devbox
思考机器6
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

【kubernetes搭建（四）】搭建Ingress_kubernetes.io/ingress.class

作者：思考机器6 | 2024-01-17 09:15:21

赞

踩

kubernetes.io/ingress.class

一、介绍

Ingress 的实现分为两个部分 Ingress Controller 和 Ingress。
Ingress Controller 是流量的入口，是一个实体软件， 一般是Nginx 和 Haproxy（较少使用）。
Ingress 描述具体的路由规则。
Ingress Controller 会监听 api server上的 /ingresses 资源 并实时生效。
Ingerss 描述了一个或者多个 域名的路由规则，以 ingress 资源的形式存在。
简单说： Ingress 描述路由规则， Ingress Controller 实时实现规则。

二、安装Ingress Controller（ingress-nginx）

vim ~/ingress-nginx.yaml

  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   name: ingress-nginx
  5.   labels:
  6.     app.kubernetes.io/name: ingress-nginx
  7.     app.kubernetes.io/instance: ingress-nginx
  8.  
  9. ---
  10. # Source: ingress-nginx/templates/controller-serviceaccount.yaml
  11. apiVersion: v1
  12. kind: ServiceAccount
  13. metadata:
  14.   labels:
  15.     helm.sh/chart: ingress-nginx-4.0.1
  16.     app.kubernetes.io/name: ingress-nginx
  17.     app.kubernetes.io/instance: ingress-nginx
  18.     app.kubernetes.io/version: 1.0.0
  19.     app.kubernetes.io/managed-by: Helm
  20.     app.kubernetes.io/component: controller
  21.   name: ingress-nginx
  22.   namespace: ingress-nginx
  23. automountServiceAccountToken: true
  24. ---
  25. # Source: ingress-nginx/templates/controller-configmap.yaml
  26. apiVersion: v1
  27. kind: ConfigMap
  28. metadata:
  29.   labels:
  30.     helm.sh/chart: ingress-nginx-4.0.1
  31.     app.kubernetes.io/name: ingress-nginx
  32.     app.kubernetes.io/instance: ingress-nginx
  33.     app.kubernetes.io/version: 1.0.0
  34.     app.kubernetes.io/managed-by: Helm
  35.     app.kubernetes.io/component: controller
  36.   name: ingress-nginx-controller
  37.   namespace: ingress-nginx
  38. data:
  39. ---
  40. # Source: ingress-nginx/templates/clusterrole.yaml
  41. apiVersion: rbac.authorization.k8s.io/v1
  42. kind: ClusterRole
  43. metadata:
  44.   labels:
  45.     helm.sh/chart: ingress-nginx-4.0.1
  46.     app.kubernetes.io/name: ingress-nginx
  47.     app.kubernetes.io/instance: ingress-nginx
  48.     app.kubernetes.io/version: 1.0.0
  49.     app.kubernetes.io/managed-by: Helm
  50.   name: ingress-nginx
  51. rules:
  52.   - apiGroups:
  53.       - ''
  54.     resources:
  55.       - configmaps
  56.       - endpoints
  57.       - nodes
  58.       - pods
  59.       - secrets
  60.     verbs:
  61.       - list
  62.       - watch
  63.   - apiGroups:
  64.       - ''
  65.     resources:
  66.       - nodes
  67.     verbs:
  68.       - get
  69.   - apiGroups:
  70.       - ''
  71.     resources:
  72.       - services
  73.     verbs:
  74.       - get
  75.       - list
  76.       - watch
  77.   - apiGroups:
  78.       - networking.k8s.io
  79.     resources:
  80.       - ingresses
  81.     verbs:
  82.       - get
  83.       - list
  84.       - watch
  85.   - apiGroups:
  86.       - ''
  87.     resources:
  88.       - events
  89.     verbs:
  90.       - create
  91.       - patch
  92.   - apiGroups:
  93.       - networking.k8s.io
  94.     resources:
  95.       - ingresses/status
  96.     verbs:
  97.       - update
  98.   - apiGroups:
  99.       - networking.k8s.io
  100.     resources:
  101.       - ingressclasses
  102.     verbs:
  103.       - get
  104.       - list
  105.       - watch
  106. ---
  107. # Source: ingress-nginx/templates/clusterrolebinding.yaml
  108. apiVersion: rbac.authorization.k8s.io/v1
  109. kind: ClusterRoleBinding
  110. metadata:
  111.   labels:
  112.     helm.sh/chart: ingress-nginx-4.0.1
  113.     app.kubernetes.io/name: ingress-nginx
  114.     app.kubernetes.io/instance: ingress-nginx
  115.     app.kubernetes.io/version: 1.0.0
