当前位置：首页 > news >正文

四、kubernetes中的微服务

news 2025/2/22 16:58:12

一什么是微服务

二微服务的类型

三 ipvs模式

3.1 ipvs模式配置方式

四微服务类型详解

4.1 clusterip

4.2 ClusterIP中的特殊模式headless

4.3 nodeport

4.4 loadbalancer

4.5 metalLB

4.6 externalname

五 Ingress-nginx

5.1 ingress-nginx功能

5.2 部署ingress

5.2.1 下载部署文件

5.2.2 安装ingress

5.2.3 测试ingress

5.3 ingress 的高级用法

5.3.1 基于路径的访问

5.3.2 基于域名的访问

5.3.3 建立tls加密

5.3.4 建立auth认证

5.3.5 rewrite重定向

六 Canary金丝雀发布

6.1 么是金丝雀发布

6.2 Canary发布方式

6.2.1 基于header（http包头）灰度

6.2.2 基于权重的灰度发布

一什么是微服务

用控制器来完成集群的工作负载，那么应用如何暴漏出去？需要通过微服务暴漏出去后才能被访问

Service是一组提供相同服务的Pod对外开放的接口。
借助Service，应用可以实现服务发现和负载均衡。
service默认只支持4层负载均衡能力，没有7层功能。（可以通过Ingress实现）

二微服务的类型

微服务类型	作用描述
ClusterIP	默认值，k8s系统给service自动分配的虚拟IP，只能在集群内部访问
NodePort	将Service通过指定的Node上的端口暴露给外部，访问任意一个NodeIP:nodePort都将路由到ClusterIP
LoadBalancer	在NodePort的基础上,借助cloud provider创建一个外部的负载均衡器，并将请求转发到 NodeIP:NodePort，此模式只能在云服务器上使用
ExternalName	将服务通过 DNS CNAME 记录方式转发到指定的域名（通过 spec.externlName 设定

示例：

#生成控制器文件并建立控制器
[root@k8s-master ~]# kubectl create deployment test --image luohailin/myapp:v1  --replicas 2 --dry-run=client -o yaml > test.yaml#生成微服务yaml追加到已有yaml中
[root@k8s-master ~]# kubectl expose deployment test --port 80 --target-port 80 --dry-run=client -o yaml >> test.yaml[root@k8s-master ~]# cat test.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:labels:app: testname: test
spec:replicas: 2selector:matchLabels:app: testtemplate:metadata:creationTimestamp: nulllabels:app: testspec:containers:- image: luohailin/myapp:v1name: myapp
---apiVersion: v1
kind: Service
metadata:labels:app: testname: test
spec:ports:- port: 80protocol: TCPtargetPort: 80selector:app: test[root@k8s-master ~]# kubectl apply -f test.yaml
deployment.apps/test created
service/test created[root@k8s-master ~]# kubectl get services
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.96.0.1       <none>        443/TCP   12h
test         ClusterIP   10.104.200.11   <none>        80/TCP    41s#微服务默认使用iptables调度
[root@k8s-master ~]# kubectl get services -o wide 
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE   SELECTOR
kubernetes   ClusterIP   10.96.0.1       <none>        443/TCP   12h   <none>
test         ClusterIP   10.104.200.11   <none>        80/TCP    59s   app=test#可以在火墙中查看到策略信息
[root@k8s-master ~]# iptables -t nat -nL
Chain KUBE-SERVICES (2 references)
target     prot opt source               destination         
KUBE-SVC-NPX46M4PTMTKRN6Y  6    --  0.0.0.0/0            10.96.0.1            /* default/kubernetes:https cluster IP */ tcp dpt:443
KUBE-SVC-HQOVHX4BQRA7XPPR  6    --  0.0.0.0/0            10.104.200.11        /* default/test cluster IP */ tcp dpt:80

三 ipvs模式

Service 是由 kube-proxy 组件，加上 iptables 来共同实现的
kube-proxy 通过 iptables 处理 Service 的过程，需要在宿主机上设置相当多的 iptables 规则，如果宿主机有大量的Pod，不断刷新iptables规则，会消耗大量的CPU资源
IPVS模式的service，可以使K8s集群支持更多量级的Pod

