四层转发：tcp/ip:端口
七层转发：http/https

service实现四层转发
ingress实现七层转发

ingress 是七层转发，会根据请求的主机名以及路径来决定把请求转发到相应的服务
clinet—ingress—url—service—（endpoint）—pod

ingress.yaml

  1.  api
  2.  kind
  3.  metadata
  4.  spec
  5.    rules
  6.    - host
  7.      http
  8.      ports
  9.      - backend
  10.    tls
  11.    - hosts
  12.      secretName
  13.  status
  14.    loadBalancer
  15.      ingress

Service-NodePort

Service的NodePort方式是把端口号对外暴露，通过ip+端口号进行访问

Service-NodePort缺陷

在每个节点上都会起个端口，在访问时候通过任务节点，通过节点Ip+暴露端口实现访问

意味着每个端口号只能使用一次，一个端口对应一个应用

实际访问中都是用域名，根据不同域名跳转到不同端口服务中，ingress就是实现这个目标的

Ingress和Pod的关系

图片.png

Ingress工作流程

图片.png

部署ingress Controller，实现域名访问

vi ingress-controller.yaml

  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   name: ingress-nginx
  5.   labels:
  6.     app.kubernetes.io/name: ingress-nginx
  7.     app.kubernetes.io/part-of: ingress-nginx
  9. ---
  11. kind: ConfigMap
  12. apiVersion: v1
  13. metadata:
  14.   name: nginx-configuration
  15.   namespace: ingress-nginx
  16.   labels:
  17.     app.kubernetes.io/name: ingress-nginx
  18.     app.kubernetes.io/part-of: ingress-nginx
  20. ---
  21. kind: ConfigMap
  22. apiVersion: v1
  23. metadata:
  24.   name: tcp-services
  25.   namespace: ingress-nginx
  26.   labels:
  27.     app.kubernetes.io/name: ingress-nginx
  28.     app.kubernetes.io/part-of: ingress-nginx
  30. ---
  31. kind: ConfigMap
  32. apiVersion: v1
  33. metadata:
  34.   name: udp-services
  35.   namespace: ingress-nginx
  36.   labels:
  37.     app.kubernetes.io/name: ingress-nginx
  38.     app.kubernetes.io/part-of: ingress-nginx
  40. ---
  41. apiVersion: v1
  42. kind: ServiceAccount
  43. metadata:
  44.   name: nginx-ingress-serviceaccount
  45.   namespace: ingress-nginx
  46.   labels:
  47.     app.kubernetes.io/name: ingress-nginx
  48.     app.kubernetes.io/part-of: ingress-nginx
  50. ---
  51. apiVersion: rbac.authorization.k8s.io/v1beta1
  52. kind: ClusterRole
  53. metadata:
  54.   name: nginx-ingress-clusterrole
  55.   labels:
  56.     app.kubernetes.io/name: ingress-nginx
  57.     app.kubernetes.io/part-of: ingress-nginx
  58. rules:
  59.   - apiGroups:
  60.       - ""
  61.     resources:
  62.       - configmaps
  63.       - endpoints
  64.       - nodes
  65.       - pods
  66.       - secrets
  67.     verbs:
  68.       - list
  69.       - watch
  70.   - apiGroups:
  71.       - ""
  72.     resources:
  73.       - nodes
  74.     verbs:
  75.       - get
  76.   - apiGroups:
  77.       - ""
  78.     resources:
  79.       - services
  80.     verbs:
  81.       - get
  82.       - list
  83.       - watch
  84.   - apiGroups:
  85.       - ""
  86.     resources:
  87.       - events
  88.     verbs:
  89.       - create
  90.       - patch
  91.   - apiGroups:
  92.       - "extensions"
  93.       - "networking.k8s.io"
  94.     resources:
  95.       - ingresses
  96.     verbs:
  97.       - get
  98.       - list
  99.       - watch
  100.   - apiGroups:
  101.       - "extensions"
  102.       - "networking.k8s.io"
  103.     resources:
  104.       - ingresses/status
  105.     verbs:
  106.       - update
  108. ---
  109. apiVersion: rbac.authorization.k8s.io/v1beta1
  110. kind: Role
  111. metadata:
  112.   name: nginx-ingress-role
  113.   namespace: ingress-nginx
  114.   labels:
  115.     app.kubernetes.io/name: ingress-nginx
  116.     app.kubernetes.io/part-of: ingress-nginx
  117. rules:
  118.   - apiGroups:
  119.       - ""
  120.     resources:
  121.       - configmaps
  122.       - pods
  123.       - secrets
  124.       - namespaces
  125.     verbs:
  126.       - get
  127.   - apiGroups:
  128.       - ""
  129.     resources:
  130.       - configmaps
  131.     resourceNames:
  132.       # Defaults to "<election-id>-<ingress-class>"
  133.       # Here: "<ingress-controller-leader>-<nginx>"
  134.       # This has to be adapted if you change either parameter
  135.       # when launching the nginx-ingress-controller.
  136.       - "ingress-controller-leader-nginx"
  137.     verbs:
  138.       - get
  139.       - update
  140.   - apiGroups:
  141.       - ""
  142.     resources:
  143.       - configmaps
  144.     verbs:
  145.       - create
  146.   - apiGroups:
  147.       - ""
  148.     resources:
  149.       - endpoints
  150.     verbs:
  151.       - get
  153. ---
  154. apiVersion: rbac.authorization.k8s.io/v1beta1
  155. kind: RoleBinding
  156. metadata:
  157.   name: nginx-ingress-role-nisa-binding
  158.   namespace: ingress-nginx
  159.   labels:
  160.     app.kubernetes.io/name: ingress-nginx
  161.     app.kubernetes.io/part-of: ingress-nginx
  162. roleRef:
  163.   apiGroup: rbac.authorization.k8s.io
  164.   kind: Role
  165.   name: nginx-ingress-role
  166. subjects:
  167.   - kind: ServiceAccount
  168.     name: nginx-ingress-serviceaccount
