K8S之Ingress概述与说明，并详解Ingress常用示例

主机配置规划

服务器名称(hostname)	系统版本	配置	内网IP	外网IP(模拟)
k8s-master	CentOS7.7	2C/4G/20G	172.16.1.110	10.0.0.110
k8s-node01	CentOS7.7	2C/4G/20G	172.16.1.111	10.0.0.111
k8s-node02	CentOS7.7	2C/4G/20G	172.16.1.112	10.0.0.112

Ingress概述 Ingress 是对集群中服务的外部访问进行管理的 API 对象，典型的访问方式是 HTTP和HTTPS。
Ingress 可以提供负载均衡、SSL 和基于名称的虚拟托管。
必须具有 ingress 控制器【例如 ingress-nginx】才能满足 Ingress 的要求。仅创建 Ingress 资源无效。
Ingress 是什么 Ingress 公开了从集群外部到集群内 services 的 HTTP 和 HTTPS 路由。 流量路由由 Ingress 资源上定义的规则控制。

internet | [ Ingress ] --|-----|-- [ Services ]

可以将 Ingress 配置为提供服务外部可访问的 URL、负载均衡流量、 SSL / TLS，以及提供基于名称的虚拟主机。Ingress 控制器 通常负责通过负载均衡器来实现 Ingress，尽管它也可以配置边缘路由器或其他前端来帮助处理流量。
Ingress 不会公开任意端口或协议。若将 HTTP 和 HTTPS 以外的服务公开到 Internet 时，通常使用 Service.Type=NodePort 或者 Service.Type=LoadBalancer 类型的服务。
以Nginx Ingress为例，图如下

文章图片


文章图片

Ingress示例 架构图
文章图片

部署Ingress-Nginx 该Nginx是经过改造的，而不是传统的Nginx。
Ingress-Nginx官网地址

https://kubernetes.github.io/ingress-nginx/

Ingress-Nginx GitHub地址

https://github.com/kubernetes/ingress-nginx

本次下载版本：nginx-0.30.0

文章图片

镜像下载与重命名

docker pull registry.cn-beijing.aliyuncs.com/google_registry/nginx-ingress-controller:0.30.0 docker tag 89ccad40ce8e quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0 docker rmiregistry.cn-beijing.aliyuncs.com/google_registry/nginx-ingress-controller:0.30.0

ingress-nginx的yaml文件修改后并启动

# 当前目录 [root@k8s-master ingress]# pwd /root/k8s_practice/ingress # 获取NGINX: 0.30.0 [root@k8s-master ingress]# wget https://github.com/kubernetes/ingress-nginx/archive/nginx-0.30.0.tar.gz [root@k8s-master ingress]# tar xf nginx-0.30.0.tar.gz # yaml文件在下载包中的位置：ingress-nginx-nginx-0.30.0/deploy/static/mandatory.yaml [root@k8s-master ingress]# cp -a ingress-nginx-nginx-0.30.0/deploy/static/mandatory.yaml ./ [root@k8s-master ingress]# # yaml文件配置修改 [root@k8s-master ingress]# vim mandatory.yaml ……………… apiVersion: apps/v1 kind: DaemonSet# 从Deployment改为DaemonSet metadata: name: nginx-ingress-controller namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: #replicas: 1# 注释掉 ……………… nodeSelector: kubernetes.io/hostname: k8s-master# 修改处 # 如下几行为新加行作用【允许在master节点运行】 tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule ……………… ports: - name: http containerPort: 80 hostPort: 80# 添加处【可在宿主机通过该端口访问Pod】 protocol: TCP - name: https containerPort: 443 hostPort: 443# 添加处【可在宿主机通过该端口访问Pod】 protocol: TCP ……………… [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl apply -f mandatory.yaml namespace/ingress-nginx created configmap/nginx-configuration created configmap/tcp-services created configmap/udp-services created serviceaccount/nginx-ingress-serviceaccount created clusterrole.rbac.authorization.k8s.io/nginx-ingress-clusterrole created role.rbac.authorization.k8s.io/nginx-ingress-role created rolebinding.rbac.authorization.k8s.io/nginx-ingress-role-nisa-binding created clusterrolebinding.rbac.authorization.k8s.io/nginx-ingress-clusterrole-nisa-binding created daemonset.apps/nginx-ingress-controller created limitrange/ingress-nginx created [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get ds -n ingress-nginx -o wide NAMEDESIREDCURRENTREADYUP-TO-DATEAVAILABLENODE SELECTORAGECONTAINERSIMAGESSELECTOR nginx-ingress-controller11111kubernetes.io/hostname=k8s-master9m47snginx-ingress-controllerquay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get pod -n ingress-nginx -o wide NAMEREADYSTATUSRESTARTSAGEIPNODENOMINATED NODEREADINESS GATES nginx-ingress-controller-rrbh91/1Running09m55s10.244.0.46k8s-master

