前提条件：有一套K8S集群，快速部署参考
使用sealos部署kubernetes集群并实现集群管理
一、Nginx Ingress Controller
1.1 nginx ingress controller位置
参考链接：https://www.f5.com/products/nginx/nginx-ingress-controller
1.2 nginx ingress controller部署
[root@k8s-master1 ~]# curl -k https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/baremetal/deploy.yaml -o deploy.yaml
# 应用资源清单文件
[root@k8s-master1 ~]# kubectl apply -f deploy.yaml
namespace/ingress-nginx created
serviceaccount/ingress-nginx created
serviceaccount/ingress-nginx-admission created
role.rbac.authorization.k8s.io/ingress-nginx created
role.rbac.authorization.k8s.io/ingress-nginx-admission created
clusterrole.rbac.authorization.k8s.io/ingress-nginx created
clusterrole.rbac.authorization.k8s.io/ingress-nginx-admission created
rolebinding.rbac.authorization.k8s.io/ingress-nginx created
rolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created
clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx created
clusterrolebinding.rbac.authorization.k8s.io/ingress-nginx-admission created
configmap/ingress-nginx-controller created
service/ingress-nginx-controller created
service/ingress-nginx-controller-admission created
deployment.apps/ingress-nginx-controller created
job.batch/ingress-nginx-admission-create created
job.batch/ingress-nginx-admission-patch created
ingressclass.networking.k8s.io/nginx created
validatingwebhookconfiguration.admissionregistration.k8s.io/ingress-nginx-admission created
# 验证部署结果
# 注意镜像较大，可提前下载至集群node节点
[root@k8s-master01 ~]# kubectl get pods -n ingress-nginx
NAME READY STATUS RESTARTS AGE
ingress-nginx-admission-create-nginx-rhftv 0/1 Completed 0 55m
ingress-nginx-admission-patch-nginx-7w9zd 0/1 Completed 1 55m
ingress-nginx-controller-nginx-84d5995659-95phs 1/1 Running 0 55m
[root@k8s-master01 ~]# kubectl get all -n ingress-nginx
NAME READY STATUS RESTARTS AGE
pod/ingress-nginx-admission-create-nginx-rhftv 0/1 Completed 0 55m
pod/ingress-nginx-admission-patch-nginx-7w9zd 0/1 Completed 1 55m
pod/ingress-nginx-controller-nginx-84d5995659-95phs 1/1 Running 0 55m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/ingress-nginx-controller-admission-nginx ClusterIP 10.96.2.210 <none> 443/TCP 55m
service/ingress-nginx-controller-nginx NodePort 10.96.0.214 <none> 80:32067/TCP,443:32076/TCP 55m
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/ingress-nginx-controller-nginx 1/1 1 1 55m
NAME DESIRED CURRENT READY AGE
replicaset.apps/ingress-nginx-controller-nginx-84d5995659 1 1 1 55m
NAME COMPLETIONS DURATION AGE
job.batch/ingress-nginx-admission-create-nginx 1/1 8s 55m
job.batch/ingress-nginx-admission-patch-nginx 1/1 10s 55m
1.3 ingress对象应用案例
1.3 1 ingress-http案例
基于名称的负载均衡
1.3.1.1 创建deployment控制器类型应用
[root@k8s-master1 ~]# vim nginx.yml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
namespace: ingress-nginx
spec:
replicas: 2
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: c1
image: nginx:1.15-alpine
imagePullPolicy: IfNotPresent
[root@k8s-master1 ~]# kubectl apply -f nginx.yml
deployment.extensions/nginx created
[root@k8s-master1 ~]# kubectl get pods -n ingress-nginx
[root@k8s-master01 ~]# kubectl get pods -n ingress-nginx
NAME READY STATUS RESTARTS AGE
ingress-nginx-admission-create-nginx-rhftv 0/1 Completed 0 61m
