nginx-controller-2skwt   1/1     Running   0          41s   10.0.0.233   worker233   <none>           <none>
pod/myingress-ingress-nginx-controller-z6slc   1/1     Running   0          41s   10.0.0.232   worker232   <none>           <none>

NAME                                                   TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE   SELECTOR
service/myingress-ingress-nginx-controller             LoadBalancer   10.200.239.174   <pending>     80:31882/TCP,443:31490/TCP   41s   app.kubernetes.io/component=controller,app.kubernetes.io/instance=myingress,app.kubernetes.io/name=ingress-nginx
service/myingress-ingress-nginx-controller-admission   ClusterIP      10.200.191.152   <none>        443/TCP                      41s   app.kubernetes.io/component=controller,app.kubernetes.io/instance=myingress,app.kubernetes.io/name=ingress-nginx

NAME                                                DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE   CONTAINERS   IMAGES                                                                   SELECTOR
daemonset.apps/myingress-ingress-nginx-controller   2         2         2       2            2           kubernetes.io/os=linux   41s   controller   registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/ingress-nginx:v1.3.1   app.kubernetes.io/component=controller,app.kubernetes.io/instance=myingress,app.kubernetes.io/name=ingress-nginx
[root@master231 manifests]#

二.Ingress Nginx初体验实战案例

1.创建测试环境

[root@master231 yinzhengjie]# cat deploy-apps.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment-apps-v1
spec:
  replicas: 3
  selector:
    matchLabels:
      apps: v1
  template:
    metadata:
      labels:
        apps: v1
    spec:
      containers:
      - name: c1
        image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1
        ports:
        - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: svc-apps
spec:
  selector:
    apps: v1
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl apply -f deploy-apps.yaml 
deployment.apps/deployment-apps-v1 created
service/svc-apps created
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl get svc,deploy,po
NAME                 TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.200.0.1       <none>        443/TCP   14d
service/svc-apps     ClusterIP   10.200.134.229   <none>        80/TCP    47s

NAME                                 READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/deployment-apps-v1   3/3     3            3           47s

NAME                                      READY   STATUS    RESTARTS   AGE
pod/deployment-apps-v1-5f6bb6f75b-g8vst   1/1     Running   0          47s
pod/deployment-apps-v1-5f6bb6f75b-tlm26   1/1     Running   0          47s
pod/deployment-apps-v1-5f6bb6f75b-vrhbs   1/1     Running   0          47s
[root@master231 yinzhengjie]#

2.创建Ingress资源

[root@master231 yinzhengjie]# cat 01-apps-ingress.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apps-ingress
spec:
  rules:
  - host: apps.yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apps
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl  apply -f 01-apps-ingress.yaml 
ingress.networking.k8s.io/apps-ingress created
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl get ing
NAME           CLASS   HOSTS                  ADDRESS   PORTS   AGE
apps-ingress   nginx   apps.yinzhengjie.com             80      71s
[root@master231 yinzhengjie]#

3.验证Ingress-nginx的controller配置

[root@master231 ~]# kubectl get pod -n yinzhengjie-ingress -o wide
NAME                                       READY   STATUS    RESTARTS   AGE   IP           NODE        NOMINATED NODE   READINESS GATES
myingress-ingress-nginx-controller-2skwt   1/1     Running   0          82m   10.0.0.233   worker233   <none>           <none>
myingress-ingress-nginx-controller-z6slc   1/1     Running   0          82m   10.0.0.232   worker232   <none>           <none>
[root@master231 ~]# 
[root@master231 ~]# 
[root@master231 ~]# kubectl -n yinzhengjie-ingress exec -it myingress-ingress-nginx-controller-2skwt -- bash
bash-5.1$ 
bash-5.1$ grep yinzhengjie.com nginx.conf -n
441:	## start server apps.yinzhengjie.com
443:		server_name apps.yinzhengjie.com ;
575:	## end server apps.yinzhengjie.com
bash-5.1$ 


温馨提示:
	不难发现，当我们创建Ingress规则时，其回自动将这个规则同步到ingress-nginx-controller的nginx.conf配置文件中哟~

4.查看po，svc，ing的详细信息

[root@master231 yinzhengjie]# kubectl get po,svc,ing
NAME                                      READY   STATUS    RESTARTS   AGE
pod/deployment-apps-v1-6bc556784f-57z4l   1/1     Running   0          116s
pod/deployment-apps-v1-6bc556784f-68tq7   1/1     Running   0          116s
pod/deployment-apps-v1-6bc556784f-s7jw5   1/1     Running   0          116s

