二，编写ingress资源清单文件
vim ingress-http.yaml
（两个自定义域名nginx.test.com和tomcat.test.com 绑定到了nginx-service和tomcat-service 这两服务上了）
这里要注意了，为什么两个servicePort都是80了，因为上面的ingress-nginx-controller是80端口嘛，由于我的kubernetes版本是1.18，因此还是使用注解方式。
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ingress-http namespace: dev annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: - host: nginx.test.com http: paths: - path: / backend: serviceName: nginx-service servicePort: 80 - host: tomcat.test.com http: paths: - path: / backend: serviceName: tomcat-service servicePort: 80
此文件执行过后，ingress的情况如下：
可以看到此ingress是绑定到了192.168.217.18也就是node2节点了，绑定了两个域名，ADDRESS是node2节点的IP。
[root@master ~]# k get ing -A NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE dev ingress-http <none> nginx.test.com,tomcat.test.com 192.168.217.18 80 3h23m
建立namespace：
[root@master ~]# cat tomcat-nginx-ns.yaml apiVersion: v1 kind: Namespace metadata: name: dev ---
vim tomcat-nginx.yaml
建立两个deployment的pod，可提供web功能的，一个nginx 一个tomcat，两个都做了node选择，和ingress-nginx-controller处于同一个节点。
apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment namespace: dev spec: replicas: 1 selector: matchLabels: app: nginx-pod template: metadata: labels: app: nginx-pod spec: containers: - name: nginx image: nginx:1.17.1 ports: - containerPort: 80 nodeName: k8s-node2 --- apiVersion: apps/v1 kind: Deployment metadata: name: tomcat-deployment namespace: dev spec: replicas: 1 selector: matchLabels: app: tomcat-pod template: metadata: labels: app: tomcat-pod spec: containers: - name: tomcat image: tomcat:8.5-jre10-slim ports: - containerPort: 8080 nodeName: k8s-node2
vim tomcat-nginx-svc.yaml
这里又需要注意了，两个service一个无头service，一个普通的clusterip，一会使用了ingress清单文件就可以将这两个服务发布到集群外了。
--- apiVersion: v1 kind: Service metadata: name: nginx-service namespace: dev spec: ports: - port: 80 name: nginx clusterIP: None selector: app: nginx-pod --- apiVersion: v1 kind: Service metadata: name: tomcat-service namespace: dev spec: selector: app: tomcat-pod type: ClusterIP ports: - protocol: TCP port: 80 targetPort: 8080
三，OK，以上文件都apply后，就可以看结果了：
宿主机做hosts域名解析：
OK，如果nginx部署到node1节点会怎么样呢？
报错504
这就说明一个问题，kubectl get ingress -A 查询出来的那个IP地址也就是ingress的节点和要发布的service对应的pod要在同一个节点下，和service的类型没有关系，即使service是无头的也是OK的，ingress-nginx-controller会帮我们自己处理好的。并且多个service都是通过同一个端口发不出来的，只是域名不同而已。
四，改造成https也就是使用ssl的域名（实验性质，当然还是使用自签的证书，实际生产环境肯定是使用备案过的证书哦）
a，生成自签证书
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=tomcat.test.com/ST=BeiJing/L=BeiJing/O=devops/OU=unicorn"
可以看到，生成了这么两个玩意
1. [root@master ~]# ls tls* 2. tls.crt tls.key
b，生成secret，证书存放到secret里
注意，这里要指定namespace，要不ingress controller找不到证书
kubectl create secret tls tls-secret --key=tls.key --cert tls.crt -n dev
c，编写ingress文件
vim ingress-https.yaml
主要就是添加了tls相关，域名还是不变的以及一个注解，并且引用了前面打入的证书
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: test-ingress3 namespace: dev annotations: nginx.ingress.kubernetes.io/rewrite-target: / kubernetes.io/ingress.class: nginx # nginx.ingress.kubernetes.io/backend-protocol: HTTPS nginx.ingress.kubernetes.io/ssl-redirect: 'true' # # nginx.ingress.kubernetes.io/use-regex: 'true' spec: tls: - hosts: - tomcat.test.com secretName: tls-secret rules: - host: tomcat.test.com http: paths: - path: / backend: serviceName: tomcat-service servicePort: 80
