Docker Kubernetes-- pod间通信，Ingress服务

1、pod间通信

1.1 同节点之间的通信

- 同一节点的pod之间通过cni网桥转发数据包。

1.2 不同节点的pod之间的通信需要网络插件支持(详解)

1.2.1 Flannel vxlan模式跨主机通信原理

1.2.2 vxlan模式(默认模式)

[root@server2 ~]# vim demo.yml 
   ---
apiVersion: v1
kind: Service
metadata:
  name: myservice
spec:
  selector:
    app: myapp
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  #clusterIP: None
  #type: NodePort
  #type: LoadBalancer
  externalIPs:
  - 192.168.0.10
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo2
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myapp:v2
[root@server2 ~]# kubectl apply -f demo.yml 
service/myservice unchanged
deployment.apps/demo2 configured
[root@server2 ~]# kubectl get pod  ##查看详细信息
[root@server2 ~]# kubectl get pod -o wide
[root@server2 ~]# kubectl attach demo -it
[ root@demo:/ ]$ ping 10.244.2.66
PING 10.244.2.66 (10.244.2.66): 56 data bytes
64 bytes from 10.244.2.66: seq=0 ttl=62 time=0.817 ms
64 bytes from 10.244.2.66: seq=1 ttl=62 time=0.605 ms
[root@server2 ~]# cat /run/flannel/subnet.env 
[root@server4 ~]# ip n 
[root@server4 ~]# bridge fdb
[root@server4 ~]# arp -n

[root@server3 ~]# ip addr

[root@server3 ~]# ip addr

[root@server4 ~]# bridge fdb

1.2.3 host-gw模式

[root@server3 ~]# yum install -y tcpdump 
[root@server2 ~]# kubectl -n kube-system edit  cm kube-flannel-cfg   ##修改模式为host-gw
        "Type": "host-gw" 
[root@server2 ~]# kubectl get pod -n kube-system |grep flannel | awk '{system("kubectl delete pod "$1" -n kube-system")}'
[root@server3 ~]# ip route   ##每个节点都可以通过这条命令查看route，也可以用route -n

1.2.4 Directrouting

[root@server2 ~]# kubectl -n kube-system edit cm kube-flannel-cfg  ##修改模式
        "Type": "vxlan",
        "Directrouting": true
[root@server2 ~]# kubectl get pod -n kube-system |grep flannel | awk '{system("kubectl delete pod "$1" -n kube-system")}'
[root@server2 ~]# kubectl get pod -o wide
[root@server2 ~]# kubectl attach demo -it

[root@server3 ~]# tcpdump -i eth0 -nn icmp #抓包
[root@server3 ~]# tcpdump -i flannel.1 -nn 

2、Ingress服务

- 一种全局的、为了代理不同后端 Service 而设置的负载均衡服务，就是 Kubernetes 里的Ingress 服务。
	Ingress由两部分组成：Ingress controller和Ingress服务。
	
	Ingress Controller 会根据你定义的 Ingress 对象，提供对应的代理能力。业界常用的各种反向代理项目，比如 Nginx、HAProxy、Envoy、Traefik 等，都已经为Kubernetes 专门维护了对应的 Ingress Controller。

2.1 部署ingress服务

官网：NGINX Ingress Controller

- 用DaemonSet结合nodeselector来部署ingress-controller到特定的node上，然后使用HostNetwork直接把该pod与宿主机node的网络打通，直接使用宿主机的80/443端口就能访问服务。
	优点是整个请求链路最简单，性能相对NodePort模式更好。
	缺点是由于直接利用宿主机节点的网络和端口，一个node只能部署一个ingress-controller pod。
	比较适合大并发的生产环境使用。

[root@foundation50 Desktop]# scp ingress-nginx.tar 192.168.0.1:
[root@server1 ~]# docker load -i ingress-nginx.tar  ##加载镜像
[root@server1 ~]# docker images | grep webhook
[root@server1 ~]# docker images | grep ingress
[root@server1 ~]# docker tag quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.33.0 reg.westos.org/library/nginx-ingress-controller:0.33.0
[root@server1 ~]# docker tag jettech/kube-webhook-certgen:v1.2.0 reg.westos.org/library/kube-webhook-certgen:v1.2.0
[root@server1 ~]# docker push reg.westos.org/library/nginx-ingress-controller:0.33.0  ##上传到harbor仓库
[root@server1 ~]# docker push reg.westos.org/library/kube-webhook-certgen:v1.2.0 

[root@server2 ~]# kubectl delete -f damo.yml   ##先删除前面实验添加的172.25.13.100的svc

[root@server2 ~]# mkdir ingress ##创建对应文件夹方便实验
[root@server2 ~]# cp deploy.yaml ingress/
[root@server2 ~]# cd ingress/

[root@server2 ingress]# kubectl apply -f deploy.yaml 
[root@server2 ingress]# kubectl get ns     ##安装成功后出现新的namespace:ingress-nginx
[root@server2 ingress]# kubectl get all -n ingress-nginx     ##查看服务是否安装成功
[root@server2 ingress]# kubectl get all -o wide -n ingress-nginx   ##查看新namespace详细信息
[root@server2 ingress]# kubectl -n ingress-nginx get pod    ##查看是否运行成功,READY状态必须为1
[root@server2 ~]# kubectl -n  ingress-nginx  describe pod ingress-nginx-controller-w62nz

2.2 Ingress配置

2.2.1 配置基本的测试文件

一个host

[root@server2 ~]# kubectl apply -f demo.yml 
service/myservice created
deployment.apps/demo2 created
[root@server2 ~]# kubectl describe svc myservice

