ingress部署

# 手动部署

# 部署ingress-nginx 官方地址：https://github.com/kubernetes/ingress-nginx

# 参考链接：https://www.jianshu.com/p/c726ed03562a

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml

# 修改mandatory.yaml

##########################################

apiVersion: v1

kind: Namespace

metadata:

  name: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

---

kind: ConfigMap

apiVersion: v1

metadata:

  name: nginx-configuration

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

---

kind: ConfigMap

apiVersion: v1

metadata:

  name: tcp-services

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

---

kind: ConfigMap

apiVersion: v1

metadata:

  name: udp-services

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

---

apiVersion: v1

kind: ServiceAccount

metadata:

  name: nginx-ingress-serviceaccount

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

---

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: ClusterRole

metadata:

  name: nginx-ingress-clusterrole

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

rules:

  - apiGroups:

      - ""

    resources:

      - configmaps

      - endpoints

      - nodes

      - pods

      - secrets

    verbs:

      - list

      - watch

  - apiGroups:

      - ""

    resources:

      - nodes

    verbs:

      - get

  - apiGroups:

      - ""

    resources:

      - services

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - ""

    resources:

      - events

    verbs:

      - create

      - patch

  - apiGroups:

      - "extensions"

      - "networking.k8s.io"

    resources:

      - ingresses

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - "extensions"

      - "networking.k8s.io"

    resources:

      - ingresses/status

    verbs:

      - update

---

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: Role

metadata:

  name: nginx-ingress-role

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

rules:

  - apiGroups:

      - ""

    resources:

      - configmaps

      - pods

      - secrets

      - namespaces

    verbs:

      - get

  - apiGroups:

      - ""

    resources:

      - configmaps

    resourceNames:

      # Defaults to "<election-id>-<ingress-class>"

      # Here: "<ingress-controller-leader>-<nginx>"

      # This has to be adapted if you change either parameter

      # when launching the nginx-ingress-controller.

      - "ingress-controller-leader-nginx"

    verbs:

      - get

      - update

  - apiGroups:

      - ""

    resources:

      - configmaps

    verbs:

      - create

  - apiGroups:

      - ""

    resources:

      - endpoints

    verbs:

      - get

---

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: RoleBinding

metadata:

  name: nginx-ingress-role-nisa-binding

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: Role

  name: nginx-ingress-role

subjects:

  - kind: ServiceAccount

    name: nginx-ingress-serviceaccount

    namespace: ingress-nginx

---

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: ClusterRoleBinding

metadata:

  name: nginx-ingress-clusterrole-nisa-binding

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: nginx-ingress-clusterrole

subjects:

  - kind: ServiceAccount

    name: nginx-ingress-serviceaccount

    namespace: ingress-nginx

---

apiVersion: extensions/v1beta1

kind: DaemonSet

metadata:

  name: nginx-ingress-controller

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

spec:

  selector:

    matchLabels:

      app.kubernetes.io/name: ingress-nginx

      app.kubernetes.io/part-of: ingress-nginx

  template:

    metadata:

      labels:

        app.kubernetes.io/name: ingress-nginx

        app.kubernetes.io/part-of: ingress-nginx

      annotations:

        prometheus.io/port: ""

        prometheus.io/scrape: "true"

    spec:

      hostNetwork: true

      dnsPolicy: ClusterFirstWithHostNet

      nodeSelector:

        nginx-ingress: "true"

      tolerations:

        - key: "node-role.kubernetes.io/master"

          operator: "Exists"

          effect: "NoSchedule"

      serviceAccountName: nginx-ingress-serviceaccount

      containers:

        - name: nginx-ingress-controller

          image: registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:0.25.

          args:

            - /nginx-ingress-controller

            - --configmap=$(POD_NAMESPACE)/nginx-configuration

            - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services

            - --udp-services-configmap=$(POD_NAMESPACE)/udp-services

            - --publish-service=$(POD_NAMESPACE)/ingress-nginx

            - --annotations-prefix=nginx.ingress.kubernetes.io

          securityContext:

            allowPrivilegeEscalation: true

            capabilities:

              drop:

                - ALL

              add:

                - NET_BIND_SERVICE

            # www-data ->

            runAsUser:

          env:

            - name: POD_NAME

              valueFrom:

                fieldRef:

                  fieldPath: metadata.name

            - name: POD_NAMESPACE

              valueFrom:

                fieldRef:

                  fieldPath: metadata.namespace

          ports:

            - name: http

              containerPort:

            - name: https

              containerPort:

          livenessProbe:

            failureThreshold:

            httpGet:

              path: /healthz

              port:

              scheme: HTTP

            initialDelaySeconds:

            periodSeconds:

            successThreshold:

            timeoutSeconds:

          readinessProbe:

            failureThreshold:

            httpGet:

              path: /healthz

              port:

              scheme: HTTP

            periodSeconds:

            successThreshold:

            timeoutSeconds: 

---

##########################################

修改参数:

、image修改为阿里云镜像registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:0.25.

、kind修改为DaemonSet,apiVersion修改为extensions/v1beta1

、replicas:  #删除此行，DaemonSet不需要此参数

、hostNetwork: true #添加该字段让docker使用物理机网络，在物理机暴露服务端口()，注意物理机80端口提前不能被占用

、dnsPolicy: ClusterFirstWithHostNet #使用hostNetwork后容器会使用物理机网络包括DNS，会无法解析内部service，使用此参数让容器使用K8S的DNS

、nginx-ingress: "true" #添加节点标签

、tolerations: 添加对指定节点污点容忍度

# 创建ingress-ingress的service

[root@test-k8s-master01 ~]# cat svc-ingress-nginx.yaml

##########################################

kind: Service

apiVersion: v1

metadata:

  name: ingress-nginx

  namespace: ingress-nginx

  labels:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

spec:

  selector:

    app.kubernetes.io/name: ingress-nginx

    app.kubernetes.io/part-of: ingress-nginx

  ports:

    - name: http

      port:

      targetPort: http

    - name: https

      port:

      targetPort: https

##########################################

kubectl apply -f svc-ingress-nginx.yaml

# 节点打上标签、污点

# 查看标签

kubectl get node --show-labels

# 打标签

kubectl label nodes test-k8s-master01 nginx-ingress=true

# 删除标签

kubectl label nodes test-k8s-master01 nginx-ingress-

# 查看污点

kubectl describe node test-k8s-master01

# 打污点

kubectl taint nodes test-k8s-master01 nginx-ingress=true:NoSchedule

# 删除污点

kubectl taint nodes test-k8s-master01 nginx-ingress:NoSchedule-

# 创建资源

kubectl apply -f mandatory.yaml

kubectl get pod -n ingress-nginx -o wide

# helm方式部署

helm fetch stable/nginx-ingress

tar xf nginx-ingress-1.17..tgz

nginx-ingress 目录下面的values.yaml文件为默认参数值

# 自定义参数

[root@test-k8s-master01 nginx-ingress]# cat custom.yaml

######################################

controller:

  replicaCount:

  image:

    repository: quay.io/kubernetes-ingress-controller/nginx-ingress-controller

  hostNetwork: true

  daemonset:

    useHostPort: false

    hostPorts:

      http:

      https:

  service:

    type: ClusterIP

  tolerations:

    - operator: "Exists"

  nodeSelector:

    nginx-ingress: "true"

defaultBackend:

  replicaCount:

  image:

    repository: gcr.azk8s.cn/google-containers/defaultbackend-amd64

  tolerations:

    - operator: "Exists"

  nodeSelector:

    nginx-ingress: "true"

######################################

helm install stable/nginx-ingress --namespace nginx-ingress --name nginx-ingress -f custom.yaml

#其它参考：https://www.cnblogs.com/wenlin-gk/p/9627403.htmlhttps://www.cnblogs.com/crazymagic/p/11267303.htmlhttps://blog.csdn.net/bbwangj/article/details/82940419