NAME                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.200.0.1      <none>        443/TCP   14d
service/svc-apps     ClusterIP   10.200.88.156   <none>        80/TCP    116s

NAME                                     CLASS   HOSTS                  ADDRESS   PORTS   AGE
ingress.networking.k8s.io/apps-ingress   nginx   apps.yinzhengjie.com             80      10m
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl describe ing
Name:             apps-ingress
Labels:           <none>
Namespace:        default
Address:          
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
Rules:
  Host                  Path  Backends
  ----                  ----  --------
  apps.yinzhengjie.com  
                        /   svc-apps:80 (10.100.1.27:80,10.100.1.28:80,10.100.2.15:80)
Annotations:            <none>
Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  Sync    10m   nginx-ingress-controller  Scheduled for sync
  Normal  Sync    10m   nginx-ingress-controller  Scheduled for sync
[root@master231 yinzhengjie]#

5.访问测试

如上图所示。windows我们可以直接访问Ingress-nginx的主机就可以查看到相应的服务啦，只不过别忘记做hosts解析即可。

温馨提示:
	也可以使用Linux命令行工具curl进行测试。
[root@master231 yinzhengjie]# curl -H 'host: apps.yinzhengjie.com' 10.0.0.232
<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8"/>
    <title>yinzhengjie apps v1</title>
    <style>
       div img {
          width: 900px;
          height: 600px;
          margin: 0;
       }
    </style>
  </head>

  <body>
    <h1 style="color: green">凡人修仙传 v1 </h1>
    <div>
      <img src="1.jpg">
    <div>
  </body>

</html>
[root@master231 yinzhengjie]#

三.Ingress Nginx实现域名重定向

1.背景说明

假如你们公司有域名变更的需求，但是之前的网站依旧是有部分流量的，想要将其流量迁移到新的域名中就可以考虑使用重定向功能。


如上图所示，修改nginx的配置文件有三种方式:
	- configMap：
		使用ConfigMap在NGINX中设置全局配置。
	- annotations：
		如果您想要特定Ingress规则的特定配置，请使用此注释。
	- Custom template：
		当需要更具体的设置时，如"open_file_cache"，将侦听选项调整为rcvbuf，或者当无法通过ConfigMap更改配置时。

参考链接:
	https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/

2.基于注解实现域名跳转

[root@master231 yinzhengjie]# cat 02-redirect.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apps-redirect
  annotations:
    nginx.ingress.kubernetes.io/permanent-redirect: https://www.cnblogs.com/yinzhengjie
spec:
  rules:
  - host: blog.yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apps
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl apply -f 02-redirect.yaml
ingress.networking.k8s.io/apps-redirect created
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl describe ing apps-redirect 
Name:             apps-redirect
Labels:           <none>
Namespace:        default
Address:          
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
Rules:
  Host                  Path  Backends
  ----                  ----  --------
  blog.yinzhengjie.com  
                        /   svc-apps:80 (10.100.1.27:80,10.100.1.28:80,10.100.2.15:80)
Annotations:            nginx.ingress.kubernetes.io/permanent-redirect: https://www.cnblogs.com/yi
Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  Sync    12s   nginx-ingress-controller  Scheduled for sync
  Normal  Sync    12s   nginx-ingress-controller  Scheduled for sync
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]#

3.访问测试

如上图所示，我们可以使用windows测试访问也可以使用Linux来直接基于命令行的方式访问。

除了跳转网站外，我们还可以设置返回的状态码，若不设置默认返回301的状态码。如果需要修改状态码添加相应注解信息即可。

只不过修改资源后，一定要删除Ingress规则后重新创建才能生效哟。

参考案例:
[root@master231 yinzhengjie]# cat 02-redirect.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apps-redirect
  annotations:
    nginx.ingress.kubernetes.io/permanent-redirect: https://www.cnblogs.com/yinzhengjie
    # 注意，这个状态码不能胡写哈，否则不识别，默认依旧返回301哟~
    nginx.ingress.kubernetes.io/permanent-redirect-code: '308'
spec:
  rules:
  - host: blog.yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apps
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl create -f 02-redirect.yaml 
ingress.networking.k8s.io/apps-redirect created
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# curl -H 'host: blog.yinzhengjie.com' 10.0.0.232 -I
HTTP/1.1 308 Permanent Redirect
Date: Sat, 20 Jan 2024 10:15:41 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://www.cnblogs.com/yinzhengjie

