Kubernetes-Ingress Nginx

1
Release "ingress-nginx" does not exist. Installing it now.
2
NAME: ingress-nginx
3
LAST DEPLOYED: Wed Nov 15 11:26:50 2023
4
NAMESPACE: ingress-nginx
5
STATUS: deployed
6
REVISION: 1
7
TEST SUITE: None
8
NOTES:
9
The ingress-nginx controller has been installed.
10
It may take a few minutes for the LoadBalancer IP to be available.
11
You can watch the status by running 'kubectl --namespace ingress-nginx get services -o wide -w ingress-nginx-controller'
12

13
An example Ingress that makes use of the controller:
14
  apiVersion: networking.k8s.io/v1
15
  kind: Ingress
16
  metadata:
17
    name: example
18
    namespace: foo
19
  spec:
20
    ingressClassName: nginx
21
    rules:
22
      - host: www.example.com
23
        http:
24
          paths:
25
            - pathType: Prefix
26
              backend:
27
                service:
28
                  name: exampleService
29
                  port:
30
                    number: 80
31
              path: /
32
    # This section is only required if TLS is to be enabled for the Ingress
33
    tls:
34
      - hosts:
35
        - www.example.com
36
        secretName: example-tls
37

38
If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
39

40
  apiVersion: v1
41
  kind: Secret
42
  metadata:
43
    name: example-tls
44
    namespace: foo
45
  data:
46
    tls.crt: <base64 encoded cert>
47
    tls.key: <base64 encoded key>
48
  type: kubernetes.io/tls

1
apiVersion: networking.k8s.io/v1
2
kind: IngressClass
3
metadata:
4
  annotations:
5
    meta.helm.sh/release-name: ingress-nginx
6
    meta.helm.sh/release-namespace: ingress-nginx
7
  creationTimestamp: "2023-11-15T03:27:16Z"
8
  generation: 1
9
  labels:
10
    app.kubernetes.io/component: controller
11
    app.kubernetes.io/instance: ingress-nginx
12
    app.kubernetes.io/managed-by: Helm
13
    app.kubernetes.io/name: ingress-nginx
14
    app.kubernetes.io/part-of: ingress-nginx
15
    app.kubernetes.io/version: 1.6.4
16
    helm.sh/chart: ingress-nginx-4.5.2
17
  name: nginx
18
  resourceVersion: "59635"
19
  uid: 620adf44-e02f-4837-9bcd-3983050297e8
20
spec:
21
  controller: k8s.io/ingress-nginx

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: my-nginx
5
spec:
6
  selector:
7
    matchLabels:
8
      app: my-nginx
9
  template:
10
    metadata:
11
      labels:
12
        app: my-nginx
13
    spec:
14
      containers:
15
        - name: my-nginx
16
          image: nginx
17
          ports:
18
            - containerPort: 80
19
          resources:
20
            limits:
21
              cpu: 100m
22
              memory: 128Mi
23
---
24
apiVersion: v1
25
kind: Service
26
metadata:
27
  name: my-nginx
28
  labels:
29
    app: my-nginx
30
spec:
31
  ports:
32
    - port: 80
33
      protocol: TCP
34
      name: http
35
  selector:
36
    app: my-nginx
37
---
38
apiVersion: networking.k8s.io/v1
39
kind: Ingress
40
metadata:
41
  name: my-nginx
42
  namespace: default
43
spec:
44
  ingressClassName: nginx # 使用 nginx 的 IngressClass（关联的 ingress-nginx 控制器）
45
  rules:
46
    - host: ngdemo.tianch.com.cn # 将域名映射到 my-nginx 服务
47
      http:
48
        paths:
49
          - path: /
50
            pathType: Prefix
51
            backend:
52
              service: # 将所有请求发送到 my-nginx 服务的 80 端口
53
                name: my-nginx
54
                port:
55
                  number: 80
56
# 不过需要注意大部分Ingress控制器都不是直接转发到Service
57
# 而是只是通过Service来获取后端的Endpoints列表，直接转发到Pod，这样可以减少网络跳转，提高性能

