Kubernetes - 配置Nginx-Ingress 作为服务发现

• 添加 Kubernetes ConfigMap配置来自定义端口与服务的映射关系
  • 配置文件， 有二个在默认空间下web服务和api服务分别映射到自定义端口 9001， 9002

     apiVersion: v1
     kind: ConfigMap
     metadata:
       name: mysite-configmap
     data:
       9000: "default/web:8080"
       9001: "default/api:8080"

  • 在kubernetes Master服务器应用 ConfigMap 配置

    kubectl apply -f mysite-configmap.yml

• 配置 Default Backend

  • kind: Deployment
    apiVersion: extensions/v1beta1
    metadata:
      name: default-http-backend
    spec:
      revisionHistoryLimit: 10
      replicas: 1
      template:
        metadata:
          labels:
            app: default-http-backend
        spec:
          terminationGracePeriodSeconds: 60
          containers:
          - name: default-http-backend
            # Any image is permissable as long as:
            # 1. It serves a 404 page at /
            # 2. It serves 200 on a /healthz endpoint
            image: defaultbackend:1.0
            livenessProbe:
              httpGet:
                path: /healthz
                port: 8080
                scheme: HTTP
              initialDelaySeconds: 30
              timeoutSeconds: 5
            ports:
            - containerPort: 8080
            resources:
              limits:
                cpu: 10m
                memory: 20Mi
              requests:
                cpu: 10m
                memory: 20Mi

    kubectl apply -f default-backend-deployment.yml

    ---
    
    apiVersion: v1
    kind: Service
    metadata:
      name: default-http-backend
      labels:
        app: default-http-backend
    spec:
      ports:
      - port: 8080
        protocol: TCP
        targetPort: 8080
      selector:
        app: default-http-backend

    kubectl apply -f default-backend-service.yml

• 配置Ingress
  • 配置 Ingress Deployment, 暴露自定义的端口, 并指定 tcp-services-configmap 来导入我们在上一步配置的端口映射
    • 配置文件,

       apiVersion: extensions/v1beta1
       kind: Deployment
       metadata:
         name: nginx-ingress-deployment
         labels:
           k8s-app: nginx-ingress-lb
       spec:
         revisionHistoryLimit: 10
         replicas: 1
         template:
           metadata:
             labels:
               k8s-app: nginx-ingress-lb
               name: nginx-ingress-lb
           spec:
             terminationGracePeriodSeconds: 60
             containers:
             - image: nginx-ingress-controller:0.8.3
               name: nginx-ingress-lb
               imagePullPolicy: Always
               readinessProbe:
                 httpGet:
                   path: /healthz
                   port: 10254
                   scheme: HTTP
               livenessProbe:
                 httpGet:
                   path: /healthz
                   port: 10254
                   scheme: HTTP
                 initialDelaySeconds: 10
                 timeoutSeconds: 1
               # use downward API
               env:
                 - name: POD_NAME
                   valueFrom:
                     fieldRef:
                       fieldPath: metadata.name
                 - name: POD_NAMESPACE
                   valueFrom:
                     fieldRef:
                       fieldPath: metadata.namespace
               ports:
               - containerPort: 9000
                 protocol: TCP
               - containerPort: 9001
                 protocol: TCP
      
               args:
               - /nginx-ingress-controller
                 - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
               - --tcp-services-configmap=$(POD_NAMESPACE)/mysite-configmap

    • 应用配置

      kubectl apply -f nginx-ingress-deployment.yml

  • 配置 Ingress Service, 配置自定义端口与ConfigMap的端口映射关系及服务名称 
    • 配置文件

       ---
      
       apiVersion: v1
       kind: Service
       metadata:
         name: nginx-ingress-lb
         labels:
           k8s-app: nginx-ingress-lb
       spec:
         type: NodePort
         ports:
         - port: 9000
           protocol: TCP
           targetPort: 9000
           nodePort: 30005
           name: web
         - port: 9001
           protocol: TCP
           targetPort: 9001
           nodePort: 30006
           name: api
      
         selector:
           k8s-app: nginx-ingress-lb

    • 应用配置

      kubectl apply -f nginx-ingress-service.yml

• 配置Nginx 反向代理
  • 添加 Upstream 配置

     upstream web {
       server my-server-1:3005 max_fails=1 fail_timeout=10s;
       server my-server-2:3005 max_fails=1 fail_timeout=10s;
     }
    
     upstream api {
       server my-server-1:3006 max_fails=1 fail_timeout=10s;
       server my-server-2:3006 max_fails=1 fail_timeout=10s;
     }
    
     server {
       listen 80;
       listen       443 ssl;
    
       ssl_certificate    /etc/nginx/conf.d/cert/wildcard.mysite.pem;
       ssl_certificate_key    /etc/nginx/conf.d/cert/wildcard.mysite.key;
       location / {
            proxy_pass http://web;
         proxy_set_header X-Forwarded-Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       }
    
       location ~^/(api) {
         proxy_pass http://api;
         proxy_set_header X-Forwarded-Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    
         if ($http_origin ~* (^(https?://(?:.+\.)?mysite\.com)$)) {
           set $cors "CORS";
           set $cors_method "${cors}_${request_method}";
         }
    
         if ($cors_method = "CORS_OPTIONS") {
           add_header 'Access-Control-Allow-Origin' '$http_origin';
           add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
           #
           # Custom headers and headers various browsers *should* be OK with but aren't
           #
           add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
           #
           # Tell client that this pre-flight info is valid for 20 days
           #
           add_header 'Access-Control-Max-Age' 1728000;
           add_header 'Content-Type' 'text/plain charset=UTF-8';
           add_header 'Content-Length' 0;
           return 204;
         }
    
         if ($cors = "CORS") {
           add_header 'Access-Control-Allow-Origin' '$http_origin';
           add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
           add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
         }
       }
     }