deply_service1的yaml信息 yaml文件

[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat deply_service1.yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp-deploy1 namespace: default spec: replicas: 3 selector: matchLabels: app: myapp release: v1 template: metadata: labels: app: myapp release: v1 env: test spec: containers: - name: myapp image: registry.cn-beijing.aliyuncs.com/google_registry/myapp:v1 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: myapp-clusterip1 namespace: default spec: type: ClusterIP# 默认类型 selector: app: myapp release: v1 ports: - name: http port: 80 targetPort: 80

启动Deployment和Service

[root@k8s-master ingress]# kubectl apply -f deply_service1.yaml deployment.apps/myapp-deploy1 created service/myapp-clusterip1 created

查看Deploy状态和信息

[root@k8s-master ingress]# kubectl get deploy -o wide NAMEREADYUP-TO-DATEAVAILABLEAGECONTAINERSIMAGESSELECTOR myapp-deploy13/33328smyappregistry.cn-beijing.aliyuncs.com/google_registry/myapp:v1app=myapp,release=v1 [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get rs -o wide NAMEDESIREDCURRENTREADYAGECONTAINERSIMAGESSELECTOR myapp-deploy1-5695bb565833330smyappregistry.cn-beijing.aliyuncs.com/google_registry/myapp:v1app=myapp,pod-template-hash=5695bb5658,release=v1 [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get pod -o wide --show-labels NAMEREADYSTATUSRESTARTSAGEIPNODENOMINATED NODEREADINESS GATESLABELS myapp-deploy1-5695bb5658-n65481/1Running036s10.244.2.144k8s-node02app=myapp,env=test,pod-template-hash=5695bb5658,release=v1 myapp-deploy1-5695bb5658-rqcpb1/1Running036s10.244.2.143k8s-node02app=myapp,env=test,pod-template-hash=5695bb5658,release=v1 myapp-deploy1-5695bb5658-vv6gm1/1Running036s10.244.3.200k8s-node01app=myapp,env=test,pod-template-hash=5695bb5658,release=v1

curl访问pod

[root@k8s-master ingress]# curl 10.244.2.144 Hello MyApp | Version: v1 | Pod Name [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.244.2.144/hostname.html myapp-deploy1-5695bb5658-n6548 [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.244.2.143/hostname.html myapp-deploy1-5695bb5658-rqcpb [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.244.3.200/hostname.html myapp-deploy1-5695bb5658-vv6gm

查看Service状态和信息

[root@k8s-master ingress]# kubectl get svc -o wide NAMETYPECLUSTER-IPEXTERNAL-IPPORT(S)AGESELECTOR kubernetesClusterIP10.96.0.1443/TCP19d myapp-clusterip1ClusterIP10.104.146.1480/TCP5m38sapp=myapp,release=v1

curl访问svc

[root@k8s-master ingress]# curl 10.104.146.14 Hello MyApp | Version: v1 | Pod Name [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.104.146.14/hostname.html myapp-deploy1-5695bb5658-n6548 [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.104.146.14/hostname.html myapp-deploy1-5695bb5658-vv6gm [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.104.146.14/hostname.html myapp-deploy1-5695bb5658-rqcpb

deply_service2的yaml信息 yaml文件

[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat deply_service2.yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp-deploy2 namespace: default spec: replicas: 3 selector: matchLabels: app: myapp release: v2 template: metadata: labels: app: myapp release: v2 env: test spec: containers: - name: myapp image: registry.cn-beijing.aliyuncs.com/google_registry/myapp:v2 imagePullPolicy: IfNotPresent ports: - name: http containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: myapp-clusterip2 namespace: default spec: type: ClusterIP# 默认类型 selector: app: myapp release: v2 ports: - name: http port: 80 targetPort: 80