3.1 ipvs模式配置方式

1 在所有节点中安装ipvsadm

[root@k8s-所有节点 pod]yum install ipvsadm –y

2 修改master节点的代理配置

[root@k8s-master ~]# kubectl -n kube-system edit cm kube-proxy metricsBindAddress: ""mode: "ipvs"							#设置kube-proxy使用ipvs模式nftables:

3 重启pod，在pod运行时配置文件中采用默认配置，当改变配置文件后已经运行的pod状态不会变化，所以要重启pod

[root@k8s-master ~]# kubectl -n kube-system get  pods   | awk '/kube-proxy/{system("kubectl -n kube-system delete pods "$1)}'
pod "kube-proxy-2kdmt" deleted
pod "kube-proxy-7hg4w" deleted
pod "kube-proxy-hmwvj" deleted
[root@k8s-master ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags-> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  10.96.0.1:443 rr-> 172.25.254.100:6443          Masq    1      0          0         
TCP  10.96.0.10:53 rr
TCP  10.96.0.10:9153 rr
TCP  10.104.200.11:80 rr-> 10.244.1.3:80                Masq    1      0          0         
UDP  10.96.0.10:53 rr

切换ipvs模式后，kube-proxy会在宿主机上添加一个虚拟网卡：kube-ipvs0，并分配所有service IP

[root@k8s-master ~]# ip a | tailinet 172.17.0.1/16 brd 172.17.255.255 scope global docker0valid_lft forever preferred_lft forever
4: kube-ipvs0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default link/ether 32:a9:37:c6:f5:23 brd ff:ff:ff:ff:ff:ffinet 10.96.0.1/32 scope global kube-ipvs0valid_lft forever preferred_lft foreverinet 10.104.200.11/32 scope global kube-ipvs0valid_lft forever preferred_lft foreverinet 10.96.0.10/32 scope global kube-ipvs0valid_lft forever preferred_lft forever

四微服务类型详解

4.1 clusterip

特点：

clusterip模式只能在集群内访问，并对集群内的pod提供健康检测和自动发现功能

示例：

[root@k8s-master ~]# vim test.yaml 
[root@k8s-master ~]# kubectl apply -f test.yaml 
deployment.apps/test unchanged
service/test configured
[root@k8s-master ~]# dig test.default.svc.cluster.local @10.96.0.10; <<>> DiG 9.16.23-RH <<>> test.default.svc.cluster.local @10.96.0.10
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50306
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 92ca11a9b3a4a775 (echoed)
;; QUESTION SECTION:
;test.default.svc.cluster.local.	IN	A;; ANSWER SECTION:
test.default.svc.cluster.local.	30 IN	A	10.96.115.55;; Query time: 0 msec
;; SERVER: 10.96.0.10#53(10.96.0.10)
;; WHEN: Fri Sep 06 13:52:17 CST 2024
;; MSG SIZE  rcvd: 117

4.2 ClusterIP中的特殊模式headless

headless（无头服务）

对于无头 Services 并不会分配 Cluster IP，kube-proxy不会处理它们，而且平台也不会为它们进行负载均衡和路由，集群访问通过dns解析直接指向到业务pod上的IP，所有的调度有dns单独完成

[root@k8s-master ~]# vim test.yaml 
[root@k8s-master ~]# kubectl apply -f test.yaml 
deployment.apps/test created
service/test created
[root@k8s-master ~]# kubectl get services test 
NAME   TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
test   ClusterIP   None         <none>        80/TCP    8s
[root@k8s-master ~]# dig  test.default.svc.cluster.local @10.96.0.10; <<>> DiG 9.16.23-RH <<>> test.default.svc.cluster.local @10.96.0.10
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5455
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: abd4b26cfe73fe1a (echoed)
;; QUESTION SECTION:
;test.default.svc.cluster.local.	IN	A;; ANSWER SECTION:
test.default.svc.cluster.local.	30 IN	A	10.244.7.3
test.default.svc.cluster.local.	30 IN	A	10.244.8.4;; Query time: 1 msec
;; SERVER: 10.96.0.10#53(10.96.0.10)
;; WHEN: Sat Sep 07 16:14:23 CST 2024
;; MSG SIZE  rcvd: 163[root@k8s-master ~]# kubectl run newtest --image luohailin/busybox:latest -it
If you don't see a command prompt, try pressing enter.
/ # 
/ # nslookup test
Server:		10.96.0.10
Address:	10.96.0.10:53Name:	test.default.svc.cluster.local
Address: 10.244.7.3
Name:	test.default.svc.cluster.local
Address: 10.244.8.4[root@k8s-master ~]# kubectl get pods -o wide
NAME                    READY   STATUS    RESTARTS   AGE   IP           NODE                 NOMINATED NODE   READINESS GATES
newtest                 1/1     Running   0          10m   10.244.7.4   k8s-node2.exam.com   <none>           <none>
test-85fc5fd74f-hdkjf   1/1     Running   0          12m   10.244.8.4   k8s-node1.exam.com   <none>           <none>
test-85fc5fd74f-nvk2x   1/1     Running   0          12m   10.244.7.3   k8s-node2.exam.com   <none>           <none>

