微服務探索之路04篇k8s增加子節點,metrics資源監控,ingress-nginx域名配置及https配置

wuyubing發表於2022-06-27

1 k8s增加子節點

1.1 子節點伺服器安裝docker，使用指令碼自動安裝

curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

安裝完之後設定docker守護程式配置vim /etc/docker/daemon.json，內容為

{
        "insecure-registries": ["http://127.0.0.1:8080"],
        "exec-opts": ["native.cgroupdriver=systemd"],
        "bip": "172.17.0.1/24",
        "registry-mirrors": [
        "https://xxxxx.mirror.aliyuncs.com"
         ]
}

insecure-registries是設定私有映象倉庫地址
exec-opts是設定驅動程式，這邊為了裝k8s的時候驅動程式相同
bip是設定內網ip段
registry-mirrors是設定國內映象，這邊是使用阿里雲加速映象xxxxx登入阿里雲加速站就可以看到對應的內容了。
重啟docker systemctl restart docker

1.2. 子節點伺服器k8s配置

根據第2篇1-3點安裝k8s環境，第4步驟的時候跳回本文往下看

1.3子節點接入

檢視主節點join命令kubeadm token list,如果沒查到執行重新生成的命令kubeadm token create --print-join-command
這裡為了更方便管理可以把子節點主機名字改一下，修改方法為：

執行vim /etc/hostname,修改名稱
執行vim /etc/hosts,修改對應的主機名，如下圖node2可以修改為跟第上一步相同的主機名

複製出join連結在子節點執行，執行之後如下圖
此時可以去主節點伺服器檢視是否成功，在主節點執行kubectl get nodes,如下圖出現子節點表示接入成功

2 k8s metrics-server資源監控

必須有子節點之後才能成功安裝資源監控資源監控只有一個主節點的時候安裝會報錯。
下載github上的yaml然後修改映象為阿里雲映象，修改地址型別只留InternalIP如下圖為修改地方

下面為修改後的可以直接使用

apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    k8s-app: metrics-server
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
  name: system:aggregated-metrics-reader
rules:
- apiGroups:
  - metrics.k8s.io
  resources:
  - pods
  - nodes
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    k8s-app: metrics-server
  name: system:metrics-server
rules:
- apiGroups:
  - ""
  resources:
  - nodes/metrics
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server-auth-reader
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: metrics-server
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server:system:auth-delegator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: metrics-server
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: system:metrics-server
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:metrics-server
subjects:
- kind: ServiceAccount
  name: metrics-server
  namespace: kube-system
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server
  namespace: kube-system
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    k8s-app: metrics-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: metrics-server
  strategy:
    rollingUpdate:
      maxUnavailable: 0
  template:
    metadata:
      labels:
        k8s-app: metrics-server
    spec:
      containers:
      - args:
        - --cert-dir=/tmp
        - --secure-port=4443
        - --kubelet-preferred-address-types=InternalIP
        - --kubelet-use-node-status-port
        - --metric-resolution=15s
        - --kubelet-insecure-tls
        image: registry.cn-hangzhou.aliyuncs.com/google_containers/metrics-server:v0.6.1 #這邊改為阿里雲加速映象，全文的image都對應已修改
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /livez
            port: https
            scheme: HTTPS
          periodSeconds: 10
        name: metrics-server
        ports:
        - containerPort: 4443
          name: https
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: https
            scheme: HTTPS
          initialDelaySeconds: 20
          periodSeconds: 10
        resources:
          requests:
            cpu: 200m
            memory: 200Mi
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
        volumeMounts:
        - mountPath: /tmp
          name: tmp-dir
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-cluster-critical
      serviceAccountName: metrics-server
      volumes:
      - emptyDir: {}
        name: tmp-dir
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  labels:
    k8s-app: metrics-server
  name: v1beta1.metrics.k8s.io
spec:
  group: metrics.k8s.io
  groupPriorityMinimum: 100
  insecureSkipTLSVerify: true
  service:
    name: metrics-server
    namespace: kube-system
  version: v1beta1
  versionPriority: 100

