[TOC] # Ingress 专题 昨晚上回顾了一下 Ingress ，总觉得理解还不够深刻，所以今天专门单独记录一下部署和使用ingress的情况 记录两种Ingress ，一个是traefik，一个是nginx nginx的性能相对traefik会好点 > 不同之处： nginx-ingress 貌似没有webUI界面 而 traefik 有webUI界面 ## Nginx Ingress 我的环境暂时安装不了最新版本，因为没有arm架构的镜像，所以这次要安装的是nginx ingress 0.30 的版。[github地址](https://github.com/kubernetes/ingress-nginx/tree/nginx-0.30.0) ### 前提说明 由于nginx-ingress需要访问外网，所以`nginx-ingress-controller`所在的节点必须要能访问外网 当在部署nginx-ingress的时候，需要将`nginx-ingress-controller`固定在能访问外网的主机上 所以需要修改一下官网提供的yaml文件，添加如下节点绑定信息 ~~~ nodeSelector: kubernetes.io/hostname: master ~~~ ### 第一步 根据文档说明，在安装前，需要执行一个yaml部署，里面包含了创建namespaces、服务账户和角色绑定之类的东西 ~~~ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.30.0/deploy/static/mandatory.yaml ~~~ 将文件下载下来，把`image`字段中使用的镜像改为arm架构镜像， 因为我的环境架构为arm架构，如果是x86架构则不用更改[arm架构地址](https://quay.io/repository/kubernetes-ingress-controller/nginx-ingress-controller-arm?tab=tags) ~~~ quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0 # 改为 quay.io/kubernetes-ingress-controller/nginx-ingress-controller-arm:0.30.0 ~~~ ### 第二步 因为是物理设备，所以选择裸架构部署，使用 NodePort： ~~~ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.30.0/deploy/static/provider/baremetal/service-nodeport.yaml ~~~ ### 使用 #### 创建一个deployment 实例 deployment.yaml ~~~ apiVersion: extensions/v1beta1 kind: Deployment metadata: name: my-nginx spec: template: metadata: labels: app: my-nginx spec: containers: - name: my-nginx image: nginx ports: - containerPort: 80 ~~~  #### 创建service 映射 deployment 创建两个svc，分别为my-nginx-svc-1和my-nginx-svc-2 ~~~ apiVersion: v1 kind: Service metadata: name: my-nginx-1 #和 my-nginx-svc-2 labels: app: my-nginx spec: ports: - port: 80 # 映射到pod的80端口 protocol: TCP name: http selector: app: my-nginx ~~~  ##### 创建基于URL规则转发的Ingess资源 创建一个 Nginx-Ingress 资源，用来转发域名为`www.zwh.com`的规则 * www.zwh.com/svc-1 转发到my-nginx-svc-1上 * www.zwh.com/svc-2 转发到my-nginx-svc-2上 ~~~ apiVersion: extensions/v1beta1 kind: Ingress metadata: name: my-nginx-ingress annotations: kubernetes.io/ingress.class: "nginx" # 用于识别ingress控制器类型，在同一集群中有多个ingress控制器时很重要,如果使用的traefix，这里则要填写traefix spec: rules: #定义当前ingress资源的转发规则列表，未被匹配到的将被转发到backend后端 - host: www.zwh.com #不支持使用IP地址，也不支持跟随端口号，此字段留空表示通配所有主机名 http: paths: - path: /svc-1 backend: serviceName: my-nginx-svc-1 # 需要向外暴露的svc名称 servicePort: 80 - path: /svc-2 backend: serviceName: my-nginx-svc-2 # 需要向外暴露的svc名称 servicePort: 80 ~~~  ##### 访问 在电脑上的hosts文件上做映射。 因为controller是在worker-3节点上，所以需要映射到worker-3这个节点  现在已经能够访问了  ##### 创建基于主机名称的虚拟主机访问规则 将“svc-1.zwh.com” 和 “svc-2.zwh.com” 这两个主机名分别转发到集群内部svc-1和svc-2两个service上去 ~~~ apiVersion: extensions/v1beta1 kind: Ingress metadata: name: my-nginx-ingress spec: rules: - host: svc-1.zwh.com http: paths: - backend: serviceName: my-nginx-svc-1 servicePort: 80 - host: svc-2.zwh.com http: paths: - backend: serviceName: my-nginx-svc-2 servicePort: 80 ~~~ ## 部署traefik ingress traefik 是有图形界面的。安装的是1.7版本的 根据[官方文档](https://docs.traefik.io/v1.7/user-guide/kubernetes/)部署 ### 根据官网文档配置RBAC traefik-rbac.yaml ~~~ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: traefik-ingress-controller rules: - apiGroups: - "" resources: - services - endpoints - secrets verbs: - get - list - watch - apiGroups: - extensions resources: - ingresses verbs: - get - list - watch - apiGroups: - extensions resources: - ingresses/status verbs: - update --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: traefik-ingress-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controller subjects: - kind: ServiceAccount