ingress-nginx-admission-patch-nginx-7w9zd 0/1 Completed 1 61m
ingress-nginx-controller-nginx-84d5995659-95phs 1/1 Running 0 61m
nginx-65c749f4dc-6zccn 1/1 Running 0 55m
nginx-65c749f4dc-wvrbq 1/1 Running 0 55m
1.3.1.2 创建service
[root@k8s-master1 ~]# vim nginx-service.yml
apiVersion: v1
kind: Service
metadata:
name: nginx-service
namespace: ingress-nginx
labels:
app: nginx
spec:
ports:
- port: 80
targetPort: 80
selector:
app: nginx
应用YAML
[root@k8s-master1 ~]# kubectl apply -f nginx-service.yml
service/nginx-service created
验证service
[root@k8s-master1 ~]# kubectl get svc -n ingress-nginx
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx-controller-admission-nginx ClusterIP 10.96.2.210 <none> 443/TCP 62m
ingress-nginx-controller-nginx NodePort 10.96.0.214 <none> 80:32067/TCP,443:32076/TCP 62m
nginx-service ClusterIP 10.96.2.69 <none> 80/TCP 55m
1.3.1.3 创建ingress对象
[root@k8s-master1 ~]# vim ingress-nginx.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-nginx #自定义ingress名称
namespace: ingress-nginx
annotations:
ingressclass.kubernetes.io/is-default-class: "true"
kubernetes.io/ingress.class: nginx
spec:
rules:
- host: www.mytest.com # 自定义域名
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: nginx-service # 对应上面创建的service名称
port:
number: 80
应用YAML
[root@k8s-master1 ~]# kubectl apply -f ingress-nginx.yaml
ingress.extensions/ingress-nginx created
验证ingress
[root@k8s-master1 ~]# kubectl get ingress -n ingress-nginx
NAME CLASS HOSTS ADDRESS PORTS AGE
ingress-nginx <none> www.mytest.com 192.168.10.12 80 113s
描述查看ingress信息
[root@k8s-master1 ~]# kubectl describe ingress ingress-nginx -n ingress-nginx
Name: ingress-nginx
Labels: <none>
Namespace: ingress-nginx
Address: 192.168.95.145
Ingress Class: <none>
Default backend: <default>
Rules:
Host Path Backends
---- ---- --------
www.mytest.com
/ nginx-service:80 (100.119.84.73:80,100.119.84.74:80)
Annotations: ingressclass.kubernetes.io/is-default-class: true
kubernetes.io/ingress.class: nginx
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Sync 54m (x2 over 55m) nginx-ingress-controller Scheduled for sync
[root@k8s-master1 ~]# kubectl get pods -o wide -n ingress-nginx
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-65c749f4dc-6zccn 1/1 Running 0 58m 100.119.84.74 k8s-worker01 <none> <none>
nginx-65c749f4dc-wvrbq 1/1 Running 0 58m 100.119.84.73 k8s-worker01 <none> <none>
可以看到两个pod的IP 100.119.84.74 100.119.84.73 正好对应ingress域名 www.mytest.com对应的IP
2.3.1.4 模拟客户端访问
1, 确认nginx-ingress-controller的podIP, 下面命令查询的结果为192.168.10.91
[root@k8s-master1 ~]# kubectl get svc -n ingress-nginx |grep ingress
ingress-nginx-controller-admission-nginx ClusterIP 10.96.2.210 <none> 443/TCP 72m
ingress-nginx-controller-nginx NodePort 10.96.0.214 <none> 80:32067/TCP,443:32076/TCP 72m
11m
2, 在集群之外任一主机中添加上述域名与k8s 任一节点IP地址解析(模拟公网DNS)
我这里配的k8s-master01的IP
[root@otherhost ~]# vim /etc/hosts
192.168.95.142 www.mytest.com
3, 准备pod内容器运行的web主页
[root@k8s-master1 ~]# kubectl get pods -n ingress-nginx
nginx-65c749f4dc-6zccn 1/1 Running 0 79m
nginx-65c749f4dc-wvrbq 1/1 Running 0 79m
[root@k8s-master1 ~]# kubectl exec -it nginx-65c749f4dc-6zccn -n ingress-nginx -- /bin/sh
/ # echo "ingress web1" > /usr/share/nginx/html/index.html
/ # exit
[root@k8s-master1 ~]# kubectl exec -it nginx-65c749f4dc-wvrbq -n ingress-nginx -- /bin/sh