1
## start server ngdemo.tianch.com.cn
2
  server {
3
    server_name ngdemo.tianch.com.cn ;
4

5
    listen 80  ;
6
    listen [::]:80  ;
7
    listen 443  ssl http2 ;
8
    listen [::]:443  ssl http2 ;
9

10
    set $proxy_upstream_name "-";
11

12
    ssl_certificate_by_lua_block {
13
      certificate.call()
14
    }
15

16
    location / {
17

18
      set $namespace      "default";
19
      set $ingress_name   "my-nginx";
20
      set $service_name   "my-nginx";
21
      set $service_port   "80";
22
      set $location_path  "/";
23
      set $global_rate_limit_exceeding n;
24

25
      rewrite_by_lua_block {
26
        lua_ingress.rewrite({
27
          force_ssl_redirect = false,
28
          ssl_redirect = true,
29
          force_no_ssl_redirect = false,
30
          preserve_trailing_slash = false,
31
          use_port_in_redirects = false,
32
          global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
33
        })
34
        balancer.rewrite()
35
        plugins.run()
36
      }
37

38
      # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
39
      # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
40
      # other authentication method such as basic auth or external auth useless - all requests will be allowed.
41
      #access_by_lua_block {
42
      #}
43

44
      header_filter_by_lua_block {
45
        lua_ingress.header()
46
        plugins.run()
47
      }
48

49
      body_filter_by_lua_block {
50
        plugins.run()
51
      }
52

53
      log_by_lua_block {
54
        balancer.log()
55

56
        monitor.call()
57

58
        plugins.run()
59
      }
60

61
      port_in_redirect off;
62

63
      set $balancer_ewma_score -1;
64
      set $proxy_upstream_name "default-my-nginx-80";
65
      set $proxy_host          $proxy_upstream_name;
66
      set $pass_access_scheme  $scheme;
67

68
      set $pass_server_port    $server_port;
69

70
      set $best_http_host      $http_host;
71
      set $pass_port           $pass_server_port;
72

73
      set $proxy_alternative_upstream_name "";
74

75
      client_max_body_size                    1m;
76

77
      proxy_set_header Host                   $best_http_host;
78

79
      # Pass the extracted client certificate to the backend
80

81
      # Allow websocket connections
82
      proxy_set_header                        Upgrade           $http_upgrade;
83

84
      proxy_set_header                        Connection        $connection_upgrade;
85

86
      proxy_set_header X-Request-ID           $req_id;
87
      proxy_set_header X-Real-IP              $remote_addr;
88

89
      proxy_set_header X-Forwarded-For        $remote_addr;
90

91
      proxy_set_header X-Forwarded-Host       $best_http_host;
92
      proxy_set_header X-Forwarded-Port       $pass_port;
93
      proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
94
      proxy_set_header X-Forwarded-Scheme     $pass_access_scheme;
95

96
      proxy_set_header X-Scheme               $pass_access_scheme;
97

98
      # Pass the original X-Forwarded-For
99
      proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
100

101
      # mitigate HTTPoxy Vulnerability
102
      # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
103
      proxy_set_header Proxy                  "";
104

105
      # Custom headers to proxied server
106

107
      proxy_connect_timeout                   5s;
108
      proxy_send_timeout                      60s;
109
      proxy_read_timeout                      60s;
110

111
      proxy_buffering                         off;
112
      proxy_buffer_size                       4k;
113
      proxy_buffers                           4 4k;
114

115
      proxy_max_temp_file_size                1024m;
116

117
      proxy_request_buffering                 on;
118
      proxy_http_version                      1.1;
119

120
      proxy_cookie_domain                     off;
121
      proxy_cookie_path                       off;
122

123
      # In case of errors try the next upstream server before returning an error
124
      proxy_next_upstream                     error timeout;
125
      proxy_next_upstream_timeout             0;
126
      proxy_next_upstream_tries               3;
127

128
      proxy_pass http://upstream_balancer;
129

130
      proxy_redirect                          off;
131

132
    }
133

134
  }
135
  ## end server ngdemo.tianch.com.cn