Ingress為彌補NodePort不足而生 　　NodePort存在的缺點 　　　　一個埠只能一個服務使用，埠需要提前規劃 　　　　只支援四層負載均衡 Pod與Ingress的關係　 　　通過service相關聯 　　通過Ingress Controller實現Pod的負載均衡 　　支援TCP/UDP 4層和HTTP 7層 部署Ingress-controller kubectl apply -f Ingress-controller.yaml 可通過kubectl get pods -n ingress-nginx命令檢視是否部署成功 部署完之後要定義Ingress.yaml規則檔案用來連線service，通過kubectl apply -f ingress.yaml 部署規則檔案，通過kubectl get ingress可檢視，HOSTS就是使用者瀏覽器需要輸入的域名（我們自己測試可以更改windos機器的hosts），通過這個域名分配到不同的專案中 Ingress-controller高可用方案 如果有幾百臺機器，每一臺都部署Ingress-controller的話就沒必要，可以選用一些專門部署Ingress-controller的node節點，利用nodeslector（標籤）+汙點+deamonset的方式將Ingress-controller精確的分部到這幾臺node節點上，然後通過一個LB（可以是nginx）將請求轉發到這幾臺機器上 Ingress的Ingress.yaml規則檔案 ingress與service要在同一名稱空間下，不支援跨名稱空間 Ingress.yaml是用來定義轉發規則的，Ingress-controller.yaml是根據轉發規則來轉發至service 實際上Ingress就是獲取service連線的pod的IP，然後自動把IP填充到nginx配置檔案的server段中，通過這個實現負載均衡，我們可以通過node進入Ingress-controller的容器，去檢視nginx.conf這個檔案

#
 
 普通http的ingress.yaml檔案
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: example-ingress
spec:
  rules:
   # 指定主機
  - host: example.ctnrs.com
    http:
      paths:
      # 指定路徑
      - path: /
        backend:
          # 通過kubectl get svc查詢到的servicename 
          serviceName: web
          
 
# 通過kubectl get svc查詢到的前面的埠
          servicePort: 80

-----------------------------------------------------------------------
# 支援https的ingress.yaml檔案
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: tls-example-ingress
spec:
  # 增加以下四行
  tls:
  - hosts:
      # 域名
    - example.ctnrs.com
    # 執行kubectl create secret命令時候的部分
    secretName: example-ctnrs-com
  rules:
    - host: sslexample.ctnrs.com
      http:
        paths:
        - path: /
          backend:
            serviceName: web
            servicePort: 80

-----------------------------------------------------------------------
# 可根據URL路由跳轉不通服務的ingress.yaml檔案，比如有的服務是nginx，有的是tomcat
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: name-virtual-host-ingress
  # 註解
  annotations:
    # 重定向目標到根
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
   # 域名
  - host: foobar.ctnrs.com
    http:
      paths:
      # 如果路徑是/foo，則跳轉到nginx1這個服務
      - path: /foo
        backend:
          serviceName: nginx1
          servicePort: 80
  - host: foobar.ctnrs.com
    http:
      paths:
      # 如果路徑是/bar，則跳轉到tomcat1這個服務
      - path: /bar
        backend:
          serviceName: tomcat1
          servicePort: 80

-----------------------------------------------------------------------
# 同一個ingress可以有多個域名，不同的域名都可以進行訪問
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: name-virtual-host-ingress
spec:
  rules:
   # 域名1
  - host: foo.ctnrs.com
    http:
      paths:
      - backend:
          serviceName: service1
          servicePort: 80
    # 域名2
  - host: bar.ctnrs.com
    http:
      paths:
      - backend:
          serviceName: service2
          servicePort: 80

-----------------------------------------------------------------------


apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: example-ingress
  # 通過註解設定超時nginx時間，很多nginx相關配置可通過註解來設定，具體要看官方文件
  annotations:
     kubernetes.io/ingress.class: "nginx“
     nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-body-size: "10m"
spec:
  rules:
  - host: example.ctnrs.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web
          servicePort: 80

