K8s Ingress服务发布

原创已于 2025-08-15 09:42:26 修改 · 850 阅读

8 ·

CC 4.0 BY-SA版权

文章标签：

#kubernetes #容器 #云原生

于 2025-08-15 09:40:31 首次发布

K8s 专栏收录该内容

11 篇文章

订阅专栏

文章目录

提示： kubernetes官方Ingress安装说明：https://kubernetes.github.io/ingress-nginx/deploy/

一、Ingress Controller安装部署

提示：Ingress Controller是代理服务，类似Nginx服务，Ingress是Ingerss Controller代理服务的配置文件，类似Nginx服务的nginx.conf配置文件

1、Kubernetes版本与Ingress Nginx版本兼容列表

提示：登录Kubernetes github官方Ingress说明文档：https://github.com/kubernetes/ingress-nginx

### Kubernetes版本
[root@k8s-master01 ~]# kubectl version
Client Version: v1.28.15
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.15

在这里插入图片描述

2、Helm客户端安装（master主管理节点安装即可）

提示：Helm官方提供的Helm客户端安装说明：https://helm.sh/docs/intro/install/

wget https://get.helm.sh/helm-v3.17.0-linux-amd64.tar.gz -P /mnt/
tar xf /mnt/helm-v3.17.0-linux-amd64.tar.gz -C /mnt/
mv /mnt/linux-amd64/helm /usr/local/bin/helm
helm version

3、下载Ingress Nginx Controller安装包

### 添加Ingress Nginx官方Helm仓库
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo list

### 更新Helm仓库
helm repo update

### 下载Ingress Nginx Controller指定版本的安装包
helm pull ingress-nginx/ingress-nginx --version 4.12.0

### 解压下载的Ingress Nginx Controller安装包到自定义的目录存放
mkdir -p /data/yaml/helm
tar xf /root/ingress-nginx-4.12.0.tgz -C /data/yaml/helm/

4、修改Ingress Nginx Controller values.yaml文件

（1）、修改Ingress Controller官方镜像源地址为个人镜像仓库源地址

提示：如果ngress Controller官方镜像源地址不可用时，可以修改成个人镜像仓库源地址拉取镜像

sed -i 's#registry: registry.k8s.io#registry: registry.cn-shenzhen.aliyuncs.com#g' /data/yaml/helm/ingress-nginx/values.yaml
sed -i 's#ingress-nginx/controller#k8sghost/controller#g' /data/yaml/helm/ingress-nginx/values.yaml
sed -i 's#ingress-nginx/kube-webhook-certgen#k8sghost/kube-webhook-certgen#g' /data/yaml/helm/ingress-nginx/values.yaml
sed -i 's#defaultbackend-amd64#k8sghost/defaultbackend-amd64#g'  /data/yaml/helm/ingress-nginx/values.yaml

（2）、如果你使用的不是Ingress Controller官方镜像源地址需要把digest值注释掉

cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "digest:"
sed -i 's/digest:/#digest:/g' /data/yaml/helm/ingress-nginx/values.yaml
cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "digest:"

（3）、hostNetwork设置为true

cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "hostNetwork: true"
sed -i 's#hostNetwork: false#hostNetwork: true#g' /data/yaml/helm/ingress-nginx/values.yaml
cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "hostNetwork: true"

（4）、dnsPolicy设置为ClusterFirstWithHostNet

cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "dnsPolicy:"
sed -i 's# dnsPolicy: ClusterFirst# dnsPolicy: ClusterFirstWithHostNet#g' /data/yaml/helm/ingress-nginx/values.yaml
cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "dnsPolicy:"

（5）、NodeSelector添加标签ingress: "true"部署到指定节点

### values.yaml配置文件有三处nodeSelector都需要添加以ingress: "true"参数
[root@k8s-master01 ~]# vim /data/yaml/helm/ingress-nginx/values.yaml
nodeSelector:
kubernetes.io/os: linux
ingress: "true"

（6）、把Kind类型更改为DaemonSet，让每个标签为ngress: "true"的节点都部署Ingress Controller

cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "kind:"
sed -i 's#kind: Deployment#kind: DaemonSet#g' /data/yaml/helm/ingress-nginx/values.yaml
cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "kind:"