4.3 nodeport

通过ipvs暴漏端口从而使外部主机通过master节点的对外ip:<port>来访问pod业务

其访问过程为：

示例：

[root@k8s-master ~]# vim test.yaml
apiVersion: apps/v1
kind: Deployment
metadata:labels:app: testname: test
spec:replicas: 2selector:matchLabels:app: testtemplate:metadata:creationTimestamp: nulllabels:app: testspec:containers:- image: luohailin/myapp:v1name: myapp
---apiVersion: v1
kind: Service
metadata:labels:app: testname: test
spec:ports:- port: 80protocol: TCPtargetPort: 80selector:app: testtype: NodePort[root@k8s-master ~]# kubectl apply -f test.yaml 
deployment.apps/test created
service/test created
[root@k8s-master ~]# kubectl get services  timinglee-service
Error from server (NotFound): services "timinglee-service" not found
[root@k8s-master ~]# kubectl get services  test 
NAME   TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
test   NodePort   10.96.115.55   <none>        80:32449/TCP   13s#nodeport在集群节点上绑定端口，一个端口对应一个服务
[root@k8s-master ~]# for i in {1..5}; do curl 172.25.254.100:32449/hostname.html; done
test-85fc5fd74f-hth7j
test-85fc5fd74f-hth7j
test-85fc5fd74f-hth7j
test-85fc5fd74f-hth7j
test-85fc5fd74f-hth7j

nodeport默认端口

nodeport默认端口是30000-32767，超出会报错

[root@k8s-master ~]# vim test.yaml
apiVersion: v1
kind: Service
metadata:labels:app: test-servicename: test-service
spec:ports:- port: 80protocol: TCPtargetPort: 80nodePort: 33333selector:app: testtype: NodePort[root@k8s-master ~]# kubectl apply -f test.yaml
deployment.apps/test created
The Service "timinglee-service" is invalid: spec.ports[0].nodePort: Invalid value: 33333: provided port is not in the valid range. The range of valid ports is 30000-32767

如果需要使用这个范围以外的端口就需要特殊设定

[root@k8s-master ~]# vim /etc/kubernetes/manifests/kube-apiserver.yaml- --service-node-port-range=30000-40000

添加“--service-node-port-range=“ 参数，端口范围可以自定义

修改后api-server会自动重启，等apiserver正常启动后才能操作集群

集群重启自动完成在修改完参数后全程不需要人为干预

4.4 loadbalancer

云平台会为我们分配vip并实现访问，如果是裸金属主机那么需要metallb来实现ip的分配

[root@k8s-master ~]# vim test.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:labels:app: testname: test
spec:replicas: 2selector:matchLabels:app: testtemplate:metadata:creationTimestamp: nulllabels:app: testspec:containers:- image: luohailin/myapp:v1name: myapp
---apiVersion: v1
kind: Service
metadata:labels:app: testname: test
spec:ports:- port: 80protocol: TCPtargetPort: 80selector:app: testtype: LoadBalancer[root@k8s-master ~]# kubectl apply -f test.yaml 
deployment.apps/test created
service/test created
[root@k8s-master ~]# kubectl get svc
NAME         TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)        AGE
kubernetes   ClusterIP      10.96.0.1       <none>          443/TCP        18h
test         LoadBalancer   10.110.12.238   172.25.254.50   80:31447/TCP   5s

