Copyright © 1998-2023 maxiaoke.com All rights reserved.

当前位置:　 首页>> 技术小册>> Kubernets合辑6-服务发现

小册名称：Kubernets合辑6-服务发现

1.安装 heml
helm 安装方式可以参考官方文档。

2.安装traefik

  1. # values.yaml 
  2. image.tag: "v2.5.3"
  4. deployment:
  5.   kind: DaemonSet
  6.   additionalVolumes: 
  7.     - name: traefik-access-log
  8.       hostPath:
  9.         path: /data/logs/traefik
  10.         type: DirectoryOrCreate
  11.   # 初始化容器，用来修改日志目录的权限
  12.   initContainers: 
  13.     - name: volume-permissions
  14.       image: busybox:1.31.1
  15.       command: ["sh", "-c", "chmod -Rv 755 /data/ && chown -R 65532.65532 /data/"]
  16.       volumeMounts:
  17.         - name: traefik-access-log
  18.           mountPath: /data
  20. ingressClass:
  21.   enabled: true
  22.   isDefaultClass: true
  23.   fallbackApiVersion: "v1"
  25. # 推荐使用域名访问
  26. ingressRoute.dashboard.enabled: false
  28. additionalVolumeMounts: 
  29.   - name: traefik-access-log
  30.     mountPath: /var/log/traefik
  32. logs:
  33.   general.level: WARN
  34.   # 访问日志配置
  35.   access:
  36.     enabled: true
  37.     # 缓冲的行数
  38.     bufferingSize: 100
  39.     # 指定哪些日志被记录
  40.     # 目前不支持过滤掉内部健康检查的日志，并且日志自定义能力很弱，
  41.     # 如果前端有LB，那么还得通过 proxyprotocol 获取客户端IP，很麻烦
  42.     # 流量下，如果前端有一个Nginx作为LB，甚至可以考虑关闭traefik的日志
  43.     filters: 
  44.       statuscodes: "100,300-302,400-404,500-505"    # 状态码范围
  45.       retryattempts: true                           # 是否重试
  46.       minduration: 10ms                             # 响应超过10ms
  48. globalArguments:
  49.   - "--global.checknewversion"
  50.   - "--global.sendanonymoususage"
  51.   # 从traefik到后端pod的访问中，不校验pod中的TLS证书，这对自签证书的pod很管用
  52.   - "--serversTransport.insecureSkipVerify=true"
  53.   # 指定访问日志的写入路径，可以用来让 filebeat 采集
  54.   # 日志轮转是需要cronjob定时发送 USR1 信号给traefik
  55.   - "--accesslog.filepath=/var/log/traefik/access.log"
  56.   # 访问日志中的时间戳以容器时区为准
  57.   - "--accesslog.fields.names.StartUTC=drop"
  59. env: 
  60.   # 指定traefik的时区
  61.   - name: TZ
  62.     value: Asia/Shanghai
  64. # 想要性能更高，甚至可以直接使用节点的网络空间
  65. ports:
  66.   traefik:
  67.     port: 9000
  68.     # 生产环境不推荐暴露9000端口
  69.     expose: false
  70.     exposedPort: 9000
  71.     protocol: TCP
  72.   web:
  73.     port: 8000
  74.     hostPort: 80
  75.     expose: true
  76.     exposedPort: 80
  77.     protocol: TCP
  78.     # redirectTo: websecure
  79.   websecure:
  80.     port: 8443
  81.     hostPort: 443
  82.     expose: true
  83.     exposedPort: 443
  84.   metrics:
  85.     port: 9100
  86.     expose: false
  87.     exposedPort: 9100
  88.     protocol: TCP  
  90. service:
  91.   type: ClusterIP
  93. resources: 
  94.   requests:
  95.     cpu: "100m"
  96.     memory: "512Mi"
  97.   limits:
  98.     cpu: "1000m"
  99.     memory: "1024Mi"
  101. # 针对指定的 node 才部署 traefik
  102. nodeSelector: 
  103.   ingressControllerNode: "yes"
  104.   ingressController: "traefik"
  1. [root@maxiaoke ~]# kubectl get node
  2. NAME          STATUS                     ROLES    AGE   VERSION
  3. 10.0.160.10   Ready,SchedulingDisabled   master   12d   v1.20.10
  4. 10.0.160.13   Ready                      node     12d   v1.20.10
  5. 10.0.160.30   Ready,SchedulingDisabled   master   12d   v1.20.10
  6. 10.0.160.32   Ready                      node     12d   v1.20.10
  7. 10.0.160.50   Ready,SchedulingDisabled   master   12d   v1.20.10
  8. 10.0.160.51   Ready                      node     12d   v1.20.10
  10. # 标记作为IngressController的节点, 之所以增加IngressController=traefik，是后续可能会部署多个ingress controller
  11. [root@maxiaoke ~]# kubectl label nodes 10.0.160.10 ingressControllerNode=yes ingressController=traefik
  12. [root@maxiaoke ~]# kubectl label nodes 10.0.160.30 ingressControllerNode=yes ingressController=traefik
  13. [root@maxiaoke ~]# kubectl label nodes 10.0.160.50 ingressControllerNode=yes ingressController=traefik
  15. [root@maxiaoke ~]# kubectl create namespace traefik
  17. [root@maxiaoke ~]# helm repo add traefik https://helm.traefik.io/traefik
  18. [root@maxiaoke ~]# helm repo update
  20. [root@maxiaoke ~]# helm install -n traefik traefik traefik/traefik -f /tmp/values.yaml
  22. [root@maxiaoke ~]# kubectl get pod -n traefik -o wide
  23. NAME            READY   STATUS    RESTARTS   AGE   IP            NODE          NOMINATED NODE   READINESS GATES
  24. traefik-2mdzt   1/1     Running   0          13h   10.200.1.18   10.0.160.10   <none>           <none>
  25. traefik-42k4f   1/1     Running   0          13h   10.200.2.17   10.0.160.50   <none>           <none>
  26. traefik-kg7v6   1/1     Running   0          13h   10.200.0.17   10.0.160.30   <none>           <none>