  116.     app.kubernetes.io/managed-by: Helm
  117.   name: ingress-nginx
  118. roleRef:
  119.   apiGroup: rbac.authorization.k8s.io
  120.   kind: ClusterRole
  121.   name: ingress-nginx
  122. subjects:
  123.   - kind: ServiceAccount
  124.     name: ingress-nginx
  125.     namespace: ingress-nginx
  126. ---
  127. # Source: ingress-nginx/templates/controller-role.yaml
  128. apiVersion: rbac.authorization.k8s.io/v1
  129. kind: Role
  130. metadata:
  131.   labels:
  132.     helm.sh/chart: ingress-nginx-4.0.1
  133.     app.kubernetes.io/name: ingress-nginx
  134.     app.kubernetes.io/instance: ingress-nginx
  135.     app.kubernetes.io/version: 1.0.0
  136.     app.kubernetes.io/managed-by: Helm
  137.     app.kubernetes.io/component: controller
  138.   name: ingress-nginx
  139.   namespace: ingress-nginx
  140. rules:
  141.   - apiGroups:
  142.       - ''
  143.     resources:
  144.       - namespaces
  145.     verbs:
  146.       - get
  147.   - apiGroups:
  148.       - ''
  149.     resources:
  150.       - configmaps
  151.       - pods
  152.       - secrets
  153.       - endpoints
  154.     verbs:
  155.       - get
  156.       - list
  157.       - watch
  158.   - apiGroups:
  159.       - ''
  160.     resources:
  161.       - services
  162.     verbs:
  163.       - get
  164.       - list
  165.       - watch
  166.   - apiGroups:
  167.       - networking.k8s.io
  168.     resources:
  169.       - ingresses
  170.     verbs:
  171.       - get
  172.       - list
  173.       - watch
  174.   - apiGroups:
  175.       - networking.k8s.io
  176.     resources:
  177.       - ingresses/status
  178.     verbs:
  179.       - update
  180.   - apiGroups:
  181.       - networking.k8s.io
  182.     resources:
  183.       - ingressclasses
  184.     verbs:
  185.       - get
  186.       - list
  187.       - watch
  188.   - apiGroups:
  189.       - ''
  190.     resources:
  191.       - configmaps
  192.     resourceNames:
  193.       - ingress-controller-leader
  194.     verbs:
  195.       - get
  196.       - update
  197.   - apiGroups:
  198.       - ''
  199.     resources:
  200.       - configmaps
  201.     verbs:
  202.       - create
  203.   - apiGroups:
  204.       - ''
  205.     resources:
  206.       - events
  207.     verbs:
  208.       - create
  209.       - patch
  210. ---
  211. # Source: ingress-nginx/templates/controller-rolebinding.yaml
  212. apiVersion: rbac.authorization.k8s.io/v1
  213. kind: RoleBinding
  214. metadata:
  215.   labels:
  216.     helm.sh/chart: ingress-nginx-4.0.1
  217.     app.kubernetes.io/name: ingress-nginx
  218.     app.kubernetes.io/instance: ingress-nginx
  219.     app.kubernetes.io/version: 1.0.0
  220.     app.kubernetes.io/managed-by: Helm
  221.     app.kubernetes.io/component: controller
  222.   name: ingress-nginx
  223.   namespace: ingress-nginx
  224. roleRef:
  225.   apiGroup: rbac.authorization.k8s.io
  226.   kind: Role
  227.   name: ingress-nginx
  228. subjects:
  229.   - kind: ServiceAccount
  230.     name: ingress-nginx
  231.     namespace: ingress-nginx
  232. ---
  233. # Source: ingress-nginx/templates/controller-service-webhook.yaml
  234. apiVersion: v1
  235. kind: Service
  236. metadata:
  237.   labels:
  238.     helm.sh/chart: ingress-nginx-4.0.1
  239.     app.kubernetes.io/name: ingress-nginx
  240.     app.kubernetes.io/instance: ingress-nginx
  241.     app.kubernetes.io/version: 1.0.0
  242.     app.kubernetes.io/managed-by: Helm
  243.     app.kubernetes.io/component: controller
  244.   name: ingress-nginx-controller-admission
  245.   namespace: ingress-nginx
  246. spec:
  247.   type: ClusterIP
  248.   ports:
  249.     - name: https-webhook
  250.       port: 443
  251.       targetPort: webhook
  252.       appProtocol: https
  253.   selector:
  254.     app.kubernetes.io/name: ingress-nginx
  255.     app.kubernetes.io/instance: ingress-nginx
  256.     app.kubernetes.io/component: controller
  257. ---
  258. # Source: ingress-nginx/templates/controller-deployment.yaml
  259. apiVersion: apps/v1
  260. kind: DaemonSet
  261. metadata:
  262.   labels:
  263.     helm.sh/chart: ingress-nginx-4.0.1
  264.     app.kubernetes.io/name: ingress-nginx
  265.     app.kubernetes.io/instance: ingress-nginx
  266.     app.kubernetes.io/version: 1.0.0
  267.     app.kubernetes.io/managed-by: Helm
  268.     app.kubernetes.io/component: controller
  269.   name: ingress-nginx-controller
  270.   namespace: ingress-nginx
  271. spec:
  272.   selector:
  273.     matchLabels:
  274.       app.kubernetes.io/name: ingress-nginx
  275.       app.kubernetes.io/instance: ingress-nginx
  276.       app.kubernetes.io/component: controller
  277.   revisionHistoryLimit: 10
  278.   minReadySeconds: 0
  279.   template:
  280.     metadata:
  281.       labels:
  282.         app.kubernetes.io/name: ingress-nginx
  283.         app.kubernetes.io/instance: ingress-nginx
  284.         app.kubernetes.io/component: controller
  285.     spec:
  286.       hostNetwork: true
  287.       dnsPolicy: ClusterFirst
  288.       containers:
  289.         - name: controller
  290.           image: registry.cn-beijing.aliyuncs.com/kole_chang/controller:v1.0.0
  291.           imagePullPolicy: IfNotPresent
  292.           lifecycle:
  293.             preStop:
  294.               exec:
  295.                 command:
  296.                   - /wait-shutdown
  297.           args:
  298.             - /nginx-ingress-controller
  299.             - --election-id=ingress-controller-leader
  300.             - --controller-class=k8s.io/ingress-nginx
  301.             - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
  302.             - --validating-webhook=:8444
  303.             - --validating-webhook-certificate=/usr/local/certificates/cert
  304.             - --validating-webhook-key=/usr/local/certificates/key
  305.             - --watch-ingress-without-class=true
  306.           securityContext:
  307.             capabilities:
  308.               drop:
  309.                 - ALL
  310.               add:
  311.                 - NET_BIND_SERVICE
  312.             runAsUser: 101
  313.             allowPrivilegeEscalation: true
  314.           env:
  315.             - name: POD_NAME
  316.               valueFrom:
  317.                 fieldRef:
  318.                   fieldPath: metadata.name
  319.             - name: POD_NAMESPACE
  320.               valueFrom:
  321.                 fieldRef:
  322.                   fieldPath: metadata.namespace
  323.             - name: LD_PRELOAD
  324.               value: /usr/local/lib/libmimalloc.so
  325.           livenessProbe:
  326.             failureThreshold: 5
  327.             httpGet:
  328.               path: /healthz
  329.               port: 10254
  330.               scheme: HTTP
  331.             initialDelaySeconds: 10
  332.             periodSeconds: 10
  333.             successThreshold: 1
  334.             timeoutSeconds: 1
  335.           readinessProbe:
  336.             failureThreshold: 3
  337.             httpGet:
  338.               path: /healthz
  339.               port: 10254
  340.               scheme: HTTP
  341.             initialDelaySeconds: 10
  342.             periodSeconds: 10
  343.             successThreshold: 1
  344.             timeoutSeconds: 1
  345.           ports:
  346.             - name: http
  347.               containerPort: 80
  348.               protocol: TCP
  349.             - name: https
  350.               containerPort: 443
  351.               protocol: TCP
  352.             - name: webhook
  353.               containerPort: 8444
  354.               protocol: TCP
  355.           volumeMounts:
  356.             - name: webhook-cert
  357.               mountPath: /usr/local/certificates/
  358.               readOnly: true
  359.           resources:
  360.             requests:
  361.               #cpu: 100m
  362.               memory: 90Mi
  363.       nodeSelector:
  364.         kubernetes.io/os: linux
  365.       serviceAccountName: ingress-nginx
  366.       terminationGracePeriodSeconds: 300
  367.       volumes:
  368.         - name: webhook-cert
  369.           secret:
  370.             secretName: ingress-nginx-admission
  371. ---
  372. # Source: ingress-nginx/templates/controller-ingressclass.yaml
  373. # We don't support namespaced ingressClass yet
  374. # So a ClusterRole and a ClusterRoleBinding is required
  375. apiVersion: networking.k8s.io/v1
  376. kind: IngressClass
  377. metadata:
  378.   labels:
  379.     helm.sh/chart: ingress-nginx-4.0.1
  380.     app.kubernetes.io/name: ingress-nginx
  381.     app.kubernetes.io/instance: ingress-nginx
  382.     app.kubernetes.io/version: 1.0.0
  383.     app.kubernetes.io/managed-by: Helm
  384.     app.kubernetes.io/component: controller
  385.   name: nginx
  386.   namespace: ingress-nginx
  387. spec:
  388.   controller: k8s.io/ingress-nginx
  389. ---
  390. # Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
  391. # before changing this value, check the required kubernetes version
  392. # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
  393. apiVersion: admissionregistration.k8s.io/v1
  394. kind: ValidatingWebhookConfiguration
  395. metadata:
  396.   labels:
  397.     helm.sh/chart: ingress-nginx-4.0.1
  398.     app.kubernetes.io/name: ingress-nginx
  399.     app.kubernetes.io/instance: ingress-nginx
  400.     app.kubernetes.io/version: 1.0.0
  401.     app.kubernetes.io/managed-by: Helm
  402.     app.kubernetes.io/component: admission-webhook
  403.   name: ingress-nginx-admission
  404. webhooks:
  405.   - name: validate.nginx.ingress.kubernetes.io
  406.     matchPolicy: Equivalent
  407.     rules:
  408.       - apiGroups:
  409.           - networking.k8s.io
  410.         apiVersions:
  411.           - v1
  412.         operations:
  413.           - CREATE
  414.           - UPDATE
  415.         resources:
  416.           - ingresses
  417.     failurePolicy: Fail
  418.     sideEffects: None
  419.     admissionReviewVersions:
  420.       - v1
  421.     clientConfig:
  422.       service:
  423.         namespace: ingress-nginx
  424.         name: ingress-nginx-controller-admission
  425.         path: /networking/v1/ingresses
  426. ---
  427. # Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
  428. apiVersion: v1
  429. kind: ServiceAccount
  430. metadata:
  431.   name: ingress-nginx-admission
  432.   namespace: ingress-nginx
  433.   annotations:
  434.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  435.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  436.   labels:
  437.     helm.sh/chart: ingress-nginx-4.0.1
  438.     app.kubernetes.io/name: ingress-nginx
  439.     app.kubernetes.io/instance: ingress-nginx
  440.     app.kubernetes.io/version: 1.0.0
  441.     app.kubernetes.io/managed-by: Helm
  442.     app.kubernetes.io/component: admission-webhook
  443. ---
  444. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
  445. apiVersion: rbac.authorization.k8s.io/v1