[root@master231 yinzhengjie]#

四.Ingress Nginx区分移动端和pc端

1.部署移动端测试环境

	1.创建deploy，svc资源
[root@master231 yinzhengjie]# cat 01-deploy-svc-apps.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment-apps-v1
spec:
  replicas: 3
  selector:
    matchLabels:
      apps: v1
  template:
    metadata:
      labels:
        apps: v1
    spec:
      containers:
      - name: c1
        image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1
        ports:
        - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: svc-apps
spec:
  selector:
    apps: v1
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
[root@master231 yinzhengjie]# 



	2.创建Ingress资源
[root@master231 yinzhengjie]# cat 02-ingress-iphone.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apps-iphone
spec:
  rules:
  - host: m.yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apps
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
[root@master231 yinzhengjie]#

2.部署pc端测试

	1.创建deploy，svc资源
[root@master231 yinzhengjie]# cat 03-deploy-apple.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment-apple
spec:
  replicas: 3
  selector:
    matchLabels:
      apps: apple
  template:
    metadata:
      labels:
        apps: apple
    spec:
      containers:
      - name: apple
        image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:apple
        ports:
        - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: svc-apple
spec:
  selector:
    apps: apple
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
[root@master231 yinzhengjie]# 


	2.创建Ingress资源
[root@master231 yinzhengjie]# cat 04-apple-ingress.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apple
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
        set $agentflag 0;

        if ($http_user_agent ~* "(Mobile)" ){
          set $agentflag 1;
        }

        if ( $agentflag = 1 ) {
          return 301 http://m.yinzhengjie.com;
        }

spec:
  rules:
  - host: yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apple
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
[root@master231 yinzhengjie]# 


参考连接：
    https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#server-snippet

3.测试验证

如上图所示，我们测试成功啦~

五.Ingress Nginx基本认证

1.使用htpasswd工具创建生成nginx认证用户

	1.安装htpasswd工具
[root@master231 yinzhengjie]# yum -y install httpd


	2.使用htpasswd工具生成测试用户名和密码
[root@master231 yinzhengjie]# htpasswd -c auth jasonyin
New password: 
Re-type new password: 
Adding password for user jasonyin
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# cat auth 
jasonyin:$apr1$v.iw5HUE$n7xcqnT3Aj23qIK0vurGU1
[root@master231 yinzhengjie]#

2.将创建的密码文件用secrets资源存储

[root@master231 yinzhengjie]# kubectl create secret generic nginx-basic-auth --from-file=auth 
secret/nginx-basic-auth created
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl get secrets nginx-basic-auth 
NAME               TYPE     DATA   AGE
nginx-basic-auth   Opaque   1      12s
[root@master231 yinzhengjie]#

3.部署测试应用

[root@master231 yinzhengjie]# cat deploy-apple.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment-apple
spec:
  replicas: 3
  selector:
    matchLabels:
      apps: apple
  template:
    metadata:
      labels:
        apps: apple
    spec:
      containers:
      - name: apple
        image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:apple
        ports:
        - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: svc-apple
spec:
  selector:
    apps: apple
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl apply -f deploy-apple.yaml 
deployment.apps/deployment-apple created
service/svc-apple created
[root@master231 yinzhengjie]#

4.创建Ingress用于认证信息

[root@master231 yinzhengjie]# cat ingress-basic-auth.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-basic-auth
  annotations:
    # 登录的提示信息
    nginx.ingress.kubernetes.io/auth-realm: Please Input Your Username and Passowrd
    # 对应认证信息，也就是我们创建的secrets资源名称，里面保存了我们创建的有效用户
    nginx.ingress.kubernetes.io/auth-secret: nginx-basic-auth
    # 指定认证类型
    nginx.ingress.kubernetes.io/auth-type: basic
spec:
  rules:
  - host: auth.yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apple
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl apply -f ingress-basic-auth.yaml 
ingress.networking.k8s.io/ingress-basic-auth created
[root@master231 yinzhengjie]#

