安裝Ingress Controller

Ingress Controller運行於k8s叢集的容器內，既讓每臺node監聽80和443埠，為來自叢集外部的請求提供反向代理，又能實時監聽叢集內Ingress配置，自動更新反向代理規則。

部署default http backend

nginx ingress controller要求有一個預設的http服務給它進行測試。
注意替換命令中的image下載路徑

cat <<EOF | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: Deployment
metadata
 
:
  name: default-http-backend
  labels:
    k8s-app: default-http-backend
  namespace: kube-system
spec:
  replicas: 1
  template:
    metadata:
      labels:
        k8s-app: default-http-backend
    spec:
      terminationGracePeriodSeconds: 60
      containers:
      - name: default-http-backend
        # Any
 
 image is permissable as long as:
        # 1. It serves a 404 page at /
        # 2. It serves 200 on a /healthz endpoint
        image: centos-master:5000/defaultbackend:1.0
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 30
 

          timeoutSeconds: 5
        ports:
        - containerPort: 8080
        resources:
          limits:
            cpu: 10m
            memory: 20Mi
          requests:
            cpu: 10m
            memory: 20Mi
---
apiVersion: v1
kind: Service
metadata:
  name: default-http-backend
  namespace: kube-system
  labels:
    k8s-app: default-http-backend
spec:
  ports:
  - port: 80
    targetPort: 8080
  selector:
    k8s-app: default-http-backend
EOF

部署nginx ingress controller

使用DaemonSet讓每臺node都執行一個反向代理，都開通80和443埠接受叢集外的請求。

cat <<EOF | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: nginx-ingress-controller
  labels:
    k8s-app: nginx-ingress-controller
  namespace: kube-system
spec:
  template:
    metadata:
      labels:
        k8s-app: nginx-ingress-controller
      annotations:
        prometheus.io/port: '10254'
        prometheus.io/scrape: 'true'
    spec:
      # hostNetwork makes it possible to use ipv6 and to preserve the source IP correctly regardless of docker configuration
      # however, it is not a hard dependency of the nginx-ingress-controller itself and it may cause issues if port 10254 already is taken on the host
      # that said, since hostPort is broken on CNI (https://github.com/kubernetes/kubernetes/issues/31307) we have to use hostNetwork where CNI is used
      # like with kubeadm
      # hostNetwork: true
      terminationGracePeriodSeconds: 60
      containers:
      - image: centos-master:5000/nginx-ingress-controller:0.8.3
        name: nginx-ingress-controller
        readinessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
        livenessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          timeoutSeconds: 1
        ports:
        - containerPort: 80
          hostPort: 80
        - containerPort: 443
          hostPort: 443
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        args:
        - /nginx-ingress-controller
        - --default-backend-service=\$(POD_NAMESPACE)/default-http-backend
EOF

安裝並訪問kubernetes dashboard

dashboard讓管理員在web頁面上檢視k8s叢集的狀態、容器的日誌。

部署dashboard

這裡通過設定NodePort來監聽node的30090埠的配置並不是必要的，因為已有nginx ingress controller提供的反向代理。

cat <<EOF | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: kube-dashboard
  namespace: kube-system
  labels:
    k8s-app: kube-dashboard
    version: v1.6.0
    kubernetes.io/cluster-service: "true"
spec:
  replicas: 1
  template:
    metadata:
      labels:
        k8s-app: kube-dashboard
        version: v1.6.0
        kubernetes.io/cluster-service: "true"
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
    spec:
      containers:
      - name: kube-dashboard
        image: centos-master:5000/kubernetes-dashboard-amd64:v1.6.0
        resources:
          limits:
            cpu: 100m
            memory: 50Mi
          requests:
            cpu: 100m
            memory: 50Mi
        ports:
        - containerPort: 9090
        livenessProbe:
          httpGet:
            path: /
            port: 9090
          initialDelaySeconds: 30
          timeoutSeconds: 30
---
apiVersion: v1
kind: Service
metadata:
  name: kube-dashboard
  namespace: kube-system
  labels:
    k8s-app: kube-dashboard
    kubernetes.io/cluster-service: "true"
spec:
  type: NodePort
  selector:
    k8s-app: kube-dashboard
  ports:
  - port: 80
    targetPort: 9090
    nodePort: 30090
EOF

配置ingress

ingress目前提供HTTP層的負載均衡配置，可根據HTTP請求裡的host+路徑，把請求轉發給叢集內的相應Service。

cat <<EOF | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kube-dashboard-ingress
  namespace: kube-system
spec:
  rules:
    - host: dashboard.wzp.local
      http:
        paths:
          - backend:
              serviceName: kube-dashboard
              servicePort: 80
EOF

在windows機器上訪問dashboard網站

在hosts檔案裡，把上述ingress裡指定的域名的IP配置為某臺node的IP，即可訪問dashboard網站。
在生產環境裡，可能就要更新子域名伺服器，讓其解析子域名到node的IP。