Ingress

<入口>

安装

下载镜像
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.47.0/deploy/static/provider/baremetal/deploy.yaml
修改镜像，将image的值改为如下值：
registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0
检查安装结果
kubectl get pod,svc -n ingress-nginx
image.png :::info 云服务器要注意端口放行 ::: 如果下载不了文件，可以直接复制下面的yml文件

  1. apiVersion: v1
  2. kind: Namespace
  3. metadata:
  4.   name: ingress-nginx
  5.   labels:
  6.     app.kubernetes.io/name: ingress-nginx
  7.     app.kubernetes.io/instance: ingress-nginx
  9. ---
  10. # Source: ingress-nginx/templates/controller-serviceaccount.yaml
  11. apiVersion: v1
  12. kind: ServiceAccount
  13. metadata:
  14.   labels:
  15.     helm.sh/chart: ingress-nginx-3.33.0
  16.     app.kubernetes.io/name: ingress-nginx
  17.     app.kubernetes.io/instance: ingress-nginx
  18.     app.kubernetes.io/version: 0.47.0
  19.     app.kubernetes.io/managed-by: Helm
  20.     app.kubernetes.io/component: controller
  21.   name: ingress-nginx
  22.   namespace: ingress-nginx
  23. automountServiceAccountToken: true
  24. ---
  25. # Source: ingress-nginx/templates/controller-configmap.yaml
  26. apiVersion: v1
  27. kind: ConfigMap
  28. metadata:
  29.   labels:
  30.     helm.sh/chart: ingress-nginx-3.33.0
  31.     app.kubernetes.io/name: ingress-nginx
  32.     app.kubernetes.io/instance: ingress-nginx
  33.     app.kubernetes.io/version: 0.47.0
  34.     app.kubernetes.io/managed-by: Helm
  35.     app.kubernetes.io/component: controller
  36.   name: ingress-nginx-controller
  37.   namespace: ingress-nginx
  38. data:
  39. ---
  40. # Source: ingress-nginx/templates/clusterrole.yaml
  41. apiVersion: rbac.authorization.k8s.io/v1
  42. kind: ClusterRole
  43. metadata:
  44.   labels:
  45.     helm.sh/chart: ingress-nginx-3.33.0
  46.     app.kubernetes.io/name: ingress-nginx
  47.     app.kubernetes.io/instance: ingress-nginx
  48.     app.kubernetes.io/version: 0.47.0
  49.     app.kubernetes.io/managed-by: Helm
  50.   name: ingress-nginx
  51. rules:
  52.   - apiGroups:
  53.       - ''
  54.     resources:
  55.       - configmaps
  56.       - endpoints
  57.       - nodes
  58.       - pods
  59.       - secrets
  60.     verbs:
  61.       - list
  62.       - watch
  63.   - apiGroups:
  64.       - ''
  65.     resources:
  66.       - nodes
  67.     verbs:
  68.       - get
  69.   - apiGroups:
  70.       - ''
  71.     resources:
  72.       - services
  73.     verbs:
  74.       - get
  75.       - list
  76.       - watch
  77.   - apiGroups:
  78.       - extensions
  79.       - networking.k8s.io   # k8s 1.14+
  80.     resources:
  81.       - ingresses
  82.     verbs:
  83.       - get
  84.       - list
  85.       - watch
  86.   - apiGroups:
  87.       - ''
  88.     resources:
  89.       - events
  90.     verbs:
  91.       - create
  92.       - patch
  93.   - apiGroups:
  94.       - extensions
  95.       - networking.k8s.io   # k8s 1.14+
  96.     resources:
  97.       - ingresses/status
  98.     verbs:
  99.       - update
  100.   - apiGroups:
  101.       - networking.k8s.io   # k8s 1.14+
  102.     resources:
  103.       - ingressclasses
  104.     verbs:
  105.       - get
  106.       - list
  107.       - watch
  108. ---
  109. # Source: ingress-nginx/templates/clusterrolebinding.yaml
  110. apiVersion: rbac.authorization.k8s.io/v1
  111. kind: ClusterRoleBinding
  112. metadata:
  113.   labels:
  114.     helm.sh/chart: ingress-nginx-3.33.0
  115.     app.kubernetes.io/name: ingress-nginx
  116.     app.kubernetes.io/instance: ingress-nginx
  117.     app.kubernetes.io/version: 0.47.0
  118.     app.kubernetes.io/managed-by: Helm
  119.   name: ingress-nginx
  120. roleRef:
  121.   apiGroup: rbac.authorization.k8s.io
  122.   kind: ClusterRole
  123.   name: ingress-nginx
  124. subjects:
  125.   - kind: ServiceAccount
  126.     name: ingress-nginx
  127.     namespace: ingress-nginx
  128. ---
  129. # Source: ingress-nginx/templates/controller-role.yaml
  130. apiVersion: rbac.authorization.k8s.io/v1
  131. kind: Role
  132. metadata:
  133.   labels:
  134.     helm.sh/chart: ingress-nginx-3.33.0
  135.     app.kubernetes.io/name: ingress-nginx
  136.     app.kubernetes.io/instance: ingress-nginx
  137.     app.kubernetes.io/version: 0.47.0
  138.     app.kubernetes.io/managed-by: Helm
  139.     app.kubernetes.io/component: controller
  140.   name: ingress-nginx
  141.   namespace: ingress-nginx
  142. rules:
  143.   - apiGroups:
  144.       - ''
  145.     resources:
  146.       - namespaces
  147.     verbs:
  148.       - get
  149.   - apiGroups:
  150.       - ''
  151.     resources:
  152.       - configmaps
  153.       - pods
  154.       - secrets
  155.       - endpoints
  156.     verbs:
  157.       - get
  158.       - list
  159.       - watch
  160.   - apiGroups:
  161.       - ''
  162.     resources:
  163.       - services
  164.     verbs:
  165.       - get
  166.       - list
  167.       - watch
  168.   - apiGroups:
  169.       - extensions
  170.       - networking.k8s.io   # k8s 1.14+
  171.     resources:
  172.       - ingresses
  173.     verbs:
  174.       - get
  175.       - list
  176.       - watch
  177.   - apiGroups:
  178.       - extensions
  179.       - networking.k8s.io   # k8s 1.14+
  180.     resources:
  181.       - ingresses/status
  182.     verbs:
  183.       - update
  184.   - apiGroups:
  185.       - networking.k8s.io   # k8s 1.14+
  186.     resources:
  187.       - ingressclasses
  188.     verbs:
  189.       - get
  190.       - list
  191.       - watch
  192.   - apiGroups:
  193.       - ''
  194.     resources:
  195.       - configmaps
  196.     resourceNames:
  197.       - ingress-controller-leader-nginx
  198.     verbs:
  199.       - get
  200.       - update
  201.   - apiGroups:
  202.       - ''
  203.     resources:
  204.       - configmaps
  205.     verbs:
  206.       - create
  207.   - apiGroups:
  208.       - ''
  209.     resources:
  210.       - events
  211.     verbs:
  212.       - create
  213.       - patch
  214. ---
  215. # Source: ingress-nginx/templates/controller-rolebinding.yaml
  216. apiVersion: rbac.authorization.k8s.io/v1
  217. kind: RoleBinding
  218. metadata:
  219.   labels:
  220.     helm.sh/chart: ingress-nginx-3.33.0
  221.     app.kubernetes.io/name: ingress-nginx
  222.     app.kubernetes.io/instance: ingress-nginx
  223.     app.kubernetes.io/version: 0.47.0
  224.     app.kubernetes.io/managed-by: Helm
  225.     app.kubernetes.io/component: controller
  226.   name: ingress-nginx
  227.   namespace: ingress-nginx
  228. roleRef:
  229.   apiGroup: rbac.authorization.k8s.io
  230.   kind: Role
  231.   name: ingress-nginx
  232. subjects:
  233.   - kind: ServiceAccount
  234.     name: ingress-nginx
  235.     namespace: ingress-nginx
  236. ---
  237. # Source: ingress-nginx/templates/controller-service-webhook.yaml
  238. apiVersion: v1
  239. kind: Service
  240. metadata:
  241.   labels:
  242.     helm.sh/chart: ingress-nginx-3.33.0
  243.     app.kubernetes.io/name: ingress-nginx
  244.     app.kubernetes.io/instance: ingress-nginx
  245.     app.kubernetes.io/version: 0.47.0
  246.     app.kubernetes.io/managed-by: Helm
  247.     app.kubernetes.io/component: controller
  248.   name: ingress-nginx-controller-admission
  249.   namespace: ingress-nginx
  250. spec:
  251.   type: ClusterIP
  252.   ports:
  253.     - name: https-webhook
