安装Nginx ingress

Nginx ingress 使用ConfigMap来管理Nginx配置，nginx是大家熟知的代理和负载均衡软件，比起Traefik来说功能更加强大.

我们使用helm来部署，chart保存在私有的仓库中，请确保您已经安装和配置好helm，helm安装使用见使用Helm管理kubernetes应用。

镜像准备

安装时需要用到的镜像有：

  • sophos/nginx-vts-exporter:v0.6
  • gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15
  • gcr.io/google_containers/defaultbackend:1.3

gcr.io中的那个两个镜像我复制了一份到时速云，可供大家下载：

  • index.tenxcloud.com/jimmy/defaultbackend:1.3
  • index.tenxcloud.com/jimmy/nginx-ingress-controller:0.9.0-beta.15

Docker hub上的那个镜像可以直接下载，所有的安装时需要的配置保存在../manifests/nginx-ingress目录下。

步骤详解

安装nginx-ingress chart到本地repo中

修改values.yaml配置，启用RBAC支持，相关配置见nginx-ingress chart。

  1. helm package .

查看niginx-ingress

  1. $ helm search nginx-ingress
  2. NAME                    VERSION    DESCRIPTION
  3. local/nginx-ingress     0.8.9      An nginx Ingress controller that uses ConfigMap...
  4. stable/nginx-ingress    0.8.9      An nginx Ingress controller that uses ConfigMap...
  5. stable/nginx-lego       0.3.0      Chart for nginx-ingress-controller and kube-lego

使用helm部署nginx-ingress

  1. $ helm install --name nginx-ingress local/nginx-ingress
  2. NAME:   nginx-ingress
  3. LAST DEPLOYED: Fri Oct 27 18:26:58 2017
  4. NAMESPACE: default
  5. STATUS: DEPLOYED
  7. RESOURCES:
  8. ==> rbac.authorization.k8s.io/v1beta1/Role
  9. NAME                         KIND
  10. nginx-ingress-nginx-ingress  Role.v1beta1.rbac.authorization.k8s.io
  12. ==> rbac.authorization.k8s.io/v1beta1/RoleBinding
  13. nginx-ingress-nginx-ingress  RoleBinding.v1beta1.rbac.authorization.k8s.io
  15. ==> v1/Service
  16. NAME                                         CLUSTER-IP      EXTERNAL-IP  PORT(S)                     AGE
  17. nginx-ingress-nginx-ingress-controller       10.254.100.108  <nodes>      80:30484/TCP,443:31053/TCP  1s
  18. nginx-ingress-nginx-ingress-default-backend  10.254.58.156   <none>       80/TCP                      1s
  20. ==> extensions/v1beta1/Deployment
  21. NAME                                         DESIRED  CURRENT  UP-TO-DATE  AVAILABLE  AGE
  22. nginx-ingress-nginx-ingress-default-backend  1        1        1           0          1s
  23. nginx-ingress-nginx-ingress-controller       1        1        1           0          1s
  25. ==> v1/ConfigMap
  26. NAME                                    DATA  AGE
  27. nginx-ingress-nginx-ingress-controller  1     1s
  29. ==> v1/ServiceAccount
  30. NAME                         SECRETS  AGE
  31. nginx-ingress-nginx-ingress  1        1s
  33. ==> rbac.authorization.k8s.io/v1beta1/ClusterRole
  34. NAME                         KIND
  35. nginx-ingress-nginx-ingress  ClusterRole.v1beta1.rbac.authorization.k8s.io
  37. ==> rbac.authorization.k8s.io/v1beta1/ClusterRoleBinding
  38. nginx-ingress-nginx-ingress  ClusterRoleBinding.v1beta1.rbac.authorization.k8s.io
  41. NOTES:
  42. The nginx-ingress controller has been installed.
  43. Get the application URL by running these commands:
  44.   export HTTP_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[0].nodePort}" nginx-ingress-nginx-ingress-controller)
  45.   export HTTPS_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[1].nodePort}" nginx-ingress-nginx-ingress-controller)
  46.   export NODE_IP=$(kubectl --namespace default get nodes -o jsonpath="{.items[0].status.addresses[1].address}")
  48.   echo "Visit http://$NODE_IP:$HTTP_NODE_PORT to access your application via HTTP."
  49.   echo "Visit https://$NODE_IP:$HTTPS_NODE_PORT to access your application via HTTPS."
  51. An example Ingress that makes use of the controller:
  53.   apiVersion: extensions/v1beta1
  54.   kind: Ingress
  55.   metadata:
  56.     annotations:
  57.       kubernetes.io/ingress.class: nginx
  58.     name: example
  59.     namespace: foo
  60.   spec:
  61.     rules:
  62.       - host: www.example.com
  63.         http:
  64.           paths:
  65.             - backend:
  66.                 serviceName: exampleService
  67.                 servicePort: 80
  68.               path: /
  69.     # This section is only required if TLS is to be enabled for the Ingress
  70.     tls:
  71.         - hosts:
  72.             - www.example.com
  73.           secretName: example-tls
  75. If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
  77.   apiVersion: v1
  78.   kind: Secret
  79.   metadata:
  80.     name: example-tls
  81.     namespace: foo
  82.   data:
  83.     tls.crt: <base64 encoded cert>
  84.     tls.key: <base64 encoded key>
  85.   type: kubernetes.io/tls

访问Nginx

首先获取Nginx的地址，从我们使用helm安装nginx-ingress命令的输出中那个可以看到提示，根据提示执行可以看到nginx的http和https地址：

  1.   export HTTP_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[0].nodePort}" nginx-ingress-nginx-ingress-controller)
  2.   export HTTPS_NODE_PORT=$(kubectl --namespace default get services -o jsonpath="{.spec.ports[1].nodePort}" nginx-ingress-nginx-ingress-controller)
  3.   export NODE_IP=$(kubectl --namespace default get nodes -o jsonpath="{.items[0].status.addresses[1].address}")
  5.   echo "Visit http://$NODE_IP:$HTTP_NODE_PORT to access your application via HTTP."
  6.   echo "Visit https://$NODE_IP:$HTTPS_NODE_PORT to access your application via HTTPS."
  7.   Visit http://172.20.0.113:30484 to access your application via HTTP.
  8.   Visit https://172.20.0.113:31053 to access your application via HTTPS.

我们分别在http和https地址上测试一下：

  • /healthz返回200
  • /返回404错误
  1. curl -v http://172.20.0.113:30484/healthz
  2. # 返回200
  3. curl -v http://172.20.0.113:30484/
  4. # 返回404
  5. curl -v --insecure http://172.20.0.113:30484/healthz
  6. # 返回200
  7. curl -v --insecure http://172.20.0.113:30484/
  8. # 返回404

删除nginx-ingress

  1. helm delete --purge nginx-ingress

使用--purge参数可以彻底删除release不留下记录，否则下一次部署的时候不能使用重名的release。

参考

Ingress-nginx github

Nginx chart configuration

使用Helm管理kubernetes应用