name: traefik-ingress-controller namespace: kube-system ~~~ ### 部署traefix的Deployment 官网提供了Deployment和 DaemnSet两种方式 我选用了Deployment的方式部署 traefik-deployment.yaml ~~~ apiVersion: v1 kind: ServiceAccount metadata: name: traefik-ingress-controller namespace: kube-system --- kind: Deployment apiVersion: apps/v1 metadata: name: traefik-ingress-controller namespace: kube-system labels: k8s-app: traefik-ingress-lb spec: replicas: 1 selector: matchLabels: k8s-app: traefik-ingress-lb template: metadata: labels: k8s-app: traefik-ingress-lb name: traefik-ingress-lb spec: serviceAccountName: traefik-ingress-controller terminationGracePeriodSeconds: 60 containers: - image: traefik:v1.7 name: traefik-ingress-lb ports: - name: http containerPort: 80 - name: admin containerPort: 8080 args: - --api - --kubernetes - --logLevel=INFO --- kind: Service apiVersion: v1 metadata: name: traefik-ingress-service namespace: kube-system spec: selector: k8s-app: traefik-ingress-lb ports: - protocol: TCP port: 80 name: web - protocol: TCP port: 8080 name: admin type: NodePort ~~~ ### 部署 web UI UI 是由Ingress 来提供服务 ui.yaml ~~~ apiVersion: v1 kind: Service metadata: name: traefik-web-ui namespace: kube-system spec: selector: k8s-app: traefik-ingress-lb ports: - name: web port: 80 targetPort: 8080 --- apiVersion: extensions/v1beta1 kind: Ingress metadata: name: traefik-web-ui namespace: kube-system spec: rules: - host: traefik-ui.minikube http: paths: - path: / backend: serviceName: traefik-web-ui servicePort: web ~~~ ### 访问 web UI 可以在上面的`traefik-deployment.yaml`片段中，看到`service`中设置了`NodePort`  并且，在部署UI的Ingress中看到访问的域名为`traefik-ui.minikube`  所以，需要在`hosts`文件里添加相关的解析 ~~~ echo "192.168.222.10 traefik-ui.minikube" | sudo tee -a /etc/hosts # 192.168.222.10是我的节点IP ~~~ 查看 svc 的端口  访问：  ### traefix添加 TLS 认证方式 根据官网提示，在 deployment 的启动参数中，添加如下参数 ~~~ --defaultentrypoints=http,https --entrypoints=Name:https Address::443 TLS --entrypoints=Name:http Address::80 ~~~  再将 TLS 的443 端口添加进traefik-deployment.yaml中 ~~~ ports: - name: https containerPort: 443 ~~~ 修改 UI.yaml 中的 ingress部分 ~~~ apiVersion: extensions/v1beta1 kind: Ingress metadata: name: traefik-web-ui namespace: kube-system annotations: kubernetes.io/ingress.class: traefik spec: rules: - host: traefik-ui.minikube http: paths: - backend: serviceName: traefik-web-ui servicePort: 80 tls: - secretName: traefik-ui-tls-cert ~~~ 创建 TLS 数字证书 ~~~ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=traefik-ui.minikube" ~~~ 创建 secret ~~~ kubectl -n kube-system create secret tls traefik-ui-tls-cert --key=tls.key --cert=tls.crt ~~~ ### 使用 #### 基于host名称 ~~~ apiVersion: extensions/v1beta1 kind: Ingress metadata: name: cheese annotations: kubernetes.io/ingress.class: traefik spec: rules: - host: stilton.minikube http: paths: - path: / backend: serviceName: stilton servicePort: http - host: cheddar.minikube http: paths: - path: / backend: serviceName: cheddar servicePort: http - host: wensleydale.minikube http: paths: - path: / backend: serviceName: wensleydale servicePort: http ~~~ #### 基于路径 ~~~ apiVersion: extensions/v1beta1 kind: Ingress metadata: name: cheeses annotations: kubernetes.io/ingress.class: traefik traefik.frontend.rule.type: PathPrefixStrip spec: rules: - host: cheeses.minikube http: paths: - path: /stilton backend: serviceName: stilton servicePort: http - path: /cheddar backend: serviceName: cheddar servicePort: http - path: /wensleydale backend: serviceName: wensleydale servicePort: http ~~~