  446. kind: ClusterRole
  447. metadata:
  448.   name: ingress-nginx-admission
  449.   annotations:
  450.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  451.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  452.   labels:
  453.     helm.sh/chart: ingress-nginx-4.0.1
  454.     app.kubernetes.io/name: ingress-nginx
  455.     app.kubernetes.io/instance: ingress-nginx
  456.     app.kubernetes.io/version: 1.0.0
  457.     app.kubernetes.io/managed-by: Helm
  458.     app.kubernetes.io/component: admission-webhook
  459. rules:
  460.   - apiGroups:
  461.       - admissionregistration.k8s.io
  462.     resources:
  463.       - validatingwebhookconfigurations
  464.     verbs:
  465.       - get
  466.       - update
  467. ---
  468. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
  469. apiVersion: rbac.authorization.k8s.io/v1
  470. kind: ClusterRoleBinding
  471. metadata:
  472.   name: ingress-nginx-admission
  473.   annotations:
  474.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  475.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  476.   labels:
  477.     helm.sh/chart: ingress-nginx-4.0.1
  478.     app.kubernetes.io/name: ingress-nginx
  479.     app.kubernetes.io/instance: ingress-nginx
  480.     app.kubernetes.io/version: 1.0.0
  481.     app.kubernetes.io/managed-by: Helm
  482.     app.kubernetes.io/component: admission-webhook
  483. roleRef:
  484.   apiGroup: rbac.authorization.k8s.io
  485.   kind: ClusterRole
  486.   name: ingress-nginx-admission
  487. subjects:
  488.   - kind: ServiceAccount
  489.     name: ingress-nginx-admission
  490.     namespace: ingress-nginx
  491. ---
  492. # Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
  493. apiVersion: rbac.authorization.k8s.io/v1
  494. kind: Role
  495. metadata:
  496.   name: ingress-nginx-admission
  497.   namespace: ingress-nginx
  498.   annotations:
  499.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  500.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  501.   labels:
  502.     helm.sh/chart: ingress-nginx-4.0.1
  503.     app.kubernetes.io/name: ingress-nginx
  504.     app.kubernetes.io/instance: ingress-nginx
  505.     app.kubernetes.io/version: 1.0.0
  506.     app.kubernetes.io/managed-by: Helm
  507.     app.kubernetes.io/component: admission-webhook
  508. rules:
  509.   - apiGroups:
  510.       - ''
  511.     resources:
  512.       - secrets
  513.     verbs:
  514.       - get
  515.       - create
  516. ---
  517. # Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
  518. apiVersion: rbac.authorization.k8s.io/v1
  519. kind: RoleBinding
  520. metadata:
  521.   name: ingress-nginx-admission
  522.   namespace: ingress-nginx
  523.   annotations:
  524.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  525.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  526.   labels:
  527.     helm.sh/chart: ingress-nginx-4.0.1
  528.     app.kubernetes.io/name: ingress-nginx
  529.     app.kubernetes.io/instance: ingress-nginx
  530.     app.kubernetes.io/version: 1.0.0
  531.     app.kubernetes.io/managed-by: Helm
  532.     app.kubernetes.io/component: admission-webhook
  533. roleRef:
  534.   apiGroup: rbac.authorization.k8s.io
  535.   kind: Role
  536.   name: ingress-nginx-admission
  537. subjects:
  538.   - kind: ServiceAccount
  539.     name: ingress-nginx-admission
  540.     namespace: ingress-nginx
  541. ---
  542. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
  543. apiVersion: batch/v1
  544. kind: Job
  545. metadata:
  546.   name: ingress-nginx-admission-create
  547.   namespace: ingress-nginx
  548.   annotations:
  549.     helm.sh/hook: pre-install,pre-upgrade