  169.     namespace: ingress-nginx
  171. ---
  172. apiVersion: rbac.authorization.k8s.io/v1beta1
  173. kind: ClusterRoleBinding
  174. metadata:
  175.   name: nginx-ingress-clusterrole-nisa-binding
  176.   labels:
  177.     app.kubernetes.io/name: ingress-nginx
  178.     app.kubernetes.io/part-of: ingress-nginx
  179. roleRef:
  180.   apiGroup: rbac.authorization.k8s.io
  181.   kind: ClusterRole
  182.   name: nginx-ingress-clusterrole
  183. subjects:
  184.   - kind: ServiceAccount
  185.     name: nginx-ingress-serviceaccount
  186.     namespace: ingress-nginx
  188. ---
  190. apiVersion: apps/v1
  191. kind: Deployment
  192. metadata:
  193.   name: nginx-ingress-controller
  194.   namespace: ingress-nginx
  195.   labels:
  196.     app.kubernetes.io/name: ingress-nginx
  197.     app.kubernetes.io/part-of: ingress-nginx
  198. spec:
  199.   replicas: 1
  200.   selector:
  201.     matchLabels:
  202.       app.kubernetes.io/name: ingress-nginx
  203.       app.kubernetes.io/part-of: ingress-nginx
  204.   template:
  205.     metadata:
  206.       labels:
  207.         app.kubernetes.io/name: ingress-nginx
  208.         app.kubernetes.io/part-of: ingress-nginx
  209.       annotations:
  210.         prometheus.io/port: "10254"
  211.         prometheus.io/scrape: "true"
  212.     spec:
  213.       hostNetwork: true
  214.       # wait up to five minutes for the drain of connections
  215.       terminationGracePeriodSeconds: 300
  216.       serviceAccountName: nginx-ingress-serviceaccount
  217.       nodeSelector:
  218.         kubernetes.io/os: linux
  219.       containers:
  220.         - name: nginx-ingress-controller
  221.           image: lizhenliang/nginx-ingress-controller:0.30.0
  222.           args:
  223.             - /nginx-ingress-controller
  224.             - --configmap=$(POD_NAMESPACE)/nginx-configuration
  225.             - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
  226.             - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
  227.             - --publish-service=$(POD_NAMESPACE)/ingress-nginx
  228.             - --annotations-prefix=nginx.ingress.kubernetes.io
  229.           securityContext:
  230.             allowPrivilegeEscalation: true
  231.             capabilities:
  232.               drop:
  233.                 - ALL
  234.               add:
  235.                 - NET_BIND_SERVICE
  236.             # www-data -> 101
  237.             runAsUser: 101
  238.           env:
  239.             - name: POD_NAME
  240.               valueFrom:
  241.                 fieldRef:
  242.                   fieldPath: metadata.name
  243.             - name: POD_NAMESPACE
  244.               valueFrom:
  245.                 fieldRef:
  246.                   fieldPath: metadata.namespace
  247.           ports:
  248.             - name: http
  249.               containerPort: 80
  250.               protocol: TCP
  251.             - name: https
  252.               containerPort: 443
  253.               protocol: TCP
  254.           livenessProbe:
  255.             failureThreshold: 3
  256.             httpGet:
  257.               path: /healthz
  258.               port: 10254
  259.               scheme: HTTP
  260.             initialDelaySeconds: 10
  261.             periodSeconds: 10
  262.             successThreshold: 1
  263.             timeoutSeconds: 10
  264.           readinessProbe:
  265.             failureThreshold: 3
  266.             httpGet:
  267.               path: /healthz
  268.               port: 10254
  269.               scheme: HTTP
  270.             periodSeconds: 10
  271.             successThreshold: 1
  272.             timeoutSeconds: 10
  273.           lifecycle:
  274.             preStop:
  275.               exec:
  276.                 command:
  277.                   - /wait-shutdown
  279. ---
  281. apiVersion: v1
  282. kind: LimitRange
  283. metadata:
  284.   name: ingress-nginx
  285.   namespace: ingress-nginx
  286.   labels:
  287.     app.kubernetes.io/name: ingress-nginx
  288.     app.kubernetes.io/part-of: ingress-nginx
  289. spec:
  290.   limits:
  291.   - min:
  292.       memory: 90Mi
  293.       cpu: 100m
  294.     type: Container

kubectl apply -f ingress-controller.yaml
kubectl get pods -n ingress-nginx

创建ingress规则

要访问到对应的service，还得配置相应的规则 rules
# vi ingress-http.yaml

  1. apiVersion: networking.k8s.io/v1beta1
  2. kind: Ingress
  3. metadata:
  4.   name: example-ingress
  5. spec:
  6.   rules:
  7.   - host: example.ingredemo.com
  8.     http:
  9.       paths:
  10.       - path: /
  11.         backend:
  12.           serviceName: web
  13.           servicePort: 80

kubectl apply -f ingress-http.yaml
kubectl get pods -n ingress-nginx -o wide
netstat -antp | grep 80 # 到对应的node上查看80是否被监听

到windows hosts中添加域名映射，实现访问