^-^
【go云原生】Kubernetes Service
最近更新：2025-01-05   |   字数总计：3.7k   |   阅读估时：18分钟   |   阅读量：次
  1. Kubernetes Service
    1. Service
      1. service定义
      2. service使用
        1. ClusterIP
        2. NodePort
        3. ExternalName
        4. LoadBalancer
        5. 没有选择符的service
      3. 无头Service
        1. 有选择符的service
        2. 无选择符的service
      4. 服务发现机制
        1. DNS
        2. 环境变量
      5. service TLS
    2. Ingress
      1. nginx ingress controller
      2. ingress的使用
        1. 准备三组service
        2. 暴露单个service
        3. ingress扇出
        4. ingress基于名称虚拟托管
        5. Ingress TLS
    3. 使用MetaILB作为外部负载均衡
      1. service LoadBalancer
      2. Ingress基于名称虚拟托管

Kubernetes Service

  • 将运行在一组pods上的应用程序公开为网络服务的抽象方法，这里的网络服务其实就是我们经常提起的微服务。

Service

service定义

  • myapp-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    apiVersion: v1
    kind: Service
    metadata:
        name: myapp-svc
    spec:
        type: ClusterIP # service发布类型
        ports: # 指定端口数组可以指定多个
            - protocol: TCP
                name: http
                port: 8080
                targetPort: 80
            - protocol: TCP
                name: https
                port: 443
                targetPort: 80
            - protocol: TCP
                name: redis-tcp
                port: 6379
                targetPort: 6379
        selector: # 标签选择器，用来匹配pod的
          name: myapp
  • type表示service发布类型
    1. ClusterIP：自动分配一个仅clusterIP内部可以访问的虚拟ip地址
    2. NodePort：在ClusterIP基础上为Service在每台机器上绑定一个端口，这样就可以通过节点IP：NodePort来访问服务
    3. ExternalName：将服务映射到DNS名称，把集群外部的服务引入到集群内部来使用
    4. LoadBalancer：使用云厂商提供的外部负载均衡器，来自外部负载均衡器的流量将直接重定位到后端Pod上。
  • myapp-deployment.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    apiVersion: apps/v1
    kind: Deployment
    metadata:
        name: myapp-deployment
        labels:
            name: myapp
    spec:
        replicas: 5
        selector:
            matchLabels:
                name: myapp
        template:
            metadata:
                labels:
                    name: myapp
            spec:
                containers:
                - name: myhello
                  image: xlhmzch/hello:1.0.0
                  imagePullPolicy: IfNotPresent
                  ports:
                  - containerPort: 80
                  env:
                  - name: env1
                    value: "k8s-env1"
                  - name: env2
                    value: "k8s-env2"
                - name: myredis
                  image: redis
                  imagePillPolicy: IfNotPresent
                  ports:
                  - containerPort: 6379
                  env:
                  - name: env1
                    value: "k8s-env1"
                  - name: env2
                    value: "k8s-env2"

    1
    kubectl apply -f myapp-deployment.yaml

service使用

ClusterIP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
kubectl apply -f myapp-svc.yaml 
kubectl get -f myapp-svc.yaml
kubectl describe -f myapp-svc.yaml

curl http://10.107.21.14:8080 # 使用集群内部ip，只能在内部访问的ip
kubectl run redis --image=redis # 创建一个带有redis-cli工具的pod
kubectl run curl --image=radial/busyboxplus:curl -it # 创建一个带有curl工具的pod
kubectl exec -it curl -- sh # 容器里面通过DNS访问进入交互模式
> nslookup myapp-svc.default.svc.cluster.local # 查看dns记录
> curl http://myapp-svc.default.svc.cluster.local:8080 # 容器内容可以使用dns的访问

kubectl exec -it redis -- bash # 进入redis-cli工具容器中
> redis-cli -h myapp-svc.default.svc.cluster.local -p 6379
> key * 
> set key1 abcde
> exit
> redis-cli -h myapp-svc.default.svc.cluster.local -p 6379 # 我们可以发现，是会被负载均衡的，我们有5个redis的pod，她们是独立的
> key * # 没有