修改完之後執行kubectl apply -f metrics.yml,檔名自己下載的時候定義的可以隨意。
執行完之後等待一會，然後看登入k8s皮膚檢視可以看到介面上出現了cpu和記憶體使用率的指標如下圖

3 Ingress-nginx

下載指令碼修改映象內容為國內的映象,下載地址點這

下方程式碼為修改後可用程式碼可直接複製使用

apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  name: ingress-nginx
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx
  namespace: ingress-nginx
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx
  namespace: ingress-nginx
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - configmaps
  - pods
  - secrets
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resourceNames:
  - ingress-controller-leader
  resources:
  - configmaps
  verbs:
  - get
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission
  namespace: ingress-nginx
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - nodes
  - pods
  - secrets
  - namespaces
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update
- apiGroups:
  - networking.k8s.io
  resources:
  - ingressclasses
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission
rules:
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  verbs:
  - get
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx
  namespace: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingress-nginx
subjects:
- kind: ServiceAccount
  name: ingress-nginx
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission
  namespace: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
  name: ingress-nginx-admission
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingress-nginx
subjects:
- kind: ServiceAccount
  name: ingress-nginx
  namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
  name: ingress-nginx-admission
  namespace: ingress-nginx
---
apiVersion: v1
data:
  allow-snippet-annotations: "true"
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-controller
  namespace: ingress-nginx
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  ports:
  - appProtocol: http
    name: http
    port: 80
    protocol: TCP
    targetPort: http
    nodePort: 80 #新增設定對外http埠
  - appProtocol: https
    name: https
    port: 443
    protocol: TCP
    targetPort: https
    nodePort: 443 #新增設定對外https埠
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-controller-admission
  namespace: ingress-nginx
spec:
  ports:
  - appProtocol: https
    name: https-webhook
    port: 443
    targetPort: webhook
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: ClusterIP
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  minReadySeconds: 0
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
    spec:
      containers:
      - args:
        - /nginx-ingress-controller
        - --election-id=ingress-controller-leader
        - --controller-class=k8s.io/ingress-nginx
        - --ingress-class=nginx
        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
        - --validating-webhook=:8443
        - --validating-webhook-certificate=/usr/local/certificates/cert
        - --validating-webhook-key=/usr/local/certificates/key
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: LD_PRELOAD
          value: /usr/local/lib/libmimalloc.so
        image: registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:v1.1.3 #修改為國內映象，本文使用阿里雲加速映象
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - /wait-shutdown
        livenessProbe:
          failureThreshold: 5
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: controller
        ports:
        - containerPort: 80
          name: http
          protocol: TCP
        - containerPort: 443
          name: https
          protocol: TCP
        - containerPort: 8443
          name: webhook
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          requests:
            cpu: 100m
            memory: 90Mi
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          runAsUser: 101
        volumeMounts:
        - mountPath: /usr/local/certificates/
          name: webhook-cert
          readOnly: true
      dnsPolicy: ClusterFirst
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: ingress-nginx
      terminationGracePeriodSeconds: 300
      volumes:
      - name: webhook-cert
        secret:
          secretName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission-create
  namespace: ingress-nginx
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/component: admission-webhook
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
        app.kubernetes.io/version: 1.1.3
      name: ingress-nginx-admission-create
    spec:
      containers:
      - args:
        - create
        - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
        - --namespace=$(POD_NAMESPACE)
        - --secret-name=ingress-nginx-admission
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: registry.cn-hangzhou.aliyuncs.com/google_containers/kube-webhook-certgen:v1.1.1
        imagePullPolicy: IfNotPresent
        name: create
        securityContext:
          allowPrivilegeEscalation: false
      nodeSelector:
        kubernetes.io/os: linux
      restartPolicy: OnFailure
      securityContext:
        fsGroup: 2000
        runAsNonRoot: true
        runAsUser: 2000
      serviceAccountName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission-patch
  namespace: ingress-nginx
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/component: admission-webhook
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
        app.kubernetes.io/version: 1.1.3
      name: ingress-nginx-admission-patch
    spec:
      containers:
      - args:
        - patch
        - --webhook-name=ingress-nginx-admission
        - --namespace=$(POD_NAMESPACE)
        - --patch-mutating=false
        - --secret-name=ingress-nginx-admission
        - --patch-failure-policy=Fail
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        image: registry.cn-hangzhou.aliyuncs.com/google_containers/kube-webhook-certgen:v1.1.1
        imagePullPolicy: IfNotPresent
        name: patch
        securityContext:
          allowPrivilegeEscalation: false
      nodeSelector:
        kubernetes.io/os: linux
      restartPolicy: OnFailure
      securityContext:
        fsGroup: 2000
        runAsNonRoot: true
        runAsUser: 2000
      serviceAccountName: ingress-nginx-admission
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: nginx
spec:
  controller: k8s.io/ingress-nginx
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.1.3
  name: ingress-nginx-admission
webhooks:
- admissionReviewVersions:
  - v1
  clientConfig:
    service:
      name: ingress-nginx-controller-admission
      namespace: ingress-nginx
      path: /networking/v1/ingresses
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: validate.nginx.ingress.kubernetes.io
  rules:
  - apiGroups:
    - networking.k8s.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - ingresses
  sideEffects: None