  550.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  551.   labels:
  552.     helm.sh/chart: ingress-nginx-4.0.1
  553.     app.kubernetes.io/name: ingress-nginx
  554.     app.kubernetes.io/instance: ingress-nginx
  555.     app.kubernetes.io/version: 1.0.0
  556.     app.kubernetes.io/managed-by: Helm
  557.     app.kubernetes.io/component: admission-webhook
  558. spec:
  559.   template:
  560.     metadata:
  561.       name: ingress-nginx-admission-create
  562.       labels:
  563.         helm.sh/chart: ingress-nginx-4.0.1
  564.         app.kubernetes.io/name: ingress-nginx
  565.         app.kubernetes.io/instance: ingress-nginx
  566.         app.kubernetes.io/version: 1.0.0
  567.         app.kubernetes.io/managed-by: Helm
  568.         app.kubernetes.io/component: admission-webhook
  569.     spec:
  570.       containers:
  571.         - name: create
  572.           image: registry.cn-beijing.aliyuncs.com/kole_chang/kube-webhook-certgen:v1.0
  573.           imagePullPolicy: IfNotPresent
  574.           args:
  575.             - create
  576.             - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
  577.             - --namespace=$(POD_NAMESPACE)
  578.             - --secret-name=ingress-nginx-admission
  579.           env:
  580.             - name: POD_NAMESPACE
  581.               valueFrom:
  582.                 fieldRef:
  583.                   fieldPath: metadata.namespace
  584.       restartPolicy: OnFailure
  585.       serviceAccountName: ingress-nginx-admission
  586.       nodeSelector:
  587.         kubernetes.io/os: linux
  588.       securityContext:
  589.         runAsNonRoot: true
  590.         runAsUser: 2000
  591. ---
  592. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
  593. apiVersion: batch/v1
  594. kind: Job
  595. metadata:
  596.   name: ingress-nginx-admission-patch
  597.   namespace: ingress-nginx
  598.   annotations:
  599.     helm.sh/hook: post-install,post-upgrade
  600.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  601.   labels:
  602.     helm.sh/chart: ingress-nginx-4.0.1
  603.     app.kubernetes.io/name: ingress-nginx
  604.     app.kubernetes.io/instance: ingress-nginx
  605.     app.kubernetes.io/version: 1.0.0
  606.     app.kubernetes.io/managed-by: Helm
  607.     app.kubernetes.io/component: admission-webhook
  608. spec:
  609.   template:
  610.     metadata:
  611.       name: ingress-nginx-admission-patch
  612.       labels:
  613.         helm.sh/chart: ingress-nginx-4.0.1
  614.         app.kubernetes.io/name: ingress-nginx
  615.         app.kubernetes.io/instance: ingress-nginx
  616.         app.kubernetes.io/version: 1.0.0
  617.         app.kubernetes.io/managed-by: Helm
  618.         app.kubernetes.io/component: admission-webhook
  619.     spec:
  620.       containers:
  621.         - name: patch
  622.           image: registry.cn-beijing.aliyuncs.com/kole_chang/kube-webhook-certgen:v1.0
  623.           imagePullPolicy: IfNotPresent
  624.           args:
  625.             - patch
  626.             - --webhook-name=ingress-nginx-admission
  627.             - --namespace=$(POD_NAMESPACE)
  628.             - --patch-mutating=false
  629.             - --secret-name=ingress-nginx-admission
  630.             - --patch-failure-policy=Fail
  631.           env:
  632.             - name: POD_NAMESPACE
  633.               valueFrom:
  634.                 fieldRef:
  635.                   fieldPath: metadata.namespace
  636.       restartPolicy: OnFailure
  637.       serviceAccountName: ingress-nginx-admission
  638.       nodeSelector:
  639.         kubernetes.io/os: linux
  640.       securityContext:
  641.         runAsNonRoot: true
  642.         runAsUser: 2000