NodePort

  • myapp-nodeport-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    apiVersion: v1
    kind: Service
    metadata:
        name: myapp-nodeport-svc
    spec:
        type: NodePort # service发布类型
        ports: # 指定端口数组可以指定多个
            - protocol: TCP
                name: http
                port: 8080
                targetPort: 80
                nodePort: 31490 # 节点端口，范围30000-32767
            - protocol: TCP
                name: https
                port: 443
                targetPort: 80
                nodePort: 30108 # 假如这里不指定，k8s会自动帮我们申请一个
            - protocol: TCP
                name: redis-tcp
                port: 6379
                targetPort: 6379
                nodePort: 31542
        selector: # 标签选择器，用来匹配pod的
          name: myapp
    1
    2
    3
    4
    kubectl apply -f myapp-nodeport-svc.yaml
    kubectl get -f myapp-nodeport-svc.yaml
    curl http://10.98.31.21:8080/ping # 通过集群内部ip，是可以的
    curl http://192.168.239.142:31490/ping # 通过节点ip，访问，此时是需要节点端口的

ExternalName

  • externalname-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    apiVersion: v1
    kind: Service
    metadata:
        name: externalname-svc
    spec:
        type: ExternalName
        externalName: www.baidu.com
    1
    2
    3
    4
    5
    6
    7
    kubectl apply -f externalname-svc.yaml
    kubectl get -f externalname-svc.yaml
    kubectl describe -f externalname-svc.yaml

    kubectl exec -it curl -- sh # 容器里面通过DNS访问进入交互模式
    > ping externalname.default.svc.cluster.local # 其实就是在ping www.baidu.com
    > curl -k https://externalname.default.svc.cluster.local # 像使用内部service的方式使用外部服务

LoadBalancer

  • my-loadbalancer-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    apiVersion: v1
    kind: Service
    metadata:
        name: my-loadbalancer-svc
    spec:
        selector:
            name: myapp
        ports:
            - protocol: TCP
                port: 8080
                targetPort: 80
            type: LoadBalancer
    1
    2
    3
    4
    5
    kubectl apply -f my-loadbalancer-svc.yaml
    kubectl get -f my-loadbalancer-svc.yaml
    kubectl describe -f my-loadbalancer-svc.yaml # 我们发现EXTERNAL-IP处于pending状态，所以我们的service会去等待云厂商的返回
    curl http://10.98.31.21:8080/ping # 通过集群内部ip，是可以的
    curl http://192.168.239.142:31490/ping # 通过节点ip，访问,也是可以的，而且k8s自动为我们创建了节点端口

没有选择符的service

  • 没有选择符的service需要手动配置endpoints
    1
    2
    3
    4
    5
    6
    # 找一个非集群内的机器, ip 192.168.239.149
    docker run -d -p 80:80 --name myhello xlhmzch/hello:1.0.0
    curl http://localhost/ping

    # 集群内运行，其集群内部ip是10.244.2.69
    kubectl run myhello-noselector --image=xlhmzch/hello:1.0.0
  • notselector-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    apiVersion: v1
    kind: Service
    metadata:
        name: notselector-svc
    spec:
        ports:
            - protocol: TCP
                port: 8080
                targetPort: 80
    1
    2
    3
    4
    kubectl apply -f notselector-svc.yaml
    kubectl get -f notselector-svc.yaml
    kubectl describe -f notselector-svc.yaml # 没有选择符，所以也没有endpoint
    # 手动创建一个endpoint资源
  • notselector-points.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    apiVersion: v1
    kind: Endpoints
    metadata:
        name: notselector-svc # 这里的name必须和service的name相同
    subsets:
        - addresses:
            - ip: 192.168.239.149
          ports:
            - port: 80
        - addresses:
            - ip: 10.244.2.69
          ports:
            - port: 80  
    1
    2
    3
    4
    kubectl apply -f notselector-points.yaml
    kubectl get -f notselector-points.yaml
    kubectl describe -f notselector-svc.yaml # 我们的service已经有endpoint了
    curl http://10.107.177.87:8080/ping # 通过service访问，可以被负载到刚在在集群外的那个docker也可以负载到集群内刚才那个pod

