logo头像
Snippet 博客主题

231_k8s-install-ingress

ingress介绍

ingress 用来暴露从集群外到集群内服务的HTTP或HTTPS路由

安装ingress-nginx

1、创建 kube-system 中的 amdin 账户,如果已经存在可跳过

1
2
3
4
5
# 创建命令
kubectl apply -f kube-system-serviceaccount.yaml

# 获取某个账户的 token
kubectl describe secret/$(kubectl get secret -n kube-system |grep admin|awk '{print $1}') -n kube-system

kube-system-serviceaccount.yaml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# rbac
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: cluster-admin
namespace: kube-system
labels:
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: "system:cluster-admin" # cluter资源,所以加一个命名空间前缀区分
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
kind: ClusterRole
name: cluster-admin # 绑定集群管理员
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: cluster-admin
namespace: kube-system

2、创建ingress

1
2
# 创建命令
kubectl apply -f kube-system-ingress.yaml

kube-system-ingress.yaml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# ingress 默认不支持暴露 tcp/udp
# 如有需要,可以通过配置这两个 configmap 对外暴露
# 并且需要在 ingress-controller 容器中开放对应的端口

kind: ConfigMap
apiVersion: v1
metadata:
name: ingress-tcp-services
namespace: kube-system
data:
3306: "icql-svc/svc-mysql:3306"

---
kind: ConfigMap
apiVersion: v1
metadata:
name: ingress-udp-services
namespace: kube-system
data:

---
kind: Deployment
apiVersion: apps/v1
metadata:
name: nginx-ingress-controller
namespace: kube-system
labels:
addonmanager.kubernetes.io/mode: Reconcile
app.kubernetes.io/name: nginx-ingress-controller
app.kubernetes.io/part-of: kube-system
spec:
replicas: 1
selector:
matchLabels:
addonmanager.kubernetes.io/mode: Reconcile
app.kubernetes.io/name: nginx-ingress-controller
app.kubernetes.io/part-of: kube-system
template:
metadata:
labels:
addonmanager.kubernetes.io/mode: Reconcile
app.kubernetes.io/name: nginx-ingress-controller
app.kubernetes.io/part-of: kube-system
spec:
containers:
- name: nginx-ingress-controller
image: >-
quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.2
args:
- /nginx-ingress-controller
- "--configmap=$(POD_NAMESPACE)/nginx-load-balancer-conf"
- "--tcp-services-configmap=$(POD_NAMESPACE)/ingress-tcp-services"
- "--udp-services-configmap=$(POD_NAMESPACE)/ingress-udp-services"
- "--annotations-prefix=nginx.ingress.kubernetes.io"
- "--report-node-internal-ip-address"
ports:
- hostPort: 80
containerPort: 80
protocol: TCP
- hostPort: 443
containerPort: 443
protocol: TCP
- hostPort: 18080
containerPort: 18080
protocol: TCP
- hostPort: 3306
containerPort: 3306
protocol: TCP
env:
- name: POD_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
resources: {}
livenessProbe:
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
timeoutSeconds: 1
periodSeconds: 10
successThreshold: 1
failureThreshold: 3
readinessProbe:
httpGet:
path: /healthz
port: 10254
scheme: HTTP
timeoutSeconds: 1
periodSeconds: 10
successThreshold: 1
failureThreshold: 3
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
runAsUser: 33
restartPolicy: Always
terminationGracePeriodSeconds: 60
dnsPolicy: ClusterFirst
serviceAccountName: cluster-admin
securityContext: {}
schedulerName: default-scheduler
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1
revisionHistoryLimit: 10
progressDeadlineSeconds: 600
微信打赏

赞赏是不耍流氓的鼓励