Kubernetes Ingress：灵活的集群外部网络访问的利器

《Kubernetes Ingress：集群外部访问的利器-打造灵活的集群网络》

添加图片注释，不超过 140 字（可选）

前提条件

• 您已经拥有一个 Kubernetes 集群，并且可以访问该集群。
  
• 您已经安装了 kubectl 命令行工具。
  

版本选择

安装前需要选择兼容你Kubernetes的版本，不能会失败

添加图片注释，不超过 140 字（可选）

ingress由两部分组成：

• Ingress Controller：负责处理 Ingress 请求，并将请求转发到正确的服务。
  
• Ingress 资源对象：定义 Ingress 规则，包括路由规则、负载均衡、SSL/TLS 保护等。
  

以下就是具体的安装步骤：

安装 Ingress Controller

添加图片注释，不超过 140 字（可选）

Ingress Controller 是负责处理 Ingress 请求的组件。Kubernetes 提供了多种 Ingress Controller，您可以根据需要选择。以下是常用的 Ingress Controller：

• Nginx Ingress Controller：基于 Nginx 的 Ingress Controller，功能强大，易于配置。
  
• HAProxy Ingress Controller：基于 HAProxy 的 Ingress Controller，性能优异，适用于高并发场景。
  
• Contour Ingress Controller：基于 Envoy 的 Ingress Controller，功能丰富，适用于多云场景。
  

在本教程中，我们将使用 Nginx Ingress Controller 进行演示。

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.4.0/deploy/static/provider/cloud/deploy.yaml