[root@foundation50 Desktop]# vim /etc/hosts
192.168.0.4 www1.westos.org

[root@server2 ingress]# vim nginx.yml 
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-demo
spec:
  rules:
  - host: www1.westos.org
    http:
      paths:
      - path: /
        backend:
          serviceName: myservice
          servicePort: 80
[root@server2 ingress]# kubectl apply -f nginx.yml  ##创建ingress
[root@server2 ingress]# kubectl -n ingress-nginx get pod
[root@server2 ingress]# kubectl get ingress
NAME           CLASS    HOSTS             ADDRESS       PORTS   AGE
ingress-demo   <none>   www1.westos.org   192.168.0.4   80      7m37s

[root@server4 ~]# netstat -antlp | grep :80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      7799/nginx: master  
tcp6       0      0 :::80                   :::*                    LISTEN      7799/nginx: master  

[root@foundation50 Desktop]# curl www1.westos.org/hostname.html
demo2-67f8c948cf-4tt69
[root@foundation50 Desktop]# curl www1.westos.org/hostname.html
demo2-67f8c948cf-dh9ch

两个host

[root@foundation50 Desktop]# vim /etc/hosts
192.168.0.4 www1.westos.org  www2.westos.org

[root@server2 ingress]# vim nginx-svc.yml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-demo
spec:
  rules:
  - host: www1.westos.org
    http:
      paths:
      - path: /
        backend:
          serviceName: myservice
          servicePort: 80

  - host: www2.westos.org
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx-svc
          servicePort: 80
[root@server2 ingress]# kubectl apply  -f nginx-svc.yml
service/nginx-svc created
deployment.apps/deployment created
[root@server2 ingress]# kubectl get pod -L app
[root@server2 ingress]# kubectl get svc
[root@server2 ingress]# kubectl describe svc nginx-svc 
[root@server2 ingress]# vim nginx.yml 
[root@server2 ingress]# kubectl apply  -f nginx.yml
[root@server2 ingress]# kubectl describe ingress ingress-demo 

[root@foundation50 Desktop]# curl www1.westos.org
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>
[root@foundation50 Desktop]# curl www2.westos.org
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

2.2.2 证书加密

[root@server2 ingress]# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=nginxsvc/O=nginxsvc"    ##生成证书文件
[root@server2 ingress]# ls
deploy.yaml  nginx-svc.yml  nginx.yml  tls.crt  tls.key
[root@server2 ingress]# kubectl create secret tls tls-secret --key tls.key --cert tls.crt  ##生成缓存的密钥文件，相当于缓存到secret这个文件中
secret/tls-secret created
[root@server2 ingress]# kubectl get secrets  ##查看生成的密钥文件
[root@server2 ingress]# kubectl describe  secrets tls-secret  ##查看密钥详细信息

[root@server2 ingress]# vim nginx.yml 
[root@server2 ingress]# kubectl apply -f nginx.yml
[root@server2 ingress]# kubectl get ingress 
NAME            CLASS    HOSTS             ADDRESS       PORTS     AGE
ingress-demo    <none>   www1.westos.org   192.168.0.4   80, 443   42m
ingress-demo2   <none>   www2.westos.org   192.168.0.4   80        7m27s

[root@foundation50 Desktop]# curl www1.westos.org
[root@foundation50 Desktop]# curl www1.westos.org -I 重定向
[root@foundation50 Desktop]# curl www2.westos.org

2.2.3 证书加密与用户认证

[root@server2 ingress]# yum provides */htpasswd    ##查看htpasswd软件属于哪个安装包
[root@server2 ingress]# yum install httpd-tools-2.4.6-88.el7.x86_64 -y  ##安装对应软件
[root@server2 ingress]# htpasswd -c auth linux
[root@server2 ingress]# htpasswd auth admin
Adding password for user admin
[root@server2 ingress]# cat auth
linux:$apr1$sE8wr.cb$/9RcGgU6FWUgNFkMPYnSA1
admin:$apr1$OlUpLQ4G$..EN8P96UNwofaHsuytHg/ 
[root@server2 ingress]# kubectl create secret generic basic-auth --from-file=auth   ##存储用户认证文件
secret/basic-auth created
[root@server2 ingress]# kubectl get secrets

[root@server2 ingress]# kubectl get secret basic-auth -o yaml   ##通过yaml文件查看用户认证信息

[root@server2 ingress]# cat nginx.yml
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - linux'
[root@server2 ingress]# kubectl apply -f nginx.yml   ##创建 
[root@server2 ingress]# kubectl describe ingress ingress-demo

网页访问www1.westos.org发现需要用户认证，登陆即可

2.2.4 简单设置重定向

[root@server2 ingress]# vim nginx.yml 
[root@server2 ingress]# kubectl apply -f nginx.yml
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /hostname.html   ##设置重定向信息，可以直接访问到www1.westos.org/hostname.html
[root@foundation50 Desktop]# curl www2.westos.org
deployment-6456d7c676-fl56x
[root@foundation50 Desktop]# curl www2.westos.org
deployment-6456d7c676-vbhts

2.2.5 地址重写(复杂的重定向)

[root@server2 ingress]# vim nginx.yml 
[root@server2 ingress]# kubectl apply -f nginx.yml
[root@server2 ingress]# kubectl describe ingress ingress-demo2
[root@foundation50 Desktop]# curl www2.westos.org/westos -I
[root@foundation50 Desktop]# curl www2.westos.org/westos/hostname.html
deployment-6456d7c676-vbhts
[root@foundation50 Desktop]# curl www2.westos.org/westos
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>