该系列历史文章

一起学云原生（1）- 本地k8s环境搭建

一起学云原生（2） 使用kuboard管理本地k8s(dockerdesk)

一起学云原生（3）k8s基础知识总结

我们在之前的章节中，实验过创建一个nginx的应用，并且使用了NodePort方式进行了访问，而NodePort其实是在每一个服务NODE节点以端口的形式提供的Service访问，那如果我们希望有一个功能可以用统一的入口（比如域名形式）来从外部访问到k8s的service服务呢？

今天我们来了解一下k8s中一个重要的组件，ingress，它类似于nginx，可以将我们k8s集群内的service服务增加外部访问的功能。

ingress安装

https://kubernetes.github.io/ingress-nginx/deploy/

ingress也有很多不同的种类，我们这里选择比较流行的 ingress-nginx

而这里的安装方式也有很多，我们因为是本地docker desktop安装的k8s，所以可以直接选择Docker Desktop

使用yaml配置文件的方式进行安装

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/cloud/deploy.yaml

这个yaml文件可能需要翻墙才能访问，我已经下载好了

apiVersion: v1kind: Namespacemetadata:  labels:    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx  name: ingress-nginx---apiVersion: v1automountServiceAccountToken: truekind: ServiceAccountmetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx  namespace: ingress-nginx---apiVersion: v1kind: ServiceAccountmetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admission  namespace: ingress-nginx---apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx  namespace: ingress-nginxrules:- apiGroups:  - ""  resources:  - namespaces  verbs:  - get- apiGroups:  - ""  resources:  - configmaps  - pods  - secrets  - endpoints  verbs:  - get  - list  - watch- apiGroups:  - ""  resources:  - services  verbs:  - get  - list  - watch- apiGroups:  - networking.k8s.io  resources:  - ingresses  verbs:  - get  - list  - watch- apiGroups:  - networking.k8s.io  resources:  - ingresses/status  verbs:  - update- apiGroups:  - networking.k8s.io  resources:  - ingressclasses  verbs:  - get  - list  - watch- apiGroups:  - coordination.k8s.io  resourceNames:  - ingress-nginx-leader  resources:  - leases  verbs:  - get  - update- apiGroups:  - coordination.k8s.io  resources:  - leases  verbs:  - create- apiGroups:  - ""  resources:  - events  verbs:  - create  - patch- apiGroups:  - discovery.k8s.io  resources:  - endpointslices  verbs:  - list  - watch  - get---apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admission  namespace: ingress-nginxrules:- apiGroups:  - ""  resources:  - secrets  verbs:  - get  - create---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:  labels:    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginxrules:- apiGroups:  - ""  resources:  - configmaps  - endpoints  - nodes  - pods  - secrets  - namespaces  verbs:  - list  - watch- apiGroups:  - coordination.k8s.io  resources:  - leases  verbs:  - list  - watch- apiGroups:  - ""  resources:  - nodes  verbs:  - get- apiGroups:  - ""  resources:  - services  verbs:  - get  - list  - watch- apiGroups:  - networking.k8s.io  resources:  - ingresses  verbs:  - get  - list  - watch- apiGroups:  - ""  resources:  - events  verbs:  - create  - patch- apiGroups:  - networking.k8s.io  resources:  - ingresses/status  verbs:  - update- apiGroups:  - networking.k8s.io  resources:  - ingressclasses  verbs:  - get  - list  - watch- apiGroups:  - discovery.k8s.io  resources:  - endpointslices  verbs:  - list  - watch  - get---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admissionrules:- apiGroups:  - admissionregistration.k8s.io  resources:  - validatingwebhookconfigurations  verbs:  - get  - update---apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx  namespace: ingress-nginxroleRef:  apiGroup: rbac.authorization.k8s.io  kind: Role  name: ingress-nginxsubjects:- kind: ServiceAccount  name: ingress-nginx  namespace: ingress-nginx---apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admission  namespace: ingress-nginxroleRef:  apiGroup: rbac.authorization.k8s.io  kind: Role  name: ingress-nginx-admissionsubjects:- kind: ServiceAccount  name: ingress-nginx-admission  namespace: ingress-nginx---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  labels:    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginxroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: ingress-nginxsubjects:- kind: ServiceAccount  name: ingress-nginx  namespace: ingress-nginx---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admissionroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: ingress-nginx-admissionsubjects:- kind: ServiceAccount  name: ingress-nginx-admission  namespace: ingress-nginx---apiVersion: v1data:  allow-snippet-annotations: "true"kind: ConfigMapmetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-controller  namespace: ingress-nginx---apiVersion: v1kind: Servicemetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-controller  namespace: ingress-nginxspec:  externalTrafficPolicy: Local  ipFamilies:  - IPv4  ipFamilyPolicy: SingleStack  ports:  - appProtocol: http    name: http    port: 80    protocol: TCP    targetPort: http  - appProtocol: https    name: https    port: 443    protocol: TCP    targetPort: https  selector:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx  type: LoadBalancer---apiVersion: v1kind: Servicemetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-controller-admission  namespace: ingress-nginxspec:  ports:  - appProtocol: https    name: https-webhook    port: 443    targetPort: webhook  selector:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx  type: ClusterIP---apiVersion: apps/v1kind: Deploymentmetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-controller  namespace: ingress-nginxspec:  minReadySeconds: 0  revisionHistoryLimit: 10  selector:    matchLabels:      app.kubernetes.io/component: controller      app.kubernetes.io/instance: ingress-nginx      app.kubernetes.io/name: ingress-nginx  strategy:    rollingUpdate:      maxUnavailable: 1    type: RollingUpdate  template:    metadata:      labels:        app.kubernetes.io/component: controller        app.kubernetes.io/instance: ingress-nginx        app.kubernetes.io/name: ingress-nginx        app.kubernetes.io/part-of: ingress-nginx        app.kubernetes.io/version: 1.8.2    spec:      containers:      - args:        - /nginx-ingress-controller        - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller        - --election-id=ingress-nginx-leader        - --controller-class=k8s.io/ingress-nginx        - --ingress-class=nginx        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller        - --validating-webhook=:8443        - --validating-webhook-certificate=/usr/local/certificates/cert        - --validating-webhook-key=/usr/local/certificates/key        env:        - name: POD_NAME          valueFrom:            fieldRef:              fieldPath: metadata.name        - name: POD_NAMESPACE          valueFrom:            fieldRef:              fieldPath: metadata.namespace        - name: LD_PRELOAD          value: /usr/local/lib/libmimalloc.so        image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2        imagePullPolicy: IfNotPresent        lifecycle:          preStop:            exec:              command:              - /wait-shutdown        livenessProbe:          failureThreshold: 5          httpGet:            path: /healthz            port: 10254            scheme: HTTP          initialDelaySeconds: 10          periodSeconds: 10          successThreshold: 1          timeoutSeconds: 1        name: controller        ports:        - containerPort: 80          name: http          protocol: TCP        - containerPort: 443          name: https          protocol: TCP        - containerPort: 8443          name: webhook          protocol: TCP        readinessProbe:          failureThreshold: 3          httpGet:            path: /healthz            port: 10254            scheme: HTTP          initialDelaySeconds: 10          periodSeconds: 10          successThreshold: 1          timeoutSeconds: 1        resources:          requests:            cpu: 100m            memory: 90Mi        securityContext:          allowPrivilegeEscalation: true          capabilities:            add:            - NET_BIND_SERVICE            drop:            - ALL          runAsUser: 101        volumeMounts:        - mountPath: /usr/local/certificates/          name: webhook-cert          readOnly: true      dnsPolicy: ClusterFirst      nodeSelector:        kubernetes.io/os: linux      serviceAccountName: ingress-nginx      terminationGracePeriodSeconds: 300      volumes:      - name: webhook-cert        secret:          secretName: ingress-nginx-admission---apiVersion: batch/v1kind: Jobmetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admission-create  namespace: ingress-nginxspec:  template:    metadata:      labels:        app.kubernetes.io/component: admission-webhook        app.kubernetes.io/instance: ingress-nginx        app.kubernetes.io/name: ingress-nginx        app.kubernetes.io/part-of: ingress-nginx        app.kubernetes.io/version: 1.8.2      name: ingress-nginx-admission-create    spec:      containers:      - args:        - create        - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc        - --namespace=$(POD_NAMESPACE)        - --secret-name=ingress-nginx-admission        env:        - name: POD_NAMESPACE          valueFrom:            fieldRef:              fieldPath: metadata.namespace        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b        imagePullPolicy: IfNotPresent        name: create        securityContext:          allowPrivilegeEscalation: false      nodeSelector:        kubernetes.io/os: linux      restartPolicy: OnFailure      securityContext:        fsGroup: 2000        runAsNonRoot: true        runAsUser: 2000      serviceAccountName: ingress-nginx-admission---apiVersion: batch/v1kind: Jobmetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admission-patch  namespace: ingress-nginxspec:  template:    metadata:      labels:        app.kubernetes.io/component: admission-webhook        app.kubernetes.io/instance: ingress-nginx        app.kubernetes.io/name: ingress-nginx        app.kubernetes.io/part-of: ingress-nginx        app.kubernetes.io/version: 1.8.2      name: ingress-nginx-admission-patch    spec:      containers:      - args:        - patch        - --webhook-name=ingress-nginx-admission        - --namespace=$(POD_NAMESPACE)        - --patch-mutating=false        - --secret-name=ingress-nginx-admission        - --patch-failure-policy=Fail        env:        - name: POD_NAMESPACE          valueFrom:            fieldRef:              fieldPath: metadata.namespace        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b        imagePullPolicy: IfNotPresent        name: patch        securityContext:          allowPrivilegeEscalation: false      nodeSelector:        kubernetes.io/os: linux      restartPolicy: OnFailure      securityContext:        fsGroup: 2000        runAsNonRoot: true        runAsUser: 2000      serviceAccountName: ingress-nginx-admission---apiVersion: networking.k8s.io/v1kind: IngressClassmetadata:  labels:    app.kubernetes.io/component: controller    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: nginxspec:  controller: k8s.io/ingress-nginx---apiVersion: admissionregistration.k8s.io/v1kind: ValidatingWebhookConfigurationmetadata:  labels:    app.kubernetes.io/component: admission-webhook    app.kubernetes.io/instance: ingress-nginx    app.kubernetes.io/name: ingress-nginx    app.kubernetes.io/part-of: ingress-nginx    app.kubernetes.io/version: 1.8.2  name: ingress-nginx-admissionwebhooks:- admissionReviewVersions:  - v1  clientConfig:    service:      name: ingress-nginx-controller-admission      namespace: ingress-nginx      path: /networking/v1/ingresses  failurePolicy: Fail  matchPolicy: Equivalent  name: validate.nginx.ingress.kubernetes.io  rules:  - apiGroups:    - networking.k8s.io    apiVersions:    - v1    operations:    - CREATE    - UPDATE    resources:    - ingresses  sideEffects: None

可以保存到本地并且执行

kubectl apply -f  本地路径/ingress-nginx.yaml

安装后自动创建了 ingress-nginx的namespace 并且创建了pod

创建ingress来访问service

编写一个yaml，将 ingress-test-zjf.com 映射到 nginx-service 这个service

（见第一章中我们创建的那个service）

apiVersion: networking.k8s.io/v1  kind: Ingress  metadata:    name: k8s-ingress-demospec:    ingressClassName: nginx    rules:      - host: ingress-test-zjf.com       http:          paths:            - backend:                service:                  name: nginx-service                 port:                    number: 88              path: /              pathType: Prefix

执行该yaml 创建ingress

第一章我们创建了 nginx-service 这个service 并且端口是88 仅集群内可访问

增加一个本地hosts

尝试直接用域名访问

我们实现了将集群内部的service 用外部统一入口来访问，而不是通过NodePort在每个机器节点上用端口转发