无法创建到 KubeSphere 的入口路由

Question

我已经安装了 nginx 入口控制器。据我了解，使用入口的主要原因之一是通过不创建多个负载平衡器来节省资金。

我的 kubesphere-console 服务 yaml 清单如下所示：

cat kubesphere-console.yaml 
apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: ks-core
    meta.helm.sh/release-namespace: kubesphere-system
  creationTimestamp: "2022-05-30T04:51:22Z"
  finalizers:
  - service.kubernetes.io/load-balancer-cleanup
  labels:
    app: ks-console
    app.kubernetes.io/managed-by: Helm
    tier: frontend
    version: v3.1.0
  name: ks-console
  namespace: kubesphere-system
  resourceVersion: "785863"
  uid: 8628c2d0-164b-499f-ac0c-254ac77aa48c
spec:
  allocateLoadBalancerNodePorts: true
  clusterIP: 10.0.29.29
  clusterIPs:
  - 10.0.29.29
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: nginx
    nodePort: 30880
    port: 80
    protocol: TCP
    targetPort: 8000
  selector:
    app: ks-console
    tier: frontend
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 20.248.217.111

kubesphere-console 入口路由 yaml 清单如下所示：

cat ingress-route-kubesphere.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kubesphere-console
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ks-console
            port:
              number: 80
      - path: /(.*)
        pathType: Prefix
        backend:
          service:
            name: ks-console
            port:
              number: 80
---

我在 AKS 集群上创建了入口控制器，如下所示：

NAMESPACE=ingress-basic

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

helm install ingress-nginx ingress-nginx/ingress-nginx \
  --create-namespace \
  --namespace $NAMESPACE \
  --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz

为 nginxingress-controller 创建的 LB 如下所示

 k get svc -ningress-basic
NAME                                 TYPE           CLUSTER-IP    EXTERNAL-IP    PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.0.194.38   20.92.133.79   80:32703/TCP,443:31053/TCP   23h
ingress-nginx-controller-admission   ClusterIP      10.0.189.8    <none>         443/TCP                      23h

请注意，我在 Ingress 中的表现并不出色 resource/networking，所以我仍在学习中。我的主要目的是使用一个入口控制器来公开所有应用程序

示例：

Kubesphere-console --> 端口 80 和 Endpoint 应该是 ksconsole

tekton-pipelines ----> 端口 80 和 Endpoint 应该是 tekton-dashboard

我将真诚地感谢任何帮助。 P.S：我调查了入口控制 pod 日志，但没有运气，或者我真的不明白他们的意思....

k logs -f ingress-nginx-controller-6648b5dbb8-ntm8t -ningress-basic

10.240.0.4 - - [02/Jun/2022:12:29:42 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.002 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.000 302 6ea21ca50e247cc5d5e56975c8946fcc
10.240.0.4 - - [02/Jun/2022:12:29:42 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 1f2e1bfa0223e6b3b630a59fe7dba4d1
10.240.0.4 - - [02/Jun/2022:12:29:48 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.004 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.000 302 dbb5af0fd6426f783c337da06912e427
10.240.0.4 - - [02/Jun/2022:12:29:48 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 9fc084018c70c0f61f379e2266a056f8
10.240.0.4 - - [02/Jun/2022:12:29:54 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 f9e4c75d81aa0e7ff03e402dfdca2d35
10.240.0.4 - - [02/Jun/2022:12:29:54 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.000 302 187cc1fdb0fb1499c1ef040e8aeb5e01
10.240.0.4 - - [02/Jun/2022:12:30:00 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 9b3b1ae4165184ed16fa974be51cd460
10.240.0.4 - - [02/Jun/2022:12:30:00 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 eac2591d333af20ab1a3ee4052327291
10.240.0.4 - - [02/Jun/2022:12:30:06 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.004 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.000 302 f08f30018bcfd229adb1ed36b6473563
10.240.0.4 - - [02/Jun/2022:12:30:06 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.002 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.000 302 f157141e253c7fcc61008440ff047605
10.240.0.4 - - [02/Jun/2022:12:30:12 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 6ba07067e1345b665e16a3cab03ee50c
10.240.0.4 - - [02/Jun/2022:12:30:12 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 4978c44153381d1aac6bc959c4afa72d
10.240.0.4 - - [02/Jun/2022:12:30:18 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.004 302 fc1e6e7fd4f4219ef6ca38689275035a
10.240.0.4 - - [02/Jun/2022:12:30:18 +0000] "GET /healthz HTTP/1.1" 302 43 "-" "Load Balancer Agent" 194 0.003 [kubesphere-system-ks-console-80] [] 10.240.0.41:8000 43 0.000 302 1e286ef7a2b36a5b04521e59657e0433

Answer 1

通常，如果您创建一个没有指定主机的入口，您可以直接通过 ingress-controller svc 的外部 IP（通配符）访问您的服务。正确配置DNS解析后，即可为入口设置域名。

下面是一个通过nginx-ingress-controller.

暴露ks-apiserver和ks-console的例子

nginx 控制器 svc

root@master:~# kubectl -n ingress-nginx get svc
NAME                                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
ingress-nginx-controller             NodePort    10.233.11.24    <none>        80:30882/TCP,443:31054/TCP   15m
ingress-nginx-controller-admission   ClusterIP   10.233.18.191   <none>        443/TCP                      37m

进入 ks-apiserver 和 ks-console

root@master:~# kubectl -n kubesphere-system get ing api -o yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubesphere.io/creator: admin
  creationTimestamp: "2022-06-02T08:48:48Z"
  generation: 8
  name: kubesphere
  namespace: kubesphere-system
  resourceVersion: "982261"
  uid: f8f6cadf-874c-4996-8759-3467ac33d61c
spec:
  ingressClassName: nginx
  rules:
  - host: api.172.31.50.170.nip.io
    http:
      paths:
      - backend:
          service:
            name: ks-apiserver
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
  - host: console.172.31.50.170.nip.io
    http:
      paths:
      - backend:
          service:
            name: ks-console
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
status:
  loadBalancer:
    ingress:
    - ip: 172.31.50.170

验证入口

$ curl http://api.172.31.50.170.nip.io:30882/
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot GET path \"/\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}%
$ curl http://console.172.31.50.170.nip.io:30882/
Redirecting to <a href="/login">/login</a>.%

无法创建到 KubeSphere 的入口路由

Unable to create ingress route to KubeSphere

kubernetes

nginx-ingress

ingress-controller