ingress部署使用
作者：互联网
ingress分开K8S社区版以及nginx社区版二种实现方式，这二者有一些区别，部署以及配置参数不同
我这里使用的是k8S社区版https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md
环境：K8S 1.18
部署选房官方文档即可，注意ingress的SVC标签需要和ingress本身对应起来，之前我在这里犯错了，个别版本的YAML文件没有SVC，单独添加的时候需要吧标签对应起来
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.3.0/deploy/static/provider/cloud/deploy.yaml
我这里使用的竟像是quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0
K8S 1.19版本之前只能使用0.X开头的版本
[root@master http-test]# kubectl get all -n ingress-nginx
NAME READY STATUS RESTARTS AGE
pod/ingress-nginx-admission-create-qdnzw 0/1 Completed 0 16h
pod/ingress-nginx-admission-patch-wk9zf 0/1 Completed 1 16h
pod/ingress-nginx-controller-57fdb6d45b-pj7t4 1/1 Running 0 16h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/ingress-nginx-controller LoadBalancer 10.104.255.152 <pending> 80:31450/TCP,443:31451/TCP 16h
service/ingress-nginx-controller-admission ClusterIP 10.109.27.88 <none> 443/TCP 16h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/ingress-nginx-controller 1/1 1 1 16h
NAME DESIRED CURRENT READY AGE
replicaset.apps/ingress-nginx-controller-57fdb6d45b 1 1 1 16h
NAME COMPLETIONS DURATION AGE
job.batch/ingress-nginx-admission-create 1/1 4s 16h
job.batch/ingress-nginx-admission-patch 1/1 8s 16h
这样部署好了
接下来写入INGRESS配置
私有证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.cert -subj "/CN=demo.localdev.me/O=demo.localdev.me"
创建tls 对应的secret
kubectl create secret tls ca-cert --key tls.key --cert tls.cert
[root@master http-test]# cat https-ingress.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: demo
#namespace: ingress-nginx
annotations:
kubernetes.io/ingress.class: "nginx"
#nginx.ingress.kubernetes.io/proxy-body-size: "200m"
spec:
rules:
- host: "demo.localdev.me"
http:
paths:
- pathType: Prefix
path: /
backend:
serviceName: demo
servicePort: 80
tls:
- hosts:
- demo.localdev.me
secretName: ca-cert
查看ingress
[root@master http-test]# kubectl describe ingress demo
Name: demo
Namespace: default
Address:
Default backend: default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
ca-cert terminates demo.localdev.me
Rules:
Host Path Backends
---- ---- --------
demo.localdev.me
/ demo:80 (10.32.0.7:80)
Annotations: kubernetes.io/ingress.class: nginx
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal UPDATE 16m nginx-ingress-controller Ingress default/demo
这里流量已经引导到10.32.0.7:80，这样就成功了，注意INGRESS需要和后端服务以及SECRET在同一个NS
电脑上写入ingress所在节点的真实IP进hosts文件
查看日志
流量已经到达INGRESS，再看下后端服务的日志
流量也到HTTD服务了
生产中，这样是不能使用的，通常有一个出口IP和服务器，在出口服务器上部署一个nginx，反向代理到所有的后端nginx服务器，比如我这里https -->172.20.69.102:30451,http-->172.20.69.102:30450
标签：tls,ingress,localdev,部署,demo,nginx,controller,使用 来源： https://www.cnblogs.com/whitelittle/p/16476362.html