无头Service

  1. 无头 Service 并不会分配 Cluster IP， kube—proxy 不会处理它们，而且平台也不会为它们进行负载均衡和路由。
  2. 无头service不能通过集群IP访问，因为没有集群IP
  3. 无头service不能通过dns名称访问，因为没有负载均衡等操作
  4. 无头service的DNS记录是返回服务下所有endpoint，正常service是返回ClusterlP

有选择符的service

  • myapp-headless-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    apiVersion: v1
    kind: Service
    metadata:
        name: myapp-headless-svc
    spec:
        clusterIP: None
        type: ClusterIP
        selector:
            name: myapp
        ports:
            - protocol: TCP
                name: http
                port: 8080
                targetPort: 80
    1
    2
    3
    4
    5
    kubectl apply -f myapp-headless-svc.yaml 
    kubectl get -f myapp-headless-svc.yaml 
    kubectl describe -f myapp-headless-svc.yaml # 没有集群ip
    kubectl exec -it curl -- bash # 无头service只能通过dns去访问了
    > nsloopup myapp-headless-svc.default # 会返回一个ip地址列表，无头service经常配合有状态的应用程序来使用，由应用程序状态来决定访问哪个域名

无选择符的service

  • 和普通的无选择符service一样，需要手动创建endpoint，为service手动创建endpoint后，其余和有选择符的无头service基本一样。

服务发现机制

DNS

1
2
kubectl exec -it curl -- sh # 进入curl pod
> nslookup myapp-svc # 通过service名称找集群ip地址

环境变量

  • 必须先有service，才能在pod新建时将service注册到pod的环境变量中
    1
    2
    3
    kubectl exec myapp-deployment-oqiwnetoh -- printenv | grep SERVICE # 查看pod的环境变量，假设是service创建之前创建的就没有service的环境变量
    kubectl rollout restart deployment myapp-deployment # 重启deployment
    kubectl exec myapp-deployment-oqiwnetoh -- printenv | grep SERVICE # 再查看应该就有了

service TLS

  • nginx-default.conf
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on; 
        listen 443 ssl;
        root /usr/share/nginx/html; 
        index index.html;

