k8s之ingress

ingress基于域名进行映射，把url(http https)的请求转发到service，再由service把请求转发到每一个pod

ingress只要一个或者少量的公网ip或者LB，可以把多个http请求暴露到外网，七层反向代理

理解为service的service，是一组基于域名和URL路径，把一个或者多个请求转发到service

先是七层代理然后再是四层代理再到pod

ingress >service>nginx

ingress的组成:

ingress是要给api对象，通过yaml文件来进行配置，ingress作用定义规则，定义请求如何转发到service的规则，配置的一个模板

ingress通过http和https暴漏集群内部的service，给service提供一个外部的url，负载均衡，ssl/tls（https），实现一份基于域名的负载均衡

ingress-controller:是具体的实现反向代理和负载均衡的程序，对ingress定义的规则进行解析，根据ingress的配置规则进行请求的转发

ingress-controller:不是k8s自带的组件功能，ingress-controller一个统称。

nginx ingress controller，traefik都是ingress-controller，开源

ingress资源的定义项

1、定义外部流量的路由规则

2、定义服务的暴漏方式，主机名，访问路径和其他的选项

3、负载均衡（ingress-controller）

nginx-ingress-controller运行方式是pod方式运行在集群当中

nginx-ingress-controller

ingress暴漏服务的方式

1、deployment+loadBalancer模式

ingress部署在公有云，会ingress配置文件里面会有一个type，type:LoadBalancer,公有云平台会为个loadbalancer的service创建一个负载均衡器，绑定一个公网地址。

通过域名指向这个公网地址就可以实现集群对外暴漏。

2、方式二:DaemonSet+hostnetwork+nodeSelector

DaemonSet在每个节点都会创建一个pod

hostnetwork:pod会共享节点主机的网络命名空间，容器内直接使用节点主机ip+端口，pod中的容器直接访问主机上网络资源

nodeSelector：根据标签来选择部署的节点，nginx-ingress-controller部署的节点

缺点:直接利用节点主机的网络和端口，一个node只能部署一个ingress-controller pod.比较适合大并发的生产环境。性能最好的。

netstat -lntp | grep nginx

8081端口，nginx-controller默认配置的一个bachend。反向代理端口

所有的请求当中，只要是不符合ingress配置的请求转发到8181，相当于一个error的页面

现在执行这个yaml文件，会生成一个service会生成一个service，在ingress-nginx这个命名空间生成一个service，所有的controlle的请求都会从这个定义的service的nodeport的端口，把请求转发到自定义的service的pod

过程

wget https://gitee.com/mirrors/ingress-nginx/raw/nginx-0.30.0/deploy/static/mandatory.yaml

vim mandatory.yaml


apiVersion: apps/v1
#kind: Deployment
kind: DaemonSet
metadata:
  name: nginx-ingress-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
      annotations:
        prometheus.io/port: "10254"
        prometheus.io/scrape: "true"
    spec:
      # wait up to five minutes for the drain of connections
      hostNetwork: true
      terminationGracePeriodSeconds: 300
      serviceAccountName: nginx-ingress-serviceaccount
      nodeSelector:
        test1: "true"
        #kubernetes.io/os: linux

#在master节点上上传镜像压缩包
cd /opt/ingress
tar zxvf ingree.contro.tar.gz



#所有节点加载镜像包
docker load -i ingree.contro.tar

kubectl apply -f mandatory.yaml


//到 node02 节点查看
netstat -lntp | grep nginx


vim /opt/ingress/nginx-service.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: nfs-pvc1
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: nfs-client-storagesclass
  resources:
    requests:
      storage: 2Gi

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-app1
  labels:
    app: nginx2
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx2
  template:
    metadata:
      labels:
        app: nginx2
    spec:
      containers:
        - name: nginx
          image: nginx:1.22
          volumeMounts:
          - name: nfs-pvc2
            mountPath: /usr/share/nginx/html/
      volumes:
      - name: nfs-pvc2
        persistentVolumeClaim:
          claimName: nfs-pvc2