  254.       port: 443
  255.       targetPort: webhook
  256.   selector:
  257.     app.kubernetes.io/name: ingress-nginx
  258.     app.kubernetes.io/instance: ingress-nginx
  259.     app.kubernetes.io/component: controller
  260. ---
  261. # Source: ingress-nginx/templates/controller-service.yaml
  262. apiVersion: v1
  263. kind: Service
  264. metadata:
  265.   annotations:
  266.   labels:
  267.     helm.sh/chart: ingress-nginx-3.33.0
  268.     app.kubernetes.io/name: ingress-nginx
  269.     app.kubernetes.io/instance: ingress-nginx
  270.     app.kubernetes.io/version: 0.47.0
  271.     app.kubernetes.io/managed-by: Helm
  272.     app.kubernetes.io/component: controller
  273.   name: ingress-nginx-controller
  274.   namespace: ingress-nginx
  275. spec:
  276.   type: NodePort
  277.   ports:
  278.     - name: http
  279.       port: 80
  280.       protocol: TCP
  281.       targetPort: http
  282.     - name: https
  283.       port: 443
  284.       protocol: TCP
  285.       targetPort: https
  286.   selector:
  287.     app.kubernetes.io/name: ingress-nginx
  288.     app.kubernetes.io/instance: ingress-nginx
  289.     app.kubernetes.io/component: controller
  290. ---
  291. # Source: ingress-nginx/templates/controller-deployment.yaml
  292. apiVersion: apps/v1
  293. kind: Deployment
  294. metadata:
  295.   labels:
  296.     helm.sh/chart: ingress-nginx-3.33.0
  297.     app.kubernetes.io/name: ingress-nginx
  298.     app.kubernetes.io/instance: ingress-nginx
  299.     app.kubernetes.io/version: 0.47.0
  300.     app.kubernetes.io/managed-by: Helm
  301.     app.kubernetes.io/component: controller
  302.   name: ingress-nginx-controller
  303.   namespace: ingress-nginx
  304. spec:
  305.   selector:
  306.     matchLabels:
  307.       app.kubernetes.io/name: ingress-nginx
  308.       app.kubernetes.io/instance: ingress-nginx
  309.       app.kubernetes.io/component: controller
  310.   revisionHistoryLimit: 10
  311.   minReadySeconds: 0
  312.   template:
  313.     metadata:
  314.       labels:
  315.         app.kubernetes.io/name: ingress-nginx
  316.         app.kubernetes.io/instance: ingress-nginx
  317.         app.kubernetes.io/component: controller
  318.     spec:
  319.       dnsPolicy: ClusterFirst
  320.       containers:
  321.         - name: controller
  322.           image: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/ingress-nginx-controller:v0.46.0
  323.           imagePullPolicy: IfNotPresent
  324.           lifecycle:
  325.             preStop:
  326.               exec:
  327.                 command:
  328.                   - /wait-shutdown
  329.           args:
  330.             - /nginx-ingress-controller
  331.             - --election-id=ingress-controller-leader
  332.             - --ingress-class=nginx
  333.             - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
  334.             - --validating-webhook=:8443
  335.             - --validating-webhook-certificate=/usr/local/certificates/cert
  336.             - --validating-webhook-key=/usr/local/certificates/key
  337.           securityContext:
  338.             capabilities:
  339.               drop:
  340.                 - ALL
  341.               add:
  342.                 - NET_BIND_SERVICE
  343.             runAsUser: 101
  344.             allowPrivilegeEscalation: true
  345.           env:
  346.             - name: POD_NAME
  347.               valueFrom:
  348.                 fieldRef:
  349.                   fieldPath: metadata.name
  350.             - name: POD_NAMESPACE
  351.               valueFrom:
  352.                 fieldRef:
  353.                   fieldPath: metadata.namespace