4.5 metalLB

官网：Installation :: MetalLB, bare metal load-balancer for Kubernetes

metalLB功能

为LoadBalancer分配vip

部署方式

#部署服务
[root@k8s-master ~]# kubectl apply -f metallb-native.yaml
[root@k8s-master ~]# kubectl apply -f test.yaml 
deployment.apps/test created
service/test created
[root@k8s-master ~]# kubectl -n metallb-system get pods
NAME                          READY   STATUS    RESTARTS   AGE
controller-65957f77c8-llmwk   1/1     Running   0          115m
speaker-5szcb                 1/1     Running   0          115m
speaker-p6fmm                 1/1     Running   0          115m
speaker-qrlf4                 1/1     Running   0          115m#配置分配地址段
[root@k8s-master ~]# vim configmap.yml
[root@k8s-master ~]# kubectl apply -f configmap.yml
ipaddresspool.metallb.io/first-pool unchanged
l2advertisement.metallb.io/example unchanged
[root@k8s-master ~]# kubectl get services
NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   18h[root@k8s-master ~]# kubectl get services
NAME         TYPE           CLUSTER-IP       EXTERNAL-IP     PORT(S)        AGE
kubernetes   ClusterIP      10.96.0.1        <none>          443/TCP        18h
test         LoadBalancer   10.108.249.204   172.25.254.50   80:30461/TCP   3s#通过分配地址从集群外访问服务
[root@k8s-master ~]# curl  172.25.254.50
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

4.6 externalname

开启services后，不会被分配IP，而是用dns解析CNAME固定域名来解决ip变化问题
一般应用于外部业务和pod沟通或外部业务迁移到pod内时
在应用向集群迁移过程中，externalname在过度阶段就可以起作用了。
集群外的资源迁移到集群时，在迁移的过程中ip可能会变化，但是域名+dns解析能完美解决此问题

示例：

[root@k8s-master ~]# vim test.yaml 
---apiVersion: v1
kind: Service
metadata:labels:app: testname: test
spec:ports:- port: 80protocol: TCPtargetPort: 80selector:app: testtype: ExternalNameexternalName: www.test.com[root@k8s-master ~]# kubectl apply -f test.yaml 
deployment.apps/test unchanged
service/test configured
[root@k8s-master ~]# kubectl get services  test 
NAME   TYPE           CLUSTER-IP   EXTERNAL-IP    PORT(S)   AGE
test   ExternalName   <none>       www.test.com   80/TCP    6m41s

五 Ingress-nginx

官网：

Installation Guide - Ingress-Nginx Controller

5.1 ingress-nginx功能

一种全局的、为了代理不同后端 Service 而设置的负载均衡服务,支持7层
Ingress由两部分组成：Ingress controller和Ingress服务
Ingress Controller 会根据你定义的 Ingress 对象，提供对应的代理能力。
业界常用的各种反向代理项目，比如 Nginx、HAProxy、Envoy、Traefik 等，都已经为Kubernetes 专门维护了对应的 Ingress Controller。

5.2 部署ingress

5.2.1 下载部署文件

[root@k8s-master  ingress]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.11.2/deploy/static/provider/baremetal/deploy.yaml#打标签
[root@k8s-master ingress]# docker tag reg.harbor.org/ingress-nginx/controller:v1.11.2   www.test.com/ingress-nginx/controller:v1.11.2 
[root@k8s-master ingress]# docker tag reg.harbor.org/ingress-nginx/kube-webhook-certgen:v1.4.3  www.test.com/ingress-nginx/kube-webhook-certgen:v1.4.3#上传到habor
[root@k8s-master ingress]# docker push www.test.com/ingress-nginx/controller:v1.11.2
[root@k8s-master ingress]# docker push www.test.com/ingress-nginx/kube-webhook-certgen:v1.4.3

5.2.2 安装ingress

[root@k8s-master ~]# vim deploy.yaml
445         image: ingress-nginx/controller:v1.11.2
546         image: ingress-nginx/kube-webhook-certgen:v1.4.3
599         image: ingress-nginx/kube-webhook-certgen:v1.4.3[root@k8s-master ~]# kubectl -n ingress-nginx get pods
NAME                                       READY   STATUS      RESTARTS   AGE
ingress-nginx-admission-create-ggqm6       0/1     Completed   0          82s
ingress-nginx-admission-patch-q4wp2        0/1     Completed   0          82s
ingress-nginx-controller-bb7d8f97c-g2h4p   1/1     Running     0          82s
[root@k8s-master ~]# kubectl -n ingress-nginx get svc
NAME                                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx-controller             NodePort    10.103.33.148   <none>        80:34512/TCP,443:34727/TCP   108s
ingress-nginx-controller-admission   ClusterIP   10.103.183.64   <none>        443/TCP                      108s#修改微服务为loadbalancer
[root@k8s-master ~]# kubectl -n ingress-nginx edit svc ingress-nginx-controller
49   type: LoadBalancer[root@k8s-master ~]# kubectl -n ingress-nginx get services
NAME                                 TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.103.33.148   172.25.254.50   80:34512/TCP,443:34727/TCP   4m43s
ingress-nginx-controller-admission   ClusterIP      10.103.183.64   <none>          443/TCP                      4m43s

