官方地址:https://kubernetes.github.io/ingress-nginx/deploy/
简介
将原来需要修改Nginx配置,如:哪个域名对应的后端哪一个服务,现将其抽象化转化为一个Ingress类型,可以通过yaml创建,每次不需要修改nginx.conf配置文件,只需applf Ingress即可,会根据定义的rules自动写入nginx配置文件,可以添加HTTPS,以及访问控制,url转发等Nginx多项功能。
部署Ingress-Container
# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.26.2/deploy/static/provider/cloud-generic.yaml
# 修改yaml文件中的image地址
# 配置服务发现
# vim service-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
name: ingress-nginx
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
spec:
type: NodePort
ports:
- name: http
port: 80
targetPort: 80
nodePort: 30080
protocol: TCP
- name: https
port: 443
targetPort: 443
protocol: TCP
nodePort: 30443
selector:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
# kubectl apply -f service-nodeport.yaml
部署Nginx的Deploment以及Service
部署多个实例方便查看结果
# vim nginx1-deployment.yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: nginx1
namespace: nginx1
labels:
app: nginx1
spec:
replicas: 2
selector:
matchLabels:
app: nginx1
template:
metadata:
name: nginx1
namespace: nginx1
labels:
app: nginx1
spec:
containers:
- name: nginx
image: ntp.weij.club/myapp/nginx:v1
ports:
- containerPort: 80
# vim nginx1-service.yaml
apiVersion: v1
kind: Service
metadata:
name: nginx1
namespace: nginx1
labels:
app: nginx
spec:
type: NodePort
selector:
app: nginx1
ports:
- name: nginx1
port: 80
targetPort: 80
部署Ingress域名访问
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: nginx1-web
namespace: nginx1
spec:
rules:
- host: www1.test.com
http:
paths:
- path: /
backend:
serviceName: nginx1
servicePort: 80
验证:修改Client的hosts文件,浏览器访问www1.test.com:30080
部署Ingress-https访问
https证书认证访问,这里采用自己创建的证书
生成证书
# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"
将证书添加到kubernetes资源中
# kubectl create secret tls tls-www1 --key tls.key --cert tls.crt
创建Ingress资源
# vim nginx1-ingress-https.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: nginx1
namespace: nginx1
spec:
tls:
- hosts:
- www1.test.com
secretName: tls-www1
rules:
- host: www1.test.com
http:
paths:
- path: /
backend:
serviceName: nginx1
servicePort: 80
浏览器访问:https://www1.test.com:30443
部署Ingress-BasicAuth认证
生成账号密码文件
需要htpasswd命令
# yum -y install httpd
# htpasswd -c auth wei
将test文件添加kubernetes资源中
# kubectl create secret generic basic-auth --from-file=auth
配置Ingress关联
# vim nginx2-ingress-passwd.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: nginx2
namespace: nginx2
annotations:
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: "Authentication Required - wei"
spec:
rules:
- host: www2.test.com
http:
paths:
- path: /
backend:
serviceName: nginx2
servicePort: 80
部署Ingress重定向
名称 | 描述 | 值 |
nginx.ingress.kubernetes.io/rewrite-target | 必须重定向流量的目标URL | 字符串 |
nginx.ingress.kubernetes.io/ssl-redirect | 指示位置部分是否仅可访问SSL包含时默认True | 布尔值 |
nginx.ingress.kubernetes.io/force-ssl-redirect | 即使Ingress未启用TLS,也强制重定向到HTTPS | 布尔值 |
nginx.ingress.kubernetes.io/app-root | 定义Countroller必须重定向的应用程序根 | 字符串 |
nginx.ingress.kubernetes.io/use-regex | 指示Ingress上定义的路径是否使用正则表达式 | 布尔值 |
# vim nginx3-ingress-url.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: nginx2
namespace: nginx2
annotations:
nginx.ingress.kubernetes.io/rewrite-target: http://www3.test.com:30080/index.html
spec:
rules:
- host: www2.test.com
http:
paths:
- path: /
backend:
serviceName: nginx2
servicePort: 80