簡介

ingress-Nginx和ingress-Nginx-Controller的區別

ingress-Nginx:是每個服務自己建立的ingress,就是nginx的轉發規則,生成Nginx的配置檔案

ingress-Nginx-Controller:相當於Nginx的服務,監聽API Server,根據使用者編寫的ingress-nginx規則(ingress.yaml檔案),動態的去更改Nginx服務的配置檔案,並且reload使其生效,此過程是自動化的,通過lua實現

ingress-Nginx-Controller 的Service型別

NodePort:用Deployment的方式部署一個ingress-nginx-controller,再建立一個type為NodePort的Service,這樣就在叢集的所有Node節點暴露了ingress-nginx-controller的埠,然後找幾臺機器掛在公有云的ELB後面,然後把域名解析到公有云的ELB就實現的服務的對外暴露

LoadBalance:用Deployment部署一個ingress-nginx-controller,再建立一個type為LoadBalancer的Service關聯這組Pod.大部分公有云,都會為LoadBalancer的Service自動建立一個負載均衡器,通常還繫結的公網地址,只要把域名指向該地址,就實現了服務的對外暴露

部署ingress-Nginx-Controller

ingress-Nginx-Crontoller所需的ServiceAccount,用來訪問API Server

apiVersion: v1
kind: ServiceAccount
metadata:
  
  labels:
    app: nginx
 
-ingress
    chart: nginx-ingress-1.26.2
    heritage: Helm
    release: nginx-ingress
  name: nginx-ingress
  namespace: se
secrets:
- name: nginx-ingress-token-9bbd4

ingress-Nginx-Controller中ServiceAccount所需的Secret(通過base64加密之後的ca和token)

apiVersion: v1
data:
  ca.crt: LS0tLS1CUJBZ0lVUXVqazcwRmhXQm43dXQ1M3liMWdLeXNkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKb3N01DVGpPK2VNd0h3WURWUjBqQkJnd0ZvQVVXYTVCSzQvSApOMjdteEVvaVB3N01DVGpPK2VNd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFJcDlveFJTb29OelNGQmJrMEMvCmIwbVNvTUFlSU5vOVYrNWFEdGg3eExjWjZPazJCYVFWV1ZLK2ZVYW45WQpjaTQ9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  
 
namespace: c2U=
  token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklpSjkuZZoWTJOdmRXNTBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5dVlXMWxjM0JoWTJVaU9pSnpaU0lzSW10MVltVnlibRTRXVlSjN2U0NlcTc5S25ENFdaWnoybXBvR1RuLVZHUFI4ai1B
kind: Secret
metadata:
 
  name: nginx-ingress-token-9bbd4
  namespace: se

type: kubernetes.io/service-account-token

ingress-Nginx-Controller的 Deployment配置檔案

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: nginx-ingress
    chart: nginx-ingress-1.26.2
    component: controller
    heritage: Helm
    release: nginx-ingress
  name: nginx-ingress-controller
  namespace: se
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-ingress
      component: controller
      release: nginx-ingress
  template:
    metadata:
      labels:
        app: nginx-ingress
        component: controller
        release: nginx-ingress
    spec:
      containers:
      - args:
        - /nginx-ingress-controller
        - --default-backend-service=se/nginx-ingress-default-backend
        - --election-id=ingress-controller-leader
        - --ingress-class=nginx
        - --configmap=se/nginx-ingress-controller
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        image: hrb.xxxx.com/library/nginx-ingress-controller:0.26.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: nginx-ingress-controller
        ports:
        - containerPort: 80
          name: http
          protocol: TCP
        - containerPort: 443
          name: https
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          runAsUser: 33
      serviceAccount: nginx-ingress
      serviceAccountName: nginx-ingress

ingress-Nginx-Controller的Service配置檔案

apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-ingress
    chart: nginx-ingress-1.26.2
    component: controller
    heritage: Helm
    release: nginx-ingress
  name: nginx-ingress-controller
  namespace: se

spec:
  ports:
  - name: http
    nodePort: 30080
    port: 80
    protocol: TCP
    targetPort: http
  - name: https
    nodePort: 30443
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    app: nginx-ingress
    component: controller
    release: nginx-ingress
  type: NodePort

檢視ingress-Nginx-Controller的Service

kubectl get  svc  nginx-ingress-controller -n se
NAME                       TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
nginx-ingress-controller   NodePort   192.168.2.67   <none>        80:30080/TCP,443:30443/TCP   1d

進行到這步,ingress-Nginx-Controller已經部署完了,所有的叢集Node節點都已經監聽30080和30443埠

AWS上申請ELB,然後找兩個固定的Node節點,專門做轉發用,不做Pod排程

• ELB的80埠-->Node節點的NodePort30080埠
• ELB的443埠-->Node節點的NodePort30443埠

部署一個測試用的服務

測試服務的Deployment配置檔案

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: test-docker
    env: stg
  name: test-docker
  namespace: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test-docker
  template:
    metadata: 
      labels:
        app: test-docker
        env: stg
    spec:
      containers:
      - env:
        - name: K8S_ENV
          value: stg
        - name: K8S_CLUSTER
          value: aws
        - name: CPU_REQUEST
          valueFrom:
            resourceFieldRef:
              containerName: test-docker
              divisor: "0"
              resource: requests.cpu
        - name: MEM_REQUEST
          valueFrom:
            resourceFieldRef:
              containerName: test-docker
              divisor: "0"
              resource: requests.memory
        - name: CPU_LIMIT
          valueFrom:
            resourceFieldRef:
              containerName: test-docker
              divisor: "0"
              resource: limits.cpu
        - name: MEM_LIMIT
          valueFrom:
            resourceFieldRef:
              containerName: test-docker
              divisor: "0"
              resource: limits.memory
        - name: TZ
          value: Asia/Shanghai
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        image: hrb.xxx.com/test-docker:1.0.428.7eb2128
        imagePullPolicy: IfNotPresent
        name: test-docker
        ports:
        - containerPort: 8025
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /status
            port: 8025
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources:
          limits:
            cpu: "1"
            memory: 2000Mi
          requests:
            cpu: 100m
            memory: 2000Mi
        volumeMounts:
        - mountPath: /etc/localtime
          name: host-time
          readOnly: true
        - mountPath: /data/logs
          name: log
        - mountPath: /app/conf
          name: config-volume
          readOnly: true

      volumes:
      - hostPath:
          path: /etc/localtime
          type: ""
        name: host-time
      - hostPath:
          path: /data/logs/test-docker-stg
          type: ""
        name: log
      - configMap:
          defaultMode: 420
          name: test-docker
        name: config-volume

測試服務的Service配置檔案

apiVersion: v1
kind: Service
metadata:
  name: test-docker
  namespace: test
spec:
  ports:
  - name: http-8025
    port: 8025
    protocol: TCP
    targetPort: 8025
  selector:
    app: test-docker
  type: ClusterIP

測試服務的ingress配置檔案

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test-docker
  namespace: test
spec:
  rules:
  - host: test.baidu.com
    http:
      paths:
      - backend:
          serviceName: test-docker
          servicePort: 8025
        path: /

到這裡,測試服務部署完成,測試服務的域名可以解析到ELB,然後就完成通過域名訪問了.