  354.             - name: LD_PRELOAD
  355.               value: /usr/local/lib/libmimalloc.so
  356.           livenessProbe:
  357.             failureThreshold: 5
  358.             httpGet:
  359.               path: /healthz
  360.               port: 10254
  361.               scheme: HTTP
  362.             initialDelaySeconds: 10
  363.             periodSeconds: 10
  364.             successThreshold: 1
  365.             timeoutSeconds: 1
  366.           readinessProbe:
  367.             failureThreshold: 3
  368.             httpGet:
  369.               path: /healthz
  370.               port: 10254
  371.               scheme: HTTP
  372.             initialDelaySeconds: 10
  373.             periodSeconds: 10
  374.             successThreshold: 1
  375.             timeoutSeconds: 1
  376.           ports:
  377.             - name: http
  378.               containerPort: 80
  379.               protocol: TCP
  380.             - name: https
  381.               containerPort: 443
  382.               protocol: TCP
  383.             - name: webhook
  384.               containerPort: 8443
  385.               protocol: TCP
  386.           volumeMounts:
  387.             - name: webhook-cert
  388.               mountPath: /usr/local/certificates/
  389.               readOnly: true
  390.           resources:
  391.             requests:
  392.               cpu: 100m
  393.               memory: 90Mi
  394.       nodeSelector:
  395.         kubernetes.io/os: linux
  396.       serviceAccountName: ingress-nginx
  397.       terminationGracePeriodSeconds: 300
  398.       volumes:
  399.         - name: webhook-cert
  400.           secret:
  401.             secretName: ingress-nginx-admission
  402. ---
  403. # Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
  404. # before changing this value, check the required kubernetes version
  405. # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
  406. apiVersion: admissionregistration.k8s.io/v1
  407. kind: ValidatingWebhookConfiguration
  408. metadata:
  409.   labels:
  410.     helm.sh/chart: ingress-nginx-3.33.0
  411.     app.kubernetes.io/name: ingress-nginx
  412.     app.kubernetes.io/instance: ingress-nginx
  413.     app.kubernetes.io/version: 0.47.0
  414.     app.kubernetes.io/managed-by: Helm
  415.     app.kubernetes.io/component: admission-webhook
  416.   name: ingress-nginx-admission
  417. webhooks:
  418.   - name: validate.nginx.ingress.kubernetes.io
  419.     matchPolicy: Equivalent
  420.     rules:
  421.       - apiGroups:
  422.           - networking.k8s.io
  423.         apiVersions:
  424.           - v1beta1
  425.         operations:
  426.           - CREATE
  427.           - UPDATE
  428.         resources:
  429.           - ingresses
  430.     failurePolicy: Fail
  431.     sideEffects: None
  432.     admissionReviewVersions:
  433.       - v1
  434.       - v1beta1
  435.     clientConfig:
  436.       service:
  437.         namespace: ingress-nginx
  438.         name: ingress-nginx-controller-admission
  439.         path: /networking/v1beta1/ingresses
  440. ---
  441. # Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
  442. apiVersion: v1
  443. kind: ServiceAccount
  444. metadata:
  445.   name: ingress-nginx-admission
  446.   annotations:
  447.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  448.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  449.   labels:
  450.     helm.sh/chart: ingress-nginx-3.33.0
  451.     app.kubernetes.io/name: ingress-nginx
  452.     app.kubernetes.io/instance: ingress-nginx
  453.     app.kubernetes.io/version: 0.47.0
  454.     app.kubernetes.io/managed-by: Helm
  455.     app.kubernetes.io/component: admission-webhook
