8. kubernetes ingress和ingerss Controller

[TOC]

本文基于马哥的docker和k8s视频总结, 在此致谢马哥.

• 卸载四层以上会话, 例如SSL
• Ingress controller => 入口控制器, 拥有七层代理和调度能力的应用程序(其实是一个pod)
  • Nginx
  • Traefik
  • Envoy
• Ingress资源

如何在kubernetes上实现七层调度?

1. 先部署一个Ingress Controller
2. 根据自己的需要配置(虚拟主机或url代理)前端
3. 根据service收集到的后端pod的IP定义成upstream server并反映在Ingress中
4. 由Ingress动态注入到Ingress Controller中

ingress controller.png

如何部署一个Ingress?

kubernetes ingress-nginx-controller-架构.png

kubectl explain ing.spec
    # backend <object> 定义后端有哪些主机
    # rules <[]object> 定义规则
    # tls <[]object> 定义https时才使用此参数, 用于卸载7层会话

kubectl explain ing.spec.rules
    # host  <string> 定义虚拟主机
    # http.paths    <[]Object> -required- 定义url

kubectl explain ing.spec.backend
    # serviceName   <string> -required- 定义后端pod的名称
    # servicePort   <string> -required- 定义后端pod的端口

nginx ingress controller

使用github上关于ingress的项目: https://github.com/kubernetes/ingress-nginx

# 1.创建文件放置目录
mkdir ~/ingress-nginx ; cd ~/ingress-nginx

# 2. 下载需要使用的yaml文件, 注意使用raw格式的url
for file in namespace.yaml configmap.yaml rbac.yaml with-rbac.yaml;do wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/$file; done

# 3. 分别创建
kubectl apply -f namespace.yaml # 注意必须要首先创建名称空间
kubectl apply -f ./ # apply可以针对目录进行, 它会自动引用目录下所有文件

# 注: 第2, 3步可以替换为引用mantadory.yaml文件
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml

# 4. 查看ingress-nginx的pod是否被创建, 注意指明名称空间
kubectl get pods -n ingress-nginx
NAME                                      READY STATUS            RESTARTS AGE
nginx-ingress-controller-79f6884cf6-g8x5h 0/1   ContainerCreating 0        77s
    # 注: 这一步下载的nginx-ingress-controller非常慢, 我第一次下载镜像, 创建pod花了40分钟
    # 记录下载的镜像名与版本:
    # quay.io/kubernetes-ingress-controller/nginx-ingress-controller   0.25.1                     0439eb3e11f1        3 weeks ago         511MB

# 用以下命令查看pod情况, 注意指明名称空间!
kubectl describe pods nginx-ingress-controller-79f6884cf6-g8x5h -n ingress-nginx

# 直接连入ingress-controller中查看配置情况
kubectl exec -it -n ingress-nginx nginx-ingress-controller-79f6884cf6-g8x5h -- /bin/sh

# 5. 创建后端被代理的服务service并使用
vi deploy-demo.yml

apiVersion: v1
kind: Service
metadata:
    name: myapp
    namespace: default
spec:
    selector:
        app: nginx
        release: canary
    ports:
    - name: http
        port: 80
        targetPort: 80
--- # 注意一定要使用三个横线来分割
apiVersion: apps/v1
kind: Deployment
metadata:
    name: nginx-deploy
    namespace: default
spec:
    replicas: 2
    selecotr:
        matchLabels:
            app: nginx
            release: canary
    template:
        metadata:
            labels:
                app: nginx
                release: canary
        spec:
            containers:
            - name: nginx-container
                image: nginx:1.14-alpine
                ports:
                - name: http
                    containerPort: 80

kubectl apply -f deploy-demo.yml

# 6. 创建Service接入集群外部流量
# 也可以直接共享node的网络名称空间, 但需要手动改造配置文件with-rbac.yaml, 
# 将Deployment改为daemonSet, 去掉replicas并修改一些对应配置, 最重要的是
# 在template.spec中添加一项配置: hostNetwork
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml

vi service-nodeport.yaml

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  type: NodePort
  ports:
    - name: http
      port: 80
      targetPort: 80
      nodePort: 30080 # 可自定义节点对外暴露的端口
      protocol: TCP 
    - name: https
      port: 443 
      targetPort: 443 
      nodePort: 30443 # 可自定义节点对外暴露的端口
      protocol: TCP 
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
---

kubectl apply -f service-nodeport.yaml

# 7. 创建Ingress
vi ingress-demo.yaml

可以使用虚拟主机(主机名)的方式进行定义:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
    name: ingress-test
    namespace: default # 与Deployment和Service应属于同一个名称空间
    annotations:
        kubernetes.io/ingress.class: "nginx" # 写明使用nginx类型的ingress-controller
spec:
    rules:
    - host: myapp.test.com # 定义外部能够通过DNS解析到的主机名
        http:
            paths:
            - path: # 前端使用url进行映射, 可以为空(此时会使用根"/")
                backend: # 映射到的后端, 会根据后面哪些pod来生成upstream
                    serviceName: myapp
                    servicePort: 80

也可以使用url的方式进行定义, 以下为示例

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
    name: ingress-test
    annotations: # 此项非常重要, 指明使用的ingress-controller类型
        nginx.ingress.kubernetes.io/rewrite-target: /
spec:
    rules:
    - http:
        paths:
        - path: /testpath
            backend:
                serviceName: myapp
                servicePort: 80

kubectl apply -f ingress-demo.yml

# 8. 外部访问测试
https://192.168.200.201:30080

记录一个实操成功的案例配置

mkdir ~/ingress-nginx ; cd ~/ingress-nginx
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml

vi service-nodeport.yaml

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  type: NodePort
  ports:
    - name: http
      port: 80
      targetPort: 80
      nodePort: 30080
      protocol: TCP
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---

kubectl apply -f service-nodeport.yaml
vi tomcat-deploy.yml

apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: default
spec:
  selector:
    app: tomcat
    release: test
  ports:
  - name: http
    port: 8080
    targetPort: 8080

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: myapp-deploy
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: tomcat
      release: test
  template:
    metadata:
      labels:
        app: tomcat
        release: test
    spec:
      containers:
      - name: tomcat-container
        image: tomcat:8-alpine
        ports:
        - name: http
          containerPort: 8080

kubectl apply -f tomcat-deploy.yml
vi tomcat-ingress.yml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: node2
    http:
      paths:
      - path:
        backend:
          serviceName: myapp
          servicePort: 8080

kubectl apply -f tomcat-ingress.yml
# 测试: 在宿主机上先做好DNS解析, 然后使用浏览器访问http://虚拟机ip:8080, 可查看到在容器中运行的tomcat服务