1. 项目概述在Kubernetes集群中Ingress作为服务发现的关键组件承担着外部流量路由和负载均衡的重要职责。不同于传统的Service资源Ingress提供了更灵活的路由规则定义能力能够基于主机名、路径等条件将外部请求分发到不同的后端服务。本实战指南将深入解析Ingress的核心工作机制并通过完整示例演示从基础配置到高级功能的实现过程特别是HTTPS安全连接的配置细节。作为K8s网络体系中的第七层代理Ingress解决了生产环境中常见的几个痛点问题单个IP暴露多个服务基于域名的路由分流集中式SSL证书管理统一入口的访问控制2. 核心组件解析2.1 Ingress Controller选型Ingress功能实际由Controller实现主流方案包括Nginx Ingress Controller最成熟的方案支持定制注解Traefik动态配置更新快适合微服务架构HAProxy高性能负载均衡适合高并发场景ALB Ingress ControllerAWS原生集成方案以Nginx Ingress为例其架构包含监听K8s API的Control Loop生成Nginx配置的Translator动态加载配置的Nginx进程2.2 Ingress资源定义典型Ingress YAML包含三大核心配置apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: demo-ingress annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: tls: - hosts: - demo.example.com secretName: tls-secret rules: - host: demo.example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80关键字段说明rules.host: 虚拟主机域名paths.backend: 服务关联配置tls.secretName: SSL证书密钥3. 完整部署实战3.1 基础环境准备先决条件运行中的K8s集群v1.19kubectl配置正确上下文Helm工具v3.0安装Nginx Ingress Controllerhelm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm install ingress-nginx ingress-nginx/ingress-nginx \ --namespace ingress-nginx \ --create-namespace \ --set controller.replicaCount2验证安装kubectl get pods -n ingress-nginx -l app.kubernetes.io/nameingress-nginx3.2 部署示例应用创建测试Deployment和Service# api-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: api-server spec: replicas: 3 selector: matchLabels: app: api template: metadata: labels: app: api spec: containers: - name: api image: nginx:alpine ports: - containerPort: 80 --- # api-service.yaml apiVersion: v1 kind: Service metadata: name: api-service spec: selector: app: api ports: - protocol: TCP port: 80 targetPort: 80应用配置kubectl apply -f api-deployment.yaml -f api-service.yaml3.3 Ingress资源配置创建基础Ingress路由# basic-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: api-ingress spec: rules: - host: api.demo.com http: paths: - path: / pathType: Prefix backend: service: name: api-service port: number: 80应用配置后测试kubectl apply -f basic-ingress.yaml # 获取Ingress外部IP INGRESS_IP$(kubectl get svc ingress-nginx-controller -n ingress-nginx -o jsonpath{.status.loadBalancer.ingress[0].ip}) # 测试访问 curl -H Host: api.demo.com http://$INGRESS_IP4. HTTPS高级配置4.1 证书准备使用Lets Encrypt生成证书示例openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout tls.key -out tls.crt \ -subj /CNapi.demo.com/Odemo创建K8s Secretkubectl create secret tls tls-secret \ --certtls.crt \ --keytls.key4.2 安全Ingress配置更新Ingress启用HTTPS# tls-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: secure-ingress spec: tls: - hosts: - api.demo.com secretName: tls-secret rules: - host: api.demo.com http: paths: - path: / pathType: Prefix backend: service: name: api-service port: number: 80验证HTTPS访问curl -k https://api.demo.com --resolve api.demo.com:443:$INGRESS_IP4.3 自动证书管理使用Cert-Manager实现自动化安装Cert-Managerhelm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ --version v1.8.0 \ --set installCRDstrue配置ClusterIssuer# letsencrypt-issuer.yaml apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: admindemo.com privateKeySecretRef: name: letsencrypt-prod solvers: - http01: ingress: class: nginx更新Ingress注解annotations: cert-manager.io/cluster-issuer: letsencrypt-prod5. 高级路由策略5.1 路径重写配置处理前端路由场景annotations: nginx.ingress.kubernetes.io/rewrite-target: /$2 rules: - http: paths: - path: /web(/|$)(.