服务对外暴露

集群内部服务之间可以通过 ingress-traefik 实现域名调用。那外网用户（与集群不在同一网络环境下的用户D）该怎么访问集群服务呢？

用户使用服务一般都是点击按钮，触发相应的域名链接（假如是java.od.com）调用，而在互联网上公认的域名将是解析到公认的ip地址，此ip地址对应一台服务器E，服务器E一般有2个网卡，一个对外流量一个对内流量（假设公网地址是108.108.108.108，内网地址是10.10.10.10），则在服务器E上部署Nginx服务实现代理转发，将通过公网地址进来的所有流量通过Nginx转发走内网流量到服务器F的81端口，即转发到traefik容器内部的80端口（traefik服务部署在内部Kubernetes集群服务器F上，已通过hostPort将容器80端口映射到服务器F的81端口），再由ingress服务进行转发，直到正常访问资源。

访问流程：
image.png

整体需求实现

环境说明

说明：

  • 因资源有限，故将NG服务部署在master1，ingress-traefik以DaemonSet类型部署到3个master节点
  • 给三台master打标签，以便能够运行ingress-traefik pod

标签：
kubectl label nodes master1 nickname=boss
kubectl label nodes master2 nickname=boss
kubectl label nodes master3 nickname=boss

nginx

  1. yum -y install nginx
  2. systemctl start nginx
  3. systemctl enable nginx
  5. # cat /etc/nginx/nginx.conf |grep 'conf.d'
  6. include /etc/nginx/conf.d/*.conf;
  8. # 将所有*.od.com请求全部转发到default_backend_traefik
  9. # cat /etc/nginx/conf.d/od.com.conf
  10. upstream default_backend_traefik {
  11.     server 10.2.2.137:81    max_fails=3 fail_timeout=10s;
  12.     server 10.2.2.166:81    max_fails=3 fail_timeout=10s;
  13.     server 10.2.2.96:81    max_fails=3 fail_timeout=10s;
  14. }
  15. server {
  16. server_name *.od.com;
  18.     location / {
  19.         proxy_pass http://default_backend_traefik;
  20.         proxy_set_header Host       $http_host;
  21.         proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
  22.     }
  23. }

开启ng文件服务

  1. # cat /etc/nginx/conf.d/k8s-yaml.od.com.conf
  2. server {
  3. listen       80;
  4. server_name  k8s-yaml.od.com;
  6.     location / {
  7.     autoindex on;
  8.     default_type text/plain;
  9.     root /data/k8s-yaml;
  10.     }
  11. }
  13. # 服务重启
  14. systemclt restart nginx

ingress-traefik

ds.yaml

  1. apiVersion: apps/v1
  2. #apiVersion: extensions/v1beta1
  3. kind: DaemonSet
  4. metadata:
  5.   name: traefik-ingress
  6.   namespace: kube-system
  7.   labels:
  8.     k8s-app: traefik-ingress
  9. spec:
  10.   selector:
  11.     matchLabels:
  12.       k8s-app: traefik-ingress
  13.   template:
  14.     metadata:
  15.       labels:
  16.         k8s-app: traefik-ingress
  17.         name: traefik-ingress
  18.     spec:
  19.       serviceAccountName: traefik-ingress-controller
  20.       terminationGracePeriodSeconds: 60
  21.       tolerations:
  22.       - operator: "Exists"
  23.       nodeSelector:
  24.         #kubernetes.io/hostname: master1
  25.         nickname: boss 
  26.       containers:
  27.       - image: traefik:v1.7.2-alpine
  28.         name: traefik-ingress
  29.         ports:
  30.         - name: controller
  31.           containerPort: 80
  32.           hostPort: 81
  33.         - name: admin-web
  34.           containerPort: 8080
  35.         securityContext:
  36.           capabilities:
  37.             drop:
  38.             - ALL
  39.             add:
  40.             - NET_BIND_SERVICE
  41.         args:
  42.         - --api
  43.         - --kubernetes
  44.         - --logLevel=INFO
  45.         - --insecureskipverify=true
  46.         - --kubernetes.endpoint=https://10.2.2.6:6443  #集群vip地址
  47.         - --accesslog
  48.         - --accesslog.filepath=/var/log/traefik_access.log
  49.         - --traefiklog
  50.         - --traefiklog.filepath=/var/log/traefik.log
  51.         - --metrics.prometheus

svc.yaml

kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress
  ports:
    - protocol: TCP
      port: 80
      name: controller
    - protocol: TCP
      port: 8080
      name: admin-web

ing.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-web-ui
  namespace: kube-system
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: traefik.od.com
    http:
      paths:
      - path: /
        backend:
          serviceName: traefik-ingress-service
          servicePort: 8080

rbac.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: kube-system

应用部署
kubectl apply -f .

整体效果展示

#地址解析
服务对应解析域名：traefik.od.com

访问效果如下
image.png