4.2.k8s.Ingress-Nginx

Ingress-Nginx

ingress-nginx为7层代理，通过配置域名访问后端服务

ingress-nginx容器和kubernetes api交互，动态生成nginx配置

ingress服务定义域名规则，最终更新到ingress容器

官网

https://kubernetes.github.io/ingress-nginx/deploy/

https://github.com/kubernetes/ingress-nginx

#部署ingress-nginx

#下载ingress-nginx yaml文件

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml

#查看image

grep image mandatory.yaml

#更改镜像源(hub.docker.com官网找镜像)

sed -i 's@quay.io/kubernetes-ingress-controller@siriuszg@' mandatory.yaml

#下载镜像

docker pull $(awk '/image/{print $2}' mandatory.yaml)

#部署Pod

kubectl apply -f mandatory.yaml

#查看

kubectl get pod -n ingress-nginx

#下载NodePort yaml

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml

#NodePort默认为随机端口，固定添加端口30080 30443

sed  -i '/targetPort: 80/a\ \ \ \ \ \ nodePort: 30080' service-nodeport.yaml

sed  -i '/targetPort: 443/a\ \ \ \ \ \ nodePort: 30443' service-nodeport.yaml

#部署

kubectl apply -f service-nodeport.yaml

#查看

kubectl get svc -n ingress-nginx

#部署后端web demo

#ingress-nginx-demo.yaml

apiVersion: extensions/v1beta1

kind: Deployment

metadata:

 name: nginx-dm

spec:

 replicas: 2

 template:

   metadata:

     labels:

       name: nginx

   spec:

     containers:

     - name: myapp

       image: alivv/nginx:node

       imagePullPolicy: IfNotPresent

       ports:

       - name: http

         containerPort: 80

---

apiVersion: v1

kind: Service

metadata:

 name: nginx-svc

spec:

 selector:

   name: nginx

 ports:

   - port: 80

     targetPort: 80

     protocol: TCP

#ingress 使用域名代理

#ingress-nginx-http.yaml

#Ingress HTTP代理 http://abc1.tt.dev

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

 name: ingress-nginx-http-demo

spec:

 rules:

   - host: abc1.tt.dev

     http:

       paths:

       - path: /

         backend:

           serviceName: nginx-svc

           servicePort: 80

---

#Ingress HTTPS代理 https://abc2.tt.dev

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

 name: ingress-nginx-https-demo

spec:

 tls:

   - hosts:

     - abc2.tt.dev

     secretName: tls-secret

 rules:

   - host: abc2.tt.dev

     http:

       paths:

       - path: /

         backend:

           serviceName: nginx-svc

           servicePort: 80

#创建域名证书，https用

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/C=CN/O=DevOps/CN=abc2.tt.dev"

#创建cert存储

kubectl create secret tls tls-secret --key tls.key --cert tls.crt

#部署

kubectl apply -f ingress-nginx-demo.yaml

kubectl apply -f ingress-nginx-http.yaml

#查看

kubectl  get pod

kubectl  get deployment

kubectl  get svc -A

kubectl  get ingress

#查看ingress-nginx容器Nginx配置

pod_ingress=$(kubectl get pod -n ingress-nginx |awk '/nginx-ingress/{print $1}')

kubectl exec -it -n ingress-nginx $pod_ingress -- cat /etc/nginx/nginx.conf

#访问测试

#host解析tt.dev

echo "127.0.0.1    abc1.tt.dev abc2.tt.dev" >>/etc/hosts

#curl访问域名

curl  http://abc1.tt.dev:30080

curl  https://abc2.tt.dev:30443 -k

#Ingress-Nginx BasicAuth 密码验证

#ingress-with-auth.yaml

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

 name: ingress-with-auth

 annotations:

   nginx.ingress.kubernetes.io/auth-type: basic

   nginx.ingress.kubernetes.io/auth-secret: basic-auth

   nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'

spec:

 rules:

 - host: auth.tt.dev

   http:

     paths:

     - path: /

       backend:

         serviceName: nginx-svc

         servicePort: 80

#创建密码文件auth 用户foo 密码pswd

#yum install httpd-tools

#htpasswd -bc auth  foo pswd

docker run -it --rm -v $(pwd):/data -w /data jess/htpasswd   -bc auth  foo pswd

cat auth

kubectl create secret generic basic-auth --from-file=auth

kubectl get secret basic-auth -o yaml

#创建

kubectl apply -f ingress-with-auth.yaml

#master节点host解析abc.tt.dev

echo "127.0.0.1    auth.tt.dev" >>/etc/hosts

#curl访问测试

curl http://auth.tt.dev:30080  #无认证用户，访问失败

curl http://auth.tt.dev:30080 -u 'foo:pswd'

#删除测试项

#删除

kubectl delete -f ingress-with-auth.yaml

kubectl delete -f ingress-nginx-http.yaml

kubectl delete -f ingress-nginx-demo.yaml

kubectl delete -f service-nodeport.yaml

kubectl delete -f mandatory.yaml

kubectl delete secret tls-secret

kubectl delete secret basic-auth

sed -i '/tt.dev/d' /etc/hosts

Blog地址 https://www.cnblogs.com/elvi/p/11755780.html

本文git地址 https://gitee.com/almi/k8s/tree/master/notes

巴特西

4.2.k8s.Ingress-Nginx

Ingress-Nginx

官网

#部署ingress-nginx

#部署后端web demo

#ingress 使用域名代理

#Ingress-Nginx BasicAuth 密码验证

#删除测试项

最新文章

热门文章