在ingress-nginx-controller中看到的对外IP就是ingress最终对外开放的ip

5.2.3 测试ingress

#生成yaml文件
[root@k8s-master ingress]# kubectl create ingress myappv1 --class nginx --rule='/=myappv1:80' --dry-run=client -o yaml > ingress1.yml
[root@k8s-master ingress]# vim ingress1.yml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:name: myappv1
spec:ingressClassName: nginxrules:- http:paths:- backend:service:name: myappv1port:number: 80path: /pathType: Prefix#建立ingress控制器
[root@k8s-master ingress]# kubectl apply -f ingress1.yml 
ingress.networking.k8s.io/myappv1 created
[root@k8s-master ingress]# kubectl get ingress
NAME      CLASS   HOSTS   ADDRESS   PORTS   AGE
myappv1   nginx   *                 80      14s
[root@k8s-master ingress]# curl 172.25.254.50
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

ingress必须和输出的service资源处于同一namespace

5.3 ingress 的高级用法

5.3.1 基于路径的访问

1.建立用于测试的控制器myapp

[root@k8s-master app]# kubectl create deployment myapp-v1 --image myapp:v1 --dry-run=client -o yaml > myapp-v1.yaml[root@k8s-master app]# kubectl create deployment myapp-v2 --image myapp:v2 --dry-run=client -o yaml > myapp-v2.yaml[root@k8s-master ingress]# vim myapp-v1.yml 
apiVersion: apps/v1
kind: Deployment
metadata:labels:app: myappv1name: myappv1
spec:replicas: 1selector:matchLabels:app: myappv1template:metadata:labels:app: myappv1spec:containers:- image: www.test.com/luohailin/myapp:v1name: myapp
---        
apiVersion: v1
kind: Service
metadata:labels:app: myappv1name: myappv1
spec:ports:- port: 80protocol: TCPtargetPort: 80selector:app: myappv1[root@k8s-master ingress]# vim myapp-v2.yml 
apiVersion: apps/v1
kind: Deployment
metadata:labels:app: myappv2name: myappv2
spec:replicas: 1selector:matchLabels:app: myappv2template:metadata:labels:app: myappv2spec:containers:- image: www.test.com/luohailin/myapp:v2name: myapp
---
apiVersion: v1
kind: Service
metadata:labels:app: myappv2name: myappv2
spec:ports:- port: 80protocol: TCPtargetPort: 80selector:app: myappv2[root@k8s-master ingress]# kubectl apply -f myapp-v1.yml 
deployment.apps/myappv1 created
service/myappv1 created
[root@k8s-master ingress]# kubectl apply -f myapp-v2.yml 
deployment.apps/myappv2 created
service/myappv2 created[root@k8s-master app]# kubectl expose deployment myapp-v1 --port 80 --target-port 80 --dry-run=client -o yaml >> myapp-v1.yaml[root@k8s-master app]# kubectl expose deployment myapp-v2 --port 80 --target-port 80 --dry-run=client -o yaml >> myapp-v1.yaml[root@k8s-master ingress]# kubectl get services
NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
kubernetes   ClusterIP   10.96.0.1      <none>        443/TCP   2d12h
myappv1      ClusterIP   10.101.147.9   <none>        80/TCP    61m
myappv2      ClusterIP   10.97.253.80   <none>        80/TCP    61m