（7）、设置当前ingress nginx为默认的ingressClass

提示：如果你不设置默认ingressClass，当你K8s集群有多个ingress nginx时，使用ingress yaml文件时需要配置参数应用到哪个ingress nginx，如果设置了默认ingressClass就不必配置参数指定

ingress nginx
cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "default:"
sed -i 's#default: false#default: true#g' /data/yaml/helm/ingress-nginx/values.yaml                                     
cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "default:"

5、K8s集群需要部署Ingress Nginx的节点打上标签ingress:“true”

kubectl label node k8s-node01 ingress=true
kubectl get nodes --show-labels -l ingress=true

6、安装部署Ingress Nginx

### 创建自定义ingress-nginx命名空间
kubectl create namespace ingress-nginx
kubectl get namespace

### 安装Ingress Nginx
helm install ingress-nginx -n ingress-nginx /data/yaml/helm/ingress-nginx/
kubectl get pods -n ingress-nginx -owide

### 登录K8s-node01节点查看是否有80端口
[root@k8s-node01 ~]# netstat -tlunp | grep 80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      24438/nginx: master 
tcp6       0      0 :::80                   :::*                    LISTEN      24438/nginx: master

7、创建一个简单的Ingress模拟访问Nginx Web服务

提示：创建的Nginx容器与Ingress Service必须要在同一个命名空间，但ingress-nginx-controller可以不在同一个命名空间下

### 创建命名空间并创建一个deployment的Nginx Pod资源
kubectl create ns study-ingress
kubectl create deploy nginx --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n study-ingress
kubectl get pods -n study-ingress

### 创建Nginx容器的Service
kubectl expose deploy nginx --port 80 -n study-ingress
kubectl get svc -n study-ingress 
curl  10.96.59.213

### Ingress的yaml文件参数说明
apiVersion: networking.k8s.io/v1     # networking.k8s.io/v1必须是k8s版本 >=1.22使用，k8s版本 < 1.22 使用networking.k8s.io/v1beat
kind: Ingress
metadata:
  labels:
    app: nginx-ingress              # 自定义访问的域名
  name: nginx-ingress
  namespace: study-ingress
spec:
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx            # 指定Service的名称
            port:
              number: 80           # 指定Service的端口号
        path: /
        pathType: ImplementationSpecific
### pathType：路径的匹配方式，目前有ImplementationSpecific、Exact 和 Prefix 方式
# Exact：精确匹配，比如配置为path为/bar，那么/bar/将不能被路由
# Prefix：前缀匹配，基于以/分隔的 URL 路径。比如 path 为/abc，可以匹配到/abc/bbb等，比较常用的配置
# ImplementationSpecific：这种类型的路由匹配根据 Ingress Controller 来实现，可以当做一个单独的类型,也可以当做 Prefix和 Exact。lmplementationSpecific是 1.18 版本引入 Prefix 和 Exact 的默认配置

### 创建Ingress指向Nginx容器的Service
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-ingress.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app: nginx-ingress
  name: nginx-ingress
  namespace: study-ingress
spec:
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f  /data/yaml/helm/study-ingress/nginx-ingress.yaml
kubectl get ingress -n study-ingress

### 查看ingress-nginx-controller容器是否已生成nginx容器配置文件
kubectl get pods -n ingress-nginx
kubectl exec -it -n ingress-nginx ingress-nginx-controller-9k626 -- cat /etc/nginx/nginx.conf | grep "nginx.test.com"

### 测试Ingress Nginx，当前ingress-nginx-controller容器部署在k8s-node01节点上，把DNS域名nginx.test.com解析到k8s-node01主节点IP即可
kubectl get pods -n ingress-nginx -owide
curl -H "Host:nginx.test.com" 172.20.235.204

二、Ingress Controller实现Ingress Nginx SSL

1、生成SSL证书（如果公司有SSL证书就不必执行）

### 指定nginx.test.com域名生成一个SSL证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /data/yaml/helm/ingress-nginx/ssl/tls.key -out  /data/yaml/helm/ingress-nginx/ssl/tls.crt -subj "/CN=nginx.test.com"
ls -l /data/yaml/helm/ingress-nginx/ssl/

