• Ingress Controller 를 사용하는 이유: L7의 부하분산 역할을 한다. 
  • 하나의 Ingress 를 통해 여러 Service 를 통합 지원
  • HTTP 연결 지원
  • load balancing
  • SSL termination
  • Name 기반 virtual Hosting
  • 외부에서 접근시 https로 접근시 ingress에서 인증서를 관리
  • client -> https -> ingress -> http -> service로 

Ingress Controller 시나리오

-ingress 엔진을 traefik으로 사용한다.
- rules에 host: www.webapp1.com으로 요청이 들어오면 webapp1으로 포워딩한다는 의미
- 서비스 객체를 2개(lab, www) 만들어 놓고 분산을 시킨다.
- path가 /class인 경우, /home인 경우 분산을 시킨다.

1.서비스 객체를 2개 생성 (개별 테스트를 하기위해서 2개 생성)

kubectl create deployment webapp1  --image=nasamjang02/app:v1
kubectl expose deployment webapp1  --type=NodePort --port=80 #@ 외부에서 접근가능하도록 NodePort로 설정
kubectl create deployment webapp2  --image=nasamjang02/app:v2
kubectl expose deployment webapp2  --type=NodePort --port=80


root@ip-172-31-4-27:~# kubectl get deploy,svc,rs,po
NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/webapp1   1/1     1            1           2m33s
deployment.apps/webapp2   1/1     1            1           109s

NAME                 TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
service/app1         ClusterIP   10.104.31.130    <none>        80/TCP         76m
service/kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP        2d7h
service/webapp1      NodePort    10.101.171.207   <none>        80:31048/TCP   2m14s
service/webapp2      NodePort    10.98.238.77     <none>        80:31042/TCP   104s

NAME                                 DESIRED   CURRENT   READY   AGE
replicaset.apps/webapp1-5b9448d6c4   1         1         1       2m33s
replicaset.apps/webapp2-5dc7d6fd6    1         1         1       109s

NAME                           READY   STATUS    RESTARTS   AGE
pod/webapp1-5b9448d6c4-46mbt   1/1     Running   0          2m33s
pod/webapp2-5dc7d6fd6-hsrkm    1/1     Running   0          109s

2. 내부 리소스의 접근 권한을 만들어준다. RBAC을 이용하여 리소스 접근 권한을 설정한다.

ingress_rbac.yaml 명세서 작성

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services #아래 3개의 접근을 허용
      - endpoints
      - secrets
    verbs:
      - get # 수정불가하고 나머지 3개는 가능
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses #ingresses에 관한 권한 허용
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount #ServiceAccount가 pod내에 프로세스에 주체
  name: traefik-ingress-controller
  namespace: kube-system

3. 생성 및 확인

root@ip-172-31-4-27:~/ingress# kubectl create -f ingress_rbac.yaml 
Warning: rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
clusterrole.rbac.authorization.k8s.io/traefik-ingress-controller created
Warning: rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding
clusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created

4. traefik-ds.yaml 명세서 작성

apiVersion: v1
kind: ServiceAccount #ServiceAccount에 assign할 주체를 설정
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
      name: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller #pod의 ServiceAccount 지정한다 (프로세스에 대한 User)
      terminationGracePeriodSeconds: 60
      containers:
      - image: traefik:v1.7
        name: traefik-ingress-lb
        ports:
        - name: http
          containerPort: 80 # 컨테이너 하나에 포트2개 80, 8080
          hostPort: 80 # 80으로 요청이 들어오면 80으로 포워딩한다
        - name: admin
          containerPort: 8080
          hostPort: 8080
        securityContext: #보안context 설정한다
          capabilities: #기본특권
            drop:
            - ALL #기본특권 다 버리고
            add:
            - NET_BIND_SERVICE #네트워크 인터페이스 공유권한만 추가 (호스트의 
        args:
        - --api #args 추가
        - --kubernetes
        - --logLevel=INFO
---
kind: Service #Service 객체가 올라간다
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 8080
      name: admin

5. 생성 및 확인

root@ip-172-31-4-27:~/ingress# kubectl create -f traefik-ds.yaml 
serviceaccount/traefik-ingress-controller created
daemonset.apps/traefik-ingress-controller created
service/traefik-ingress-service created

6. ingress_rule.yaml 명세서 작성

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-test
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: www.webapp1.com #로 접근하면 webapp1로 포워딩
    http:
      paths:
      - backend:
          serviceName: webapp1
          servicePort: 80
        path: /
  - host: www.webapp2.com  #로 접근하면 webapp2로 포워딩
    http:  
      paths: 
      - backend: 
           serviceName: webapp2 
           servicePort: 80 
        path: /

7. 생성 및 확인

#kubectl create -f ingress_rule.yaml

	root@ip-172-31-4-27:~/ingress# kubectl create -f ingress_rule.yaml 
	Warning: extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
	ingress.extensions/ingress-test created

#curl -H "Host: www.webapp1.com" http://master_ip/
	root@ip-172-31-4-27:~/ingress# curl -H "Host: www.webapp1.com" http://172.31.4.27/
	This is app v1 test…

#curl -H "Host: www.webapp2.com" http://master_ip/
	root@ip-172-31-4-27:~/ingress# curl -H "Host: www.webapp2.com" http://172.31.4.27/
	This is app v2 test…

#kubectl get svc,ds,po -o wide --all-namespaces |grep traefix

#curl -H "Host: www.webapp1.com" http://Service_IP/
	root@ip-172-31-4-27:~/ingress# curl -H "Host: www.webapp1.com" http://172.31.13.180/
	This is app v1 test…

#curl -H "Host: www.webapp1.com" http://Service_IP/

kubectl edit -n kube-system svc traefik-ingress-service
type=NodePort  로 변경 (외부에서 적근가능하도록)
kubectl get -n kube-system svc  (Node port확인 후 접속)

8. 외부에서 접근 확인

'클라우드 컴퓨팅 & NoSQL > k8s' 카테고리의 다른 글

limit range/resource-quota 시나리오  (0) 2020.12.06
Pod의 Resource 관리  (0) 2020.12.03
Service Controller  (0) 2020.12.03
Job/CronJob Controller  (0) 2020.12.03
DaemonSetController  (0) 2020.12.03

+ Recent posts

티스토리툴바