要使Ingress 资源正常工作,集群必须配置一个Ingress 控制器。
这与其他类型的控制器不同,其他类型的控制器通常作为 kube-controller-manager 二进制文件的一部分运行,并且通常作为集群创建的一部分自动启动。
对于带有helm的 EKS ,您可以尝试:
helm registry install quay.io/coreos/alb-ingress-controller-helm
接下来,配置 Ingress 资源:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test-ingress
annotations:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: 'true'
spec:
rules:
- host: YOUR_DOMAIN
http:
paths:
- path: /
backend:
serviceName: ingress-example-test
servicePort: 80
tls:
- secretName: custom-tls-cert
hosts:
- YOUR_DOMAIN
应用配置:
kubectl create -f ingress.yaml
接下来,使用 TLS 证书创建密钥:
kubectl create secret tls custom-tls-cert --key /path/to/tls.key --cert /path/to/tls.crt
并在 Ingress 定义中引用它们:
tls:
- secretName: custom-tls-cert
hosts:
- YOUR_DOMAIN
以下配置示例显示了如何配置 Ingress 控制器:
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: nginx-ingress-controller
labels:
k8s-app: nginx-ingress-controller
spec:
replicas: 1
selector:
matchLabels:
k8s-app: nginx-ingress-controller
template:
metadata:
labels:
k8s-app: nginx-ingress-controller
spec:
# hostNetwork makes it possible to use ipv6 and to preserve the source IP correctly regardless of docker configuration
# however, it is not a hard dependency of the nginx-ingress-controller itself and it may cause issues if port 10254 already is taken on the host
# that said, since hostPort is broken on CNI (https://github.com/kubernetes/kubernetes/issues/31307) we have to use hostNetwork where CNI is used
# like with kubeadm
# hostNetwork: true
terminationGracePeriodSeconds: 60
containers:
- image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.17.1
name: nginx-ingress-controller
readinessProbe:
httpGet:
path: /healthz
port: 10254
scheme: HTTP
livenessProbe:
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
timeoutSeconds: 1
ports:
- containerPort: 80
hostPort: 80
- containerPort: 443
hostPort: 443
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
args:
- /nginx-ingress-controller
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
- --publish-service=$(POD_NAMESPACE)/nginx-ingress-lb
接下来,应用上述配置,然后您可以检查服务是否暴露了外部 IP:
kubectl get service nginx-controller -n kube-system
外部 IP 是一个地址,它终止于由外部配置的路由机制配置的 Kubernetes 节点之一。在服务定义中配置时,一旦请求到达节点,流量就会重定向到服务端点。
Kubernetes 的文档提供了更多示例。