[英]Ingress Resource getting address from wrong Ingress Controller when using multiple ingress-nginx Controllers
我們在 AWS (EKS) 中有一個 Kubernetes 集群。 在我們的設置中,我們需要有兩個 ingress-nginx 控制器,以便我們可以實施不同的安全策略。 為了實現這一點,我正在利用
kubernetes.io/ingress.class 和-ingress-class
按照這里的建議,我從 ingress-nginx 存儲庫創建了一個標准的 Ingress Controller,默認為“mandatory.yaml” 。
為了創建第二個入口 controller,我從“mandatory.yaml”稍微定制了入口部署。 我基本上添加了標簽:
“環境:內部”
部署定義。
我還相應地創建了另一個服務,指定“env:內部”標簽,以便將此新服務與我的新入口 controller 綁定。 請看一下我的 yaml 定義:
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-ingress-controller-internal
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
env: internal
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
env: internal
template:
metadata:
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
env: internal
annotations:
prometheus.io/port: "10254"
prometheus.io/scrape: "true"
spec:
# wait up to five minutes for the drain of connections
terminationGracePeriodSeconds: 300
serviceAccountName: nginx-ingress-serviceaccount
nodeSelector:
kubernetes.io/os: linux
containers:
- name: nginx-ingress-controller-internal
image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1
args:
- /nginx-ingress-controller
- --configmap=$(POD_NAMESPACE)/nginx-configuration
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
- --publish-service=$(POD_NAMESPACE)/ingress-nginx
- --annotations-prefix=nginx.ingress.kubernetes.io
- --ingress-class=nginx-internal
securityContext:
allowPrivilegeEscalation: true
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
# www-data -> 33
runAsUser: 33
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
ports:
- name: http
containerPort: 80
- name: https
containerPort: 443
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 10
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
---
kind: Service
apiVersion: v1
metadata:
name: ingress-nginx-internal
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
env: internal
spec:
externalTrafficPolicy: Local
type: LoadBalancer
selector:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
env: internal
ports:
- name: http
port: 80
targetPort: http
- name: https
port: 443
targetPort: https
應用此定義后,我的 Ingress Controller 與新的 LoadBalancer 服務一起創建:
$ kubectl get deployments -n ingress-nginx
NAME READY UP-TO-DATE AVAILABLE AGE
nginx-ingress-controller 1/1 1 1 10d
nginx-ingress-controller-internal 1/1 1 1 95m
$ kubectl get service -n ingress-nginx
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
ingress-nginx LoadBalancer 172.20.6.67 xxxx.elb.amazonaws.com 80:30857/TCP,443:31863/TCP 10d
ingress-nginx-internal LoadBalancer 172.20.115.244 yyyyy.elb.amazonaws.com 80:30036/TCP,443:30495/TCP 97m
到目前為止一切順利,一切正常。
但是,當我創建兩個入口資源時,每個資源都綁定到不同的入口控制器(注意'kubernetes.io/ingress.class:'):
外部入口資源:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: accounting-ingress
annotations:
kubernetes.io/ingress.class: nginx
spec: ...
內部入口資源:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: internal-ingress
annotations:
kubernetes.io/ingress.class: nginx-internal
spec: ...
我看到它們都包含相同的 ADDRESS,第一個 Ingress Controller 的地址:
$ kg ingress
NAME HOSTS ADDRESS PORTS AGE
external-ingress bbb.aaaa.com xxxx.elb.amazonaws.com 80, 443 10d
internal-ingress ccc.aaaa.com xxxx.elb.amazonaws.com 80 88m
我希望綁定到“ingress-class=nginx-internal”的入口將包含此地址:“yyyyy.elb.amazonaws.com”。 一切似乎都運行良好,但這讓我很煩,我覺得有些不對勁。
我應該從哪里開始對其進行故障排除以了解幕后發生的事情?
#### - -更新 - -####
除了上述內容外,我還在 manadatory.yaml 中添加了“ingress-controller-leader-nginx-internal”行,如下所示。 我是根據在mandatory.yaml 文件中找到的一條評論做到這一點的:
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
name: nginx-ingress-role
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- configmaps
resourceNames:
# Defaults to "<election-id>-<ingress-class>"
# Here: "<ingress-controller-leader>-<nginx>"
# This has to be adapted if you change either parameter
# when launching the nginx-ingress-controller.
- "ingress-controller-leader-nginx"
- "ingress-controller-leader-nginx-internal"
不幸的是,nginx 文檔只提到了 'kubernetes.io/ingress.class 和 -ingress-class' 來定義一個新的 controller。 我有可能會弄亂一些小細節。
嘗試更改此行:
- --configmap=$(POD_NAMESPACE)/nginx-configuration
在您的代碼中,它應該是這樣的:
- --configmap=$(POD_NAMESPACE)/internal-nginx-configuration
這樣你每個 nginx-controller 會有不同的配置,否則你會有相同的配置,它可能看起來可以工作,但是更新時你會遇到一些錯誤......(已經在那里......)
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.