---
apiVersion: v1
kind: Service
metadata:
  name: nginx-app-svc2
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  selector:
    app: nginx2

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-app-ingress2
spec:
  rules:
  - host: www.test1.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-app-svc2
            port:
              number: 80

kubectl apply -f nginx-service.yaml

3、deployment+NodePort:

nginx+ingress-controller

host--->ingress的配置赵大鹏pod---controller---请求到pod

nodeport----controller---ingress==service---pod

nodeport暴露端口的方式最简单的方法，nodeport多了一层nat地址转换

并发量大的对性能会有一定影响，内部都会用nodeport

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: nfs-pvc3
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: nfs-client-storageclass
  resources:
    requests:
      storage: 2Gi

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-app3
  labels:
    app: nginx3
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx3
  template:
    metadata:
      labels:
        app: nginx3
    spec:
      containers:
        - name: nginx3
          image: nginx:1.22
          volumeMounts:
          - name: nfs-pvc3
            mountPath: /usr/share/nginx/html
      volumes:
      - name: nfs-pvc3
        persistentVolumeClaim:
          claimName: nfs-pvc3

---
apiVersion: v1
kind: Service
metadata:
  name: nginx-app-svc3
spec:
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  selector:
    app: nginx3

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-app-ingress3
spec:
  rules:
  - host: www.test2.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-app-svc3
            port:
              number: 80
kubectl apply -f nodePort.yaml

vim /etc/hosts
20.0.0.92 www.test2.com
~                         

 Ingress HTTP 代理访问虚拟主机

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment1
spec:
  replicas: 1
  selector:
    matchLabels:
      name: nginx1
  template:
    metadata:
      labels:
        name: nginx1
    spec:
      containers:
        - name: nginx1
          image: nginx:1.14
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: svc-1
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    name: nginx1

kubectl apply -f deployment1.yaml

vim deployment2.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment2
spec:
  replicas: 1
  selector:
    matchLabels:
      name: nginx2
  template:
    metadata:
      labels:
        name: nginx2
    spec:
      containers:
        - name: nginx2
          image: nginx:1.14
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: svc-2
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    name: nginx2
 
 
kubectl apply -f deployment2.yaml

创建ingress资源

vim ingress-nginx.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress1
spec:
  rules:
    - host: www.test.com
      http:
        paths:
        - path: /
          pathType: Prefix
          backend:
            service: 
              name: svc-1
              port:
                number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress2
spec:
  rules:
    - host: www.abc.com
      http:
        paths:
        - path: /
          pathType: Prefix
          backend:
            service: 
              name: svc-2
              port:
                number: 80
 
 
kubectl apply -f ingress-nginx.yaml

ingress实现https代理访问

证书密钥创建证书，密钥

创建证书 密钥

secret 保存密钥信息

openssl req -x509 -sha256 -nodes -days 356 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "CN=nginxsvc/O=nginxsvc"

openssl req -x509 -sha256 -nodes -days 356 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "CN=nginxsvc/O=nginxsvc"

req生成证书文件的

x509生成x.509自签名 的证书

-sha256:表示使用sha-256的散列算法

-nodes:表示生成的密钥不加密

-days:365天 证书有效期365天

-newkey rsa:RSA的密钥对，长度2048位

-subj "/CN=nginxsvc/O=nginxsvc":主题，CN common name O: organzation组织

kubectl create secret tls tls-secret --key tls.key --cert tls.crt

kubectl describe secrets tls-secret

cd /opt

mkdir https

vim ingress-cs.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-https
  labels:
    app: https
spec:
  replicas: 3
  selector:
    matchLabels:
      app: https
  template:
    metadata:
      labels:
        app: https
    spec:
      containers:
        - name: nginx
          image: nginx:1.22