3.配置负载均衡器
一般使用ingress controller监听在节点的80后者443端口，80负责HTTP流量，443负责HTTPS流量。用户从集群外面访问集群内业务的API，从安全角度考虑，建议强制走HTTPS协议到达负载均衡器，从负载均衡器到后端ingress controller，可以走HTTP或者HTTPS，推荐在做好安全工作的前提下，推荐走HTTP。针对需要走HTTPS的流量，在负载均衡器上使用更高优先级的虚拟机主机，将流量转发到 ingress controller 的https接口。

  1. # /etc/nginx/nginx.conf
  2. user nginx;
  3. worker_processes auto;
  4. pid /run/nginx.pid;
  6. include /usr/share/nginx/modules/*.conf;
  8. events {
  9.     worker_connections 65535;
  10. }
  12. http {
  13.     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  14.                       '$status $body_bytes_sent "$http_referer" '
  15.                       '"$http_user_agent" "$http_x_forwarded_for"';
  17.     log_format access '$time_local|$http_x_real_ip|$remote_addr|$http_x_forwarded_for|$upstream_addr|$upstream_connect_time|$upstream_response_time|'
  18.                       '$request_method|$server_protocol|$host|$request_uri|$http_referer|$http_user_agent|$proxy_host|$status' ;
  20.     access_log  /var/log/nginx/http-access.log  main;
  21.     error_log /var/log/nginx/http-error.log error;
  23.     sendfile            on;
  24.     tcp_nopush          on;
  25.     tcp_nodelay         on;
  26.     keepalive_timeout   65;
  27.     types_hash_max_size 4096;
  29.     include             /etc/nginx/mime.types;
  30.     default_type        application/octet-stream;
  32.     include /etc/nginx/conf.d/http/*.conf;
  33. }
  35. stream {
  36.     log_format stream '$time_local|$remote_addr|$protocol|$bytes_sent|$bytes_received|$upstream_addr|$upstream_connect_time|$status'
  38.     access_log  /var/log/nginx/stream-access.log  stream;
  39.     error_log /var/log/nginx/stream-error.log error;
  41.     include /etc/nginx/conf.d/stream/*.conf;
  42. }
  1. # 配置默认的转发规则
  2. # /etc/nginx/conf.d/http/default.conf
  3. server {
  4.     listen 0.0.0.0:80 backlog=2048 ;
  5.     server_name *.huanle.com ;
  6.     access_log /var/log/nginx/http-k8s-local-01.log access ;
  7.     rewrite (.*) https://$host$1 redirect ;
  8. }
  10. server {
  11.     listen 0.0.0.0:443 ssl backlog=2048 ;
  12.     server_name *.huanle.com ;
  13.     access_log /var/log/nginx/http-k8s-local-01.log access ;
  14.     keepalive_timeout 100s ;
  15.     keepalive_requests 200 ;
  16.     ssl_certificate ssl_key/huanle.crt ;
  17.     ssl_certificate_key ssl_key/huanle.key ;
  18.     ssl_ciphers HIGH:!aNULL:!MD5 ;
  19.     ssl_session_cache shared:SSL:30m ;  ## 设置SSL session缓存
  20.     ssl_session_timeout 10m ;
  21.     location / {
  22.         proxy_pass http://k8s-local-01-http ;
  23.         proxy_connect_timeout 3 ;
  24.         proxy_read_timeout    10 ;
  25.         proxy_send_timeout    10 ;
  26.         proxy_set_header Host $host;
  27.         proxy_set_header X-Real-IP $remote_addr ;
  28.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;
  29.     }
  30. }
  1. # /etc/nginx/conf.d/http/upstream.conf
  2. upstream k8s-local-01-http {
  3.     server 10.0.160.10:80 max_fails=2 fail_timeout=3s;
  4.     server 10.0.160.30:80 max_fails=2 fail_timeout=3s;
  5.     server 10.0.160.50:80 max_fails=2 fail_timeout=3s;
  6. }
  8. upstream k8s-local-01-https {
  9.     server 10.0.160.10:443 max_fails=2 fail_timeout=3s;
  10.     server 10.0.160.30:443 max_fails=2 fail_timeout=3s;
  11.     server 10.0.160.50:443 max_fails=2 fail_timeout=3s;
  12. }

该分类下的相关小册推荐：

Kubernets合辑4-kubernetes入门
Kubernets合辑4-kubernetes入门
Kubernets合辑3-kubernetes介绍
Kubernets合辑3-kubernetes介绍
Kubernets合辑15-持续部署
Kubernets合辑15-持续部署
Kubernets合辑10-网络
Kubernets合辑10-网络
Kubernets合辑13-集群监控
Kubernets合辑13-集群监控
Kubernetes中文教程(五)
Kubernetes中文教程(五)
Kubernetes中文教程(三)
Kubernetes中文教程(三)
Kubernetes中文教程(一)
Kubernetes中文教程(一)
Kubernetes合辑1-安装Kubernetes
Kubernetes合辑1-安装Kubernetes
Kubernets合辑14-日志收集
Kubernets合辑14-日志收集
Kubernets合辑2-部署Ingress
Kubernets合辑2-部署Ingress
Kubernets合辑8-权限控制
Kubernets合辑8-权限控制