启动Deployment和Service

[root@k8s-master ingress]# kubectl apply -f deply_service2.yaml deployment.apps/myapp-deploy2 created service/myapp-clusterip2 created

查看Deploy状态和信息

[root@k8s-master ingress]# kubectl get deploy myapp-deploy2 -o wide NAMEREADYUP-TO-DATEAVAILABLEAGECONTAINERSIMAGESSELECTOR myapp-deploy23/3339smyappregistry.cn-beijing.aliyuncs.com/google_registry/myapp:v2app=myapp,release=v2 [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get rs-o wide NAMEDESIREDCURRENTREADYAGECONTAINERSIMAGESSELECTOR myapp-deploy1-5695bb56583337m23smyappregistry.cn-beijing.aliyuncs.com/google_registry/myapp:v1app=myapp,pod-template-hash=5695bb5658,release=v1# 之前创建的 myapp-deploy2-54f48f879b33315smyappregistry.cn-beijing.aliyuncs.com/google_registry/myapp:v2app=myapp,pod-template-hash=54f48f879b,release=v2# 当前deploy创建的 [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get pod -o wide --show-labels -l "release=v2" NAMEREADYSTATUSRESTARTSAGEIPNODENOMINATED NODEREADINESS GATESLABELS myapp-deploy2-54f48f879b-7pxwp1/1Running025s10.244.3.201k8s-node01app=myapp,env=test,pod-template-hash=54f48f879b,release=v2 myapp-deploy2-54f48f879b-lqlh21/1Running025s10.244.2.146k8s-node02app=myapp,env=test,pod-template-hash=54f48f879b,release=v2 myapp-deploy2-54f48f879b-pfvnn1/1Running025s10.244.2.145k8s-node02app=myapp,env=test,pod-template-hash=54f48f879b,release=v2

查看Service状态和信息

[root@k8s-master ingress]# kubectl get svc -o wide NAMETYPECLUSTER-IPEXTERNAL-IPPORT(S)AGESELECTOR kubernetesClusterIP10.96.0.1443/TCP19d myapp-clusterip1ClusterIP10.104.146.1480/TCP8m9sapp=myapp,release=v1 myapp-clusterip2ClusterIP10.110.181.6280/TCP61sapp=myapp,release=v2

curl访问svc

[root@k8s-master ingress]# curl 10.110.181.62 Hello MyApp | Version: v2 | Pod Name [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.110.181.62/hostname.html myapp-deploy2-54f48f879b-lqlh2 [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.110.181.62/hostname.html myapp-deploy2-54f48f879b-7pxwp [root@k8s-master ingress]# [root@k8s-master ingress]# curl 10.110.181.62/hostname.html myapp-deploy2-54f48f879b-pfvnn

Ingress HTTP代理访问 yaml文件【由于自建的service在默认default名称空间，因此这里也是default名称空间】

[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat ingress-http.yaml apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: nginx-http namespace: default spec: rules: - host: www.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip1 servicePort: 80 - host: blog.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip2 servicePort: 80

启动ingress http并查看状态

[root@k8s-master ingress]# kubectl apply -f ingress-http.yaml ingress.networking.k8s.io/nginx-http created [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get ingress -o wide NAMEHOSTSADDRESSPORTSAGE nginx-httpwww.zhangtest.com,blog.zhangtest.com809s

查看nginx配置文件

[root@k8s-master ~]# kubectl get pod -A | grep 'ingre' ingress-nginxnginx-ingress-controller-rrbh91/1Running027m [root@k8s-master ~]# [root@k8s-master ~]# kubectl exec -it -n ingress-nginx nginx-ingress-controller-rrbh9 bash bash-5.0$ cat /etc/nginx/nginx.conf ………… ##### 可见server www.zhangtest.com 和 server blog.zhangtest.com的配置

浏览器访问
hosts文件修改，添加如下信息

文件位置：C:\WINDOWS\System32\drivers\etc\hosts 添加信息如下： # K8S ingress学习 10.0.0.110www.zhangtest.comblog.zhangtest.com

