k8s 之 應(yīng)用實(shí)踐-Service,Ingress

1.背景;

? ? ? ? 由于簡(jiǎn)化部署k8s 集群 ，公司的k8s 部署方案使用的是 kubeadm ,且跟進(jìn)線上線下維度進(jìn)行集群劃分，為何要使用kubeadm 主要有兩個(gè)原因：1.部署方便快捷，2.k8s節(jié)點(diǎn)擴(kuò)容方便? 3.部署難度降低;?

2.系統(tǒng)環(huán)境;

3.相關(guān)組件版本;

4.應(yīng)用實(shí)踐;

(1).集群已經(jīng)正常運(yùn)行如下所示;

2.查看deployment 配置;

apiVersion:?extensions/v1beta1?
kind:?Deployment?
metadata:?
??name:?nginx-dp
spec:?
??selector:
????matchLabels:
??????app:?nginx-dp
??replicas:?1
??template:?
????metadata:?
??????labels:?
????????app:?nginx-dp?
????spec:?
??????containers:?
????????-?name:?nginx?
??????????image:?nginx:alpine?
??????????ports:?
????????????-?containerPort:?80

3.查看ervice 配置;

apiVersion:?v1
kind:?Service
metadata:
??name:?nginx-dp-cpf
spec:
??type:?NodePort
??ports:
??-?nodePort:?30001
????port:?80
????targetPort:?80
????protocol:?TCP
??selector:
????app:?nginx-dp

4.查看生成endpoints?

5.查看service 規(guī)則;

6.查看由kube-proxy 生成的iptables 防火墻規(guī)則; (正常規(guī)則)

注意:

? ? ? 1.如果防火墻規(guī)則出現(xiàn) 類似如下規(guī)則:

? ? ? ? -A KUBE-EXTERNAL-SERVICES -p tcp -m comment --comment "default/nginx-dp-cpf: has no endpoints" -m addrtype --dst-type LOCAL -m tcp --dport 30001 -j REJECT --reject-with icmp-port-unreachable

? ? ? 2.解決辦法;

? ? ? ? ?? (1).net.ipv4.ip_forward?= 1? #系統(tǒng)內(nèi)核路由轉(zhuǎn)發(fā)功能

? ? ? ? ? ?(2).iptables -P FORWARD ACCEPT? #允許 iptables??FORWARD 鏈規(guī)則通過;

? ? ? ? ? ?(3).iptables -P?OUTPUT ACCEPT? #允許 iptables??OUTPUT?鏈規(guī)則通過;

? ? ? ? ? ?(4).檢查deployment?labels? 和 service?labels?設(shè)置是否關(guān)聯(lián)正確;

? ? ? ? ? ?(5).kubectl get endpoints? --show-labels? #注意此規(guī)則和防火墻規(guī)則匹配 若出現(xiàn)none 請(qǐng)檢查防火墻規(guī)則;

7.進(jìn)行功能測(cè)試 (k8s 集群內(nèi)進(jìn)行測(cè)試);

8.ingress 部署;

#master?端執(zhí)行;
kubectl?apply?-f?https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
kubectl?apply?-f?https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/baremetal/service-nodeport.yaml

注意:?

? ? ? nodeSelector 字段 labels? 和 node labels 關(guān)聯(lián); 否則運(yùn)行ingres pod 出現(xiàn) peding 狀態(tài);

8.ingress 配置;

##配置yaml
apiVersion:?extensions/v1beta1
kind:?Ingress
metadata:
??name:?test-ingress
spec:
??rules:
??-?http:
??????paths:
??????-?path:?/
????????backend:
??????????serviceName:?test-nginx?
??????????servicePort:?80

###查看創(chuàng)建?ingress;

####測(cè)試訪問###

####基于域名多服務(wù)的 Ingress

路由到多服務(wù)的 Ingress 即根據(jù)請(qǐng)求路徑的不同轉(zhuǎn)發(fā)到不同的后端服務(wù)上，比如

www.breaklinux.com?->?10.109.21.77->?/test1?????s1:80
??????????????????????????????????—>?/test2??????s2:80

apiVersion:?extensions/v1beta1
kind:?Ingress
metadata:
??name:?test
spec:
??rules:
??-?host:?www.breaklinux.com
????http:
??????paths:
??????-?path:?/test1
????????backend:
??????????serviceName:?test-nginx
??????????servicePort:?80
??????-?path:?/test2
????????backend:
??????????serviceName:?nginx-dp-test-01?
??????????servicePort:?80

###虛擬主機(jī) Ingress

apiVersion:?extensions/v1beta1
kind:?Ingress
metadata:
??annotations:
????nginx.ingress.kubernetes.io/configuration-snippet:?""
????nginx.ingress.kubernetes.io/proxy-body-size:?10240m
????nginx.ingress.kubernetes.io/proxy-read-timeout:?"36000"
????nginx.ingress.kubernetes.io/proxy-send-timeout:?"36000"
????nginx.ingress.kubernetes.io/rewrite-target:?/$1
????nginx.ingress.kubernetes.io/ssl-redirect:?"false"
??name:?test-nginx-ingess
spec:
??rules:
??-?host:?test-nginx-ingress.dev.k8s.chj.cloud
????http:
??????paths:
??????-?backend:
??????????serviceName:?test-nginx
??????????servicePort:?80?
????????path:?/?(.*)

? ##基于虛擬主機(jī)訪問測(cè)試#

##因?yàn)闆]有dns 服務(wù)環(huán)境 綁定hosts 進(jìn)行測(cè)試

cat?/etc/hosts

10.109.21.77???www.breaklinux.com?test-nginx-ingress.dev.k8s.chj.cloud