  456.   namespace: ingress-nginx
  457. ---
  458. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
  459. apiVersion: rbac.authorization.k8s.io/v1
  460. kind: ClusterRole
  461. metadata:
  462.   name: ingress-nginx-admission
  463.   annotations:
  464.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  465.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  466.   labels:
  467.     helm.sh/chart: ingress-nginx-3.33.0
  468.     app.kubernetes.io/name: ingress-nginx
  469.     app.kubernetes.io/instance: ingress-nginx
  470.     app.kubernetes.io/version: 0.47.0
  471.     app.kubernetes.io/managed-by: Helm
  472.     app.kubernetes.io/component: admission-webhook
  473. rules:
  474.   - apiGroups:
  475.       - admissionregistration.k8s.io
  476.     resources:
  477.       - validatingwebhookconfigurations
  478.     verbs:
  479.       - get
  480.       - update
  481. ---
  482. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
  483. apiVersion: rbac.authorization.k8s.io/v1
  484. kind: ClusterRoleBinding
  485. metadata:
  486.   name: ingress-nginx-admission
  487.   annotations:
  488.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  489.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  490.   labels:
  491.     helm.sh/chart: ingress-nginx-3.33.0
  492.     app.kubernetes.io/name: ingress-nginx
  493.     app.kubernetes.io/instance: ingress-nginx
  494.     app.kubernetes.io/version: 0.47.0
  495.     app.kubernetes.io/managed-by: Helm
  496.     app.kubernetes.io/component: admission-webhook
  497. roleRef:
  498.   apiGroup: rbac.authorization.k8s.io
  499.   kind: ClusterRole
  500.   name: ingress-nginx-admission
  501. subjects:
  502.   - kind: ServiceAccount
  503.     name: ingress-nginx-admission
  504.     namespace: ingress-nginx
  505. ---
  506. # Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
  507. apiVersion: rbac.authorization.k8s.io/v1
  508. kind: Role
  509. metadata:
  510.   name: ingress-nginx-admission
  511.   annotations:
  512.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  513.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  514.   labels:
  515.     helm.sh/chart: ingress-nginx-3.33.0
  516.     app.kubernetes.io/name: ingress-nginx
  517.     app.kubernetes.io/instance: ingress-nginx
  518.     app.kubernetes.io/version: 0.47.0
  519.     app.kubernetes.io/managed-by: Helm
  520.     app.kubernetes.io/component: admission-webhook
  521.   namespace: ingress-nginx
  522. rules:
  523.   - apiGroups:
  524.       - ''
  525.     resources:
  526.       - secrets
  527.     verbs:
  528.       - get
  529.       - create
  530. ---
  531. # Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
  532. apiVersion: rbac.authorization.k8s.io/v1
  533. kind: RoleBinding
  534. metadata:
  535.   name: ingress-nginx-admission
  536.   annotations:
  537.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
  538.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  539.   labels:
  540.     helm.sh/chart: ingress-nginx-3.33.0
  541.     app.kubernetes.io/name: ingress-nginx
  542.     app.kubernetes.io/instance: ingress-nginx
  543.     app.kubernetes.io/version: 0.47.0
  544.     app.kubernetes.io/managed-by: Helm
  545.     app.kubernetes.io/component: admission-webhook
  546.   namespace: ingress-nginx
  547. roleRef:
  548.   apiGroup: rbac.authorization.k8s.io
  549.   kind: Role
  550.   name: ingress-nginx-admission
  551. subjects:
  552.   - kind: ServiceAccount
  553.     name: ingress-nginx-admission
  554.     namespace: ingress-nginx
  555. ---
  556. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
  557. apiVersion: batch/v1
  558. kind: Job
  559. metadata:
