• 安装Nginx ingress
    • 镜像准备
    • 步骤详解
    • 参考

    安装Nginx ingress

    Nginx ingress 使用ConfigMap来管理Nginx配置,nginx是大家熟知的代理和负载均衡软件,比起Traefik来说功能更加强大.

    我们使用helm来部署,chart保存在私有的仓库中,请确保您已经安装和配置好helm,helm安装使用见使用Helm管理kubernetes应用。

    镜像准备

    安装时需要用到的镜像有:

    • sophos/nginx-vts-exporter:v0.6
    • gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15
    • gcr.io/google_containers/defaultbackend:1.3

    gcr.io中的那个两个镜像我复制了一份到时速云,可供大家下载:

    • index.tenxcloud.com/jimmy/defaultbackend:1.3
    • index.tenxcloud.com/jimmy/nginx-ingress-controller:0.9.0-beta.15

    Docker hub上的那个镜像可以直接下载,所有的安装时需要的配置保存在../manifests/nginx-ingress目录下。

    步骤详解

    安装nginx-ingress chart到本地repo中

    修改values.yaml配置,启用RBAC支持,相关配置见nginx-ingress chart。

    1. helm package .

    查看niginx-ingress

    1. $ helm search nginx-ingress
    2. NAME VERSION DESCRIPTION
    3. local/nginx-ingress 0.8.9 An nginx Ingress controller that uses ConfigMap...
    4. stable/nginx-ingress 0.8.9 An nginx Ingress controller that uses ConfigMap...
    5. stable/nginx-lego 0.3.0 Chart for nginx-ingress-controller and kube-lego

    使用helm部署nginx-ingress

    1. $ helm install --name nginx-ingress local/nginx-ingress
    2. NAME: nginx-ingress
    3. LAST DEPLOYED: Fri Oct 27 18:26:58 2017
    4. NAMESPACE: default
    5. STATUS: DEPLOYED
    6. RESOURCES:
    7. ==> rbac.authorization.k8s.io/v1beta1/Role
    8. NAME KIND
    9. nginx-ingress-nginx-ingress Role.v1beta1.rbac.authorization.k8s.io
    10. ==> rbac.authorization.k8s.io/v1beta1/RoleBinding
    11. nginx-ingress-nginx-ingress RoleBinding.v1beta1.rbac.authorization.k8s.io
    12. ==> v1/Service
    13. NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
    14. nginx-ingress-nginx-ingress-controller 10.254.100.108 <nodes> 80:30484/TCP,443:31053/TCP 1s
    15. nginx-ingress-nginx-ingress-default-backend 10.254.58.156 <none> 80/TCP 1s
    16. ==> extensions/v1beta1/Deployment
    17. NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
    18. nginx-ingress-nginx-ingress-default-backend 1 1 1 0 1s
    19. nginx-ingress-nginx-ingress-controller 1 1 1 0 1s
    20. ==> v1/ConfigMap
    21. NAME DATA AGE
    22. nginx-ingress-nginx-ingress-controller 1 1s
    23. ==> v1/ServiceAccount
    24. NAME SECRETS AGE
    25. nginx-ingress-nginx-ingress 1 1s
    26. ==> rbac.authorization.k8s.io/v1beta1/ClusterRole
    27. NAME KIND
    28. nginx-ingress-nginx-ingress ClusterRole.v1beta1.rbac.authorization.k8s.io
    29. ==> rbac.authorization.k8s.io/v1beta1/ClusterRoleBinding
    30. nginx-ingress-nginx-ingress ClusterRoleBinding.v1beta1.rbac.authorization.k8s.io
    31. NOTES:
    32. The nginx-ingress controller has been installed.
    33. Get the application URL by running these commands:
    34. export HTTP_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[0].nodePort}" nginx-ingress-nginx-ingress-controller)
    35. export HTTPS_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[1].nodePort}" nginx-ingress-nginx-ingress-controller)
    36. export NODE_IP=$(kubectl --namespace default get nodes -o jsonpath="{.items[0].status.addresses[1].address}")
    37. echo "Visit http://$NODE_IP:$HTTP_NODE_PORT to access your application via HTTP."
    38. echo "Visit https://$NODE_IP:$HTTPS_NODE_PORT to access your application via HTTPS."
    39. An example Ingress that makes use of the controller:
    40. apiVersion: extensions/v1beta1
    41. kind: Ingress
    42. metadata:
    43. annotations:
    44. kubernetes.io/ingress.class: nginx
    45. name: example
    46. namespace: foo
    47. spec:
    48. rules:
    49. - host: www.example.com
    50. http:
    51. paths:
    52. - backend:
    53. serviceName: exampleService
    54. servicePort: 80
    55. path: /
    56. # This section is only required if TLS is to be enabled for the Ingress
    57. tls:
    58. - hosts:
    59. - www.example.com
    60. secretName: example-tls
    61. If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
    62. apiVersion: v1
    63. kind: Secret
    64. metadata:
    65. name: example-tls
    66. namespace: foo
    67. data:
    68. tls.crt: <base64 encoded cert>
    69. tls.key: <base64 encoded key>
    70. type: kubernetes.io/tls

    访问Nginx

    首先获取Nginx的地址,从我们使用helm安装nginx-ingress命令的输出中那个可以看到提示,根据提示执行可以看到nginx的http和https地址:

    1. export HTTP_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[0].nodePort}" nginx-ingress-nginx-ingress-controller)
    2. export HTTPS_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[1].nodePort}" nginx-ingress-nginx-ingress-controller)
    3. export NODE_IP=$(kubectl --namespace default get nodes -o jsonpath="{.items[0].status.addresses[1].address}")
    4. echo "Visit http://$NODE_IP:$HTTP_NODE_PORT to access your application via HTTP."
    5. echo "Visit https://$NODE_IP:$HTTPS_NODE_PORT to access your application via HTTPS."
    6. Visit http://172.20.0.113:30484 to access your application via HTTP.
    7. Visit https://172.20.0.113:31053 to access your application via HTTPS.
    • http地址:http://172.20.0.113:30484
    • https地址:https://172.20.0.113:31053

    我们分别在http和https地址上测试一下:

    • /healthz返回200
    • /返回404错误
    1. curl -v http://172.20.0.113:30484/healthz
    2. # 返回200
    3. curl -v http://172.20.0.113:30484/
    4. # 返回404
    5. curl -v --insecure http://172.20.0.113:30484/healthz
    6. # 返回200
    7. curl -v --insecure http://172.20.0.113:30484/
    8. # 返回404

    删除nginx-ingress

    1. helm delete --purge nginx-ingress

    使用--purge参数可以彻底删除release不留下记录,否则下一次部署的时候不能使用重名的release。

    参考

    Ingress-nginx github

    Nginx chart configuration

    使用Helm管理kubernetes应用