-----------------------------------------------------------------------
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: tls-example-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    # 如果不想跳轉到https，設定成false即可
    nginx.ingress.kubernetes.io/ssl-redirect: 'false'
spec:
  tls:
  - hosts:
    - sslexample.ctnrs.com
    secretName: secret-tls
  rules:
    - host: sslexample.ctnrs.com
      http:
        paths:
        - path: /
          backend:
            serviceName: web
            servicePort: 80

Ingress的Ingress-controller.yaml檔案內容 多個node之間不共享ingress，可以將Ingress-controller控制器更改成daemonset

# 建立名稱空間
apiVersion: v1
kind: Namespace
metadata:
  name: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---

kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: tcp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: udp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nginx-ingress-serviceaccount
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: nginx-ingress-clusterrole
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - endpoints
      - nodes
      - pods
      - secrets
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "extensions"
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - "extensions"
    resources:
      - ingresses/status
    verbs:
      - update

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: nginx-ingress-role
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - pods
      - secrets
      - namespaces
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      # Defaults to "<election-id>-<ingress-class>"
      # Here: "<ingress-controller-leader>-<nginx>"
      # This has to be adapted if you change either parameter
      # when launching the nginx-ingress-controller.
      - "ingress-controller-leader-nginx"
    verbs:
      - get
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - endpoints
    verbs:
      - get

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: nginx-ingress-role-nisa-binding
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: nginx-ingress-role
subjects:
  - kind: ServiceAccount
    name: nginx-ingress-serviceaccount
    namespace: ingress-nginx

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: nginx-ingress-clusterrole-nisa-binding
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: nginx-ingress-clusterrole
subjects:
  - kind: ServiceAccount
    name: nginx-ingress-serviceaccount
    namespace: ingress-nginx

---

apiVersion: apps/v1
# 在每臺node節點上都部署上ingress-nginx
kind: DaemonSet 
metadata:
  name: nginx-ingress-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  selector:
    matchLabels:
      # 標籤
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
      annotations:
        prometheus.io/port: "10254"
        prometheus.io/scrape: "true"
    spec:
       # hostNetwork表示使用宿主機網路
      hostNetwork: true
      serviceAccountName: nginx-ingress-serviceaccount
      containers:
        - name: nginx-ingress-controller
          # 國內映象地址
          image: lizhenliang/nginx-ingress-controller:0.20.0 
          # 啟動映象的引數
          args:
            - /nginx-ingress-controller
            # 使用下面的變數設定名稱空間
            - --configmap=$(POD_NAMESPACE)/nginx-configuration
            # 定義四層相關配置
            - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
            - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
            # 暴露的service
            - --publish-service=$(POD_NAMESPACE)/ingress-nginx
            # 註解字首，當叢集部署多個Ingress-controller時，通過註解字首區分應用到哪個控制器上
            - --annotations-prefix=nginx.ingress.kubernetes.io
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            # www-data -> 33
            runAsUser: 33
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
             # 設定變數
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          ports:
            - name: http
              containerPort: 80
            - name: https
              containerPort: 443
          # 健康檢查
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10

---
apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
spec:
  #type: NodePort
  ports:
  - name: http
    port: 80
    targetPort: 80
    protocol: TCP
  - name: https
    port: 443
    targetPort: 443
    protocol: TCP
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

外部流量進叢集POD是怎麼被轉發的？ 畫圖說明，比如用到了3個邊緣節點，流量從LB進來，然後被轉發到其中一個ingress controller的pod裡面，並根據svc規則轉發到svc對應的後端endpoint上（對應app pod），其中ingress controller是執行在某個ingress controller pod裡面，直接watch API SERVER裡面ingress規則的變更，這裡就已經不需要ingress-nginx的svc了（不過一般還需要配置下，否則叢集會一直提示err services "ingress-nginx" not found）