下载就是如下文件(去除版本后面的摘要)：

apiVersion: v1 kind: Namespace metadata:   labels:     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx   name: ingress-nginx --- apiVersion: v1 automountServiceAccountToken: true kind: ServiceAccount metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx   namespace: ingress-nginx --- apiVersion: v1 kind: ServiceAccount metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission   namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx   namespace: ingress-nginx rules: - apiGroups:   - ""   resources:   - namespaces   verbs:   - get - apiGroups:   - ""   resources:   - configmaps   - pods   - secrets   - endpoints   verbs:   - get   - list   - watch - apiGroups:   - ""   resources:   - services   verbs:   - get   - list   - watch - apiGroups:   - networking.k8s.io   resources:   - ingresses   verbs:   - get   - list   - watch - apiGroups:   - networking.k8s.io   resources:   - ingresses/status   verbs:   - update - apiGroups:   - networking.k8s.io   resources:   - ingressclasses   verbs:   - get   - list   - watch - apiGroups:   - ""   resourceNames:   - ingress-controller-leader   resources:   - configmaps   verbs:   - get   - update - apiGroups:   - ""   resources:   - configmaps   verbs:   - create - apiGroups:   - coordination.k8s.io   resourceNames:   - ingress-controller-leader   resources:   - leases   verbs:   - get   - update - apiGroups:   - coordination.k8s.io   resources:   - leases   verbs:   - create - apiGroups:   - ""   resources:   - events   verbs:   - create   - patch - apiGroups:   - discovery.k8s.io   resources:   - endpointslices   verbs:   - list   - watch   - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission   namespace: ingress-nginx rules: - apiGroups:   - ""   resources:   - secrets   verbs:   - get   - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata:   labels:     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx rules: - apiGroups:   - ""   resources:   - configmaps   - endpoints   - nodes   - pods   - secrets   - namespaces   verbs:   - list   - watch - apiGroups:   - coordination.k8s.io   resources:   - leases   verbs:   - list   - watch - apiGroups:   - ""   resources:   - nodes   verbs:   - get - apiGroups:   - ""   resources:   - services   verbs:   - get   - list   - watch - apiGroups:   - networking.k8s.io   resources:   - ingresses   verbs:   - get   - list   - watch - apiGroups:   - ""   resources:   - events   verbs:   - create   - patch - apiGroups:   - networking.k8s.io   resources:   - ingresses/status   verbs:   - update - apiGroups:   - networking.k8s.io   resources:   - ingressclasses   verbs:   - get   - list   - watch - apiGroups:   - discovery.k8s.io   resources:   - endpointslices   verbs:   - list   - watch   - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission rules: - apiGroups:   - admissionregistration.k8s.io   resources:   - validatingwebhookconfigurations   verbs:   - get   - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx   namespace: ingress-nginx roleRef:   apiGroup: rbac.authorization.k8s.io   kind: Role   name: ingress-nginx subjects: - kind: ServiceAccount   name: ingress-nginx   namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission   namespace: ingress-nginx roleRef:   apiGroup: rbac.authorization.k8s.io   kind: Role   name: ingress-nginx-admission subjects: - kind: ServiceAccount   name: ingress-nginx-admission   namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata:   labels:     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx roleRef:   apiGroup: rbac.authorization.k8s.io   kind: ClusterRole   name: ingress-nginx subjects: - kind: ServiceAccount   name: ingress-nginx   namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission roleRef:   apiGroup: rbac.authorization.k8s.io   kind: ClusterRole   name: ingress-nginx-admission subjects: - kind: ServiceAccount   name: ingress-nginx-admission   namespace: ingress-nginx --- apiVersion: v1 data:   allow-snippet-annotations: "true" kind: ConfigMap metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-controller   namespace: ingress-nginx --- apiVersion: v1 kind: Service metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-controller   namespace: ingress-nginx spec:   externalTrafficPolicy: Local   ipFamilies:   - IPv4   ipFamilyPolicy: SingleStack   ports:   - appProtocol: http     name: http     port: 80     protocol: TCP     targetPort: http   - appProtocol: https     name: https     port: 443     protocol: TCP     targetPort: https   selector:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx   type: LoadBalancer --- apiVersion: v1 kind: Service metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-controller-admission   namespace: ingress-nginx spec:   ports:   - appProtocol: https     name: https-webhook     port: 443     targetPort: webhook   selector:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx   type: ClusterIP --- apiVersion: apps/v1 kind: Deployment metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-controller   namespace: ingress-nginx spec:   minReadySeconds: 0   revisionHistoryLimit: 10   selector:     matchLabels:       app.kubernetes.io/component: controller       app.kubernetes.io/instance: ingress-nginx       app.kubernetes.io/name: ingress-nginx   template:     metadata:       labels:         app.kubernetes.io/component: controller         app.kubernetes.io/instance: ingress-nginx         app.kubernetes.io/name: ingress-nginx     spec:       containers:       - args:         - /nginx-ingress-controller         - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller         - --election-id=ingress-controller-leader         - --controller-class=k8s.io/ingress-nginx         - --ingress-class=nginx         - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller         - --validating-webhook=:8443         - --validating-webhook-certificate=/usr/local/certificates/cert         - --validating-webhook-key=/usr/local/certificates/key         env:         - name: POD_NAME           valueFrom:             fieldRef:               fieldPath: metadata.name         - name: POD_NAMESPACE           valueFrom:             fieldRef:               fieldPath: metadata.namespace         - name: LD_PRELOAD           value: /usr/local/lib/libmimalloc.so         image: registry.k8s.io/ingress-nginx/controller:v1.4.0         imagePullPolicy: IfNotPresent         lifecycle:           preStop:             exec:               command:               - /wait-shutdown         livenessProbe:           failureThreshold: 5           httpGet:             path: /healthz             port: 10254             scheme: HTTP           initialDelaySeconds: 10           periodSeconds: 10           successThreshold: 1           timeoutSeconds: 1         name: controller         ports:         - containerPort: 80           name: http           protocol: TCP         - containerPort: 443           name: https           protocol: TCP         - containerPort: 8443           name: webhook           protocol: TCP         readinessProbe:           failureThreshold: 3           httpGet:             path: /healthz             port: 10254             scheme: HTTP           initialDelaySeconds: 10           periodSeconds: 10           successThreshold: 1           timeoutSeconds: 1         resources:           requests:             cpu: 100m             memory: 90Mi         securityContext:           allowPrivilegeEscalation: true           capabilities:             add:             - NET_BIND_SERVICE             drop:             - ALL           runAsUser: 101         volumeMounts:         - mountPath: /usr/local/certificates/           name: webhook-cert           readOnly: true       dnsPolicy: ClusterFirst       nodeSelector:         kubernetes.io/os: linux       serviceAccountName: ingress-nginx       terminationGracePeriodSeconds: 300       volumes:       - name: webhook-cert         secret:           secretName: ingress-nginx-admission --- apiVersion: batch/v1 kind: Job metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission-create   namespace: ingress-nginx spec:   template:     metadata:       labels:         app.kubernetes.io/component: admission-webhook         app.kubernetes.io/instance: ingress-nginx         app.kubernetes.io/name: ingress-nginx         app.kubernetes.io/part-of: ingress-nginx         app.kubernetes.io/version: 1.4.0       name: ingress-nginx-admission-create     spec:       containers:       - args:         - create         - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc         - --namespace=$(POD_NAMESPACE)         - --secret-name=ingress-nginx-admission         env:         - name: POD_NAMESPACE           valueFrom:             fieldRef:               fieldPath: metadata.namespace         image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343         imagePullPolicy: IfNotPresent         name: create         securityContext:           allowPrivilegeEscalation: false       nodeSelector:         kubernetes.io/os: linux       restartPolicy: OnFailure       securityContext:         fsGroup: 2000         runAsNonRoot: true         runAsUser: 2000       serviceAccountName: ingress-nginx-admission --- apiVersion: batch/v1 kind: Job metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission-patch   namespace: ingress-nginx spec:   template:     metadata:       labels:         app.kubernetes.io/component: admission-webhook         app.kubernetes.io/instance: ingress-nginx         app.kubernetes.io/name: ingress-nginx         app.kubernetes.io/part-of: ingress-nginx         app.kubernetes.io/version: 1.4.0       name: ingress-nginx-admission-patch     spec:       containers:       - args:         - patch         - --webhook-name=ingress-nginx-admission         - --namespace=$(POD_NAMESPACE)         - --patch-mutating=false         - --secret-name=ingress-nginx-admission         - --patch-failure-policy=Fail         env:         - name: POD_NAMESPACE           valueFrom:             fieldRef:               fieldPath: metadata.namespace         image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343         imagePullPolicy: IfNotPresent         name: patch         securityContext:           allowPrivilegeEscalation: false       nodeSelector:         kubernetes.io/os: linux       restartPolicy: OnFailure       securityContext:         fsGroup: 2000         runAsNonRoot: true         runAsUser: 2000       serviceAccountName: ingress-nginx-admission --- apiVersion: networking.k8s.io/v1 kind: IngressClass metadata:   labels:     app.kubernetes.io/component: controller     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: nginx spec:   controller: k8s.io/ingress-nginx --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata:   labels:     app.kubernetes.io/component: admission-webhook     app.kubernetes.io/instance: ingress-nginx     app.kubernetes.io/name: ingress-nginx     app.kubernetes.io/part-of: ingress-nginx     app.kubernetes.io/version: 1.4.0   name: ingress-nginx-admission webhooks: - admissionReviewVersions:   - v1   clientConfig:     service:       name: ingress-nginx-controller-admission       namespace: ingress-nginx       path: /networking/v1/ingresses   failurePolicy: Fail   matchPolicy: Equivalent   name: validate.nginx.ingress.kubernetes.io   rules:   - apiGroups:     - networking.k8s.io     apiVersions:     - v1     operations:     - CREATE     - UPDATE     resources:     - ingresses   sideEffects: None