*) backend: service: name: web-service port: number: 805.2 流量切分配置实现金丝雀发布# canary-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: api-canary annotations: nginx.ingress.kubernetes.io/canary: true nginx.ingress.kubernetes.io/canary-weight: 20 spec: rules: - host: api.demo.com http: paths: - path: / backend: service: name: api-service-v2 port: number: 805.3 跨域配置支持前端跨域访问annotations: nginx.ingress.kubernetes.io/enable-cors: true nginx.ingress.kubernetes.io/cors-allow-methods: PUT, GET, POST, OPTIONS nginx.ingress.kubernetes.io/cors-allow-origin: *6. 性能优化实践6.1 连接参数调优调整Nginx参数annotations: nginx.ingress.kubernetes.io/proxy-connect-timeout: 30 nginx.ingress.kubernetes.io/proxy-read-timeout: 1800 nginx.ingress.kubernetes.io/proxy-body-size: 20m nginx.ingress.kubernetes.io/upstream-keepalive-connections: 1006.2 负载均衡策略配置会话保持annotations: nginx.ingress.kubernetes.io/affinity: cookie nginx.ingress.kubernetes.io/session-cookie-name: route nginx.ingress.kubernetes.io/session-cookie-expires: 1728006.3 监控集成暴露Prometheus指标controller: metrics: enabled: true serviceMonitor: enabled: true7. 故障排查指南7.1 常见问题分析503 Service Unavailable检查后端服务Endpoint状态kubectl get endpoints service-name验证Service selector匹配Pod标签404 Not Found检查Ingress中host和path配置验证Controller日志kubectl logs -n ingress-nginx controller-podSSL证书错误检查Secret是否存在kubectl get secret tls-secret验证证书有效期openssl x509 -in tls.crt -noout -dates7.2 诊断命令集合获取Ingress事件kubectl describe ingress ingress-name检查Nginx配置kubectl exec -n ingress-nginx controller-pod -- cat /etc/nginx/nginx.conf实时监控日志kubectl logs -f -n ingress-nginx controller-pod8. 生产环境建议高可用部署至少部署2个Controller副本使用PodAntiAffinity分散节点分布配置HPA自动扩缩容安全加固限制Controller权限RBAC启用ModSecurity WAF规则定期轮换TLS证书性能考量根据QPS调整worker_processes启用动态TLS记录大小优化内核网络参数版本管理保持Controller版本与K8s版本兼容测试环境先行验证配置变更使用GitOps管理Ingress配置
Kubernetes Ingress实战：从基础配置到HTTPS高级应用
1. 项目概述在Kubernetes集群中Ingress作为服务发现的关键组件承担着外部流量路由和负载均衡的重要职责。不同于传统的Service资源Ingress提供了更灵活的路由规则定义能力能够基于主机名、路径等条件将外部请求分发到不同的后端服务。本实战指南将深入解析Ingress的核心工作机制并通过完整示例演示从基础配置到高级功能的实现过程特别是HTTPS安全连接的配置细节。作为K8s网络体系中的第七层代理Ingress解决了生产环境中常见的几个痛点问题单个IP暴露多个服务基于域名的路由分流集中式SSL证书管理统一入口的访问控制2. 核心组件解析2.1 Ingress Controller选型Ingress功能实际由Controller实现主流方案包括Nginx Ingress Controller最成熟的方案支持定制注解Traefik动态配置更新快适合微服务架构HAProxy高性能负载均衡适合高并发场景ALB Ingress ControllerAWS原生集成方案以Nginx Ingress为例其架构包含监听K8s API的Control Loop生成Nginx配置的Translator动态加载配置的Nginx进程2.2 Ingress资源定义典型Ingress YAML包含三大核心配置apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: demo-ingress annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: tls: - hosts: - demo.example.com secretName: tls-secret rules: - host: demo.example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80关键字段说明rules.host: 虚拟主机域名paths.backend: 服务关联配置tls.secretName: SSL证书密钥3. 完整部署实战3.1 基础环境准备先决条件运行中的K8s集群v1.19kubectl配置正确上下文Helm工具v3.0安装Nginx Ingress Controllerhelm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm install ingress-nginx ingress-nginx/ingress-nginx \ --namespace ingress-nginx \ --create-namespace \ --set controller.replicaCount2验证安装kubectl get pods -n ingress-nginx -l app.kubernetes.io/nameingress-nginx3.2 部署示例应用创建测试Deployment和Service# api-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: api-server spec: replicas: 3 selector: matchLabels: app: api template: metadata: labels: app: api spec: containers: - name: api image: nginx:alpine ports: - containerPort: 80 --- # api-service.yaml apiVersion: v1 kind: Service metadata: name: api-service spec: selector: app: api ports: - protocol: TCP port: 80 targetPort: 80应用配置kubectl apply -f api-deployment.yaml -f api-service.yaml3.3 