/ # echo "ingress web2" > /usr/share/nginx/html/index.html
/ # exit
4, 访问及结果展示
[root@otherhost ~]# curl www.mytest.com::32067
ingress web1
[root@otherhost ~]# curl www.mytest.com:32067
ingress web2
1.4 访问流程图
我们进入到容器内查看ingress-nginx-controller-nginx的nginx.conf
[root@k8s-master01 ~]# kubectl exec -it ingress-nginx-controller-nginx-84d5995659-95phs -n ingress-nginx -- sh
/etc/nginx $ cat nginx.conf
### 这是创建Ingress对象后自动创建出的一段配置,其实原理也还是通过nginx做的反向代理来实现
## start server www.mytest.com
server {
server_name www.mytest.com ;
listen 80 ;
listen [::]:80 ;
listen 443 ssl http2 ;
listen [::]:443 ssl http2 ;
set $proxy_upstream_name "-";
ssl_certificate_by_lua_block {
certificate.call()
}
location / {
set $namespace "ingress-nginx";
set $ingress_name "ingress-nginx";
set $service_name "nginx-service";
set $service_port "80";
set $location_path "/";
set $global_rate_limit_exceeding n;
rewrite_by_lua_block {
lua_ingress.rewrite({
force_ssl_redirect = false,
ssl_redirect = true,
force_no_ssl_redirect = false,
preserve_trailing_slash = false,
use_port_in_redirects = false,
global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
})
balancer.rewrite()
plugins.run()
}
# be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
# will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
# other authentication method such as basic auth or external auth useless - all requests will be allowed.
#access_by_lua_block {
#}
header_filter_by_lua_block {
lua_ingress.header()
plugins.run()
}
body_filter_by_lua_block {
plugins.run()
}
log_by_lua_block {
balancer.log()
monitor.call()
plugins.run()
}
port_in_redirect off;
set $balancer_ewma_score -1;
set $proxy_upstream_name "ingress-nginx-nginx-service-80";
set $proxy_host $proxy_upstream_name;
set $pass_access_scheme $scheme;
set $pass_server_port $server_port;
set $best_http_host $http_host;
set $pass_port $pass_server_port;
set $proxy_alternative_upstream_name "";
client_max_body_size 1m;
proxy_set_header Host $best_http_host;
# Pass the extracted client certificate to the backend
# Allow websocket connections
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header X-Request-ID $req_id;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Host $best_http_host;
proxy_set_header X-Forwarded-Port $pass_port;
proxy_set_header X-Forwarded-Proto $pass_access_scheme;
proxy_set_header X-Forwarded-Scheme $pass_access_scheme;
proxy_set_header X-Scheme $pass_access_scheme;
# Pass the original X-Forwarded-For
proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
# mitigate HTTPoxy Vulnerability
# https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
proxy_set_header Proxy "";
# Custom headers to proxied server
proxy_connect_timeout 5s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_buffer_size 4k;
proxy_buffers 4 4k;
proxy_max_temp_file_size 1024m;
proxy_request_buffering on;
proxy_http_version 1.1;
proxy_cookie_domain off;
proxy_cookie_path off;
# In case of errors try the next upstream server before returning an error
proxy_next_upstream error timeout;
proxy_next_upstream_timeout 0;
proxy_next_upstream_tries 3;
proxy_pass http://upstream_balancer;
proxy_redirect off;
}
}
## end server www.mytest.com
扫一扫
1087
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