kubectl apply -f ingress-nginx.yaml

三、安装ingress

vim ~/ingress.yaml

  1. apiVersion: networking.k8s.io/v1
  2. kind: Ingress
  3. metadata:
  4.   name: sumengnan.com
  5.   annotations:
  6.     nginx.ingress.kubernetes.io/rewrite-target: /
  7.     nginx.ingress.kubernetes.io/ssl-redirect: "true"
  8.     nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
  9.     nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
  10.     nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
  11.     nginx.ingress.kubernetes.io/proxy-body-size: "100m"
  12.     kubernetes.io/ingress.class: "nginx"
  13.     nginx.inaress.kubernetes.io/use-reaex: "true"
  14. spec:
  15.   rules:
  16.   - host: sumengnan.com
  17.     http:
  18.       paths:
  19.       - path: /
  20.         pathType: Prefix
  21.         backend:
  22.           service:
  23.             name: tomcat-service
  24.             port:
  25.               number: 8080

表示：当接收的域名为sumengnan.com时，把请求转发到service的name为tomcat-service的8080端口

kubectl apply -f ingress.yaml

四、配置SSL证书

1、先获取到证书key和crt文件

2、创建tls secret

kubectl  create secret tls sumengnan.com-secret --key sumengnan.com.key --cert sumengnan.com.crt

3、修改ingress.yaml

增加tls配置

  1. spec:
  2.   tls:
  3.   - hosts:
  4.     - "sumengnan.com"
  5.     secretName: sumengnan.com-secret
  6.   rules:
  7.   - host: sumengnan.com
  8.     http:
  9.       paths:
  10.       - path: /
  11.         pathType: Prefix
  12.         backend:
  13.           service:
  14.             name: tomcat-service
  15.             port:
  16.               number: 8080

应用：kubectl apply -f  ingress.yaml

五、通过ingress访问service（svc）组件

1、通过ingress访问grafana

(1)、创建tls secret:

kubectl  create secret tls grafana.sumengnan.com-secret --key grafana.sumengnan.com.key --cert grafana.sumengnan.com.crt -n ns-monitor

(2)、创建ingress

  1. apiVersion: networking.k8s.io/v1
  2. kind: Ingress
  3. metadata:
  4.   namespace: ns-monitor
  5.   name: grafana.sumengnan.com
  6.   annotations:
  7.     nginx.ingress.kubernetes.io/ssl-redirect: "true"
  8.     nginx.ingress.kubernetes.io/rewrite-target: /
  9.     nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
  10.     nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
  11.     nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
  12.     nginx.ingress.kubernetes.io/proxy-body-size: "100m"
  13.     kubernetes.io/ingress.class: "nginx"
  14.     nginx.inaress.kubernetes.io/use-reaex: "true"
  15. spec:
  16.   tls:
  17.   - hosts:
  18.     - "grafana.sumengnan.com"
  19.     secretName: grafana.sumengnan.com-secret
  20.   rules:
  21.   - host: grafana.sumengnan.com
  22.     http:
  23.       paths:
  24.       - path: /
  25.         pathType: Prefix
  26.         backend:
  27.           service:
  28.             name: grafana-service
  29.             port:
  30.               number: 3000

  kubectl apply -f grafana-ingress.yml

(3)、去掉grafana.yaml文件中的nodePort: 30001（可选）

搭建grafana参考：【kubernetes搭建（三）】搭建Promethus+grafana监控平台_sumengnan的博客-CSDN博客

因为不需要外部访问集群了，所以去掉，只留下内部的3000端口即可

kubectl apply -f grafana.yaml

(4)、访问地址验证

2、通过ingress访问kubernetes-dashboard

(1)、创建tls secret:

kubectl  create secret tls kubernetes.sumengnan.com-secret --key kubernetes.sumengnan.com.key --cert kubernetes.sumengnan.com.crt -n kubernetes-dashboard 

(2)、创建ingress

kubernetes-dashboard由于后端需要https访问，所以需要增加
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

  1. apiVersion: networking.k8s.io/v1
  2. kind: Ingress
  3. metadata:
  4.   namespace: kubernetes-dashboard
  5.   name: kubernetes.sumengnan.com
  6.   annotations:
  7.     nginx.ingress.kubernetes.io/rewrite-target: /
  8.     nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
  9.     nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
  10.     nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
  11.     nginx.ingress.kubernetes.io/proxy-body-size: "100m"
  12.     kubernetes.io/ingress.class: "nginx"
  13.     nginx.inaress.kubernetes.io/use-reaex: "true"
  14.     #注意后端也是需要https访问的
  15.     nginx.ingress.kubernetes.io/ssl-redirect: "true"
  16.     nginx.ingress.kubernetes.io/secure-backends: "true"
  17.     nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  18. spec:
  19.   tls:
  20.   - hosts:
  21.     - "kubernetes.sumengnan.com"
  22.     secretName: kubernetes.sumengnan.com-secret
  23.   rules:
  24.   - host: kubernetes.sumengnan.com
  25.     http:
  26.       paths:
  27.       - path: /
  28.         pathType: Prefix
  29.         backend:
  30.           service:
  31.             name: kubernetes-dashboard
  32.             port:
  33.               number: 8443

 kubectl apply -f kubernetes-dashboard-ingress.yml

注：如果报错failed calling webhook "validate.nginx.ingress.kubernetes.io": failed to call webhook:

