Ingress 高级配置

Ingress 是 Kubernetes 中管理外部访问集群服务的 API 对象，通过 HTTP/HTTPS 路由规则提供负载均衡、SSL 终止和基于名称的虚拟主机等功能。Ingress 高级配置涉及多种复杂场景和功能扩展。

Ingress 架构图

graph TB
    subgraph "外部网络"
        CLIENT[客户端请求]
        DNS[DNS 解析]
    end
    
    subgraph "K8s 集群"
        subgraph "Ingress Controller"
            INGRESS[Ingress Controller
Nginx/HAProxy/Traefik]
            CONFIG[配置同步
监听 Ingress 资源]
        end
        
        subgraph "服务后端"
            SVC1[Service A
app1.example.com]
            SVC2[Service B
app2.example.com]
            SVC3[Service C
路径: /api]
        end
    end
    
    CLIENT --> DNS
    DNS --> INGRESS
    INGRESS --> SVC1
    INGRESS --> SVC2
    INGRESS --> SVC3
    CONFIG --> SVC1
    CONFIG --> SVC2
    CONFIG --> SVC3

Ingress 高级功能

路径路由

基于 URL 路径将请求路由到不同后端服务

基于主机路由

根据 Host 头将请求路由到不同服务

TLS/SSL 终止

在 Ingress 层处理 SSL 证书和加密解密

负载均衡

通过多种算法实现请求分发

Ingress TLS/SSL 配置

# TLS 终止配置示例

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - secure.example.com
    secretName: tls-secret
  rules:
  - host: secure.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

路径重写和负载均衡配置

# 路径重写配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Accept-Encoding "";
      gzip off;
    nginx.ingress.kubernetes.io/upstream-hash-by: "$request_uri"
spec:
  rules:
  - http:
      paths:
      - path: /api(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080

流量控制和限流配置

# 限流和流量控制配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rate-limit-ingress
  annotations:
    nginx.ingress.kubernetes.io/rate-limit-connections: "10"
    nginx.ingress.kubernetes.io/rate-limit-requests-per-second: "5"
    nginx.ingress.kubernetes.io/custom-http-errors: "404,429,500,502,503"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      limit_req_zone $binary_remote_addr zone=api:10m rate=5r/s;
      limit_req zone=api burst=10 nodelay;
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080

Ingress Controller 配置

Ingress Controller 是实际处理路由规则的负载均衡器，常见的有 Nginx、Traefik、HAProxy 等。

# Nginx Ingress Controller 配置示例

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
data:
  use-proxy-protocol: "false"
  use-forwarded-headers: "true"
  compute-full-forwarded-for: "true"
  forwarded-for-header: "X-Forwarded-For"
  enable-real-ip: "true"
  http-snippet: |
    map $http_x_forwarded_proto $proxy_x_forwarded_proto {
      default $http_x_forwarded_proto;
      " " $scheme;
    }
  server-snippet: |
    server_tokens off;
    location ~ /\. {
      deny all;
    }

高级 Ingress 策略对比

策略	应用场景	优势	注意事项
路径路由	单域名多服务	资源利用率高	路径冲突需注意
主机路由	多域名服务	服务隔离好	需要多个域名
SSL 终止	HTTPS 访问	统一证书管理	内部网络需额外安全措施
重定向	HTTP 到 HTTPS	安全访问保障	避免重定向循环
限流	防止过载	保护后端服务	合理设置阈值

Ingress 故障排查

# 检查 Ingress 状态
kubectl get ingress

# 查看 Ingress 详细信息
kubectl describe ingress <ingress-name>

# 检查 Ingress Controller 日志
kubectl logs -n ingress-nginx deployment/ingress-nginx-controller

# 测试 Ingress 规则
curl -H "Host: example.com" http://<ingress-ip>/path

# 验证 TLS 配置
openssl s_client -connect example.com:443 -servername example.com