2、Ingress Nginx配置TLS（配置强转HTTPS）

## 创建命名空间并创建一个deployment的Nginx Pod资源
kubectl create ns study-ingress
kubectl create deploy nginx --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n study-ingress
kubectl get pods -n study-ingress

### 创建Nginx容器的Service
kubectl expose deploy nginx --port 80 -n study-ingress
kubectl get svc -n study-ingress 
curl http://10.96.114.226

### 查看K8s集群有哪些IngressClassName
[root@k8s-master01 ~]# kubectl get ingressclass
NAME    CONTROLLER             PARAMETERS   AGE
nginx   k8s.io/ingress-nginx   <none>       2d18h

### 创建Secret
kubectl create secret tls ca-secret --cert=/data/yaml/helm/ingress-nginx/ssl/tls.crt --key=/data/yaml/helm/ingress-nginx/ssl/tls.key -n study-ingress --dry-run=client 
kubectl get secret -n study-ingress 

### 创建Ingress配置TLS配置
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-ingress-tls.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app: nginx-ingress
  name: nginx-ingress
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
  tls:
    - hosts:
      - nginx.test.com
      secretName: ca-secret
EOF
kubectl create -f  /data/yaml/helm/study-ingress/nginx-ingress-tls.yaml
kubectl get ingress -n study-ingress

### 查看ingress-nginx-controller容器是否已生成nginx容器SSL配置参数
kubectl get pods -n ingress-nginx
kubectl exec -it -n ingress-nginx ingress-nginx-controller-g54xn  -- cat /etc/nginx/nginx.conf

### 测试
echo "172.20.235.204   nginx.test.com" >> /etc/hosts
curl https://nginx.test.com

3、Ingress Nginx配置不强制转HTTPS

### 修改Ingress配置添加annotations参数
### 创建Ingress配置TLS配置
cat > /data/yaml/helm/study-ingress/nginx-ingress-tls.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  labels:
    app: nginx-ingress
  name: nginx-ingress
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
  tls:
    - hosts:
      - nginx.test.com
      secretName: ca-secret
EOF
kubectl apply -f /data/yaml/helm/study-ingress/nginx-ingress-tls.yaml 
kubectl get ingress nginx-ingress -n study-ingress -oyaml

三、Ingress Controller实现Ingress Nginx的其它功能

1、Ingress Nginx Redirect域名重定向

提示：Kubernetes官网annotations说明：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/

提示：在 Nginx 作为代理服务器时，Redirect 可用于域名的重定向，比如访问ingress.test.com 被重定向到新指定的域名www.baidu.com。Imgress 可以更简单的实现 Redirect 功能

### 修改Nginx容器的Service并重新应用
cat > /data/yaml/helm/study-ingress/nginx-ingress-redirect.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/permanent-redirect: https://www.baidu.com
    nginx.ingress.kubernetes.io/permanent-redirect-code: '308'
  labels:
    app: nginx-ingress-redirect
  name: nginx-ingress-redirect
  namespace: study-ingress
spec:
  rules:
  - host: ingress.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-ingress-redirect.yaml
kubectl get ingress -n study-ingress

### 查看ingress-nginx-controller容器是否已生成nginx容器配置文件
kubectl get pods -n ingress-nginx
kubectl exec -it -n ingress-nginx ingress-nginx-controller-9k626 -- cat /etc/nginx/nginx.conf | grep "ingress.test.com"
kubectl exec -it -n ingress-nginx ingress-nginx-controller-9k626 -- cat /etc/nginx/nginx.conf | grep www.baidu.com

### 测试Ingress Nginx
kubectl get pods -n ingress-nginx -owide
curl -H "Host:ingress.test.com" 172.20.235.204 -I

2、Ingress Nginx Rewrite实现前后端分离

提示：Kubernetes官网annotations Rewrite说明：https://kubernetes.github.io/ingress-nginx/examples/rewrite/

实验模拟说明：当访问http://nginx.test.com跳转到Nginx-index容器首页，当访问http://nginx.test.com/api-a跳转到Nginx-api容器首页

### 创建命名空间并创建一个deployment的Nginx Pod资源
kubectl create ns study-ingress
kubectl create deploy nginx-index --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n study-ingress
kubectl create deploy nginx-api --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.26 -n study-ingress
kubectl get deploy -n study-ingress
kubectl get pods -n study-ingress

