Kubernetes---Service(SVC)服务--ingress api

忘是亡心i 2023-03-13 05:06 11阅读 0赞

对于k8s传统的svc来说 它仅支持4层代理，如果遇到7层代理的话，是没有办法去实现的

k8s官方在1.11中推出了ingress api接口，通过ingress达到7层代理的效果

对于ingress来说，必须要绑定一个域名，因为它是基于7层代理的

资料信息

Ingress-Nginx github 地址：httos://github.com/kubernetes/ingress-nginx

Ingress-Nginx 官方网站：https:/kubernetes.github.io/ingress-nginx/

![format_png][]

访问流程图

![format_png 1][]

本质上是创建了一个Nginx的Node pod，只不过这个无需手写Nginx的配置文件而是通过自动生成的方式实现

⒈部署Ingress-Nginx

1.下载资源文件

#下载资源文件
    wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml

⒉创建

kubectl apply -f mandatory.yaml

⒊查看

kubectl get pod -n ingress-nginx

⒋选择不同的暴露方案执行【此处选择裸机暴露方案，就是以svc暴露】

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

#下载
    wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml
    
    #创建
    kubectl apply -f service-nodeport.yaml

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

⒌查看

kubectl get svc -n ingress-nginx

⒉Ingress方案

1.Ingress HTTP 代理访问

㈠Deployment

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: extensions/v1beta1
    kind: Deployment 
    metadata:
      name: nginx-dm 
    spec:
      replicas: 2 
      template:
        metadata:
          labels:
            name: nginx 
        spec:
          containers:
            - name: nginx 
              image: fanqisoft/myapp:v1 
              imagePullPolicy: IfNotPresent 
              ports:
                - containerPort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

㈡Service

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: v1 
    kind: Service 
    metadata:
      name: nginx-svc 
    spec:
      ports:
        - port: 80 
          targetPort: 80 
          protocol: TCP 
      selector:
        name: nginx

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

㈢Ingress

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: extensions/v1beta1 
    kind: Ingress 
    metadata:
      name: nginx-test 
    spec:
      rules:
        - host: www.coreqi.cn
          http:
            paths:
            - path: / 
              backend:
                serviceName: nginx-svc 
                servicePort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

3.查看服务端口

kubectl get svc -n ingress-nginx

4.将相关域名写入host文件

5.在浏览器中进行HTTP访问

2.Ingress HTTPS代理访问

1.创建证书及cert存储方式

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"
    kubectl create secret tls tls-secret --key tls.key --cert tls.crt

2.创建相关资源

㈠Deployment

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: extensions/v1beta1
    kind: Deployment 
    metadata:
      name: deployment3
    spec:
      replicas: 2 
      template:
        metadata:
          labels:
            name: nginx3
        spec:
          containers:
            - name: nginx3
              image: fanqisoft/myapp:v3
              imagePullPolicy: IfNotPresent 
              ports:
                - containerPort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

㈡Service

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: v1 
    kind: Service 
    metadata:
      name: svc-3
    spec:
      ports:
        - port: 80 
          targetPort: 80 
          protocol: TCP 
      selector:
        name: nginx3

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

㈢Ingress

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: extensions/v1beta1 
    kind: Ingress 
    metadata:
      name: nginx-test 
    spec:
      tls:
        - hosts:
          - foo.bar.com 
          secretName: tls-secret 
      rules:
        - host:foo.bar.com 
          http:
            paths:
              - path: / 
                backend:
                  serviceName: svc-3
                  servicePort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

3.查看服务端口

kubectl get svc -n ingress-nginx

4.将相关域名写入host文件

5.在浏览器中进行HTTP访问

⒊Nginx添加BasicAuth（基础认证）功能

1.安装相关模块并创建密钥

对于Nginx的认证方案来说，采用的是Apache的一个模块,所以在配置Nginx的认证之前，需要先安装Apache的模块.  
　　因为Ingress的实现方案采用的是Nginx的软件，所以Nginx的相关特性Ingress都支持.

