Kubernetes: k8s 运维篇-服务发布Ingress进阶

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml

apiVersion: v1
items:
- apiVersion: extensions/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/permanent-redirect: https://www.baidu.com   # 301重定向到想去的url
    name: ingress-test
    namespace: ratel-test1
  spec:
    rules:
    - host: ingress.test.com
      http:
        paths:
        - backend:
            serviceName: ingress-test
            servicePort: 80
          path: /

# 创建ingress
kubectl edit ingress-demo.yaml

# entry 容器查看
kubectl get po -n ingress-nginx
kubectl exec -it nginx-ingress-controller-b2442 -n ingress-nginx -- bash
cat /etc/nginx/nginx.conf

$ echo '
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
  name: rewrite
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: rewrite.bar.com
    http:
      paths:
      - path: /something(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: http-svc
            port: 
              number: 80
' | kubectl create -f -

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ${KEY_FILE} -out ${CERT_FILE} -subj "/CN=${HOST}/O=${HOST}"

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls-key -out tls.cert -subj "/CN=test-tls.test.com/O=test-tls.test.com"

# create the secret in the cluster via
kubectl create secret tls ca-cert --key tls.key --cert tls.cert -n ratel-test1

echo '
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    #kubernetes.io/ingress.class: nginx-example
    nginx.ingress.kubernetes.io/ssl-redirect: "false"   # 禁用https强制跳转
  name: tls-example-ingress
spec:
  ingressClassName: nginx-example
  tls:
  - hosts:
      - https-example.foo.com
    secretName: testsecret-tls
  rules:
  - host: https-example.foo.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: service1
            port:
              number: 80
' | kubectl create -f -

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  labels:
    app.kubernetes.io/component: controller
  name: nginx-example
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"
spec:
  controller: k8s.io/ingress-nginx

apiVersion: extensions/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"   # 禁用https强制跳转
  generation: 1
  name: test-tls
  namespace: ratel-test1
spec:
  rules:
  - host: test-tls.test.com
    http:
      paths:
      - backend:
          serviceName: ingress-test
          servicePort: 80
        path: /
  tls:
  - hosts:
    - test-tls.test.com
    secretName: ca-cert

containers:
- args:
  - --auto-generate-certificates=false
  - --tls-key-file=server.key
  - --tls-cert-file=server.pem
  - --token-ttl=21600
  - --authentication-mode=basic,token
  - --namespace=kubernetes-dashboard
  image: kubernetesui/dashboard:v2.0.0-rc5
  imagePullPolicy: Always

  volumeMounts:
  - mountPath: /certs
    name: kubernetes-dashboard-new
  - mountPath: /tmp
    name: tmp-volume

volumes:
- name: kubernetes-dashboard-new
  secret:
    defaultMode: 420
    secretName: kubernetes-dashboard-new
- emptyDir: {}
  name: tmp-volume

nginx.ingress.kubernetes.io/server-snippet: |
  set $agentflag 0;
  if ($http_user_agent ~* "(Android|iPhone|Windows|Phone|UC|Kindel)"){
    set $agentflag 1;
  }
  if ($agentflab = 1){
    return 301 http://m.test.com;
  }

[root@k8s-master01 ~]# htpasswd -c auth foo   # 账号foo   密码 123456   
New password:              # 123456
Re-type new password:      # 123456
Adding password for user foo

# 生成一个auth文件
[root@k8s-master01 ~]# ls auth
auth

[root@k8s-master01 ~]# kubectl create secret generic basic-auth --from-file=auth
secret/basic-auth created
[root@k8s-master01 ~]# kubectl get secret basic-auth -o yaml
apiVersion: v1
data:
  auth: Zm9vOiRhcHIxJGZzREw0b0xmJHNuUUNDTFkxbTE2N1BkNUdEMHIwcC8K
kind: Secret
metadata:
  name: basic-auth
  namespace: default
type: Opaque

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-with-auth
  annotations:
    # 认证类型
    nginx.ingress.kubernetes.io/auth-type: basic
    # 包含 user/password 定义的 secret 对象名
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    # 要显示的带有适当上下文的消息，说明需要身份验证的原因
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - foo'
spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - path: /
        backend:
          serviceName: my-nginx
          servicePort: 80

➜ curl -v http://k8s.qikqiak.com -H 'Host: foo.bar.com'
'* Rebuilt URL to: http://k8s.qikqiak.com/
'*   Trying 123.59.188.12...
'* TCP_NODELAY set
'* Connected to k8s.qikqiak.com (123.59.188.12) port 80 (#0)
> GET / HTTP/1.1
> Host: foo.bar.com
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Server: openresty/1.15.8.2
< Date: Sun, 08 Dec 2019 06:44:35 GMT
< Content-Type: text/html
< Content-Length: 185
< Connection: keep-alive
< WWW-Authenticate: Basic realm="Authentication Required - foo"
<
<html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>openresty/1.15.8.2</center>
</body>
</html>