        server_name localhost;
        ssl_certificate /etc/nginx/ssl/tls.crt; ssl_certificate_key /etc/nginx/ss1/tls.key; location /{
            try_files $uri $uri/ =404;
        }
    } 
    1
    2
    3
    4
    5
    6
    7
    # 将nginx配置文件创建为configmap
    kubectl create configmap nginxconfigmap --from-file=nginx-default.conf
    # 生成自签名证书
    openssl req -x509 -nodes -days 365 -newkey rsa:2049 -keyout /tmp/nginx.key -out /tmp/nginx.crt -subj "/CN=my-nginx-svc.default.svc.cluster.local/0=my-nginx"
    # 对密钥实施base64编码
    cat /tmp/nginx.crt | base64
    cat /tmp/nginx.key | base64
  • nginxsecret.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    apiVersion: "v1"
    kind: "Secret"
    metadata:
        name: "nginxsecret"
        namespace: "default"
    type: kubernetes.io/tls
    data:
        tls.crt: "aldskmiognapignoierngopqniergopnier"
        tls.key: "qoiegnoqgnorpiqnp3irugnpqirognpqirug"
    1
    kubectl apply -f nginxsecret.yaml
  • my-nginx-deployment.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    apiVersion: apps/v1 
    kind: Deployment 
    metadata:
        name: my-nginx-deployment 
    spec:
        selector: 
            matchLabels: 
                run: my-nginx 
        replicas: 1 
        template: 
            metadata: 
                labels:
                    run: my-nginx 
            spec:
                volumes:
                - name: secret-volume 
                    secret:
                    secretName: nginxsecret 
                - name: configmap-volume
                    configMap:
                        name: nginxconfigmap 
                containers:
                - name: nginxhttps 
                    image: nginx 
                    ports:
                    - containerPort: 443 
                    - containerPort: 80 
                volumeMounts:
                - mountPath: /etc/nginx/ssl 
                    name: secret-volume 
                - mountPath: /etc/nginx/conf.d 
                    name: configmap-volume
  • my-nginx-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    apiVersion: v1
    kind: Service
    metadata:
        name: my-nginx-svc
        labels:
            run: my-nginx-svc
    spec:
        type: NodePort
        ports:
        - port: 8080
            targetPort: 80
            protocol: TCP
            name: http
        - port: 443
            protocol: TCP
            name: https
        selector:
            run: my-nginx
  • curl-deployment.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    apiVersion: apps/v1 
    kind: Deployment 
    metadata:
        name: curl-deployment 
    spec:
        selector: 
            matchLabels: 
                app: curlpod
        replicas: 1
        template: 
            metadata: 
                labels:
                    app: curlpod 
            spec:
                volumes:
                -name: secret-volume 
                    secret:
                        secretName: nginxsecret 
                containers:
                - name: curlpod 
                    command: 
                    - sh 
                    - -c
                    - while true; do sleep 1; done 
                    image: radial/busyboxplus: curl
                    volumeMounts:
                    - mountPath: /etc/nginx/ssl 
                        name: secret-volume 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    kubectl apply -f my-nginx-deployment.yaml
    kubectl apply -f my-nginx-svc.yaml
    kubectl get -f my-nginx-svc.yaml # 查看集群ip
    curl http://10.100.180.94:8080 
    curl https://10.100.180.94:443 # 不行，证书和域名不一致

    kubectl apply -f curl-deployment.yaml
    kubectl exec -it curlpod -- sh
    > curl https://my-nginx-svc.default.svc.cluster.local --cacert /etc/nginx/ssl/tls.crt
    > curl https://10.111.168.64 --cacert /etc/nginx/ssl/tls.crt # 通过域名能正常访问，通过ip则提示hostname不匹配

Ingress

  • 公开从集群外部到集群内服务的HTTP和HTTPS路由。
    alt text

nginx ingress controller

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# =====================================
# 安装

# 配置一下域名，防止controller没办法down下来
vim /etc/hosts
185.199.108.133 raw.githubusercontent.com

# 我们把配置文件down下来，方便修改
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.12.0/deploy/static/provider/cloud/deploy.yaml
# 需要修改的配置：
# k8s.gcr.io/ingress-nginx/controller这个改成registry.aliyuncs.com/google_containers/nginx-ingress-controller
# k8s.gcr.io/ingress-nginx/kube-webhook-certgen修改为registry.aliyuncs.com/google_containers/kube-webhook-certgen

# 应用配置
kubectl apply -f deploy.yaml
kubectl get -f deploy.yaml

# 将nginx ingress controller设置为默认的ingress controller
kubectl edit -n ingress-nginx ingressclasses.networking.k8s.io nginx
> annotations:
>   ingressclass.kubernets.io/is-default-class: "true"
kubectl get -f deploy.yaml

