【发布时间】：2017-04-30 16:12:24
【问题描述】：
谁能给我一个完整的例子，说明如何使用 nginx 运行不安全（没有 TLS）入口控制器和资源以远程访问在 kubernetes 集群中运行的服务？我没有找到有用的东西。
PS：我的 kubernetes 集群在裸机上运行，而不是在云提供商上。 下一个可能是关于我所做的有用信息：
$kubectl 获取服务
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
attachmentservice 10.254.111.232 <none> 80/TCP 3d
financeservice 10.254.38.228 <none> 80/TCP 3d
gatewayservice 10.254.38.182 nodes 80/TCP 3d
hrservice 10.254.61.196 <none> 80/TCP 3d
kubernetes 10.254.0.1 <none> 443/TCP 31d
messageservice 10.254.149.125 <none> 80/TCP 3d
redis-service 10.254.201.241 <none> 6379/TCP 15d
settingservice 10.254.157.155 <none> 80/TCP 3d
trainingservice 10.254.166.92 <none> 80/TCP 3d
nginx-ingress-rc.yml
apiVersion: v1
kind: ReplicationController
metadata:
name: nginx-ingress-rc
labels:
app: nginx-ingress
spec:
replicas: 1
selector:
app: nginx-ingress
template:
metadata:
labels:
app: nginx-ingress
spec:
containers:
- image: nginxdemos/nginx-ingress:0.6.0
imagePullPolicy: Always
name: nginx-ingress
ports:
- containerPort: 80
hostPort: 80
services-ingress.yml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: services-ingress
spec:
rules:
- host: ctc-cicd2
http:
paths:
- path: /gateway
backend:
serviceName: gatewayservice
servicePort: 80
- path: /training
backend:
serviceName: trainingservice
servicePort: 80
- path: /attachment
backend:
serviceName: attachmentservice
servicePort: 80
- path: /hr
backend:
serviceName: hrservice
servicePort: 80
- path: /message
backend:
serviceName: messageservice
servicePort: 80
- path: /settings
backend:
serviceName: settingservice
servicePort: 80
- path: /finance
backend:
serviceName: financeservice
servicePort: 80
nginx.conf 新增内容
upstream default-services-ingress-ctc-cicd2-trainingservice {
server 12.16.64.5:8190;
server 12.16.65.6:8190;
}
upstream default-services-ingress-ctc-cicd2-attachmentservice {
server 12.16.64.2:8095;
}
upstream default-services-ingress-ctc-cicd2-hrservice {
server 12.16.64.7:8077;
}
upstream default-services-ingress-ctc-cicd2-messageservice {
server 12.16.64.9:8065;
}
upstream default-services-ingress-ctc-cicd2-settingservice {
server 12.16.64.10:8098;
server 12.16.65.4:8098;
}
upstream default-services-ingress-ctc-cicd2-financeservice {
server 12.16.64.4:8092;
}
upstream default-services-ingress-ctc-cicd2-gatewayservice {
server 12.16.64.6:8090;
server 12.16.65.7:8090;
}`
server {
listen 80;
server_name ctc-cicd2;
location /gateway {
proxy_http_version 1.1;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
client_max_body_size 1m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering on;
proxy_pass http://default-services-ingress-ctc-cicd2-gatewayservice;
}
location /training {
proxy_http_version 1.1;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
client_max_body_size 1m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering on;
proxy_pass http://default-services-ingress-ctc-cicd2-trainingservice;
}
location /attachment {
proxy_http_version 1.1;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
client_max_body_size 1m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering on;
proxy_pass http://default-services-ingress-ctc-cicd2-attachmentservice;
}
location /hr {
proxy_http_version 1.1;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
client_max_body_size 1m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering on;
proxy_pass http://default-services-ingress-ctc-cicd2-hrservice;
}
location /message {
proxy_http_version 1.1;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
client_max_body_size 1m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering on;
proxy_pass http://default-services-ingress-ctc-cicd2-messageservice;
}
location /settings {
proxy_http_version 1.1;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
client_max_body_size 1m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering on;
proxy_pass http://default-services-ingress-ctc-cicd2-settingservice;
}
location /finance {
proxy_http_version 1.1;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
client_max_body_size 1m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering on;
proxy_pass http://default-services-ingress-ctc-cicd2-financeservice;
}
}
【问题讨论】：
标签： nginx kubernetes