➜ curl -v http://k8s.qikqiak.com -H 'Host: foo.bar.com' -u 'foo:foo'
'* Rebuilt URL to: http://k8s.qikqiak.com/
'*   Trying 123.59.188.12...
'* TCP_NODELAY set
'* Connected to k8s.qikqiak.com (123.59.188.12) port 80 (#0)
'* Server auth using Basic with user 'foo'
> GET / HTTP/1.1
> Host: foo.bar.com
> Authorization: Basic Zm9vOmZvbw==
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: openresty/1.15.8.2
< Date: Sun, 08 Dec 2019 06:46:27 GMT
< Content-Type: text/html
< Content-Length: 612
< Connection: keep-alive
< Vary: Accept-Encoding
< Last-Modified: Tue, 19 Nov 2019 12:50:08 GMT
< ETag: "5dd3e500-264"
< Accept-Ranges: bytes
<
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

nginx.ingress.kubernetes.io/limit-connections 1 # 连接数只有一个
nginx.ingress.kubernetes.io/limit-rps 1 # 每秒请求数

nginx.ingress.kubernetes.io/server-snippet:
  error_page 404 https://www.baidu.com # 如果访问不存在，跳转到baidu
  # 和nginx的配置没有区别

    spec:
      containers:
      - args:
       - --enable-metrics=true

        ports:
        - containerPort: 10254
          name: prometheus
          protocol: TCP

kind: Service
  namespace: ingress-nginx-prod
spec:
  ports:
  - name: prometheus
    port: 10254
    protocol: TCP

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cici
  namespace: dev
spec:
  ingressClassName: nginx-dev
  rules: #多域名指向同一后端
  - host: cicitest.xxx.online
    http: &cici_rules
      paths:
      - backend:
          service:
            name: cici-svc
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
  - host: ci-kjr6wutest.xxx.online
    http: *cici_rules
  - host: ci-vnioustest.xxx.online
    http: *cici_rules

---
apiVersion: v1
data:
  enable-underscores-in-headers: "true"  #识别有_下划线的http头部
  allow-snippet-annotations: "true"      #开启所有注释配置
  #设置全局缓存
  http-snippet: |-
    proxy_cache_path /tmp/section_group_test levels=1:2 keys_zone=section_group_test:20m inactive=7d max_size=1g;
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx-dev
    app.kubernetes.io/name: ingress-nginx-dev
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.10.1
  name: ingress-nginx-controller
  namespace: ingress-nginx-dev

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 50M
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    #nginx.ingress.kubernetes.io/http-snippet: |
    #    proxy_cache_path /tmp/api_cache/section_group_test levels=1:2 keys_zone=section_group_test:20m inactive=7d max_size=1g;
    #modify ingress-controler configmap
    nginx.ingress.kubernetes.io/server-snippet: |
        location ~* /api/actuator {
            deny all;
        }
        location ^~ /app/complain {
                return 200;
        }
        location /xc/episodic_drama/dramas/app/compilations_40.txt {
                proxy_pass http://xxxxokio41x-us-west-2c.s3.us-west-2.vpce.amazonaws.com;
        }
        location = /xc/section_group {
                add_header X-Cache $upstream_cache_status;
                proxy_cache section_group_test;
                proxy_cache_methods GET POST;
                proxy_cache_valid  200 206 304 301 302 1m;
                proxy_cache_key $scheme$http_origin$request_method$uri$http_client_id$arg_sectionGroupTypeValue;
                proxy_pass http://xc-server-svc.dev1:80/;
        }
    nginx.ingress.kubernetes.io/configuration-snippet: |
        add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains;' always;
  name: xc
  namespace: dev
spec:
  ingressClassName: nginx-dev
  rules:
  - host: xc.xxx.online
    http:
      paths:
      - backend:
          service:
            name: xc-server-svc
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific

#ingress 的 中新增如下内容，可以通过request_uri按需配置指定文件的cache control：
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: >
      more_set_headers "cache-Control: no-cache, no-store"; if ($request_uri ~*
      \.(?:ico|css|js|gif|jpe?g|png|svg|woff2|woff|ttf|eo|mp3|glb)$) {
        more_set_headers "cache-control: public, max-age=2592000";
      }

apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-configuration
data:
  use-gzip: "true"
  gzip-level: "6"

apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-configuration
data:
  enable-brotli: "true"
  brotli-level: "6"

---
apiVersion: v1
data:
  compute-full-forwarded-for: "true"
  forwarded-for-header: "X-Forwarded-For"
  use-forwarded-headers: "true"
kind: ConfigMap

#service
spec:
  ports:
  - name: prometheus
    port: 10254
    protocol: TCP
#deployment
    spec:
      containers:
      - args:
        - --enable-metrics=true
        ports:
        - containerPort: 10254
          name: prometheus
          protocol: TCP

---
#ingress-nginx
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: ingress-nginx-dev
  namespace: monitoring
  labels:
     app.kubernetes.io/name: ingress-nginx-dev
    app.kubernetes.io/instance: ingress-nginx-dev
    release: prometheus
spec:
  endpoints:
    - path: /metrics
      port: prometheus
      #interval: 15s
  namespaceSelector:
    matchNames:
      - ingress-nginx-dev
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx-dev
      app.kubernetes.io/name: ingress-nginx-dev
      app.kubernetes.io/part-of: ingress-nginx
      app.kubernetes.io/version: 1.10.1

helm show values ingress-nginx --repo https://kubernetes.github.io/ingress-nginx
helm pull ingress-nginx --repo https://kubernetes.github.io/ingress-nginx

helm upgrade --install ingress-nginx ingress-nginx \
--repo https://kubernetes.github.io/ingress-nginx \
-n default-info \
--create-namespace \
--set controller.metrics.enabled=true \
--set-string controller.podAnnotations."prometheus\.io/scrape"="true" \
--set-string controller.podAnnotations."prometheus\.io/port"="10254"  --dry-run -oyaml