### 创建Nginx容器的Service
kubectl expose deploy nginx-index --port 80 -n study-ingress
kubectl expose deploy nginx-api --port 80 -n study-ingress
kubectl get svc -n study-ingress 

### 修改nginx-api容器的首页显示内容
kubectl get pods -n study-ingress
kubectl -n study-ingress exec -it nginx-api-5477d9689-f6hsm -- bash
echo "This is a API">/usr/share/nginx/html/index.html
cat /usr/share/nginx/html/index.html
exit

### 访问两个Nginx容器的首页
kubectl get svc -n study-ingress 
curl 10.96.128.232
curl 10.96.208.29

### 创建名称nginx-index-ingress的Ingress(Nginx / 目录访问)
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-index-ingress.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app: nginx-index-ingress
  name: nginx-index-ingress
  namespace: study-ingress
spec:
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-index
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f  /data/yaml/helm/study-ingress/nginx-index-ingress.yaml
kubectl get ingress -n study-ingress
kubectl get pods -n study-ingress

### 创建名称nginx-api-ingress的Ingress(Nginx /api-a 目录访问)
cat > /data/yaml/helm/study-ingress/nginx-api-ingress.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
  labels:
    app: nginx-api-ingress
  name: nginx-api-ingress
  namespace: study-ingress
spec:
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-api
            port:
              number: 80
        path: /api-a(/|$)(.*)
        pathType: ImplementationSpecific
EOF
kubectl create -f  /data/yaml/helm/study-ingress/nginx-api-ingress.yaml
kubectl get ingress -n study-ingress
kubectl get pods -n study-ingress

### 测试
echo "172.20.235.204   nginx.test.com" >> /etc/hosts
curl http://nginx.test.com
curl http://nginx.test.com/api-a

3、Ingress Nginx 实现错误代码友好页面

提示：Kubernetes官网Nginx参数设置说明：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/

### 修改Ingress Nginx Helm的values.yaml配置文件
[root@k8s-master01 ~]# vim /data/yaml/helm/ingress-nginx/values.yaml
# 把defaultBackend的enabled参数false修改成true
defaultBackend:
  ##
  enabled: true
  name: defaultbackend
# 添加自定义的apiVersion、custom-htt-errors、client_max_body_size错误代码参数
controller:
  name: controller
  config: 
    config:
    apiVersion: v1
    client_max_body_size: 20m
    custom-http-errors: "404,415,503"

### 更新Ingress Nginx
helm upgrade ingress-nginx -n ingress-nginx /data/yaml/helm/ingress-nginx/
kubectl get pods -n ingress-nginx -owide

### 查看Ingress Nginx的ConfigureMap没有配置任何data数据
kubectl get cm -n ingress-nginx
kubectl get cm ingress-nginx-controller -n ingress-nginx –oyaml

### 测试，访问不存在的一个Nginx页面，会提示default backend - 404
echo "172.20.235.204   nginx.test.com" >> /etc/hosts
curl http://nginx.test.com/123

4、Ingress Nginx 实现匹配请求头

提示：kubernetes官网annotations server-snippet参数说明：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-snippet

实验模拟说明：当访问http://nginx.test.com匹配到请求头User-Agent是主机端就跳转到nginx-laptop容器首页，当访问http://nginx.test.com匹配请求头User-Agent是手机端就跳转到nginx-phone容器首页

（1）、Ingress Nginx开启snippet功能

提示：如果Ingress Contriller是使用Helm 4.12.0版以上安装部署的，需要添加以下参数开启snippet功能才可以使用

### 需要使用snippet功能，需要开启该功能，默认关闭snippet功能
cat /data/yaml/helm/ingress-nginx/values.yaml | grep -w "allowSnippetAnnotations"
sed -i 's#allowSnippetAnnotations: false#allowSnippetAnnotations: true#g' /data/yaml/helm/ingress-nginx/values.yaml

### Helm添加以下参数controller.config.annotations-risk-level: Critical
[root@k8s-master01 ~]# vim /data/yaml/helm/ingress-nginx/values.yaml
  config:
annotations-risk-level: Critical

