ingress-nginx

wget https://github.com/kubernetes/ingress-nginx/releases/download/helm-chart-4.12.0/ingress-nginx-4.12.0.tgz
tar -zxvf ingress-nginx-4.12.0.tgz

修改配置

hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
kind: DaemonSet
关闭 digest
ingressClassResource.default: true

相关镜像

docker pull registry.k8s.io/ingress-nginx/controller:v1.12.0
docker pull registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0

安装ingress

kubectl create ns ingress
cd ingress-nginx
helm install ingress-nginx -n ingress . -f values.yaml

ingress-nginx 代理

http代理

deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-http-proxy-www1
spec:
  replicas: 2
  selector:
    matchLabels:
      hostname: www1
  template:
    metadata:
      labels:
        hostname: www1
    spec:
      containers:
        - name: nginx
          image: nginx:1.27.2
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: ingress-http-proxy-www1
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    hostname: www1
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-http-proxy-www1
spec:
  ingressClassName: nginx
  rules:
    - host: www1.zbzly.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-http-proxy-www1
                port:
                  number: 80

https代理

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 \
-keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"

kubectl create secret tls ingress-nginx-tls --key tls.key --cert tls.crt

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-https-proxy-www1
spec:
  replicas: 2
  selector:
    matchLabels:
      hostname: ssl
  template:
    metadata:
      labels:
        hostname: ssl
    spec:
      containers:
        - name: nginx
          image: nginx:1.27.2
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: ingress-https-proxy-www1
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  selector:
    hostname: ssl

ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-https-proxy-www1
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
    - host: ssl.zbzly.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-https-proxy-www1
                port:
                  number: 80
  tls:
    - hosts:
        - ssl.zbzly.com
      secretName: ingress-nginx-tls

Ingress-nginx BasicAuth代理

dnf install -y httpd-tools
htpasswd -c  auth zbzly
kubectl create secret generic ingress-with-basic-auth --from-file=auth

cat ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-with-basic-auth
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: ingress-with-basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - zbzly'
spec:
  ingressClassName: nginx
  rules:
    - host: auth.zbzly.com
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: ingress-http-proxy-auth
                port:
                  number: 80

Ingress-nginx 重定向

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: redirect.zbzly.com
  namespace: default
  annotations:
    #kubectl.kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/permanent-redirect: "https://www.zbzly.com"
    nginx.ingress.kubernetes.io/permanent-redirect-code: "301"
spec:
  ingressClassName: "nginx"
  rules:
    - host: redirect.zbzly.com
      http:

Ingress 默认错误后端

helm uninstall ingress-nginx -n ingress
#修改values.yaml
#defaultBackend.enabled: true
#修改相关镜像 端口