K8s的lngress简易安装及操作使用

一、部署前准备

1. 配置私有仓库 HTTP 加速与 insecure-registries

因为你的镜像仓库是 HTTP 的 192.168.57.200:8099，需要在每个节点的 Docker 里配置 daemon.json。

#### 1.1 编辑 daemon.json

 sudo tee /etc/docker/daemon.json > /dev/null <<'EOF'
 {
     "registry-mirrors": [
         "https://0flxnlct2crdwm8pmt.xuanyuan.dev",
         "https://docker.m.daocloud.io",
         "https://docker.1ms.run"
     ],
     "insecure-registries": [
         "192.168.57.200:8099"
     ],
     "exec-opts": [
         "native.cgroupdriver=systemd"
     ]
 }
 EOF

1.2 重启 Docker

改完 daemon.json 必须重启 Docker 才生效：

 sudo systemctl daemon-reload
 sudo systemctl restart docker

1.3 验证配置是否生效

 docker info | grep -A 5 "Insecure Registries"
 docker info | grep -A 5 "Registry Mirrors"

能看 192.168.57.200:8099 和镜像加速地址即可。

注意：K8s 如果用的是 containerd，而不是 Docker，那要改的是 /etc/containerd/config.toml，然后 systemctl restart containerd。你这里写的是 daemon.json，所以按 Docker 处理。

