首页 文章

Kubernetes - 入口路由问题 - 跨命名空间的路由

提问于
浏览
0

我在 AWS 上有一个主节点和两个工作节点kubernetes集群 . 我在集群中有两个环境(qc和prod),我创建了两个名称空间 . 我在 qcprod 名称空间上运行相同的服务 .

我为两个命名空间创建了入口 .

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  namespace: prod
spec:
  rules:
  - host: "*.qc-k8s.example.com"
    http:
      paths:
      - path: /app
        backend:
          serviceName: client-svc
          servicePort: 80
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  namespace: qc
spec:
  rules:
  - host: "*.qc-k8s.example.com"
    http:
      paths:
      - path: /app-qc
        backend:
          serviceName: client-svc
          servicePort: 80

我在 qcprod 名称空间中都有 client-svc 并打开nodeport 80.然后我创建了 ELB service和 daemonset ,如下所示 .

kind: Service
apiVersion: v1
metadata:
  name: ingress-svc
  namespace: deafult
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:ca-central-1:492276880714:certificate/xxxxxxxxxxxxxx
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
  - name: http
    port: 80
    targetPort: http
  - name: https
    port: 443
    targetPort: http
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: ingress-nginx
  namespace: deafult
spec:
  template:
    metadata:
      labels:
        app: my-app
    spec:
      terminationGracePeriodSeconds: 60
      containers:
      - image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.6
        name: ingress-nginx
        imagePullPolicy: Always
        ports:
          - name: http
            containerPort: 80
            hostPort: 80
        livenessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 30
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
          requests:
            cpu: 100m
            memory: 100Mi
        args:
        - /nginx-ingress-controller
        - --default-backend-service=$(POD_NAMESPACE)/nginx-default-backend

当我试图卷曲 curl -iv https://gayan.qc-k8s.example.com/app/ . 然后我得到一个错误 .

*2017/06/27 15:43:31 [error] 158#158: 981 connect() failed (111: Connection refused) while connecting to upstream, client: 209.128.50.138, server: gayan.qc-k8s.example.com, request: "GET /app/ HTTP/1.1", upstream: "http://100.82.2.47:80/app/", host: "gayan.qc-k8s.example.com" 209.128.50.138 - [209.128.50.138, 209.128.50.138] - - [27/Jun/2017:15:43:31 +0000] "GET /app/ HTTP/1.1" 500 193 "-" "curl/7.51.0" 198 0.014 100.82.2.47:80, 100.96.2.48:80 0, 193 0.001, 0.013 502, 500

如果我卷曲 curl -iv https://gayan.qc-k8s.example.com/app-qc ,我会遇到同样的问题 . 以前有人遇到过此错误吗?解决这个问题的任何线索?

谢谢

1 回答

  • 0

    我通过https://github.com/kubernetes/kubernetes/issues/17088解决了这个问题

    一个例子,来自我们使用的真实文档:

    apiVersion: extensions/v1beta1
      kind: Ingress
      metadata:
        name: ingress
        namespace: dev-1
      spec:
        rules:
        - host: api-gateway-dev-1.faceit.com
          http:
            paths:
            - backend:
                serviceName: api-gateway
                servicePort: 80
              path: /
        - host: api-shop-dev-1.faceit.com
          http:
            paths:
            - backend:
                serviceName: api-shop
                servicePort: 80
              path: /
        - host: api-search-dev-1.faceit.com
          http:
            paths:
            - backend:
                serviceName: api-search
                servicePort: 8080
              path: /
        tls:
        - hosts:
          - api-gateway-dev-1.faceit.com
          - api-search-dev-1.faceit.com
          - api-shop-dev-1.faceit.com
          secretName: faceitssl
    

    我们为每个轨道的每个命名空间创建其中一个 .

    然后,我们有一个带有Ingress Controller的命名空间,它运行自动配置的NGINX pod . 另一个AWS负载均衡器指向这些在NodePort上运行的pod,使用DaemonSet最多运行并且至少在群集中的每个节点上运行一个 .

    因此,流量将被路由:

    Internet - > AWS ELB - > NGINX(在节点上) - > Pod

    我们在使用Ingress时保持名称空间之间的隔离 . 使用一个入口来命中多个名称空间是不正确甚至是明智的 . 鉴于它们的设计方式,它没有意义 . 解决方案是使用每个命名空间的一个入口和一个实际进行路由的集群范围入口控制器 .

相关问题