查看ingress，可以看到多了一个443，还是绑定的node2节点（ingress 控制器前面部署的时候搞错了，就部署在了一个节点，daemonset没有使用的。）
[root@master ~]# k get ing -A NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE dev ingress-http <none> nginx.test.com,tomcat.test.com 192.168.217.18 80 11h dev test-ingress3 <none> tomcat.test.com 192.168.217.18 80, 443 4m16s
d，验证；
需要先查询一哈ingress的service提供的端口，查询出端口是31675
[root@master ~]# vim ingress-https.yaml [root@master ~]# k get svc -A NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default kubernetes ClusterIP 10.0.0.1 <none> 443/TCP 37d dev nginx-service ClusterIP None <none> 80/TCP 16h dev tomcat-service ClusterIP 10.0.92.37 <none> 80/TCP 16h ingress-nginx ingress-nginx-controller NodePort 10.0.0.102 <none> 80:31702/TCP,443:31675/TCP 4d14h ingress-nginx ingress-nginx-controller-admission ClusterIP 10.0.0.12 <none> 443/TCP 4d14h kube-system coredns ClusterIP 10.0.0.2 <none> 53/UDP,53/TCP 36d
OK，https证书启用成功，此网站的证书只是没有注册的自产证书，但功能是完好的。
总结：
那么现在这个ingress controller插件是可以使用的，ingress统一了要发布服务的端口，可以看到即使多个门户，也可以简单的以域名来区分，端口是统一的31702（http）或者31675（https），从而达到了服务治理的目的（其它功能，比如黑白名单，重定向，二级域名跳转等等留待以后研究哈）：
[root@master ~]# k get ing -A NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE dev ingress-http <none> nginx.test.com,tomcat.test.com 192.168.217.18 80 11h dev test-ingress3 <none> tomcat.test.com 192.168.217.18 80, 443 4m16s
ingress-nginx-controller截取的部分日志：
192.168.217.18 - - [03/Oct/2022:09:03:03 +0000] "GET /favicon.ico HTTP/1.1" 404 555 "http://nginx.test.com:31702/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Core/1.94.175.400 QQBrowser/11.1.5155.400" 423 0.001 [dev-nginx-service-80] [] 10.244.36.97:80 555 0.001 404 3b851fa39d2268e5fbd230fc5f8d1d59 192.168.217.18 - - [03/Oct/2022:09:03:05 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Core/1.94.175.400 QQBrowser/11.1.5155.400" 581 0.001 [dev-nginx-service-80] [] 10.244.36.97:80 0 0.001 304 21366d34e3103a50236738d6b1dd00e7 192.168.217.18 - - [03/Oct/2022:09:03:07 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Core/1.94.175.400 QQBrowser/11.1.5155.400" 581 0.002 [dev-nginx-service-80] [] 10.244.36.97:80 0 0.002 304 69bcb2182681ea3be696fe3b449e286c 192.168.217.18 - - [03/Oct/2022:09:03:09 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Core/1.94.175.400 QQBrowser/11.1.5155.400" 581 0.001 [dev-nginx-service-80] [] 10.244.36.97:80 0 0.000 304 3622a7bf35abbdf08c43084c89fd0110 192.168.217.18 - - [03/Oct/2022:09:06:15 +0000] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Core/1.94.175.400 QQBrowser/11.1.5155.400" 500 0.003 [dev-nginx-service-80] [] 10.244.36.97:80 612 0.003 200 5f6ba8d7070c9b7984acf2012fa57a5b 192.168.217.18 - - [03/Oct/2022:09:06:17 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Core/1.94.175.400 QQBrowser/11.1.5155.400" 581 0.002 [dev-nginx-service-80] [] 10.244.36.97:80 0 0.001 304 12d114732628f18df5988661bf79fc83 192.168.217.18 - - [03/Oct/2022:09:16:42 +0000] "GET / HTTP/1.1" 200 612 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" 460 0.001 [dev-nginx-service-80] [] 10.244.36.97:80 612 0.001 200 298738d5c747741af42d8f13fb4c4566
可以看到我是使用的QQ浏览器（也用了谷歌105版本），192.168.217.18:31702 代理了10.244.36.97:80
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES dev nginx-deployment-b785b4498-5r8jn 1/1 Running 0 16m 10.244.36.97 k8s-node1 <none> <none>