### 更新Ingress Nginx
helm upgrade ingress-nginx -n ingress-nginx /data/yaml/helm/ingress-nginx/
kubectl get pods -n ingress-nginx

### 查看Ingress Nginx的ConfigMap是否生效
kubectl get cm ingress-nginx-controller -n ingress-nginx -oyaml
# 显示allow-snippet-annotations: "true"和annotations-risk-level: Critical
apiVersion: v1
data:
  allow-snippet-annotations: "true"
  annotations-risk-level: Critical

（2）、部署移动端Ingress Nginx

### 创建移动端的Deployment
kubectl create ns study-ingress
kubectl create deploy nginx-phone --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n study-ingress
kubectl get deploy -n study-ingress
kubectl get pods -n study-ingress

### 暴露Nginx容器的Service
kubectl expose deploy nginx-phone --port 80 -n study-ingress
kubectl get svc -n study-ingress

### 修改nginx-phone容器的首页显示内容
kubectl get pods -n study-ingress
kubectl -n study-ingress exec -it nginx-phone-b54b88d75-qv5dg -- bash
echo "This is a phone html">/usr/share/nginx/html/index.html
cat /usr/share/nginx/html/index.html
exit

### 访问nginx-phone容器的首页
kubectl get svc -n study-ingress 
curl 10.96.77.40

### 创建nginx-phone的Ingress
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-phone-ingress.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app: nginx-phone-ingress
  name: nginx-phone-ingress
  namespace: study-ingress
spec:
  rules:
  - host: phone.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-phone
            port:
              number: 80
        path: /
        pathType: Prefix
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-phone-ingress.yaml
kubectl get ingress -n study-ingress

（3）、部署主机端Ingress Nginx

### 创建主机端的Deployment
kubectl create ns study-ingress
kubectl create deploy nginx-laptop --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.26 -n study-ingress
kubectl get deploy -n study-ingress
kubectl get pods -n study-ingress

### 暴露Nginx容器的Service
kubectl expose deploy nginx-laptop --port 80 -n study-ingress
kubectl get svc -n study-ingress

### 修改nginx-laptop容器的首页显示内容
kubectl get pods -n study-ingress
kubectl -n study-ingress exec -it nginx-laptop-64b69d4bb7-q7ztn -- bash
echo "This is a laptop html">/usr/share/nginx/html/index.html
cat /usr/share/nginx/html/index.html
exit

### 访问nginx-phone容器的首页
kubectl get svc -n study-ingress 
curl 10.96.44.161

### 创建nginx-laptop的Ingress
cat > /data/yaml/helm/study-ingress/nginx-laptop-ingress.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
        set $agentflag 0;

        if ($http_user_agent ~* "(Android|iPhone|WindowsPhone|UC|Kindle)" ){
          set $agentflag 1;
        }

        if ( $agentflag = 1 ) {
          return 301 http://phone.test.com; 
        }
  labels:
    app: nginx-laptop-ingress
  name: nginx-laptop-ingress
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: laptop.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-laptop
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f  /data/yaml/helm/study-ingress/nginx-laptop-ingress.yaml
kubectl get ingress -n study-ingress

（4）、打开浏览器模拟移动端和主机端访问

在这里插入图片描述

5、Ingress Nginx 添加账号和密码认证

提示：Kubernetes官方Ingress Nginx说明：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/

提示：Kubernetes官方Ingress Nginx说明：https://kubernetes.github.io/ingress-nginx/examples/auth/basic/

### 创建命名空间并创建一个deployment的Nginx Pod资源
kubectl create ns study-ingress
kubectl create deploy nginx --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n study-ingress
kubectl get pods -n study-ingress

### 创建Nginx容器的Service
kubectl expose deploy nginx --port 80 -n study-ingress
kubectl get svc -n study-ingress 
curl  10.96.59.213

### 安装htpasswd工具生成账号和密码
yum install httpd -y
mkdir -p /data/yaml/helm/study-ingress/passwd
htpasswd -c /data/yaml/helm/study-ingress/passwd/auth admin
# cat /data/yaml/helm/study-ingress/passwd/auth
admin:$apr1$/kaaohHW$xhb8XFravmWWzKSIu/cvg/