2.建立ingress的yaml

[root@k8s-master app]# vim ingress1.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/rewrite-target: /		#访问路径后加任何内容都被定向到/name: ingress1
spec:ingressClassName: nginxrules:- host: www.test.comhttp:paths:- backend:service:name: myapp-v1port:number: 80path: /v1pathType: Prefix- backend:service:name: myapp-v2port:number: 80path: /v2pathType: Prefix#测试：
[root@reg ~]# echo 172.25.254.50 www.test.com >> /etc/hosts[root@reg ~]# curl  www.test.com/v1
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@reg ~]# curl  www.test.com/v2
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>#nginx.ingress.kubernetes.io/rewrite-target: / 的功能实现
[root@reg ~]# curl  www.test.com/v2/aaaa
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>

5.3.2 基于域名的访问

#在测试主机中设定解析
[root@reg ~]# vim /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.200 www.test.com
172.25.254.50  reg.test.com myappv1.test.org myappv2.test.org# 建立基于域名的yml文件
[root@k8s-master app]# vim ingress2.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/rewrite-target: /name: ingress2
spec:ingressClassName: nginxrules:- host: myappv1.test.orghttp:paths:- backend:service:name: myapp-v1port:number: 80path: /pathType: Prefix- host: myappv2.test.orghttp:paths:- backend:service:name: myapp-v2port:number: 80path: /pathType: Prefix#利用文件建立ingress
[root@k8s-master app]# kubectl apply -f ingress2.yml
ingress.networking.k8s.io/ingress2 created[root@k8s-master app]# kubectl describe ingress ingress2
Name:             ingress2
Labels:           <none>
Namespace:        default
Address:
Ingress Class:    nginx
Default backend:  <default>
Rules:Host                   Path  Backends----                   ----  --------myappv1.test.org/   myapp-v1:80 (10.244.2.31:80)myappv2.test.org/   myapp-v2:80 (10.244.2.32:80)
Annotations:             nginx.ingress.kubernetes.io/rewrite-target: /
Events:Type    Reason  Age   From                      Message----    ------  ----  ----                      -------Normal  Sync    21s   nginx-ingress-controller  Scheduled for sync#在测试主机中测试
[root@reg ~]# curl  reg.test.com/v1
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@reg ~]# curl  reg.test.com/v2
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>

5.3.3 建立tls加密

#建立证书
[root@k8s-master ingress]# openssl req -newkey rsa:2048 -nodes -keyout tls.key -x509 -days 365 -subj "/CN=nginxsvc/O=nginxsvc" -out tls.crt

#建立加密资源类型secret
[root@k8s-master ingress]# kubectl create secret tls  web-tls-secret --key tls.key --cert.crt
secret/web-tls-secret created
[root@k8s-master ingress]# kubectl get secrets
NAME             TYPE                DATA   AGE
web-tls-secret   kubernetes.io/tls   2      6s

secret通常在kubernetes中存放敏感数据，他并不是一种加密方式，在后面课程中会有专门讲解

#建立ingress3基于tls认证的yml文件
[root@k8s-master ingress]# vim ingress3.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/rewrite-target: /name: ingress3
spec:tls:- hosts:- myapp-tls.timinglee.orgsecretName: web-tls-secretingressClassName: nginxrules:- host: myapp-tls.timinglee.orghttp:paths:- backend:service:name: myapp-v1port:number: 80path: /pathType: Prefix#测试
[root@reg ~]# curl -k https://myapp-tls.timinglee.org
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

