安装Nginx ingress

Nginx ingress 使用ConfigMap来管理Nginx配置,nginx是大家熟知的代理和负载均衡软件,比起Traefik来说功能更加强大.

我们使用helm来部署,chart保存在私有的仓库中,请确保您已经安装和配置好helm,helm安装使用见使用Helm管理kubernetes应用

镜像准备

安装时需要用到的镜像有:

  • sophos/nginx-vts-exporter:v0.6
  • gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15
  • gcr.io/google_containers/defaultbackend:1.3

gcr.io中的那个两个镜像我复制了一份到时速云,可供大家下载:

  • index.tenxcloud.com/jimmy/defaultbackend:1.3
  • index.tenxcloud.com/jimmy/nginx-ingress-controller:0.9.0-beta.15

Docker hub上的那个镜像可以直接下载,所有的安装时需要的配置保存在../manifests/nginx-ingress目录下。

步骤详解

安装nginx-ingress chart到本地repo中

修改values.yaml配置,启用RBAC支持,相关配置见nginx-ingress chart

  1. helm package .

查看niginx-ingress

  1. $ helm search nginx-ingress
  2. NAME VERSION DESCRIPTION
  3. local/nginx-ingress 0.8.9 An nginx Ingress controller that uses ConfigMap...
  4. stable/nginx-ingress 0.8.9 An nginx Ingress controller that uses ConfigMap...
  5. stable/nginx-lego 0.3.0 Chart for nginx-ingress-controller and kube-lego

使用helm部署nginx-ingress

  1. $ helm install --name nginx-ingress local/nginx-ingress
  2. NAME: nginx-ingress
  3. LAST DEPLOYED: Fri Oct 27 18:26:58 2017
  4. NAMESPACE: default
  5. STATUS: DEPLOYED
  6. RESOURCES:
  7. ==> rbac.authorization.k8s.io/v1beta1/Role
  8. NAME KIND
  9. nginx-ingress-nginx-ingress Role.v1beta1.rbac.authorization.k8s.io
  10. ==> rbac.authorization.k8s.io/v1beta1/RoleBinding
  11. nginx-ingress-nginx-ingress RoleBinding.v1beta1.rbac.authorization.k8s.io
  12. ==> v1/Service
  13. NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
  14. nginx-ingress-nginx-ingress-controller 10.254.100.108 <nodes> 80:30484/TCP,443:31053/TCP 1s
  15. nginx-ingress-nginx-ingress-default-backend 10.254.58.156 <none> 80/TCP 1s
  16. ==> extensions/v1beta1/Deployment
  17. NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
  18. nginx-ingress-nginx-ingress-default-backend 1 1 1 0 1s
  19. nginx-ingress-nginx-ingress-controller 1 1 1 0 1s
  20. ==> v1/ConfigMap
  21. NAME DATA AGE
  22. nginx-ingress-nginx-ingress-controller 1 1s
  23. ==> v1/ServiceAccount
  24. NAME SECRETS AGE
  25. nginx-ingress-nginx-ingress 1 1s
  26. ==> rbac.authorization.k8s.io/v1beta1/ClusterRole
  27. NAME KIND
  28. nginx-ingress-nginx-ingress ClusterRole.v1beta1.rbac.authorization.k8s.io
  29. ==> rbac.authorization.k8s.io/v1beta1/ClusterRoleBinding
  30. nginx-ingress-nginx-ingress ClusterRoleBinding.v1beta1.rbac.authorization.k8s.io
  31. NOTES:
  32. The nginx-ingress controller has been installed.
  33. Get the application URL by running these commands:
  34. export HTTP_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[0].nodePort}" nginx-ingress-nginx-ingress-controller)
  35. export HTTPS_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[1].nodePort}" nginx-ingress-nginx-ingress-controller)
  36. export NODE_IP=$(kubectl --namespace default get nodes -o jsonpath="{.items[0].status.addresses[1].address}")
  37. echo "Visit http://$NODE_IP:$HTTP_NODE_PORT to access your application via HTTP."
  38. echo "Visit https://$NODE_IP:$HTTPS_NODE_PORT to access your application via HTTPS."
  39. An example Ingress that makes use of the controller:
  40. apiVersion: extensions/v1beta1
  41. kind: Ingress
  42. metadata:
  43. annotations:
  44. kubernetes.io/ingress.class: nginx
  45. name: example
  46. namespace: foo
  47. spec:
  48. rules:
  49. - host: www.example.com
  50. http:
  51. paths:
  52. - backend:
  53. serviceName: exampleService
  54. servicePort: 80
  55. path: /
  56. # This section is only required if TLS is to be enabled for the Ingress
  57. tls:
  58. - hosts:
  59. - www.example.com
  60. secretName: example-tls
  61. If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
  62. apiVersion: v1
  63. kind: Secret
  64. metadata:
  65. name: example-tls
  66. namespace: foo
  67. data:
  68. tls.crt: <base64 encoded cert>
  69. tls.key: <base64 encoded key>
  70. type: kubernetes.io/tls

访问Nginx

首先获取Nginx的地址,从我们使用helm安装nginx-ingress命令的输出中那个可以看到提示,根据提示执行可以看到nginx的http和https地址:

  1. export HTTP_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[0].nodePort}" nginx-ingress-nginx-ingress-controller)
  2. export HTTPS_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[1].nodePort}" nginx-ingress-nginx-ingress-controller)
  3. export NODE_IP=$(kubectl --namespace default get nodes -o jsonpath="{.items[0].status.addresses[1].address}")
  4. echo "Visit http://$NODE_IP:$HTTP_NODE_PORT to access your application via HTTP."
  5. echo "Visit https://$NODE_IP:$HTTPS_NODE_PORT to access your application via HTTPS."
  6. Visit http://172.20.0.113:30484 to access your application via HTTP.
  7. Visit https://172.20.0.113:31053 to access your application via HTTPS.

我们分别在http和https地址上测试一下:

  • /healthz返回200
  • /返回404错误
  1. curl -v http://172.20.0.113:30484/healthz
  2. # 返回200
  3. curl -v http://172.20.0.113:30484/
  4. # 返回404
  5. curl -v --insecure http://172.20.0.113:30484/healthz
  6. # 返回200
  7. curl -v --insecure http://172.20.0.113:30484/
  8. # 返回404

删除nginx-ingress

  1. helm delete --purge nginx-ingress

使用--purge参数可以彻底删除release不留下记录,否则下一次部署的时候不能使用重名的release。

参考

Ingress-nginx github

Nginx chart configuration

使用Helm管理kubernetes应用