### 创建Secret
kubectl create secret generic basic-auth --from-file=/data/yaml/helm/study-ingress/passwd/auth -n study-ingress
kubectl get secret -n study-ingress
kubectl get secret basic-auth -n study-ingress -oyaml

### 创建Ingress
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-ingress-passwd.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-realm: 'Please Input Your Username and Password'
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-type: basic
  labels:
    app: nnginx-ingress-passwd
  name: nginx-ingress-passwd
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: Prefix
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-ingress-passwd.yaml
kubectl get ingress -n study-ingress

### 参数说明
# nginx.ingress.kubernetes.io/auth-realm：需要密码认证的消息提醒
# nginx.ingress.kubernetes.io/auth-secret：填写已创建的Secret 名称，
# nginx.ingress.kubernetes.io/auth-type：认证类型，可以是 basic 和 digest

打开浏览器访问测试

在这里插入图片描述

6、Ingress Nginx 实现黑白名单访问

（1）、创建测试的Deployment和Service

### 创建命名空间并创建一个deployment的Nginx Pod资源
kubectl create ns study-ingress
kubectl create deploy nginx --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n study-ingress
kubectl get pods -n study-ingress

### 创建Nginx容器的Service
kubectl expose deploy nginx --port 80 -n study-ingress
kubectl get svc -n study-ingress 
curl -H "Host:nginx.test.com" 10.96.67.221
curl -H "Host:nginx.test.com" 10.96.67.221 -I

（2）、创建Ingress配置黑名单

### 创建Ingress配置黑名单：禁止k8s-node02节点IP访问Nginx容器首页
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-ingress-denylist.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    spec.ingressClassName: nginx
    nginx.ingress.kubernetes.io/denylist-source-range: 172.20.235.205
  labels:
    app: nnginx-ingress-passwd
  name: nginx-ingress-passwd
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-ingress-denylist.yaml 
kubectl get ingress -n study-ingress

### 登录k8s-node02访问测试，提示403 Forbidden错误
curl -H "Host:nginx.test.com" 172.20.235.204
curl -H "Host:nginx.test.com" 172.20.235.204 -I

（3）、创建Ingress配置白名单

### 创建Ingress配置白名单：只允许k8s-node02节点IP访问Nginx容器首页
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-ingress-denylist.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    spec.ingressClassName: nginx
    nginx.ingress.kubernetes.io/whitelist-source-range: 172.20.235.205
  labels:
    app: nnginx-ingress-passwd
  name: nginx-ingress-passwd
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-ingress-denylist.yaml 
kubectl get ingress -n study-ingress

### 登录k8s-node02访问测试正常
curl -H "Host:nginx.test.com" 172.20.235.204
curl -H "Host:nginx.test.com" 172.20.235.204 -I

### 登录k8s集群其它节点访问测试，提示403 Forbidden错误
curl -H "Host:nginx.test.com" 172.20.235.204
curl -H "Host:nginx.test.com" 172.20.235.204 -I

7、Ingress Nginx 实现连接数限制

提示：Kubernetes官方annotations 黑白名单配置说明：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/

### 创建命名空间并创建一个deployment的Nginx Pod资源
kubectl create ns study-ingress
kubectl create deploy nginx --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n study-ingress
kubectl get pods -n study-ingress

### 创建Nginx容器的Service
kubectl expose deploy nginx --port 80 -n study-ingress
kubectl get svc -n study-ingress 
curl -H "Host:nginx.test.com" 10.96.67.221
curl -H "Host:nginx.test.com" 10.96.67.221 -I

### 创建Ingress：没有配置限制连接数量
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-ingress-limit.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app: nginx-ingress-passwd
  name: nginx-ingress-passwd
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-ingress-limit.yaml
kubectl get ingress -n study-ingress

### 登录其它Linux测试主机使用ab工具测试连接数
[root@testmysql01 ~]# echo "172.20.235.204  nginx.test.com" >> /etc/hosts
[root@testmysql01 ~]# yum install httpd -y
[root@testmysql01 ~]# ab -c 100 -n 1000 http://nginx.test.com/ | grep requests
Complete requests:      1000
Failed requests:        0
Time per request:       0.199 [ms] (mean, across all concurrent requests)
Percentage of the requests served within a certain time (ms)

