首先区分开ingress和ingress-controller
前者个人理解是一种集群中服务之间访问控制策略
后者是client访问集群时得一种方式如下图
思维导图（部署方式不同，略有差别）
暴露服务还分几种方式
一 .Deployment+LoadBalancer模式的Service
客户端不能直接访问集群服务，创建ingress controller 的多副本模式 整套需要创建2个负载均衡 一个是proxy到ingress controller，一个是进来集群到后端服务的ingress的反向代理 需绑定2个svc。
二.Deployment+NodePort模式的Service
client直接访问集群服务，通过标签匹配node节点，创建的资源同上，只不过ingress controller的svc需修改成nodeport模式，node节点直接暴露服务，但是只能是30000-32767不方便客户使用。
三.DaemonSet+HostNetwork+nodeSelector （本次实验使用的方式）
通过标签匹配，选定node节点，使用主机网络模式，与上面的流程不同之处，整套流程创建一个ingress controller 绑定一个ingress代理一个svc绑定deployment
有一定依耐性，必须先启动Ingress Controller 服务
1.创建Ingress Controller
vim mandatory.yaml ##190行之后定义适合自己的模式
apiVersion: v1 kind: Namespace metadata: name: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx --- kind: ConfigMap apiVersion: v1 metadata: name: nginx-configuration namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx --- kind: ConfigMap apiVersion: v1 metadata: name: tcp-services namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx --- kind: ConfigMap apiVersion: v1 metadata: name: udp-services namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx --- apiVersion: v1 kind: ServiceAccount metadata: name: nginx-ingress-serviceaccount namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata: name: nginx-ingress-clusterrole labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx rules: - apiGroups: - "" resources: - configmaps - endpoints - nodes - pods - secrets verbs: - list - watch - apiGroups: - "" resources: - nodes verbs: - get - apiGroups: - "" resources: - services verbs: - get - list - watch - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - "extensions" - "networking.k8s.io" resources: - ingresses verbs: - get - list - watch - apiGroups: - "extensions" - "networking.k8s.io" resources: - ingresses/status verbs: - update --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: Role metadata: name: nginx-ingress-role namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx rules: - apiGroups: - "" resources: - configmaps - pods - secrets - namespaces verbs: - get - apiGroups: - "" resources: - configmaps resourceNames: # Defaults to "<election-id>-<ingress-class>" # Here: "<ingress-controller-leader>-<nginx>" # This has to be adapted if you change either parameter # when launching the nginx-ingress-controller. - "ingress-controller-leader-nginx" verbs: - get - update - apiGroups: - "" resources: - configmaps verbs: - create - apiGroups: - "" resources: - endpoints verbs: - get --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: RoleBinding metadata: name: nginx-ingress-role-nisa-binding namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: nginx-ingress-role subjects: - kind: ServiceAccount name: nginx-ingress-serviceaccount namespace: ingress-nginx --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata: name: nginx-ingress-clusterrole-nisa-binding labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: nginx-ingress-clusterrole subjects: - kind: ServiceAccount name: nginx-ingress-serviceaccount namespace: ingress-nginx --- apiVersion: apps/v1 #kind: Deployment kind: DaemonSet metadata: name: nginx-ingress-controller namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: # replicas: 1 selector: matchLabels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx template: metadata: labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx annotations: prometheus.io/port: "10254" prometheus.io/scrape: "true" spec: hostNetwork: true # wait up to five minutes for the drain of connections terminationGracePeriodSeconds: 300 serviceAccountName: nginx-ingress-serviceaccount nodeSelector: kubernetes.io/os: linux nodes-rola: edg containers: - name: nginx-ingress-controller image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.29.0 args: - /nginx-ingress-controller - --configmap=$(POD_NAMESPACE)/nginx-configuration - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services - --udp-services-configmap=$(POD_NAMESPACE)/udp-services - --publish-service=$(POD_NAMESPACE)/ingress-nginx - --annotations-prefix=nginx.ingress.kubernetes.io securityContext: allowPrivilegeEscalation: true capabilities: drop: - ALL add: - NET_BIND_SERVICE # www-data -> 101 runAsUser: 101 env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace ports: - name: http containerPort: 80 protocol: TCP - name: https containerPort: 443 protocol: TCP livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 10 readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 10 lifecycle: preStop: exec: command: - /wait-shutdown --- apiVersion: v1 kind: LimitRange metadata: name: ingress-nginx namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: limits: - min: memory: 90Mi cpu: 100m type: Container
如果是cluster，nodeport的话 还需要一个svc代理Ingress Controller
vim mandatory-svc.yaml
apiVersion: v1 kind: Service metadata: name: ingress-nginx namespace: ingress-nginx spec: ports: - name: http port: 80 targetPort: 80 - name: https port: 443 targetPort: 443 selector: app.kubernetes.io/name: ingress-nginx type: ClusterIP
这里我们用的主机网络模式 所以不用创建svc
2.创建转发规则ingress
vim ingress-nginx.yaml
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ingress-mynginx namespace: default ##修改命名空间 annotations: kubernetes.io/ingress.class: "nginx" spec: rules: - host: mynginx.com http: paths: - path: backend: serviceName: service-nginx ##绑定后端服务 servicePort: 80
3.创建后端web服务
vim my-nginx.yaml
apiVersion: v1 kind: Service metadata: name: service-nginx ##与上面的ingress需一致，绑定关系 namespace: default ##命名空间 spec: selector: app: mynginx ##绑定下面的deployment启的pod ports: - name: http port: 80 targetPort: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: mynginx ##deployment的名字 无依赖关系 namespace: default spec: replicas: 2 selector: matchLabels: app: mynginx ##这里是deployment和svc绑定关系，下面pod也得一致 template: metadata: labels: app: mynginx ##与上面得deployment绑定，才能让deploy管理pod spec: containers: - name: mycontainer image: nginx imagePullPolicy: IfNotPresent ports: - name: nginx containerPort: 80