二、安装 Ingress-Nginx

1. 创建 Ingress-Nginx 部署文件

 vim Ingress-Nginx-deploy.yaml
 
 # 填写以下内容 
 apiVersion: v1
 kind: Namespace
 metadata:
   labels:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
   name: ingress-nginx
 ---
 apiVersion: v1
 automountServiceAccountToken: true
 kind: ServiceAccount
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx
   namespace: ingress-nginx
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission
   namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx
   namespace: ingress-nginx
 rules:
 - apiGroups:
   - ""
   resources:
   - namespaces
   verbs:
   - get
 - apiGroups:
   - ""
   resources:
   - configmaps
   - pods
   - secrets
   - endpoints
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ""
   resources:
   - services
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingresses
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingresses/status
   verbs:
   - update
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingressclasses
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - coordination.k8s.io
   resourceNames:
   - ingress-nginx-leader
   resources:
   - leases
   verbs:
   - get
   - update
 - apiGroups:
   - coordination.k8s.io
   resources:
   - leases
   verbs:
   - create
 - apiGroups:
   - ""
   resources:
   - events
   verbs:
   - create
   - patch
 - apiGroups:
   - discovery.k8s.io
   resources:
   - endpointslices
   verbs:
   - list
   - watch
   - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission
   namespace: ingress-nginx
 rules:
 - apiGroups:
   - ""
   resources:
   - secrets
   verbs:
   - get
   - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx
 rules:
 - apiGroups:
   - ""
   resources:
   - configmaps
   - endpoints
   - nodes
   - pods
   - secrets
   - namespaces
   verbs:
   - list
   - watch
 - apiGroups:
   - coordination.k8s.io
   resources:
   - leases
   verbs:
   - list
   - watch
 - apiGroups:
   - ""
   resources:
   - nodes
   verbs:
   - get
 - apiGroups:
   - ""
   resources:
   - services
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingresses
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ""
   resources:
   - events
   verbs:
   - create
   - patch
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingresses/status
   verbs:
   - update
 - apiGroups:
   - networking.k8s.io
   resources:
   - ingressclasses
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - discovery.k8s.io
   resources:
   - endpointslices
   verbs:
   - list
   - watch
   - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission
 rules:
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - validatingwebhookconfigurations
   verbs:
   - get
   - update
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx
   namespace: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: ingress-nginx
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx
   namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission
   namespace: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: ingress-nginx-admission
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx-admission
   namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: ingress-nginx
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx
   namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: ingress-nginx-admission
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx-admission
   namespace: ingress-nginx
 ---
 apiVersion: v1
 data:
   allow-snippet-annotations: "true"
 kind: ConfigMap
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-controller
   namespace: ingress-nginx
 ---
 apiVersion: v1
 kind: Service
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-controller
   namespace: ingress-nginx
 spec:
   externalTrafficPolicy: Local
   ipFamilies:
   - IPv4
   ipFamilyPolicy: SingleStack
   ports:
   - appProtocol: http
     name: http
     port: 80
     protocol: TCP
     targetPort: http
   - appProtocol: https
     name: https
     port: 443
     protocol: TCP
     targetPort: https
   selector:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
   type: LoadBalancer
 ---
 apiVersion: v1
 kind: Service
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-controller-admission
   namespace: ingress-nginx
 spec:
   ports:
   - appProtocol: https
     name: https-webhook
     port: 443
     targetPort: webhook
   selector:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
   type: ClusterIP
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-controller
   namespace: ingress-nginx
 spec:
   minReadySeconds: 0
   revisionHistoryLimit: 10
   selector:
     matchLabels:
       app.kubernetes.io/component: controller
       app.kubernetes.io/instance: ingress-nginx
       app.kubernetes.io/name: ingress-nginx
   template:
     metadata:
       labels:
         app.kubernetes.io/component: controller
         app.kubernetes.io/instance: ingress-nginx
         app.kubernetes.io/name: ingress-nginx
     spec:
       containers:
       - args:
         - /nginx-ingress-controller
         - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
         - --election-id=ingress-nginx-leader
         - --controller-class=k8s.io/ingress-nginx
         - --ingress-class=nginx
         - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         - name: LD_PRELOAD
           value: /usr/local/lib/libmimalloc.so
         image: 192.168.57.200:8099/ingress-nginx/controller:v1.6.3
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
         livenessProbe:
           failureThreshold: 5
           httpGet:
             path: /healthz
             port: 10254
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 10
           successThreshold: 1
           timeoutSeconds: 1
         name: controller
         ports:
         - containerPort: 80
           name: http
           protocol: TCP
         - containerPort: 443
           name: https
           protocol: TCP
         - containerPort: 8443
           name: webhook
           protocol: TCP
         readinessProbe:
           failureThreshold: 3
           httpGet:
             path: /healthz
             port: 10254
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 10
           successThreshold: 1
           timeoutSeconds: 1
         resources:
           requests:
             cpu: 100m
             memory: 90Mi
         securityContext:
           allowPrivilegeEscalation: true
           capabilities:
             add:
             - NET_BIND_SERVICE
             drop:
             - ALL
           runAsUser: 101
         volumeMounts:
         - mountPath: /usr/local/certificates/
           name: webhook-cert
           readOnly: true
       dnsPolicy: ClusterFirst
       nodeSelector:
         kubernetes.io/os: linux
       serviceAccountName: ingress-nginx
       terminationGracePeriodSeconds: 300
       volumes:
       - name: webhook-cert
         secret:
           secretName: ingress-nginx-admission
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission-create
   namespace: ingress-nginx
 spec:
   template:
     metadata:
       labels:
         app.kubernetes.io/component: admission-webhook
         app.kubernetes.io/instance: ingress-nginx
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/version: 1.6.3
       name: ingress-nginx-admission-create
     spec:
       containers:
       - args:
         - create
         - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
         - --namespace=$(POD_NAMESPACE)
         - --secret-name=ingress-nginx-admission
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         image: 192.168.57.200:8099/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343
         imagePullPolicy: IfNotPresent
         name: create
         securityContext:
           allowPrivilegeEscalation: false
       nodeSelector:
         kubernetes.io/os: linux
       restartPolicy: OnFailure
       securityContext:
         fsGroup: 2000
         runAsNonRoot: true
         runAsUser: 2000
       serviceAccountName: ingress-nginx-admission
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission-patch
   namespace: ingress-nginx
 spec:
   template:
     metadata:
       labels:
         app.kubernetes.io/component: admission-webhook
         app.kubernetes.io/instance: ingress-nginx
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/version: 1.6.3
       name: ingress-nginx-admission-patch
     spec:
       containers:
       - args:
         - patch
         - --webhook-name=ingress-nginx-admission
         - --namespace=$(POD_NAMESPACE)
         - --patch-mutating=false
         - --secret-name=ingress-nginx-admission
         - --patch-failure-policy=Fail
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         image: 192.168.57.200:8099/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343
         imagePullPolicy: IfNotPresent
         name: patch
         securityContext:
           allowPrivilegeEscalation: false
       nodeSelector:
         kubernetes.io/os: linux
       restartPolicy: OnFailure
       securityContext:
         fsGroup: 2000
         runAsNonRoot: true
         runAsUser: 2000
       serviceAccountName: ingress-nginx-admission
 ---
 apiVersion: networking.k8s.io/v1
 kind: IngressClass
 metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: nginx
 spec:
   controller: k8s.io/ingress-nginx
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   labels:
     app.kubernetes.io/component: admission-webhook
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.6.3
   name: ingress-nginx-admission
 webhooks:
 - admissionReviewVersions:
   - v1
   clientConfig:
     service:
       name: ingress-nginx-controller-admission
       namespace: ingress-nginx
       path: /networking/v1/ingresses
   failurePolicy: Fail
   matchPolicy: Equivalent
   name: validate.nginx.ingress.kubernetes.io
   rules:
   - apiGroups:
     - networking.k8s.io
     apiVersions:
     - v1
     operations:
     - CREATE
     - UPDATE
     resources:
     - ingresses
   sideEffects: None

2. 应用 YAML

 kubectl apply -f Ingress-Nginx-deploy.yaml

3. 查看安装结果

3.1 查看 namespace

 kubectl get ns

应该能看到 ingress-nginx。

3.2 查看 Pod

 kubectl get pods -n ingress-nginx -o wide

重点看：

ingress-nginx-controller-xxx 是否 Running
ingress-nginx-admission-create-xxx 是否 Completed
ingress-nginx-admission-patch-xxx 是否 Completed