  560.   name: ingress-nginx-admission-create
  561.   annotations:
  562.     helm.sh/hook: pre-install,pre-upgrade
  563.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  564.   labels:
  565.     helm.sh/chart: ingress-nginx-3.33.0
  566.     app.kubernetes.io/name: ingress-nginx
  567.     app.kubernetes.io/instance: ingress-nginx
  568.     app.kubernetes.io/version: 0.47.0
  569.     app.kubernetes.io/managed-by: Helm
  570.     app.kubernetes.io/component: admission-webhook
  571.   namespace: ingress-nginx
  572. spec:
  573.   template:
  574.     metadata:
  575.       name: ingress-nginx-admission-create
  576.       labels:
  577.         helm.sh/chart: ingress-nginx-3.33.0
  578.         app.kubernetes.io/name: ingress-nginx
  579.         app.kubernetes.io/instance: ingress-nginx
  580.         app.kubernetes.io/version: 0.47.0
  581.         app.kubernetes.io/managed-by: Helm
  582.         app.kubernetes.io/component: admission-webhook
  583.     spec:
  584.       containers:
  585.         - name: create
  586.           image: docker.io/jettech/kube-webhook-certgen:v1.5.1
  587.           imagePullPolicy: IfNotPresent
  588.           args:
  589.             - create
  590.             - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
  591.             - --namespace=$(POD_NAMESPACE)
  592.             - --secret-name=ingress-nginx-admission
  593.           env:
  594.             - name: POD_NAMESPACE
  595.               valueFrom:
  596.                 fieldRef:
  597.                   fieldPath: metadata.namespace
  598.       restartPolicy: OnFailure
  599.       serviceAccountName: ingress-nginx-admission
  600.       securityContext:
  601.         runAsNonRoot: true
  602.         runAsUser: 2000
  603. ---
  604. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
  605. apiVersion: batch/v1
  606. kind: Job
  607. metadata:
  608.   name: ingress-nginx-admission-patch
  609.   annotations:
  610.     helm.sh/hook: post-install,post-upgrade
  611.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  612.   labels:
  613.     helm.sh/chart: ingress-nginx-3.33.0
  614.     app.kubernetes.io/name: ingress-nginx
  615.     app.kubernetes.io/instance: ingress-nginx
  616.     app.kubernetes.io/version: 0.47.0
  617.     app.kubernetes.io/managed-by: Helm
  618.     app.kubernetes.io/component: admission-webhook
  619.   namespace: ingress-nginx
  620. spec:
  621.   template:
  622.     metadata:
  623.       name: ingress-nginx-admission-patch
  624.       labels:
  625.         helm.sh/chart: ingress-nginx-3.33.0
  626.         app.kubernetes.io/name: ingress-nginx
  627.         app.kubernetes.io/instance: ingress-nginx
  628.         app.kubernetes.io/version: 0.47.0
  629.         app.kubernetes.io/managed-by: Helm
  630.         app.kubernetes.io/component: admission-webhook
  631.     spec:
  632.       containers:
  633.         - name: patch
  634.           image: docker.io/jettech/kube-webhook-certgen:v1.5.1
  635.           imagePullPolicy: IfNotPresent
  636.           args:
  637.             - patch
  638.             - --webhook-name=ingress-nginx-admission
  639.             - --namespace=$(POD_NAMESPACE)
  640.             - --patch-mutating=false
  641.             - --secret-name=ingress-nginx-admission
  642.             - --patch-failure-policy=Fail
  643.           env:
  644.             - name: POD_NAMESPACE
  645.               valueFrom:
  646.                 fieldRef:
  647.                   fieldPath: metadata.namespace
  648.       restartPolicy: OnFailure
  649.       serviceAccountName: ingress-nginx-admission
  650.       securityContext:
  651.         runAsNonRoot: true
  652.         runAsUser: 2000

