kubernetes1.13.4部署nginx-ingress

基础环境

拥有一个完美运行的kubernetes1.13.4集群并已经部署过dashboard，可参考我的部署文章创建自己的集群。

部署步骤

1. 编写部署需要的yaml文件

   • mandatory.yaml

     apiVersion: v1
     kind: Namespace
     metadata:
       name: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     
     ---
     
     kind: ConfigMap
     apiVersion: v1
     metadata:
       name: nginx-configuration
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     
     ---
     kind: ConfigMap
     apiVersion: v1
     metadata:
       name: tcp-services
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     
     ---
     kind: ConfigMap
     apiVersion: v1
     metadata:
       name: udp-services
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     
     ---
     apiVersion: v1
     kind: ServiceAccount
     metadata:
       name: nginx-ingress-serviceaccount
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     
     ---
     apiVersion: rbac.authorization.k8s.io/v1beta1
     kind: ClusterRole
     metadata:
       name: nginx-ingress-clusterrole
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     rules:
       - apiGroups:
           - ""
         resources:
           - configmaps
           - endpoints
           - nodes
           - pods
           - secrets
         verbs:
           - list
           - watch
       - apiGroups:
           - ""
         resources:
           - nodes
         verbs:
           - get
       - apiGroups:
           - ""
         resources:
           - services
         verbs:
           - get
           - list
           - watch
       - apiGroups:
           - "extensions"
         resources:
           - ingresses
         verbs:
           - get
           - list
           - watch
       - apiGroups:
           - ""
         resources:
           - events
         verbs:
           - create
           - patch
       - apiGroups:
           - "extensions"
         resources:
           - ingresses/status
         verbs:
           - update
     
     ---
     apiVersion: rbac.authorization.k8s.io/v1beta1
     kind: Role
     metadata:
       name: nginx-ingress-role
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     rules:
       - apiGroups:
           - ""
         resources:
           - configmaps
           - pods
           - secrets
           - namespaces
         verbs:
           - get
       - apiGroups:
           - ""
         resources:
           - configmaps
         resourceNames:
           # Defaults to "<election-id>-<ingress-class>"
           # Here: "<ingress-controller-leader>-<nginx>"
           # This has to be adapted if you change either parameter
           # when launching the nginx-ingress-controller.
           - "ingress-controller-leader-nginx"
         verbs:
           - get
           - update
       - apiGroups:
           - ""
         resources:
           - configmaps
         verbs:
           - create
       - apiGroups:
           - ""
         resources:
           - endpoints
         verbs:
           - get
     
     ---
     apiVersion: rbac.authorization.k8s.io/v1beta1
     kind: RoleBinding
     metadata:
       name: nginx-ingress-role-nisa-binding
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: Role
       name: nginx-ingress-role
     subjects:
       - kind: ServiceAccount
         name: nginx-ingress-serviceaccount
         namespace: ingress-nginx
     
     ---
     apiVersion: rbac.authorization.k8s.io/v1beta1
     kind: ClusterRoleBinding
     metadata:
       name: nginx-ingress-clusterrole-nisa-binding
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: ClusterRole
       name: nginx-ingress-clusterrole
     subjects:
       - kind: ServiceAccount
         name: nginx-ingress-serviceaccount
         namespace: ingress-nginx
     
     ---
     
     apiVersion: apps/v1
     kind: Deployment
     metadata:
       name: nginx-ingress-controller
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     spec:
       replicas: 1
       selector:
         matchLabels:
           app.kubernetes.io/name: ingress-nginx
           app.kubernetes.io/part-of: ingress-nginx
       template:
         metadata:
           labels:
             app.kubernetes.io/name: ingress-nginx
             app.kubernetes.io/part-of: ingress-nginx
           annotations:
             prometheus.io/port: "10254"
             prometheus.io/scrape: "true"
         spec:
           serviceAccountName: nginx-ingress-serviceaccount
           containers:
             - name: nginx-ingress-controller
               image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.24.0
               args:
                 - /nginx-ingress-controller
                 - --configmap=$(POD_NAMESPACE)/nginx-configuration
                 - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
                 - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
                 - --publish-service=$(POD_NAMESPACE)/ingress-nginx
                 - --annotations-prefix=nginx.ingress.kubernetes.io
               securityContext:
                 allowPrivilegeEscalation: true
                 capabilities:
                   drop:
                     - ALL
                   add:
                     - NET_BIND_SERVICE
                 # www-data -> 33
                 runAsUser: 33
               env:
                 - name: POD_NAME
                   valueFrom:
                     fieldRef:
                       fieldPath: metadata.name
                 - name: POD_NAMESPACE
                   valueFrom:
                     fieldRef:
                       fieldPath: metadata.namespace
               ports:
                 - name: http
                   containerPort: 80
                 - name: https
                   containerPort: 443
               livenessProbe:
                 failureThreshold: 3
                 httpGet:
                   path: /healthz
                   port: 10254
                   scheme: HTTP
                 initialDelaySeconds: 10
                 periodSeconds: 10
                 successThreshold: 1
                 timeoutSeconds: 10
               readinessProbe:
                 failureThreshold: 3
                 httpGet:
                   path: /healthz
                   port: 10254
                   scheme: HTTP
                 periodSeconds: 10
                 successThreshold: 1
                 timeoutSeconds: 10
     
     ---
     
     

   • cloud-generic.yaml

     kind: Service
     apiVersion: v1
     metadata:
       name: ingress-nginx
       namespace: ingress-nginx
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
     spec:
       externalTrafficPolicy: Local
       type: LoadBalancer
       selector:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
       ports:
         - name: http
           port: 80
           targetPort: http
         - name: https
           port: 443
           targetPort: https
     
     ---
     
     

2. 执行命令完成相关部署

   $ kubectl create -f mandatory.yaml
   
   $ kubectl create -f cloud-generic.yaml
   
   

3. 查看部署结果

   $ kubectl get pod,svc --all-namespaces | grep ingress
   ingress-nginx   pod/nginx-ingress-controller-68647f69b8-2gdbt    1/1     Running   0          6h6m
   ingress-nginx   service/ingress-nginx             LoadBalancer   10.109.194.74    <pending>     80:30448/TCP,443:31808/TCP    5h59m
   

4. 部署测试应用

   • 编写yaml文件

     $ cat test2.yaml 
     apiVersion: extensions/v1beta1
     kind: Ingress
     metadata:
       name: dashboard-ingress
       namespace: kube-system
       annotations:
         nginx.ingress.kubernetes.io/ingress.class: nginx
         nginx.ingress.kubernetes.io/secure-backends: "true"
         nginx.ingress.kubernetes.io/ssl-passthrough: "true"
     spec:
       tls:
       - hosts:
         - dashboard.minminmsn.com
         secretName: ingress-secret
       rules:
         - host: dashboard.minminmsn.com
           http:
             paths:
             - path: /
               backend:
                 serviceName: kubernetes-dashboard
                 servicePort: 443
     
     

   • 编写host用于dns我们的服务

     # 在hosts文件中添加以下记录
     xx.xx.xx.xx dashboard.minminmsn.com
     # xx.xx.xx.xx 为转化服务的那个节点的ip地址
     

   • 通过ingress访问服务

     在浏览器输入https://dashboard.minminmsn.com:31021 即可看到自己的dashboard界面。