Ingress资源配置创建基础Ingress路由# basic-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: api-ingress spec: rules: - host: api.demo.com http: paths: - path: / pathType: Prefix backend: service: name: api-service port: number: 80应用配置后测试kubectl apply -f basic-ingress.yaml # 获取Ingress外部IP INGRESS_IP$(kubectl get svc ingress-nginx-controller -n ingress-nginx -o jsonpath{.status.loadBalancer.ingress[0].ip}) # 测试访问 curl -H Host: api.demo.com http://$INGRESS_IP4. HTTPS高级配置4.1 证书准备使用Lets Encrypt生成证书示例openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout tls.key -out tls.crt \ -subj /CNapi.demo.com/Odemo创建K8s Secretkubectl create secret tls tls-secret \ --certtls.crt \ --keytls.key4.2 安全Ingress配置更新Ingress启用HTTPS# tls-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: secure-ingress spec: tls: - hosts: - api.demo.com secretName: tls-secret rules: - host: api.demo.com http: paths: - path: / pathType: Prefix backend: service: name: api-service port: number: 80验证HTTPS访问curl -k https://api.demo.com --resolve api.demo.com:443:$INGRESS_IP4.3 自动证书管理使用Cert-Manager实现自动化安装Cert-Managerhelm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ --version v1.8.0 \ --set installCRDstrue配置ClusterIssuer# letsencrypt-issuer.yaml apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-prod spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: admindemo.com privateKeySecretRef: name: letsencrypt-prod solvers: - http01: ingress: class: nginx更新Ingress注解annotations: cert-manager.io/cluster-issuer: letsencrypt-prod5. 高级路由策略5.1 路径重写配置处理前端路由场景annotations: nginx.ingress.kubernetes.io/rewrite-target: /$2 rules: - http: paths: - path: /web(/|$)(.*) backend: service: name: web-service port: number: 805.2 流量切分配置实现金丝雀发布# canary-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: api-canary annotations: nginx.ingress.kubernetes.io/canary: true nginx.ingress.kubernetes.io/canary-weight: 20 spec: rules: - host: api.demo.com http: paths: - path: / backend: service: name: api-service-v2 port: number: 805.3 跨域配置支持前端跨域访问annotations: nginx.ingress.kubernetes.io/enable-cors: true nginx.ingress.kubernetes.io/cors-allow-methods: PUT, GET, POST, OPTIONS nginx.ingress.kubernetes.io/cors-allow-origin: *6. 性能优化实践6.1 连接参数调优调整Nginx参数annotations: nginx.ingress.kubernetes.io/proxy-connect-timeout: 30 nginx.ingress.kubernetes.io/proxy-read-timeout: 1800 nginx.ingress.kubernetes.io/proxy-body-size: 20m nginx.ingress.kubernetes.io/upstream-keepalive-connections: 1006.2 负载均衡策略配置会话保持annotations: nginx.ingress.kubernetes.io/affinity: cookie nginx.ingress.kubernetes.io/session-cookie-name: route nginx.ingress.kubernetes.io/session-cookie-expires: 1728006.3 监控集成暴露Prometheus指标controller: metrics: enabled: true serviceMonitor: enabled: true7. 故障排查指南7.1 常见问题分析503 Service Unavailable检查后端服务Endpoint状态kubectl get endpoints service-name验证Service selector匹配Pod标签404 Not Found检查Ingress中host和path配置验证Controller日志kubectl logs -n ingress-nginx controller-podSSL证书错误检查Secret是否存在kubectl get secret tls-secret验证证书有效期openssl x509 -in tls.crt -noout -dates7.2 诊断命令集合获取Ingress事件kubectl describe ingress ingress-name检查Nginx配置kubectl exec -n ingress-nginx controller-pod -- cat /etc/nginx/nginx.conf实时监控日志kubectl logs -f -n ingress-nginx controller-pod8. 生产环境建议高可用部署至少部署2个Controller副本使用PodAntiAffinity分散节点分布配置HPA自动扩缩容安全加固限制Controller权限RBAC启用ModSecurity WAF规则定期轮换TLS证书性能考量根据QPS调整worker_processes启用动态TLS记录大小优化内核网络参数版本管理保持Controller版本与K8s版本兼容测试环境先行验证配置变更使用GitOps管理Ingress配置
