- 负载均衡器 POD 使用节点的网络名称空间, 那么它只   能在这个 node 节点上运行一个了,否则就出现端口冲突- 负载均衡器是代理 POD 卸载 ssl 证书的关键节点, 它不能只运行一个, 它需要在所有节点运行一个

- 负载均衡器使用 DaemonSet 在每个 node 节点运行一个,代理请求至 POD 网络的中的 POD 上- 如果集群节点非常的多,其实不必在每个 node 节点都必须运行一个负载均衡器 POD- 控制负载均衡器 POD 运行的数量可以通过 lables 指定运行那几个 node 节点上- 然后可以在负载均衡器 POD 所在的 node 节点上打上 "污点" 使其他的 POD 不会再被调度上来, 而只有负载均衡器 POD 可以容忍这些 "污点"

Envoy            # 云原生高性能服务代理,已从cncf毕业Traefik          # 为微服务而生的反向代理Nginx            # 改造后可以适用于微服务环境HAproxy          # 不推荐使用

apiVersion: extensions
kind: ingress

backend         # 后端有哪些 PODrules           # 调度规则    host        # 虚拟主机    http        # http 路径

apiVersion: v1kind: Servicemetadata:  name: service-ingress-myapp  namespace: defaultspec:  selector:    app: myapp    release: canary  ports:    - name: http      port: 80      targetPort: 80
---apiVersion: apps/v1kind: Deploymentmetadata:  name: myapp  namespace: defaultspec:  replicas: 4  selector:    matchLabels:      app: myapp      release: canary  template:    metadata:      labels:        app: myapp        release: canary    spec:      containers:        - name: myapp          image: ikubernetes/myapp:v2          ports:            - name: http              containerPort: 80

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.21.0/deploy/mandatory.yaml

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.21.0/deploy/provider/baremetal/service-nodeport.yaml

apiVersion: extensions/v1beta1kind: Ingressmetadata:  name: ingress-deploy-myapp  namespace: default  annotations:    kubernetes.io/ingress.class: "nginx"spec:  rules:    - host: myapp.kaliarch.com                       # 基于主机名的访问      http:        paths:          - path:                                   # 空的时候代表根，访问根的时候映射到 backend            backend:                                # 后端的 service 的配置              serviceName: service-ingress-myapp    # 关联 service 从而获取到后端主机的变动              servicePort: 80                       # 关联 service 的地址

kubectl get service -n ingress-nginx

http://myapp.kaliarch.com:30080/index.html  

apiVersion: v1kind: Servicemetadata:  name: service-ingress-tomcat  namespace: defaultspec:  selector:    app: tomcat    release: canary  ports:    - name: http      port: 8080      targetPort: http    - name: ajp      port: 8009      targetPort: ajp
---apiVersion: apps/v1kind: Deploymentmetadata:  name: deploy-tomcat  namespace: defaultspec:  replicas: 4  selector:    matchLabels:      app: tomcat      release: canary  template:    metadata:      labels:        app: tomcat        release: canary    spec:      containers:        - name: tomcat          image: tomcat:8.5.32-jre8-alpine          ports:            - name: http              containerPort: 8080            - name: ajp              containerPort: 8009

# 生成 keyopenssl genrsa -out tls.key 2048
# 生成自签证书，CN=域名必须要与自己的域名完全一致openssl req -new -x509 -key tls.key -out tls.crt -subj /C=CN/ST=Beijing/L=Beijing/O=DevOps/CN=tomcat.kaliarch.com

kubectl create secret tls tomcat-ingress-secret --cert=tls.crt --key=tls.key

apiVersion: extensions/v1beta1kind: Ingressmetadata:  name: ingress-deploy-tomcat-tls  namespace: default  annotations:    kubernetes.io/ingress.class: "nginx"spec:  tls:    - hosts:      - tomcat.kaliarch.com      secretName: tomcat-ingress-secret  rules:    - host: tomcat.kaliarch.com      http:        paths:          - path:            backend:              serviceName: service-ingress-tomcat              servicePort: 8080

kubectl get service -n ingress-nginx

https://tomcat.kaliarch.com:30443