k8s 之 應用實踐-Service,Ingress

1.背景;

? ? ? ? 由于簡化部署k8s 集群 ，公司的k8s 部署方案使用的是 kubeadm ,且跟進線上線下維度進行集群劃分，為何要使用kubeadm 主要有兩個原因：1.部署方便快捷，2.k8s節點擴容方便? 3.部署難度降低;?

2.系統環境;

3.相關組件版本;

4.應用實踐;

(1).集群已經正常運行如下所示;

2.查看deployment 配置;

apiVersion:?extensions/v1beta1?
kind:?Deployment?
metadata:?
??name:?nginx-dp
spec:?
??selector:
????matchLabels:
??????app:?nginx-dp
??replicas:?1
??template:?
????metadata:?
??????labels:?
????????app:?nginx-dp?
????spec:?
??????containers:?
????????-?name:?nginx?
??????????image:?nginx:alpine?
??????????ports:?
????????????-?containerPort:?80

3.查看ervice 配置;

apiVersion:?v1
kind:?Service
metadata:
??name:?nginx-dp-cpf
spec:
??type:?NodePort
??ports:
??-?nodePort:?30001
????port:?80
????targetPort:?80
????protocol:?TCP
??selector:
????app:?nginx-dp

4.查看生成endpoints?

5.查看service 規則;

6.查看由kube-proxy 生成的iptables 防火墻規則; (正常規則)

注意:

? ? ? 1.如果防火墻規則出現 類似如下規則:

? ? ? ? -A KUBE-EXTERNAL-SERVICES -p tcp -m comment --comment "default/nginx-dp-cpf: has no endpoints" -m addrtype --dst-type LOCAL -m tcp --dport 30001 -j REJECT --reject-with icmp-port-unreachable

? ? ? 2.解決辦法;

? ? ? ? ?? (1).net.ipv4.ip_forward?= 1? #系統內核路由轉發功能

? ? ? ? ? ?(2).iptables -P FORWARD ACCEPT? #允許 iptables??FORWARD 鏈規則通過;

? ? ? ? ? ?(3).iptables -P?OUTPUT ACCEPT? #允許 iptables??OUTPUT?鏈規則通過;

? ? ? ? ? ?(4).檢查deployment?labels? 和 service?labels?設置是否關聯正確;

? ? ? ? ? ?(5).kubectl get endpoints? --show-labels? #注意此規則和防火墻規則匹配 若出現none 請檢查防火墻規則;

7.進行功能測試 (k8s 集群內進行測試);

8.ingress 部署;

#master?端執行;
kubectl?apply?-f?https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
kubectl?apply?-f?https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml

注意:?

? ? ? nodeSelector 字段 labels? 和 node labels 關聯; 否則運行ingres pod 出現 peding 狀態;

8.ingress 配置;

##配置yaml
apiVersion:?extensions/v1beta1
kind:?Ingress
metadata:
??name:?test-ingress
spec:
??rules:
??-?http:
??????paths:
??????-?path:?/
????????backend:
??????????serviceName:?test-nginx?
??????????servicePort:?80

###查看創建?ingress;

####測試訪問###

####基于域名多服務的 Ingress

路由到多服務的 Ingress 即根據請求路徑的不同轉發到不同的后端服務上，比如

www.breaklinux.com?->?10.109.21.77->?/test1?????s1:80
??????????????????????????????????—>?/test2??????s2:80

apiVersion:?extensions/v1beta1
kind:?Ingress
metadata:
??name:?test
spec:
??rules:
??-?host:?www.breaklinux.com
????http:
??????paths:
??????-?path:?/test1
????????backend:
??????????serviceName:?test-nginx
??????????servicePort:?80
??????-?path:?/test2
????????backend:
??????????serviceName:?nginx-dp-test-01?
??????????servicePort:?80

###虛擬主機 Ingress

apiVersion:?extensions/v1beta1
kind:?Ingress
metadata:
??annotations:
????nginx.ingress.kubernetes.io/configuration-snippet:?""
????nginx.ingress.kubernetes.io/proxy-body-size:?10240m
????nginx.ingress.kubernetes.io/proxy-read-timeout:?"36000"
????nginx.ingress.kubernetes.io/proxy-send-timeout:?"36000"
????nginx.ingress.kubernetes.io/rewrite-target:?/$1
????nginx.ingress.kubernetes.io/ssl-redirect:?"false"
??name:?test-nginx-ingess
spec:
??rules:
??-?host:?test-nginx-ingress.dev.k8s.chj.cloud
????http:
??????paths:
??????-?backend:
??????????serviceName:?test-nginx
??????????servicePort:?80?
????????path:?/?(.*)

? ##基于虛擬主機訪問測試#

##因為沒有dns 服務環境 綁定hosts 進行測試

cat?/etc/hosts

10.109.21.77???www.breaklinux.com?test-nginx-ingress.dev.k8s.chj.cloud