# =====================================
# 使用
# 查看nginx ingress controller的conf
kubectl exec -n ingress-nginx -it pod/ingress-nginx-controller-oingqoirthpqoerih -- bash 
> vi nginx.conf
> ps # 可以看到就是运行的一个nginx，只是不是普通的nginx，而是经过ingress定向优化的nginx

ingress的使用

准备三组service

  • mysvc1-deployment.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    apiVersion: apps/v1 
    kind: Deployment 
    metadata:
        name: mysvc1-deployment
    spec:
        selector: 
            matchLabels: 
                app: mysvc1-app
        replicas: 2
        template: 
            metadata: 
                labels:
                    name: mysvc1-app 
            spec:
                containers:
                - name: myhello 
                    image: xlhmzch/hello:1.0.2
                    imagePullPolicy: IfNotPresent
                    ports:
                    - containerPort: 80
                    env:
                    - name: env1
                        value: "myservice1"
  • mysvc1.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    apiVersion: v1
    kind: Service
    metadata:
        name: mysvc1
        labels:
            name: mysvc1-app
    spec:
        ports:
        - port: 8081
            protocol: TCP
            targetPort: 80
            name: http
        selector:
            name: mysvc1-app
    1
    2
    3
    4
    kubectl create -f mysvc1-deployment.yaml
    kubectl create -f mysvc1.yaml
    kubectl get -f mysvc1.yaml
    curl http://10.108.195.227:8081/print/env
  • 按照上述步骤，定义mysvc2（8082，环境变量myservice2）和mysvc3（8083，myservice3），并创建好三组服务。

暴露单个service

  • default-backend-ingress.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
        name: default-backend-ingress
    spec:
        defaultBackend: # 默认的后端，所有规则都没有匹配上的时候
            service:
                name: mysvc1 # 所有的未匹配都到mysvc1上
                port:
                    number: 80
    1
    2
    3
    4
    5
    kubectl create -f defaultBackend-ingress.yaml
    kubectl get -f defaultBackend-ingress.yaml
    # 发现hosts是*，所以所有域名都匹配这条
    kubectl get -n ingress-nginx svc # 找到LoadBalancer，这里就是我们集群的入口
    curl http://10.111.20.126:80/print/env # 从入口进入，现在会转发到mysvc1

ingress扇出

  • 一个扇出（fanout）配置根据请求的HTTP URI将来自同一IP地址的流量路由到多个Service。
    alt text
  • fanout-ingress.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
        annotations:
            nginx.ingress.kubernetes.io/rewrite-target: "/$1"
        name: fanout-ingress
    spec
        rules:
        - host: www.icu.com # 如果注释掉这个，就可以通过ip访问了，否则不行
            http:
                paths:
                - path: /svc2/(.*)$
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc2
                            port:
                                number: 8082
                - path: /svc3/(.*)$
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc3
                            port:
                                number: 8083
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    kubectl apply -f fanout-ingress.yaml
    kubectl get -f fanout-ingress.yaml # 有了host，就不能用ip访问了
    kubectl get -n ingress-nginx pod 
    kubectl exec -n ingress-nginx -it pod/ingress-nginx-controller-noqihetoq -- bash # 进入到controller
    >  vim nginx.conf # 我们发现配置的路由生效了

    curl http://10.111.20.126/svc2/print/env # 发现没生效，直接去了默认的匹配mysvc1上去了，因为没有加域名
    vim /etc/hosts 
    > 10.111.20.126 www.icu.com  # 加上集群ip（ingress controller）的映射，我们发现我们通过ingress，所有的访问都可以只使用成集群入口的访问了
    curl http://www.icu.com/svc2/print/env
    curl http://www.icu.com/svc3/print/env

ingress基于名称虚拟托管

alt text

  • hostname-ingress.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
        name: hostname-ingress
    spec
        rules:
        - host: svc1.icu.com 
            http:
                paths:
                - path: /
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc1
                            port:
                                number: 8081
        - host: svc2.nick.com
            http:
                paths:
                - path: /
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc2
                            port:
                                number: 8082
    1
    2
    3
    4
    5
    6
    7
    8
    kubectl apply -f hostname-ingress.yaml
    kubectl get -f hostname-ingress.yaml
    vim /etc/hosts
    > 10.111.20.126 svc1.icu.com 
    > 10.111.20.126 svc2.icu.com 