 则需要执行：kubectl delete -A ValidatingWebhookConfiguration ingress-nginx-admission

删除ValidatingWebhookConfiguration

(3)、去掉kubernetes-dashboard.yml文件中的nodePort: 30000（可选）

搭建kubernetes-dashboard参考：【kubernetes搭建（二）】搭建kubernetes-dashborad_sumengnan的博客-CSDN博客

通过集群内部端口访问即可，不需要通过外部端口访问

  kubectl apply -f kubernetes-dashboard.yml

 (4)、访问地址验证

3、通过ingress访问tomcat

(1)、创建deployment:

kubectl create deployment tomcat --image=tomcat --replicas=2 --port=8080

运行2个tomcat环境在8080端口

(2)、创建service（svc组件）

可以使用命令：kubectl expose deployment/tomcat --port=8080 --target-port=8080

创建svc资源：kubectl create service nodeport tomcat-service --tcp=8080:8080

也可以手动创建svc组件：(推荐)

vim ~/tomcat-service.yml

  1. apiVersion: v1
  2. kind: Service
  3. metadata:
  4.   name: tomcat-service
  5.   labels:
  6.     name: tomcat-service
  7. spec:
  8.   type: NodePort
  9.   ports:
  10.   - port: 8080
  11.     targetPort: 8080
  12.     protocol: TCP
  13.   selector:
  14.     app: tomcat

注意：最后的selector是选择器，选择label为tomcat的pod组成一组服务

kubectl apply -f tomcat-service.yml

(3)、创建ingress

vim ~/tomcat-ingress.yml

  1. apiVersion: networking.k8s.io/v1
  2. kind: Ingress
  3. metadata:
  4.   name: sumengnan.com
  5.   annotations:
  6.     nginx.ingress.kubernetes.io/rewrite-target: /
  7.     # 是否开启客户端证书验证
  8.     #nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
  9.     # 信任链
  10.     #nginx.ingress.kubernetes.io/auth-tls-secret: "tls.secret"
  11.     # 信任链校验层数
  12.     #nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
  13.     # 是否传递证书给后端服务
  14.     #nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
  15.     #ingress.kubernetes.io/ssl-redirect: "true"
  16.     nginx.ingress.kubernetes.io/ssl-redirect: "true"
  17.     nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
  18.     nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
  19.     nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
  20.     nginx.ingress.kubernetes.io/proxy-body-size: "100m"
  21.     kubernetes.io/ingress.class: "nginx"
  22.     nginx.inaress.kubernetes.io/use-reaex: "true"
  23. spec:
  24.   tls:
  25.   - hosts:
  26.     - "sumengnan.com"
  27.     secretName: sumengnan.com-secret
  28.   rules:
  29.   - host: sumengnan.com
  30.     http:
  31.       paths:
  32.       - path: /
  33.         pathType: Prefix
  34.         backend:
  35.           service:
  36.             name: tomcat-service
  37.             port:
  38.               number: 8080

kubectl apply -f tomcat-ingress.yml

（4）、配置证书

kubectl create secret tls sumengnan.com-secret --key sumengnan.com.key --cert sumengnan.com.crt

(5)、访问地址验证

完毕 

六、ingress只允许在master节点上运行

当后续多节点部署后，ingress可能会分配到别的node节点，这并不是我们想的

1、给mater节点node打上一个自定义的标签

kubectl label nodes tencent-centos7.6 custem/ingress-controller-ready=true

2、修改ingress-nginx.yml文件

增加custem/ingress-controller-ready: true

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/article/detail/40791
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号