5.3.4 建立auth认证

#建立认证文件
[root@k8s-master ingress]# htpasswd -cm auth test
New password: 
Re-type new password: 
Adding password for user test
[root@k8s-master ingress]# cat auth
test:$apr1$11auxQL6$uwxw6oI3njgx0vsWCjD0q0#建立认证类型资源
[root@k8s-master ingress]# kubectl create secret generic auth-web --from-file auth
secret/auth-web created
[root@k8s-master ingress]# kubectl describe secrets auth-web
Name:         auth-web
Namespace:    default
Labels:       <none>
Annotations:  <none>Type:  OpaqueData
====
auth:  43 bytes#建立ingress4基于用户认证的yaml文件
[root@k8s-master ingress]# vim ingress4.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/auth-type: basicnginx.ingress.kubernetes.io/auth-secret: auth-webnginx.ingress.kubernetes.io/auth-realm: "Please input username and password"name: ingress4
spec:tls:- hosts:- myapp-tls.timinglee.orgsecretName: web-tls-secretingressClassName: nginxrules:- host: myapp-tls.timinglee.orghttp:paths:- backend:service:name: myapp-v1port:number: 80path: /pathType: Prefix#建立ingress4
[root@k8s-master ingress]# kubectl apply -f ingress4.yml
ingress.networking.k8s.io/ingress4 created
[root@k8s-master ingress]# kubectl describe ingress ingress4
Name:             ingress4
Labels:           <none>
Namespace:        default
Address:          172.25.254.10
Ingress Class:    nginx
Default backend:  <default>
TLS:web-tls-secret terminates myapp-tls.timinglee.org
Rules:Host                     Path  Backends----                     ----  --------myapp-tls.timinglee.org  /   myapp-v1:80 (<error: endpoints "myapp-v1" not found>)
Annotations:               nginx.ingress.kubernetes.io/auth-realm: Please input username passwordnginx.ingress.kubernetes.io/auth-secret: auth-webnginx.ingress.kubernetes.io/auth-type: basic
Events:Type    Reason  Age               From                      Message----    ------  ----              ----                      -------Normal  Sync    8s (x2 over 11s)  nginx-ingress-controller  Scheduled for sync#测试：[root@reg ~]# curl -k https://myapp-tls.timinglee.org
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

5.3.5 rewrite重定向

#指定默认访问的文件到hostname.html上
[root@k8s-master app]# vim ingress5.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/app-root: /hostname.htmlnginx.ingress.kubernetes.io/auth-type: basicnginx.ingress.kubernetes.io/auth-secret: auth-webnginx.ingress.kubernetes.io/auth-realm: "Please input username and password"name: ingress5
spec:tls:- hosts:- myapp-tls.timinglee.orgsecretName: web-tls-secretingressClassName: nginxrules:- host: myapp-tls.timinglee.orghttp:paths:- backend:service:name: myapp-v1port:number: 80path: /pathType: Prefix
[root@k8s-master app]# kubectl apply -f ingress5.yml
ingress.networking.k8s.io/ingress5 created
[root@k8s-master app]# kubectl describe ingress ingress5
Name:             ingress5
Labels:           <none>
Namespace:        default
Address:          172.25.254.10
Ingress Class:    nginx
Default backend:  <default>
TLS:web-tls-secret terminates myapp-tls.timinglee.org
Rules:Host                     Path  Backends----                     ----  --------myapp-tls.timinglee.org/   myapp-v1:80 (10.244.2.31:80)
Annotations:               nginx.ingress.kubernetes.io/app-root: /hostname.htmlnginx.ingress.kubernetes.io/auth-realm: Please input username and passwordnginx.ingress.kubernetes.io/auth-secret: auth-webnginx.ingress.kubernetes.io/auth-type: basic
Events:Type    Reason  Age                    From                      Message----    ------  ----                   ----                      -------Normal  Sync    2m16s (x2 over 2m54s)  nginx-ingress-controller  Scheduled for sync#测试：
[root@reg ~]# curl -Lk https://myapp-tls.timinglee.org -ulee:lee
myapp-v1-7479d6c54d-j9xc6[root@reg ~]# curl -Lk https://myapp-tls.timinglee.org/lee/hostname.html -ulee:lee
<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.12.2</center>
</body>
</html>#解决重定向路径问题
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/rewrite-target: /$2nginx.ingress.kubernetes.io/use-regex: "true"nginx.ingress.kubernetes.io/auth-type: basicnginx.ingress.kubernetes.io/auth-secret: auth-webnginx.ingress.kubernetes.io/auth-realm: "Please input username and password"name: ingress6
spec:tls:- hosts:- myapp-tls.timinglee.orgsecretName: web-tls-secretingressClassName: nginxrules:- host: myapp-tls.timinglee.orghttp:paths:- backend:service:name: myapp-v1port:number: 80path: /pathType: Prefix- backend:service:name: myapp-v1port:number: 80path: /lee(/|$)(.*)					#正则表达式匹配/lee/，/lee/abcpathType: ImplementationSpecific#测试
[root@reg ~]# curl -Lk https://myapp-tls.timinglee.org/lee/hostname.html -ulee:lee
myapp-v1-7479d6c54d-j9xc6