#密码文件的创建
    yum -y install httpd
    htpasswd -c auth fanqi  #创建密钥文件，文件名为auth，用户名为fanqi
    #把该文件以secret方式进行保存，类型为generic
    kubectl create secret generic basic-auth --from-file=auth

2.创建Ingress资源

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: extensions/v1beta1
    kind: Ingress 
    metadata:
      name: ingress-with-auth 
      annotations:
        nginx.ingress.kubernetes.io/auth-type: basic 
        nginx.ingress.kubernetes.io/auth-secret:  basic-auth 
        nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo' 
    spec:
      rules:
      - host: foo2.bar.com 
        http:
          paths:
          - path: / 
            backend:
              serviceName: nginx-svc 
              servicePort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

⒋Nginx进行URL重定向

1.相关属性

<table> 
 <tbody> 
 <tr> 
 <td>名称</td> 
 <td>描述</td> 
 <td>值类型</td> 
 </tr> 
 <tr> 
 <td> nginx.ingress.kubernetes.io/rewrite- target </td> 
 <td>必须重定向流量的目标URI</td> 
 <td>string</td> 
 </tr> 
 <tr> 
 <td> nginx.ingress.kubernetes.io/ssl- redirect </td> 
 <td> 指示位置部分是否仅可访问SSL（当Ingress包含证书时 默认为True) </td> 
 <td>bool</td> 
 </tr> 
 <tr> 
 <td> nginx.ingress.kubernetes.io/force- ssl-redirect </td> 
 <td>即使lngress未启用TLS，也强制重定向到HTTPS</td> 
 <td>bool</td> 
 </tr> 
 <tr> 
 <td> nginx.ingress.kubernetes.io/app- root </td> 
 <td>定义Controller必须重定向的应用程序根，如果它在‘/’上下文中</td> 
 <td>string</td> 
 </tr> 
 <tr> 
 <td> nginx.ingress.kubernetes.io/use- regex </td> 
 <td>指示Ingress上定义的路径是否使用正则表达式</td> 
 <td>bool</td> 
 </tr> 
 </tbody> 
</table>

2.创建资源示例

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

apiVersion: extensions/v1beta1 
    kind: Ingress 
    metadata:
      name: nginx-test 
      annotations:
        nginx.ingress.kubernetes.io/rewrite-target: http://foo.bar.com:31795/hostname.html 
    spec:
      rules:
      - host: foo10.bar.com 
        http:
          paths:
          - path: / 
            backend:
              serviceName: nginx-svc 
              servicePort: 80

![复制代码][aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]

作者：[奇][Link 1]

出处：[https://www.cnblogs.com/fanqisoft/][Link 1]

本文版权归作者和博客园共有，欢迎转载，但必须给出原文链接，并保留此段声明，否则保留追究法律责任的权利。

分类: [Kubernetes][]

好文要顶 关注我 收藏该文 ![format_png 2][] ![format_png 3][]

[![format_png 4][]][format_png 4 1]

[SpringCore][format_png 4 1]  
[关注 - 3][- 3]  
[粉丝 - 33][- 33]

\+加关注

[« ][Link 2]上一篇： [Kubernetes---Service(SVC)服务][Link 2]  
[» ][Link 3]下一篇： [C\# DataTable映射成Entity][Link 3]

[format_png]: /images/20230312/6cb0c3baf72c4c2a850636ce93767242.png
[format_png 1]: /images/20230312/7f30da93813040dbab3b3187c7c7a818.png
[aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2NvcHljb2RlLmdpZg]: /images/20230312/5763c35d1f6f496e9e7f78f8c73fb32f.png
[Link 1]: https://www.cnblogs.com/fanqisoft/
[Kubernetes]: https://www.cnblogs.com/fanqisoft/category/1449947.html
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9jb21tb24uY25ibG9ncy5jb20vaW1hZ2VzL2ljb25fd2VpYm9fMjQucG5n?x-oss-process=image/format,png
[format_png 3]: /images/20230312/6e9e37dde5394554846b70b014667c8f.png
[format_png 4]: /images/20230312/ef60723038314e91a665f19a2f11fe0d.png
[format_png 4 1]: https://home.cnblogs.com/u/fanqisoft/
[- 3]: https://home.cnblogs.com/u/fanqisoft/followees/
[- 33]: https://home.cnblogs.com/u/fanqisoft/followers/
[Link 2]: https://www.cnblogs.com/fanqisoft/p/11579061.html
[Link 3]: https://www.cnblogs.com/fanqisoft/p/11671428.html