執行指令碼kubectl apply -f ingress.yaml

執行上面指令碼如果遇到埠限制報錯是因為service預設埠範圍是30000-32767。開啟檔案編輯vim /etc/kubernetes/manifests/kube-apiserver.yaml在如圖位置增加一行- --service-node-port-range=1-65535

編輯後執行systemctl restart kubelet重啟，重啟之後在執行ingress.yaml就可以了成功了。

登入皮膚查詢如圖成功（如果馬上看可能還沒安裝完成會有紅色區塊，可以等待幾分鐘）

服務對外開放訪問，三種方式

NodePort，設定Service的type就可以對外暴露埠這種方式如果服務很多那就得暴露很多埠不適合生產環境。
LoadBalancer，這個是雲原生才會採用的方式
Ingress，本文主要介紹這個方式使用ingress-nginx

第一步，拉取一個映象部署服務資源,此處使用的使用倉庫映象拉取方法（可參考03篇）

apiVersion: v1
kind: Service
metadata:
  name: test       # Service 名稱
  namespace: yuan-yao
spec:
  selector:
    app: test
    release: canary
  ports:
  - name: http
    targetPort: 80      # 指定容器埠
    port: 80            # Service 自己開放的埠
    
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  namespace: yuan-yao
spec:
  replicas: 3
  selector:
    matchLabels:
      app: test
      release: canary
  template:
    metadata:
      labels:
        app: test
        release: canary
    spec:
      imagePullSecrets:
      - name: yuanyao-se #第三篇的私有映象有講到怎麼獲得這個
      containers:
      - name: test
        image: 159.xx.71.xx:8080/yuanyao/website01:1.0.2 #這裡是私有倉庫的映象
        ports:
        - name: http
          containerPort: 80

第二步，建立ingress-nginx，特別提示：名稱空間必須和對應的Service名稱空間一樣不然外部訪問的時候會報503錯誤

apiVersion: networking.k8s.io/v1
kind: Ingress               #寫個資源，資源物件是Ingress，就由此Ingress資源物件定義的規則，來配置Ingress轉發情況
metadata:
  name: ingress-test    #名稱隨便寫
  namespace: yuan-yao   #必須和對應Service的名稱空間一樣
spec:
  ingressClassName: nginx       #預設就寫Nginx
  rules:
  - host: q1.wyb.com         #服務的域名
    http:
      paths: 
      - pathType: Prefix        #表示以字首的方式進行匹配
        path: /              #字首必須有個"/"，才可以成功匹配
        backend:
          service:              #規定Ingress後端的Service
            name: test      #後端Service的名稱
            port:  
              number: 80      #後端Service監聽的埠

注意：如果是本地虛擬機器測試此處的域名是自定義隨便的，在訪問的伺服器編輯hosts檔案把域名配置一下才能訪問，如果是伺服器正式域名的使用就不需要這個配置。配置修改如下圖：

，以上配置完就可以直接瀏覽器訪問檢視。

第四步，配置https

①下載域名證書複製格式為.key和.crt的檔案到伺服器隨意目錄下方便自己管理就行。

②切換至檔案所在目錄執行命令kubectl -n 名稱空間 create secret tls digital-api-ingress-secret --cert=digital.api.xxxxx.com_bundle.crt --key=digital.api.xxxxxx.com.key，建立Secrets。