浏览器访问www.zhangtest.com

http://www.zhangtest.com/ http://www.zhangtest.com/hostname.html

文章图片

浏览器访问blog.zhangtest.com

http://blog.zhangtest.com/ http://blog.zhangtest.com/hostname.html

文章图片

当然：除了用浏览器访问外，也可以在Linux使用curl访问。前提是修改/etc/hosts文件，对上面的两个域名进行解析。
Ingress HTTPS代理访问 SSL证书创建

[root@k8s-master cert]# pwd /root/k8s_practice/ingress/cert [root@k8s-master cert]# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/C=CN/ST=BJ/L=BeiJing/O=BTC/OU=MOST/CN=zhang/emailAddress=ca@test.com" Generating a 2048 bit RSA private key ......................................................+++ ........................+++ writing new private key to 'tls.key' ----- [root@k8s-master cert]# kubectl create secret tls tls-secret --key tls.key --cert tls.crt secret/tls-secret created

创建ingress https
yaml文件【由于自建的service在默认default名称空间，因此这里也是default名称空间】

[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat ingress-https.yaml apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: nginx-https namespace: default spec: tls: - hosts: - www.zhangtest.com - blog.zhangtest.com secretName: tls-secret rules: - host: www.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip1 servicePort: 80 - host: blog.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip2 servicePort: 80

启动ingress https并查看状态

[root@k8s-master ingress]# kubectl apply -f ingress-https.yaml ingress.networking.k8s.io/nginx-https created [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get ingress -o wide NAMEHOSTSADDRESSPORTSAGE nginx-httpswww.zhangtest.com,blog.zhangtest.com80, 4438s

浏览器访问
hosts文件修改，添加如下信息

文件位置：C:\WINDOWS\System32\drivers\etc\hosts 添加信息如下： # K8S ingress学习 10.0.0.110www.zhangtest.comblog.zhangtest.com

浏览器访问www.zhangtest.com

https://www.zhangtest.com/ https://www.zhangtest.com/hostname.html

文章图片

浏览器访问blog.zhangtest.com

https://blog.zhangtest.com/ https://blog.zhangtest.com/hostname.html

文章图片

Ingress-Nginx实现BasicAuth认证 官网地址：

https://kubernetes.github.io/ingress-nginx/examples/auth/basic/

准备工作

[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# yum install -y httpd [root@k8s-master ingress]# htpasswd -c auth foo New password: #输入密码 Re-type new password: #重复输入的密码 Adding password for user foo##### 此时会生成一个 auth文件 [root@k8s-master ingress]# kubectl create secret generic basic-auth --from-file=auth secret/basic-auth created [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get secret basic-auth -o yaml apiVersion: v1 data: auth: Zm9vOiRhcHIxJFpaSUJUMDZOJDVNZ3hxdkpFNWVRTi9NdnZCcVpHaC4K kind: Secret metadata: creationTimestamp: "2020-08-17T09:42:04Z" name: basic-auth namespace: default resourceVersion: "775573" selfLink: /api/v1/namespaces/default/secrets/basic-auth uid: eef0853b-a52b-4684-922a-817e4cd9e9ca type: Opaque

ingress yaml文件

[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat nginx_basicauth.yaml apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: ingress-with-auth annotations: # type of authentication nginx.ingress.kubernetes.io/auth-type: basic # name of the secret that contains the user/password definitions nginx.ingress.kubernetes.io/auth-secret: basic-auth # message to display with an appropriate context why the authentication is required nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo' spec: rules: - host: auth.zhangtest.com http: paths: - path: / backend: serviceName: myapp-clusterip1 servicePort: 80

启动ingress并查看状态

[root@k8s-master ingress]# kubectl apply -f nginx_basicauth.yaml ingress.networking.k8s.io/ingress-with-auth created [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get ingress -o wide NAMEHOSTSADDRESSPORTSAGE ingress-with-authauth.zhangtest.com806s

浏览器访问 hosts文件修改，添加如下信息

文件位置：C:\WINDOWS\System32\drivers\etc\hosts 添加信息如下： # K8S ingress学习 10.0.0.110www.zhangtest.comblog.zhangtest.com auth.zhangtest.com