    curl http://svc1.icu.com/print/env 
    curl http://svc2.icu.com/print/env

Ingress TLS

  • 注意事项
  1. 自签证书中的CN字段必须为全限定域名，例如：https-www.icu.com
  2. 自签证书中的CN字段必须与ingress定义中rules.host匹配
  3. ingress定义中tls.hosts字段的值必须与rules.host完全匹配
  4. TLSSecret的数据中必须包含用于TLS的以键名tls.crt保存的证书和以键名tls.key保存的私钥，即tls.crt为键 值保存证书，tls.key为键值保存私钥
    1
    2
    3
    4
    5
    # 生成自签名证书
    openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/fanouttls.key -out /tmp/fanouttls.crt -subj "/CN=https-www.icu.com/0=https-www.icu.com"
    # 对密钥实施base64编码
    cat /tmp/fanouttls.crt | base64
    cat /tmp/fanouttls.key | base64
  • fanout-ingress-tls-secret.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    apiVersion: v1
    kind: Secret
    metadata:
        name: fanout-ingress-tls
        namespace: default
    type: kubernetes.io/tls
    data:
        tls.crt: "aldskmiognapignoierngopqniergopnier"
        tls.key: "qoiegnoqgnorpiqnp3irugnpqirognpqirug"
    1
    2
    kubectl apply -f fanout-ingress-tls-secret.yaml
    kubectl get -f fanout-ingress-tls-secret.yaml
  • fanout-tls-ingress.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
        annotations:
            nginx.ingress.kubernetes.io/rewrite-target: "/$1"
        name: fanout-tls-ingress
    spec
        tls:
        - hosts:
            - https-www.icu.com
            secretName: fanout-ingress-tls
        rules:
        - host: https-www.icu.com 
            http:
                paths:
                - path: /svc2/(.*)$
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc2
                            port:
                                number: 8082
                - path: /svc3/(.*)$
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc3
                            port:
                                number: 8083
    1
    2
    3
    4
    5
    6
    kubectl create -f fanout-tls-ingress.yaml
    vim /etc/hosts
    > 10.111.20.126 https-www.icu.com
    curl -k https://https-www.icu.com/svc2/print/env # -k跳过校验
    curl https://https-www.icu.com/svc2/print/env --cacert /tmp/fanouttls.crt # 进行校验访问 
    curl https://https-www.icu.com/svc3/print/env --cacert /tmp/fanouttls.crt # 进行校验访问

使用MetaILB作为外部负载均衡

  • 功能就是替代云厂商，实现逻辑k8s得负载均衡器
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    # 编辑kube-proxy配置箱
    kubectl edit cm kube-proxy -n kube-system 
    > mode: "ipvs"
    > ipvs:
    >   strictARP: true
    kubectl rollout restart ds/kube-proxy -n kube-system # 重启下kube-proxy

    # 安装MetaILB
    vim /etc/hosts
    > 185.199.108.133 raw.githubusercontent.com # 需要自己查一下可以联通的地址
    kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.14.9/config/manifests/metallb-native.yaml
  • metallb-config.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    apiVersion: metallb.io/v1beta1
    kind: IPAddressPool
    metadata:
        name: first-pool
        namespace: metallb-system
    spec:
        addresses:
            - 192.168.10.0/24
            - 192.168.9.1-192.168.9.5
            - fc00:f853:0ccd:e799::/124

service LoadBalancer

1
2
3
kubectl get -n ingress-nginx svc # 发现ingress-nginx-controller的EXTERNAL-IP是pending，说明在等待外部工具创建负载均衡
kubectl apply -f metallb-config.yaml
kubectl get -n ingress-nginx svc # 发现ingress-nginx-controller的EXTERNAL-IP是有得了
  • myapp-deployment.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    apiVersion: apps/v1
    kind: Deployment
    metadata:
        name: myapp-deployment
        labels:
            name: myapp
    spec:
        replicas: 5
        selector:
            matchLabels:
                name: myapp
        template:
            metadata:
                labels:
                    name: myapp
            spec:
                containers:
                - name: myhello
                  image: xlhmzch/hello:1.0.0
                  imagePullPolicy: IfNotPresent
                  ports:
                  - containerPort: 80
                  env:
                  - name: env1
                    value: "k8s-env1"
                  - name: env2
                    value: "k8s-env2"
                  - name: env3
                    value: "k8s-env3"