③修改第三步的指令碼為主要內容是增加了tls到rules之間的內容

apiVersion: networking.k8s.io/v1
kind: Ingress               #寫個資源，資源物件是Ingress，就由此Ingress資源物件定義的規則，來配置Ingress轉發情況
metadata:
  name: ingress-test    #名稱隨便寫
  namespace: yuan-yao   #必須和對應Service的名稱空間一樣
spec:
  ingressClassName: nginx       #預設就寫Nginx
  tls: #這裡配置https
  - hosts:
      - digital.api.fjyuanyao.com
      secretName: digital-api-ingress-secret
  rules:
  - host: q1.wyb.com         #服務的域名
    http:
      paths: 
      - pathType: Prefix        #表示以字首的方式進行匹配
        path: /              #字首必須有個"/"，才可以成功匹配
        backend:
          service:              #規定Ingress後端的Service
            name: test      #後端Service的名稱
            port:  
              number: 80      #後端Service監聽的埠

④如果更新kubectl apply -f xxxx.yaml

微服務監控探索
2020-04-04
微服務
springcloud 微服務配置監控端點 hystrix.stream
2020-03-10
SpringGCCloud微服務
使用metrics-server監控k8s的資源指標
2023-03-06
ServerK8S指標
kubenetes metrics-server監控資源
2022-07-26
Server
配置CACTI監控MySQL資料庫狀態(5)增加MySQL監控模板
2012-04-17
MySql資料庫
愛奇藝微服務監控的探索與實踐
2020-07-15
微服務
在 k8s 中自動為域名配置 https
2019-10-30
K8SHTTP
微服務監控
2018-11-20
微服務
使用nginx配置子域名
2020-11-22
Nginx
mysql cluster 7 動態增加資料節點配置步驟
2009-06-03
MySql
在 KubeSphere 中使用 DevOps 部署 Java 微服務配置監控預警
2022-07-08
devJava微服務
Java微服務監控及與普羅米整合
2022-02-09
Java微服務
K8S - 配置資源管理
2024-03-07
K8S
Laravel-admin 配置子域名
2019-08-09
Laravel
Docker Nginx 配置多個子域名
2018-05-22
DockerNginx
運維文件：系統監控及告警配置
2024-07-26
運維
服務監控-友好地整合Metrics到專案中
2019-01-30
activeMQ JMS監控配置
2015-06-30
MQ
使用Prometheus搞定微服務監控
2021-03-01
Prometheus微服務
Sentry Web 效能監控 - Metrics
2021-09-11
Web
配置CACTI監控MySQL資料庫狀態(4)配置cacti
2012-04-12
MySql資料庫
如何配置https站點
2016-11-16
HTTP
Spark Metrics配置詳解
2016-03-13
Spark
[使用技巧] GitHub pages 自定義域名配置 https
2018-11-06
GithubHTTP
go-kit微服務：API監控
2019-02-21
Go微服務API
Skywalking微服務監控分析
2019-01-04
微服務
微服務：指標和健康監控
2022-09-04
微服務指標
對於k8s微服務的效能測試監控平臺搭建
2021-01-13
K8S微服務
配置CACTI監控MySQL資料庫狀態(3)配置apache模組
2012-04-11
MySql資料庫Apache
vivo服務端監控系統架構及演進之路
2022-02-23
服務端架構
如何使用zabbix內建 key 配置windows服務監控
2024-09-11
Windows
【Azure 微服務】基於已經存在的虛擬網路(VNET)及子網建立新的Service Fabric並且為所有節點配置自定義DNS服務
2021-02-10
微服務DNS
安全性配置－定義任務流節點
2007-11-27
一鍵配置開源伺服器監控工具 NetData
2018-08-22
伺服器
監控寶SQL Server效能監控的功能和配置
2014-03-14
SQLServer
nagios的配置（監控端和被監控端）
2014-11-05
iOS
JavaScript 監聽子節點改變
2018-08-18
JavaScript
微服務架構之「呼叫鏈監控」
2019-05-28
微服務架構