K8s发现和负载均衡-Ingress

基于1.25

什么是Ingress

对集群中服务的外部访问进行管理的API对象，典型的访问时间是HTTP

  • Ingress：提供了负载均衡、SSL终结和基于名称的虚拟托管
  • Ingress公开集群外部到集群内部的HTTP服务和HTTPS路由
  • Inress不会随意公开端口和协议

仅仅创建Ingress不会有效果，需要Ingress控制器

IngressSpec

// IngressSpec describes the Ingress the user wishes to exist.
type IngressSpec struct {
	// IngressClassName is the name of an IngressClass cluster resource. Ingress
	// controller implementations use this field to know whether they should be
	// serving this Ingress resource, by a transitive connection
	// (controller -> IngressClass -> Ingress resource). Although the
	// `kubernetes.io/ingress.class` annotation (simple constant name) was never
	// formally defined, it was widely supported by Ingress controllers to create
	// a direct binding between Ingress controller and Ingress resources. Newly
	// created Ingress resources should prefer using the field. However, even
	// though the annotation is officially deprecated, for backwards compatibility
	// reasons, ingress controllers should still honor that annotation if present.
	// +optional
  // 集群支持部署多个Ingress控制器，声明使用哪个控制器（替代了最早的kubernetes.io/ingress.class注解功能）
	IngressClassName *string `json:"ingressClassName,omitempty" protobuf:"bytes,4,opt,name=ingressClassName"`

	// DefaultBackend is the backend that should handle requests that don't
	// match any rule. If Rules are not specified, DefaultBackend must be specified.
	// If DefaultBackend is not set, the handling of requests that do not match any
	// of the rules will be up to the Ingress controller.
	// +optional
  // 处理不匹配任何规则的请求后端
	DefaultBackend *IngressBackend `json:"defaultBackend,omitempty" protobuf:"bytes,1,opt,name=defaultBackend"`

	// TLS configuration. Currently the Ingress only supports a single TLS
	// port, 443. If multiple members of this list specify different hosts, they
	// will be multiplexed on the same port according to the hostname specified
	// through the SNI TLS extension, if the ingress controller fulfilling the
	// ingress supports SNI.
	// +listType=atomic
	// +optional
  // TLS配置，目前Ingress只支持一个TLS443
  // 如果这个列表的多个成员，指定的主机不同，实现的入口的控制器支持SNI
	TLS []IngressTLS `json:"tls,omitempty" protobuf:"bytes,2,rep,name=tls"`

	// A list of host rules used to configure the Ingress. If unspecified, or
	// no rule matches, all traffic is sent to the default backend.
	// +listType=atomic
	// +optional
  // 配置Ingress的主机规则列表
  // 每日匹配和指定，流量都转发到默认后端
	Rules []IngressRule `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
}

Ingress控制器

Ingress控制器不随着K8s启动安装

K8s官网支持维护的Ingress控制器

  • Kubernetes 作为一个项目，目前支持和维护 AWS、 GCE 和 Nginx Ingress 控制器

第三方Ingress：

Ingress-Nginx

根据配置的Ingress资源，生成nginx.config文件

  • 防止错误，通过nginx -t 校验通过之后才能实现添加到etcd中
  • Ingress-Nginx:使用lua-nginx-module模块实现PodIP地址频繁变化但是不需要频繁添加加载到Nginx
    • 在每个端点更改的时候，Ingress-nginx先获取端点生成配置文件
    • 再把对象发送到Lua程序
    • Lua程序通过balancer_by_lua检测每个请求从哪些个端点选择上游对等点
    • 这样会只影响了 nginx的upstream，节省了nginx加载时间
  • 由于使用了动态的upstream能力，查看nginx.config无法看到PodIP信息
    • 可以通过curl -s https://127.0.0.1:10246/configuration/backends查看当前动态生成完整的PodIP信息

​