一定要把版本后面带的@摘要值删除掉

添加图片注释，不超过 140 字（可选）

要创建 Ingress 资源对象，您可以使用 kubectl 命令：

kubectl apply -f deploy.yaml #安装后查看安装结果 kubectl  get pods  -n ingress-nginx

看到下图的结果就代表成功了，只要controller是Running，其它是Completed就可以了。

添加图片注释，不超过 140 字（可选）

p.s.

如果发现安装失败，可以尝试删除pod再重新kubectl apply -f deploy.yaml

#强制删除pod kubectl delete pod --all -n ingress-nginx --force --grace-period=0 kubectl apply -f deploy.yaml

如果想查看具体的失败原因，可以使用下面的命令

kubectl  get pods  -n ingress-nginx kubectl describe pod ingress-nginx-controller-6c978d4999-vqfwp --namespace ingress-nginx

添加图片注释，不超过 140 字（可选）

发部署应用

vim nginx-deploy.yaml

apiVersion: apps/v1 kind: Deployment metadata:   labels:     app: nginx-demo   name: nginx-demo spec:   replicas: 2   selector:     matchLabels:       app: nginx   template:     metadata:       labels:         app: nginx     spec:       containers:       - image: nginx         name: nginx --- apiVersion: v1 kind: Service metadata:   labels:     app: nginx   name: nginx spec:   selector:     app: nginx   ports:   - port: 8000     protocol: TCP     targetPort: 80

kubecl apply -f nginx-deploy.yaml kubectl get pod,svc

添加图片注释，不超过 140 字（可选）

Ingress资源对象

vim ingress-nginx.yaml

apiVersion: networking.k8s.io/v1 kind: Ingress   metadata:   name: ingress-nginx spec:   ingressClassName: nginx   rules:   - host: "demo.com"     http:       paths:       - pathType: Prefix         path: "/"         backend:           service:             name: nginx             port:               number: 8000

没有域名可以自己在/etc/hosts 增加demo.com

kubecl apply -f ingress-nginx.yaml kubectl get ing

添加图片注释，不超过 140 字（可选）

查看端口

kubectl  get pods,svc  -n ingress-nginx

添加图片注释，不超过 140 字（可选）

添加图片注释，不超过 140 字（可选）

总结

一般安装都会失败，主要是国内无法下载镜像。可以看到第一个deploy.yaml中要下载两个镜像文件分别是：

• registry.k8s.io/ingress-nginx/controller:v1.4.0
  
• registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343
  

有几种解决方案：

• 改成国内镜像源，一般旧怎么的还是比较多的，新版本还是比较少
  
• 安装个代理，然后下载
  
• 手动下载镜像tar，再docker load进本地镜像库里。使用tag修改镜像tag：
  

docker tag old_image_name new_image_name

如果文章对你有帮助，欢迎关注+点赞，必回关！！！