浏览器访问auth.zhangtest.com

http://auth.zhangtest.com/

文章图片

Ingress-Nginx实现Rewrite重写 官网地址：

https://kubernetes.github.io/ingress-nginx/examples/rewrite/

重写可以使用以下注解控制：

名称	描述	值
nginx.ingress.kubernetes.io/rewrite-target	必须重定向的目标URL	String
nginx.ingress.kubernetes.io/ssl-redirect	指示位置部分是否只能由SSL访问(当Ingress包含证书时，默认为True)	Bool
nginx.ingress.kubernetes.io/force-ssl-redirect	即使Ingress没有启用TLS，也强制重定向到HTTPS	Bool
nginx.ingress.kubernetes.io/app-root	定义应用程序根目录，Controller在“/”上下文中必须重定向该根目录	String
nginx.ingress.kubernetes.io/use-regex	指示Ingress上定义的路径是否使用正则表达式	Bool

ingress yaml文件

[root@k8s-master ingress]# pwd /root/k8s_practice/ingress [root@k8s-master ingress]# cat nginx_rewrite.yaml apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: annotations: nginx.ingress.kubernetes.io/rewrite-target: https://www.baidu.com name: rewrite namespace: default spec: rules: - host: rewrite.zhangtest.com http: paths: - backend: serviceName: myapp-clusterip1 servicePort: 80

启动ingress并查看状态

[root@k8s-master ingress]# kubectl apply -f nginx_rewrite.yaml ingress.networking.k8s.io/rewrite created [root@k8s-master ingress]# [root@k8s-master ingress]# kubectl get ingress -o wide NAMEHOSTSADDRESSPORTSAGE rewriterewrite.zhangtest.com8013s

浏览器访问 hosts文件修改，添加如下信息

文件位置：C:\WINDOWS\System32\drivers\etc\hosts 添加信息如下： # K8S ingress学习 10.0.0.110www.zhangtest.comblog.zhangtest.com auth.zhangtest.comrewrite.zhangtest.com

浏览器访问rewrite.zhangtest.com

http://rewrite.zhangtest.com/

文章图片

之后，可见重定向到了https://www.baidu.com百度页面
相关阅读 1、k8s 官方 Ingress
2、Ingress-Nginx官网地址
3、Ingress-Nginx GitHub地址
4、Ingress-Nginx实现BasicAuth认证
5、Ingress-Nginx实现Rewrite重写
———END——— 如果觉得不错就关注下呗 (-^O^-) ！ 【kubernetes|Kubernetes K8S之Ingress详解与示例】
文章图片

推荐阅读

• 

  什么鸟儿是飞行家
• 

  古风笔名
• 

  怀孕初期吃什么好 怀孕初期饮食原则
• 

  redis查看当前是哪个数据库 查看redis数据库版本
• 

  【创融同学会征4动态】征4创融跑团戈壁挑战赛备战会议圆满成功
• 

  现在的英雄联盟满攻速是点那个符文？
• 

  蟹蒸出来怎么蟹黄变黑了
• 

  柠檬女孩什么意思 柠檬女孩的意思
• 

  tr4
• 

  佳能万能版清零软件-打印机清零软件怎么下载
• 

  Android开源日志库Logger
• 

  牵牛花种子什么时候种植 牵牛花种子什么时候种
• 

  西门子燃气灶显示灯解决方法有哪些？
• 

  夏季吃红辣椒可以预防中暑
• 

  大豆纤维被孔数越多越好吗
• 

  牛抄藤
• 

  usbcan分析仪
• 

  青海信创服务器在知乎上的评价如何？ 青海信创服务器怎么样知乎
• 

  怎样培殖蚯蚓 水蚯蚓培育方法
• 

  中国联通手机营业厅100M全国流量免费领 升级即可领取

• kubernetes|kubernetes (k8s) list-watch机制、调度约束
• kubernetes|【云原生】docker+k8微服务容器化实战（下篇）
• 云原生|云原生应用的建设之路
• kubernetes|kubernetes学习笔记-ingress-nginx
• kubernetes|二、Kubernetes集群环境的搭建
• kubernetes|使用k8e快速部署Kubernetes集群服务
• k8s|k8s--基础--02--组件
• 阿里云|平安保险基于 SPI 机制的 RocketMQ 定制化应用
• 云原生系列|【云原生】4.2 DevOps 精讲篇