Kubernetes Ingress控制器配置实战：NGINX Ingress路由规则与TLS证书自动化

小编 • • 网站运维

Kubernetes Ingress控制器部署与基础架构

Kubernetes Ingress是集群内HTTP/HTTPS路由的统一入口，通过Ingress Resource定义路由规则，由Ingress Controller实现具体转发。NGINX Ingress Controller是最广泛使用的实现方案，基于OpenResty构建，支持Lua插件扩展。

使用Helm部署NGINX Ingress Controller：

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

helm install ingress-nginx ingress-nginx/ingress-nginx   --namespace ingress-nginx   --create-namespace   --set controller.replicaCount=2   --set controller.nodeSelector."kubernetes\.io/os"=linux   --set controller.service.type=LoadBalancer   --set controller.config.proxy-body-size="50m"   --set controller.config.proxy-read-timeout="3600"   --set controller.config.proxy-send-timeout="3600"   --set controller.config.client-header-timeout="60"   --set controller.config.use-forwarded-headers="true"   --set controller.config.compute-full-forwarded-for="true"   --set controller.config.proxy-buffer-size="16k"   --set controller.metrics.enabled=true   --set controller.podAnnotations."prometheus\.io/scrape"="true"   --set controller.podAnnotations."prometheus\.io/port"="10254"

私有云环境无LoadBalancer支持时，改用NodePort或HostNetwork模式。HostNetwork模式直接使用节点网络，性能最高但侵入性强，适用于专用Ingress节点：

helm install ingress-nginx ingress-nginx/ingress-nginx   --namespace ingress-nginx   --create-namespace   --set controller.hostNetwork=true   --set controller.hostPort.enabled=true   --set controller.kind=DaemonSet   --set controller.dnsPolicy=ClusterFirstWithHostNet   --set controller.nodeSelector."ingress"="true"

Ingress路由规则配置与域名分发

Ingress Resource通过HTTP路由规则将外部请求分发到集群内Service。单个Ingress可配置多个域名、路径和后端：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-app-ingress
  namespace: production
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "10"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
    nginx.ingress.kubernetes.io/client-body-buffer-size: "1m"
    nginx.ingress.kubernetes.io/proxy-buffering: "true"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "X-Frame-Options: DENY";
      more_set_headers "X-Content-Type-Options: nosniff";
spec:
  ingressClassName: nginx
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /v1(/|$)(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: api-v1-service
            port:
              number: 8080
      - path: /v2(/|$)(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: api-v2-service
            port:
              number: 8080
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-default-service
            port:
              number: 8080
  - host: www.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-service
            port:
              number: 80

rewrite-target配合正则路径实现URL重写：/v1/users/123会被重写为/users/123转发给后端服务。路径正则匹配需要同时设置use-regex: "true"注解。

TLS证书自动化管理：cert-manager集成

cert-manager是Kubernetes原生的证书管理控制器，支持Let’s Encrypt自动签发和续期。部署cert-manager并配置Let’s Encrypt ClusterIssuer：

# 部署cert-manager
helm repo add jetstack https://charts.jetstack.io
helm install cert-manager jetstack/cert-manager   --namespace cert-manager   --create-namespace   --set installCRDs=true   --set replicaCount=2

# ClusterIssuer配置
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
    - http01:
        ingress:
          class: nginx
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-staging-account-key
    solvers:
    - http01:
        ingress:
          class: nginx

在Ingress中引用ClusterIssuer实现自动签发：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-app-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.2 TLSv1.3"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.example.com
    - www.example.com
    secretName: example-com-tls
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080

cert-manager会自动创建Certificate资源，通过HTTP-01 challenge完成域名验证后签发证书，存入指定的Secret。证书到期前30天自动续期。

金丝雀发布与流量分割

NGINX Ingress Controller支持通过注解实现金丝雀发布，将部分流量路由到新版本：

# 主Ingress - 稳定版本
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-stable
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-stable-svc
            port:
              number: 80

---
# 金丝雀Ingress - 新版本
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-canary
  annotations:
    nginx.ingress.kubernetes.io/canary: "true"
    nginx.ingress.kubernetes.io/canary-weight: "10"
    # 按权重分流：10%流量到新版本
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-canary-svc
            port:
              number: 80

除按权重分流外，还支持按Header和Cookie定向路由，适用于A/B测试场景：

# 按Header路由到金丝雀
annotations:
  nginx.ingress.kubernetes.io/canary: "true"
  nginx.ingress.kubernetes.io/canary-by-header: "X-Canary"
  nginx.ingress.kubernetes.io/canary-by-header-value: "true"

# 按Cookie路由
annotations:
  nginx.ingress.kubernetes.io/canary: "true"
  nginx.ingress.kubernetes.io/canary-by-cookie: "canary"

性能调优与故障排查

NGINX Ingress Controller的性能调优集中在worker进程数、连接数和缓冲区配置：

# ConfigMap全局配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
data:
  worker-processes: "auto"           # 自动匹配CPU核数
  max-worker-connections: "65535"
  max-worker-open-files: "65535"
  keep-alive-requests: "10000"
  keep-alive: "75"
  upstream-keepalive-connections: "320"
  upstream-keepalive-timeout: "60"
  upstream-keepalive-requests: "10000"
  proxy-body-size: "50m"
  proxy-buffer-size: "16k"
  proxy-buffers-number: "4"
  proxy-busy-buffers-size: "32k"
  large-client-header-buffers: "4 16k"
  enable-brotli: "true"
  brotli-level: "4"
  gzip-level: "5"
  use-gzip: "true"

排查Ingress问题时的常用命令：

# 查看Ingress Controller日志
kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx --tail=200

# 查看生成的NGINX配置
kubectl exec -n ingress-nginx <ingress-pod> -- cat /etc/nginx/nginx.conf

# 验证后端服务连通性
kubectl exec -n ingress-nginx <ingress-pod> -- curl -v http://api-service.production.svc.cluster.local:8080/health

# 查看Ingress状态
kubectl describe ingress web-app-ingress -n production

# 测试TLS证书
openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null | openssl x509 -noout -dates -issuer

# 查看cert-manager证书状态
kubectl get certificate -A
kubectl describe certificate example-com-tls -n production

通过NGINX Ingress Controller与cert-manager的组合，Kubernetes集群内HTTP路由、TLS证书、金丝雀发布可实现全自动化管理，配合Prometheus监控Ingress指标，形成完整的入口流量管理方案。

原创文章，作者：小编，如若转载，请注明出处：https://www.yunthe.com/kubernetesingress-kong-zhi-qi-pei-zhi-shi-zhan-nginxingress/

赞 (0)
小编小编
0
上一篇 20小时前
下一篇 20小时前

相关推荐