六 Canary金丝雀发布

6.1 么是金丝雀发布

金丝雀发布（Canary Release）也称为灰度发布，是一种软件发布策略。

主要目的是在将新版本的软件全面推广到生产环境之前，先在一小部分用户或服务器上进行测试和验证，以降低因新版本引入重大问题而对整个系统造成的影响。

是一种Pod的发布方式。金丝雀发布采取先添加、再删除的方式，保证Pod的总量不低于期望值。并且在更新部分Pod后，暂停更新，当确认新Pod版本运行正常后再进行其他版本的Pod的更新。

6.2 Canary发布方式

其中header和weiht中的最多

6.2.1 基于header（http包头）灰度

通过Annotaion扩展
创建灰度ingress，配置灰度头部key以及value
灰度流量验证完毕后，切换正式ingress到新版本
之前我们在做升级时可以通过控制器做滚动更新，默认25%利用header可以使升级更为平滑，通过key 和vule 测试新的业务体系是否有问题。

示例：

#建立版本1的ingress
[root@k8s-master ingress]# vim ingress7.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:name: myapp-v1-ingress
spec:ingressClassName: nginxrules:- host: reg.test.comhttp:paths:- backend:service:name: myapp-v1port:number: 80path: /pathType: Prefix[root@k8s-master ingress]# kubectl apply -f ingress7.yml 
ingress.networking.k8s.io/myapp-v1-ingress created
[root@k8s-master ingress]# kubectl describe ingress myapp-v1-ingress
Name:             myapp-v1-ingress
Labels:           <none>
Namespace:        default
Address:          
Ingress Class:    nginx
Default backend:  <default>
Rules:Host          Path  Backends----          ----  --------reg.test.com  /   myapp-v1:80 (<error: endpoints "myapp-v1" not found>)
Annotations:    <none>
Events:Type    Reason  Age   From                      Message----    ------  ----  ----                      -------Normal  Sync    6s    nginx-ingress-controller  Scheduled for sync

#建立基于header的ingress
[root@k8s-master ingress]# vim ingress8.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/canary: "true"nginx.ingress.kubernetes.io/canary-by-header: "version"nginx.ingress.kubernetes.io/canary-by-header-value: "2"name: myapp-v2-ingress
spec:ingressClassName: nginxrules:- host: reg.test.comhttp:paths:- backend:service:name: myapp-v2port:number: 80path: /pathType: Prefix[root@k8s-master ingress]# kubectl apply -f ingress8.yml 
ingress.networking.k8s.io/myapp-v2-ingress created
[root@k8s-master ingress]# kubectl describe ingress myapp-v2-ingress
Name:             myapp-v2-ingress
Labels:           <none>
Namespace:        default
Address:          
Ingress Class:    nginx
Default backend:  <default>
Rules:Host          Path  Backends----          ----  --------reg.test.com  /   myapp-v2:80 (<error: endpoints "myapp-v2" not found>)
Annotations:    nginx.ingress.kubernetes.io/canary: truenginx.ingress.kubernetes.io/canary-by-header: versionnginx.ingress.kubernetes.io/canary-by-header-value: 2
Events:Type    Reason  Age   From                      Message----    ------  ----  ----                      -------Normal  Sync    5s    nginx-ingress-controller  Scheduled for sync

6.2.2 基于权重的灰度发布

通过Annotaion拓展
创建灰度ingress，配置灰度权重以及总权重
灰度流量验证完毕后，切换正式ingress到新版本

示例

#基于权重的灰度发布
[root@k8s-master ingress]# vim ingress8.yml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:annotations:nginx.ingress.kubernetes.io/canary: "true"nginx.ingress.kubernetes.io/canary-by-header: "10"nginx.ingress.kubernetes.io/canary-by-header-value: "2"name: myapp-v2-ingress
spec:ingressClassName: nginxrules:- host: reg.test.comhttp:paths:- backend:service:name: myapp-v2port:number: 80path: /pathType: Prefix[root@k8s-master ingress]# kubectl apply -f  ingress8.yml 
ingress.networking.k8s.io/myapp-v2-ingress configured#测试
[root@k8s-master ingress]# vim check_ingress.sh
#!/bin/bash
v1=0
v2=0for (( i=0; i<100; i++))
doresponse=`curl -s reg.test.com |grep -c v1`v1=`expr $v1 + $response`v2=`expr $v2 + 1 - $response`done
echo "v1:$v1, v2:$v2"[root@k8s-master ingress]# sh check_ingress.sh
v1:0, v2:100
#更改完毕权重后继续测试可观察变化