使用

测试环境

# 起2个hello-server pod，
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-server
spec:
  replicas: 2
  selector:
    matchLabels:
      app: hello-server
  template:
    metadata:
      labels:
        app: hello-server
    spec:
      containers:
      - name: hello-server
        image: registry.cn-hangzhou.aliyuncs.com/lfy_k8s_images/hello-server
        ports:
        - containerPort: 9000
---
# 起2个 nginx pod名称nginx-demo
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-demo
  name: nginx-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-demo
  template:
    metadata:
      labels:
        app: nginx-demo
    spec:
      containers:
      - image: nginx
        name: nginx
---
# 把service的8000映射到nginx的80
apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-demo
  name: nginx-demo
spec:
  selector:
    app: nginx-demo
  ports:
  - port: 8000
    protocol: TCP
    targetPort: 80
---
# 同样把service的8000映射到hello-server的9000
apiVersion: v1
kind: Service
metadata:
  labels:
    app: hello-server
  name: hello-server
spec:
  selector:
    app: hello-server
  ports:
  - port: 8000
    protocol: TCP
    targetPort: 9000

域名访问

apiVersion: networking.k8s.io/v1
kind: Ingress  
metadata:
  name: ingress-host-bar
spec:
  ingressClassName: nginx
  rules:
  - host: "hello.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: hello-server
            port:
              number: 8000
  - host: "demo.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/nginx"  # 把请求会转给下面的服务，下面的服务一定要能处理这个路径，不能处理就是404
        backend:
          service:
            name: nginx-demo 
            port:
              number: 8000

路径重写

apiVersion: networking.k8s.io/v1
kind: Ingress  
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2 # 1
  name: ingress-host-bar
spec:
  ingressClassName: nginx
  rules:
  - host: "hello.atguigu.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: hello-server
            port:
              number: 8000
  - host: "demo.atguigu.com"
    http:
      paths:
      - pathType: Prefix #前缀模式 #2
        path: "/nginx(/|$)(.*)"  #3 把请求会转给下面的服务，下面的服务一定要能处理这个路径，不能处理就是404
        backend:
          service:
            name: nginx-demo  
            port:
              number: 8000

流量限制

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-limit-rate #1
  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "1" #2
spec:
  ingressClassName: nginx
  rules:
  - host: "haha.atguigu.com"
    http:
      paths:
      - pathType: Exact # 3精确模式
        path: "/"
        backend:
          service:
            name: nginx-demo
            port:
              number: 8000

kubectl get ing 查看ingress

k8s网络模型

image.png

存储抽象

环境准备

所有节点安装nfs-utils
yum install -y nfs-utils

主节点

echo “/nfs/data *(insecure,rw,sync,no_root_squash)” > /etc/exports
mkdir -p /nfs/data
systemctl enable rpcbind —now
systemctl enable nfs-server —now
生效配置：exportfs -r

从节点

查看主节点可用的挂载点
showmount -e 主节点ip(内网ip，不是公网)
挂载nfs服务器上的共享目录到本机
mkdir -p /nfs/data
mount -t nfs 主节点:/nfs/data /nfs/data
写入一个文件测试
echo “hello nfs server” > /nfs/data/test.txt

原生方式数据挂载

目录要提前创建，否则报错
mkdir -p /nfs/data/nginx-pv

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-pv-demo
  name: nginx-pv-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-pv-demo
  template:
    metadata:
      labels:
        app: nginx-pv-demo
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
        - name: html
          nfs:
            server: 172.31.0.131
            path: /nfs/data/nginx-pv

pv&pvc

PV：持久卷（persistent volume），将应用需要持久化的数据保存到指定位置
PVC：持久卷申明（persistent volume claim），申明需要使用的持久卷规格