    1
    kubectl apply -f myapp-deployment.yaml
  • my-loadbalancer-svc.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    apiVersion: v1
    kind: Service
    metadata:
        name: my-loadbalancer-svc
    spec:
        ports:
        - port: 8080
            protocol: TCP
            targetPort: 80
        selector:
            name: myapp
        type: LoadBalancer
    1
    2
    3
    4
    5
    kubectl apply -f my-loadbalancer-svc.yaml
    kubectl get svc # 因为我们的service是LoadBalancer类型，所以MetaILB自动帮我们申请了EXTERNAL-IP地址192.168.10.1，CLUSTER-IP 10.103.09.249

    curl http://192.168.10.1:8080/print/env
    curl http://10.103.09.249:8080/print/env # 是一样得

Ingress基于名称虚拟托管

  • mysvc1-deployment.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    apiVersion: apps/v1 
    kind: Deployment 
    metadata:
        name: mysvc1-deployment
    spec:
        selector: 
            matchLabels: 
                app: mysvc1-app
        replicas: 2
        template: 
            metadata: 
                labels:
                    name: mysvc1-app 
            spec:
                containers:
                - name: myhello 
                    image: xlhmzch/hello:1.0.2
                    imagePullPolicy: IfNotPresent
                    ports:
                    - containerPort: 80
                    env:
                    - name: env1
                        value: "myservice1"
  • mysvc1.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    apiVersion: v1
    kind: Service
    metadata:
        name: mysvc1
        labels:
            name: mysvc1-app
    spec:
        ports:
        - port: 8081
            protocol: TCP
            targetPort: 80
            name: http
        selector:
            name: mysvc1-app
    1
    2
    3
    4
    kubectl create -f mysvc1-deployment.yaml
    kubectl create -f mysvc1.yaml
    kubectl get -f mysvc1.yaml
    curl http://10.108.195.227:8081/print/env
  • 按照上述步骤，定义mysvc2（8082，环境变量myservice2）。
  • hostname-ingress.yaml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
        name: hostname-ingress
    spec
        ingressClassName: nginx # 这个必须有，否则无法分配ip，k8s需要这个class去分配controller去配置ingress
        rules:
        - host: svc1.icu.com 
            http:
                paths:
                - path: /
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc1
                            port:
                                number: 8081
        - host: svc2.nick.com
            http:
                paths:
                - path: /
                    pathType: Prefix
                    backend:
                        service:
                            name: mysvc2
                            port:
                                number: 8082
    1
    2
    3
    4
    5
    6
    7
    8
    kubectl apply -f hostname-ingress.yaml
    kubectl get -f hostname-ingress.yaml # 我们会发现过一会（因为是异步得，耐心等一下），这个ingress就会被MetaILB分配addresses了
    vim /etc/hosts
    > 192.168.1.240 svc1.icu.com # 这次是分配到MetaILB得地址了，不再是集群地址
    > 192.168.1.240 svc2.icu.com 

    curl http://svc1.icu.com/print/env 
    curl http://svc2.icu.com/print/env
2025-01-03 该篇文章被 Cleofwine 归为分类: Go云原生

上一篇：个人摄影学习：摄影基础 下一篇：【go云原生】Kubernetes Pod
© 2023-2026 Cleofwine / Email / GitHub / 浙ICP备2024136127号
🌙赠我弯弯一枚月，也赠予我晚星⭐ 本站由Hexo驱动｜使用Hexo-theme-A4主题