---
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    app: https

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress-https
spec:
  tls:
    - hosts:
      - www.123ccc.com
      secretName: tls-secret
#加密的配置保存在ingress当中，请求先到ingress-controller再根据ingress配置解析再转发到service,在代理进行时就要先验证密钥对，然后再把请求转发到service对应的pod。
  rules:
    - hosts: www.123ccc.com
      http:
        paths:
        - paths: /
          pathType: prefix
          backend:
            service:
              name: nginx-svc
              port:
                number: 80





kubectl get svc -n ingress-nginx

容器对nginx实现账号密码认证

mkdir basic-auth

yum -y install http
cd basic-auth
vim ingress-auth.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-auth
  annotations:
#开启认证模块的位置
    nginx.ingress.kubernets.io/auth-type: basic
#设置认证类型basic，这是k8s自带的认证加密模块
    nginx.ingress.kubernets.io/auth-secret: basic-auth
#把认证的加密模块导入到ingress当中
    nginx.ingress.kubernets.io/auth-realm: 'Authentication Required -wqb'
#设置认证窗口的提示信息。
spec:
  rules:
  - host: www.wqb.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-svc
            port:
              number: 80

kubectl apply -f ingress-auth.yaml


vim nginx-rewrite.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-rewrite
  annotation:
    nginx.ingress.kubernetes.io/rewrite-target: https://www.123ccc.com:32336
#访问页面会跳转到指定的页面。
spec:
  rules:
  - host: www.wqb.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-svc
            port:
              number: 80
kubectl apply -f nginx-rewrite.yaml                     

traefik是一个为了让部署微服务更加快捷而诞生的一个http反向代理，负载均衡

traefik设计时就能够实现和k8ss API交互，感知后端service以及pod的变化，可以自动更新配置和重载

pod内的nginx 80 8081

traefik的部署方式

daemonset

特点优点:每个节点都会部署要给traeflk，节点感知，可以自动发现，更新容器的配置，不需要手动重载

缺点：资源占用，大型集群中，aemonset可能会运行多个traefik的实例，尤其时节点上不需要大量容器运行的情况下，没有办法进行扩缩容

主要部署再对外集群:对外的业务会经常容易八年更，daemonset可以更好的，自动的发现服务配置变更

部署对外集群。

deployment：集中控制，可以使用少量的实例来运行处理整个集群的流量

缺点：deployment的负载均衡不会均分到每个节点

手动更新，无法感知容器内部配置变化，主要部署在对内集群

部署对内集群：对内相对稳定，更新和变化也比较少。适合deployment

traffic-tye:internal 对内服务

traffic-type:external 对外服务

nginx-ingress:相对较慢

工作原理都一样，都是七层代理，都可以动态的更新配置，都可以自动发现服务

traefik-ingress：自动更新重载更快，更方便

traefik的并发能力只有nginx-ingress的6成

ingress

nginx-ingress-controller用的时最多的

deployment+loadbalaner这个必须要共有云提供公网的地址

daemonset+hostnetwork+nodeselector:和节点服务器共享网络，一个节点部署一个controller pod. 既然使用宿主机的端口性能最好适合大并发

deployment+NodePort:这是最常见的也是最常用最简单的方法，但是性能不太好，因为多了一层nat地址转发，不太适合大并发

另外就是traefik-controller

deamontset适合对外 可以自动更新容器配置 hsot 用的时节点的网络

deployment适合对内 无法自动更新配置 Nodeport

daomonset演示

daemonset的配置更新后的自动发现wget https://gitee.com/mirrors/traefik/raw/v1.7/examples/k8s/traefik-rbac.yaml wget https://gitee.com/mirrors/traefik/raw/v1.7/examples/k8s/traefik-ds.yaml wget https://gitee.com/mirrors/traefik/raw/v1.7/examples/k8s/ui.yaml

需要执行这三个文件

然后自己配置yaml文件

kubectl apply -f traefik-ingress2.yaml

接下来做域名映射

vim /etc/hosts

用域名加8080访问页面