创建pv池

静态供应
mkdir -p /nfs/data/01
mkdir -p /nfs/data/02
mkdir -p /nfs/data/03
创建pv

apiVersion: v1
kind: PersistentVolume 
metadata:
  name: pv01-10m # 名字可以随便知意就行，必须是小写不能是大写字母
spec:
  capacity:
    storage: 10M #告诉k8s需要用的空间
  accessModes:
    - ReadWriteMany #读写
  storageClassName: nfs
  nfs:
    path: /nfs/data/01
    server: 172.31.0.131
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv02-1gi
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/02
    server: 172.31.0.131
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv03-3gi
spec:
  capacity:
    storage: 3Gi
  accessModes:
    - ReadWriteMany
  storageClassName: nfs
  nfs:
    path: /nfs/data/03
    server: 172.31.0.131

创建pvc与绑定

创建pvc

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: nginx-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 200Mi
  storageClassName: nfs #与pv池的ClassName对应

创建Pod绑定PVC

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-deploy-pvc
  name: nginx-deploy-pvc
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-deploy-pvc
  template:
    metadata:
      labels:
        app: nginx-deploy-pvc
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
        - name: html
          persistentVolumeClaim:
            claimName: nginx-pvc

ConfigMap

抽取应用配置，并且可以自动更新
挂载目录用pv&pvc，挂载配置文件用configmap

redis示例

准备一个redis配置文件
echo “appendonly yes” >redis.conf
把之前的配置文件创建为配置集(cm)
kubectl create cm redis-conf —from-file=redis.conf

apiVersion: v1
data:    #data是所有真正的数据，key：默认是文件名   value：配置文件的内容
  redis.conf: | #短竖线 代表下面是个文本
    appendonly yes
kind: ConfigMap
metadata:
  name: redis-conf
  namespace: default

创建Pod

apiVersion: v1
kind: Pod
metadata:
  name: redis
spec:
  containers:
  - name: redis
    image: redis
    command:
      - redis-server
      - "/redis-master/redis.conf"  #指的是redis容器内部的位置
    ports:
    - containerPort: 6379
    volumeMounts:
    - mountPath: /data
      name: data
    - mountPath: /redis-master
      name: config
  volumes:
    - name: data
      emptyDir: {}
    - name: config
      configMap:
        name: redis-conf
        items:
        - key: redis.conf
          path: redis.conf

检查默认配置

kubectl exec -it redis -- redis-cli

127.0.0.1:6379> CONFIG GET appendonly
127.0.0.1:6379> CONFIG GET requirepass

修改ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: example-redis-config
data:
  redis-config: |
    maxmemory 2mb
    maxmemory-policy allkeys-lru

通过kubectl edit cm redis-conf 命令修改配置集的内容，redis的配置文件也会自动修改。
检查配置是否更新

kubectl exec -it redis -- redis-cli

127.0.0.1:6379> CONFIG GET maxmemory
127.0.0.1:6379> CONFIG GET maxmemory-policy

坚持指定文件是否更新，修改了CM，Pod里面的配置文件会跟着改变

配置值未更改，因为需要重新启动 Pod 才能从关联的 ConfigMap 中获取更新的值。 原因：我们的Pod部署的中间件自己本身没有热更新能力

Secret

Secret 对象类型用来保存敏感信息，例如密码、OAuth 令牌和 SSH 密钥。 将这些信息放在 secret 中比放在 Pod 的定义或者 容器镜像 中来说更加安全和灵活。

kubectl create secret docker-registry leifengyang-docker \
--docker-username=leifengyang \
--docker-password=Lfy123456 \
--docker-email=534096094@qq.com

##命令格式
kubectl create secret docker-registry regcred \
  --docker-server=<你的镜像仓库服务器> \
  --docker-username=<你的用户名> \
  --docker-password=<你的密码> \
  --docker-email=<你的邮箱地址>

apiVersion: v1
kind: Pod
metadata:
  name: private-nginx
spec:
  containers:
  - name: private-nginx
    image: leifengyang/guignginx:v1.0
  imagePullSecrets:
  - name: leifengyang-docker