入口未绑定到负载均衡器

Question

我将 Netlify 上的 A record 映射到 Digital Ocean 上的负载均衡器 IP 地址，它能够访问 nginx 服务器，但在尝试访问任何应用程序 API 时，我得到了 404。我注意到我的 Ingress 的状态并未显示它已绑定到负载均衡器。

有人知道我缺少什么来获得这个设置吗？

应用入口：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: d2d-server
spec:
  rules:
    - host: api.cloud.myhostname.com
      http:
        paths:
          - backend:
              service:
                name: d2d-server
                port:
                  number: 443
            path: /
            pathType: ImplementationSpecific

应用服务：

apiVersion: v1
kind: Service
metadata:
  name: d2d-server
spec:
  selector:
    app: d2d-server
  ports:
    - name: http-api
      protocol: TCP
      port: 443
      targetPort: 8080
  type: ClusterIP

入口控制器：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
  uid: fc64d9f6-a935-49b2-9d7a-b862f660a4ea
  resourceVersion: '257931'
  generation: 1
  creationTimestamp: '2021-10-22T05:31:26Z'
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/version: 1.0.4
    helm.sh/chart: ingress-nginx-4.0.6
  annotations:
    deployment.kubernetes.io/revision: '1'
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
    spec:
      volumes:
        - name: webhook-cert
          secret:
            secretName: ingress-nginx-admission
            defaultMode: 420
      containers:
        - name: controller
          image: >-
            k8s.gcr.io/ingress-nginx/controller:v1.0.4@sha256:545cff00370f28363dad31e3b59a94ba377854d3a11f18988f5f9e56841ef9ef
          args:
            - /nginx-ingress-controller
            - '--publish-service=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--election-id=ingress-controller-leader'
            - '--controller-class=k8s.io/ingress-nginx'
            - '--configmap=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--validating-webhook=:8443'
            - '--validating-webhook-certificate=/usr/local/certificates/cert'
            - '--validating-webhook-key=/usr/local/certificates/key'
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
            - name: https
              containerPort: 443
              protocol: TCP
            - name: webhook
              containerPort: 8443
              protocol: TCP
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: LD_PRELOAD
              value: /usr/local/lib/libmimalloc.so
          resources:
            requests:
              cpu: 100m
              memory: 90Mi
          volumeMounts:
            - name: webhook-cert
              readOnly: true
              mountPath: /usr/local/certificates/
          livenessProbe:
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          lifecycle:
            preStop:
              exec:
                command:
                  - /wait-shutdown
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL
            runAsUser: 101
            allowPrivilegeEscalation: true
      restartPolicy: Always
      terminationGracePeriodSeconds: 300
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: ingress-nginx
      serviceAccount: ingress-nginx
      securityContext: {}
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

负载均衡器：

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/version: 1.0.4
    helm.sh/chart: ingress-nginx-4.0.6
  annotations:
    kubernetes.digitalocean.com/load-balancer-id: <LB_ID>
    service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: 'true'
    service.beta.kubernetes.io/do-loadbalancer-name: ingress-nginx
    service.beta.kubernetes.io/do-loadbalancer-protocol: https
status:
  loadBalancer:
    ingress:
      - ip: <IP_HIDDEN>
spec:
  ports:
    - name: http
      protocol: TCP
      appProtocol: http
      port: 80
      targetPort: http
      nodePort: 31661
    - name: https
      protocol: TCP
      appProtocol: https
      port: 443
      targetPort: https
      nodePort: 32761
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  clusterIP: <IP_HIDDEN>
  clusterIPs:
    - <IP_HIDDEN>
  type: LoadBalancer
  sessionAffinity: None
  externalTrafficPolicy: Local
  healthCheckNodePort: 30477
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack

Answer 1

kind: ingress 是关于管理从 入口控制器 到集群服务的流量的代理规则。但要实现这一点，外部流量需要到达 Ingress Controller。 https://kubernetes.io/docs/concepts/services-networking/ingress/#what-is-ingress

假设“客户端”是我们的负载均衡器

所以我假设您想要做的是将您的 LoadBalancer 指向 Ingress Controler，然后根据您的 Ingress 规则，它将流量路由给您（在这种情况下） d2d 服务。

要将 LB 指向 pod，您需要创建一个带有 spec.type: Loadbalancer 字段的 Service 资源。我修改了一个来自数字海洋的示例，它应该符合您的需求。注意 Service 的注解可以修改 Loadbalancer 参数，更多信息可以在这里找到：https://github.com/digitalocean/digitalocean-cloud-controller-manager/blob/master/docs/controllers/services/annotations.md

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
  annotations:
    # @Edit set it to http since no certyficate is provided
    service.beta.kubernetes.io/do-loadbalancer-protocol: "http"
    service.beta.kubernetes.io/do-loadbalancer-name: "<YOUR_LB_NAME>"
spec:
  type: LoadBalancer
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/version: 1.0.4
    helm.sh/chart: ingress-nginx-4.0.6
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
    - name: https
      protocol: TCP
      port: 443
      targetPort: 443
    - name: webhook
      protocol: TCP
      port: 8443
      targetPort: 8443

Answer 2

我只需要将nginx 的字段ingressClassName 添加到入口规范。