5.访问测试

如上图所示，直接进行访问测试即可。

六.Ingress Nginx实现前后端分离

1.创建测试服务

[root@master231 yinzhengjie]# cat deploy-apple.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment-apple
spec:
  replicas: 3
  selector:
    matchLabels:
      apps: apple
  template:
    metadata:
      labels:
        apps: apple
    spec:
      containers:
      - name: apple
        image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:apple
        ports:
        - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: svc-apple
spec:
  selector:
    apps: apple
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
[root@master231 yinzhengjie]#

2.编写Ingress规则实现rewrite

[root@master231 yinzhengjie]# cat ingress-rewrite.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-rewrite
  annotations:
    # 这句话的是意思是将"/api(/|$)(.*)"改写为"/.*",
    # 后端在调用时会直接将"/api(/|$)"的内容取消掉.
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  rules:
  - host: www.yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apple
            port:
              number: 80
        # 注意，这里用到了2个分组，小括号代表分组，共计2个小括号，
        # 上面的注解中"rewrite-target"使用到第二个小括号的参数。
        path: /api(/|$)(.*)
        pathType: ImplementationSpecific
[root@master231 yinzhengjie]#

3.测试访问

七.Ingress Nginx https

1.生成自建证书

	1.生成证书文件
[root@master231 yinzhengjie]# openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=www.yinzhengjie.com"


	2.将证书文件以secrets形式存储
[root@master231 yinzhengjie]# kubectl create secret tls ca-secret --cert=tls.crt --key=tls.key 
secret/ca-secret created
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl get secrets ca-secret 
NAME        TYPE                DATA   AGE
ca-secret   kubernetes.io/tls   2      84s
[root@master231 yinzhengjie]#

2.部署测试服务

[root@master231 yinzhengjie]# cat deploy-apple.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment-apple
spec:
  replicas: 3
  selector:
    matchLabels:
      apps: apple
  template:
    metadata:
      labels:
        apps: apple
    spec:
      containers:
      - name: apple
        image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:apple
        ports:
        - containerPort: 80

---

apiVersion: v1
kind: Service
metadata:
  name: svc-apple
spec:
  selector:
    apps: apple
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
[root@master231 yinzhengjie]#

3.配置Ingress添加TLS证书

[root@master231 yinzhengjie]# cat ingress-https.html 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-rewrite
  # 如果指定了"ingressClassName"参数，就不需要在这里重复声明啦。
  # 如果你的K8S 1.22- 版本，则使用注解的方式进行传参即可。
  #annotations:
  #  kubernetes.io/ingress.class: "nginx"
spec:
  # 指定Ingress controller，要求你的K8S 1.22+
  ingressClassName: nginx
  rules:
  - host: www.yinzhengjie.com
    http:
      paths:
      - backend:
          service:
            name: svc-apple
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
  # 配置https证书
  tls:
  - hosts:
    - www.yinzhengjie.com
    secretName: ca-secret
[root@master231 yinzhengjie]# 
[root@master231 yinzhengjie]# kubectl apply -f ingress-https.html 
ingress.networking.k8s.io/ingress-rewrite created
[root@master231 yinzhengjie]#

4.测试访问

posted @ 2024-01-19 23:11 尹正杰阅读(2493) 评论(0) 编辑收藏举报

刷新页面返回顶部

尹正杰

Ingress-Nginx使用指南上篇

一.部署Ingress-Nginx

1.Ingress-Nginx和nginx-Ingress的区别对比

2.Ingress-Nginx的安装方式

3.基于helm安装Ingress-nginx

二.Ingress Nginx初体验实战案例

1.创建测试环境

2.创建Ingress资源

3.验证Ingress-nginx的controller配置

4.查看po，svc，ing的详细信息

5.访问测试

三.Ingress Nginx实现域名重定向

1.背景说明

2.基于注解实现域名跳转

3.访问测试

四.Ingress Nginx区分移动端和pc端

1.部署移动端测试环境

2.部署pc端测试

3.测试验证

五.Ingress Nginx基本认证

1.使用htpasswd工具创建生成nginx认证用户

2.将创建的密码文件用secrets资源存储

3.部署测试应用

4.创建Ingress用于认证信息

5.访问测试

六.Ingress Nginx实现前后端分离

1.创建测试服务

2.编写Ingress规则实现rewrite

3.测试访问

七.Ingress Nginx https

1.生成自建证书

2.部署测试服务

3.配置Ingress添加TLS证书

4.测试访问

公告