### 创建Ingress：配置限制连接数量10
cat > /data/yaml/helm/study-ingress/nginx-ingress-limit.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    spec.ingressClassName: nginx
    nginx.ingress.kubernetes.io/limit-connections: "10"
  labels:
    app: nnginx-ingress-passwd
  name: nginx-ingress-passwd
  namespace: study-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl replace -f /data/yaml/helm/study-ingress/nginx-ingress-limit.yaml
kubectl get ingress -n study-ingress

### 登录其它Linux测试主机使用ab工具测试连接数
[root@testmysql01 ~]# ab -c 100 -n 1000 http://nginx.test.com/ | grep requests
Complete requests:      1000
Failed requests:        679
Time per request:       0.215 [ms] (mean, across all concurrent requests)
Percentage of the requests served within a certain time (ms)

### 其它限制参数说明
# 限制每秒的连接，单个 IP:
nginx.ingress.kubernetes.io/limit-rps
# 限制每分钟的连接，单个 IP:
nginx.ingress.kubernetes.io/limit-rpm
# 限制客户端每秒传输的字节数，单位为K，需要开启proxy-buffering:
nginx.ingress.kubernetes.io/limit-rate
# 速率限制白名单
nginx.ingress.kubernetes.io/limit-whitelist

8、Ingress Nginx 实现灰度发布

提示：Kubernetes官方annotations 灰度发布说明：https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/

### 创建一个生产命名空间和一个测试命名空间
kubectl create namespace production
kubectl create namespace test
kubectl get ns

### 创建一个生产Deployment和一个测试Deployment
kubectl create deploy nginx-production --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n production
kubectl create deploy nginx-test --image=registry.cn-shenzhen.aliyuncs.com/dockerghost/nginx:1.24 -n test
kubectl get deployment -n production
kubectl get pods -n production
kubectl get deployment -n test
kubectl get pods -n test

### 修改生产Nginx容器和测试Nginx容器首页内容
kubectl get pods -n production
kubectl exec -it -n production nginx-production-5f6b664b98-22ndr -- bash
echo "Production Project" > /usr/share/nginx/html/index.html 
cat /usr/share/nginx/html/index.html 
exit
kubectl get pods -n test
kubectl exec -it -n test nginx-test-8655f87d6f-h5n6g -- bash 
echo "Test Project" > /usr/share/nginx/html/index.html 
cat /usr/share/nginx/html/index.html 
exit

### 创建生产系统Nginx和测试系统Nginx的Service
kubectl expose deploy nginx-production --port 80 -n production
kubectl expose deploy nginx-test --port 80 -n test
kubectl get svc -n production
curl -H "Host:nginx.test.com" 10.96.94.47
curl -H "Host:nginx.test.com" 10.96.254.241

### 创建nginx-production生产系统Ingress
mkdir -p /data/yaml/helm/study-ingress
cat > /data/yaml/helm/study-ingress/nginx-ingress-production.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app: nginx-ingress-production
  name: nginx-ingress-production
  namespace: production
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-production
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-ingress-production.yaml
kubectl get ingress -n production
kubectl get ingress nginx-ingress-production -n production -oyaml

### 创建nginx-test生产系统Ingress（设置灰度发布占用生产发布50%）
cat > /data/yaml/helm/study-ingress/nginx-ingress-test.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    spec.ingressClassName: nginx
    nginx.ingress.kubernetes.io/canary: "true"
    nginx.ingress.kubernetes.io/canary-weight: "50"
  labels:
    app: nnginx-ingress-test
  name: nginx-ingress-test
  namespace: test
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - backend:
          service:
            name: nginx-test
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
EOF
kubectl create -f /data/yaml/helm/study-ingress/nginx-ingress-test.yaml
kubectl get ingress -n test
 kubectl get ingress nginx-ingress-test -n test -oyaml

### 测试
[root@testmysql01 ~]# for ((i=1;i<=20;i++));do curl http://nginx.test.com;done
Production Project
Production Project
Test Project
Production Project
Test Project
Test Project
Production Project
Production Project
Production Project
Production Project
Test Project
Production Project
Test Project
Test Project
Production Project
Test Project
Test Project
Test Project
Production Project
Production Project