3.3 查看 Service

 kubectl get svc -n ingress-nginx

应该能看到：

ingress-nginx-controller，类型 LoadBalancer
ingress-nginx-controller-admission，类型 ClusterIP

3.4 查看 IngressClass

kubectl get ingressclass

应该能看到 nginx。

3.5 查看 controller 详细信息

kubectl describe pod -n ingress-nginx -l app.kubernetes.io/component=controller

如果 Pod 起不来，重点看 Events。

三、部署测试应用 Nginx 和 Tomcat

1. 创建 nginx-deployment.yaml

vim nginx-deployment.yaml

内容：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80

应用：

kubectl apply -f nginx-deployment.yaml

2. 创建 tomcat-deployment.yaml

vim tomcat-deployment.yaml

内容：

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: tomcat
  name: tomcat
spec:
  replicas: 3
  selector:
    matchLabels:
      app: tomcat
  template:
    metadata:
      labels:
        app: tomcat
    spec:
      containers:
        - image: tomcat:9
          name: tomcat

应用：

kubectl apply -f tomcat-deployment.yaml

3. 查看 Pod 是否 Running

kubectl get pods -o wide

应该看到 3 个 nginx Pod 和 3 个 tomcat Pod。

如果镜像拉取失败，检查：

kubectl describe pod <pod-name>

看 Events 里是不是 ImagePullBackOff，如果是，回到第一步检查 daemon.json 和 Docker 重启。

四、创建 Service

1. 创建 service.yaml

vim service.yaml

内容：

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
  labels:
    app: nginx
spec:
  type: LoadBalancer       
  selector:
    app: nginx
  ports:
  - name: http
    port: 80               
    targetPort: 80         
    protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: tomcat-svc
  labels:
    app: tomcat
spec:
  type: LoadBalancer       
  selector:
    app: tomcat
  ports:
  - name: http
    port: 8080               
    targetPort: 8080         
    protocol: TCP

应用：

kubectl apply -f service.yaml

2. 查看 Service

kubectl get svc

应该看到 nginx-svc 和 tomcat-svc，类型 LoadBalancer。

3. 查看 Endpoints

这是排查 Service 有没有正确关联到 Pod 的关键：

kubectl get endpoints nginx-svc tomcat-svc

如果 ENDPOINTS 是 <none>，说明：

Service 的 selector 和 Pod 的 labels 对不上
或者 Pod 没 Ready

用下面命令对照：

kubectl get pods --show-labels
kubectl describe svc nginx-svc
kubectl describe svc tomcat-svc

五、创建 Ingress 规则

1. 创建 Ingress.yaml

vim Ingress.yaml

内容：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.test.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-svc
            port:
              number: 80
  - host: tomcat.test.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: tomcat-svc
            port:
              number: 8080

应用：

kubectl apply -f Ingress.yaml

2. 查看 Ingress

kubectl get ingress
kubectl get ingress -A

3. 查看某个 Ingress 完整 YAML

kubectl get ingress api-ingress -o yaml

六、配置 hosts 并验证访问

1. 查看 Ingress Controller 对外 IP / 端口

kubectl get svc -n ingress-nginx

看 ingress-nginx-controller 的 EXTERNAL-IP 和 PORT(S)。

如果是 LoadBalancer 且没有 MetalLB，EXTERNAL-IP 可能是 <pending>。这时可以先用节点 IP + NodePort 访问，或者先改 externalTrafficPolicy。

2. 查看 externalTrafficPolicy

kubectl get svc -n ingress-nginx ingress-nginx-controller -o yaml | grep -i externalTrafficPolicy

如果是 Local，只有 Pod 所在节点才监听。如果想让三个节点都监听，可以改成 Cluster：

kubectl patch svc -n ingress-nginx ingress-nginx-controller -p '{"spec":{"externalTrafficPolicy":"Cluster"}}'

3. 修改本机 hosts

Windows：

C:\Windows\System32\drivers\etc\hosts

加两行（把 节点IP 换成你实际节点 IP）：

    节点IP nginx.test.com
    节点IP tomcat.test.com

4. 测试访问

浏览器访问：

http://nginx.test.com
http://tomcat.test.com

或者命令行：

curl -I http://nginx.test.com
curl -I http://tomcat.test.com

七、MetalLB（可选，未完成部分）

你的笔记里写了 MetalLB，但标注“未完成”。如果想让 LoadBalancer 类型的 Service 真正拿到外部 IP，可以装 MetalLB。

1. 安装 MetalLB

kubectl apply -f https://ghproxy.net/https://raw.githubusercontent.com/metallb/metallb/v0.16.1/config/manifests/metallb-native.yaml

2. 查看 MetalLB Pod

kubectl get pods -n metallb-system -o wide

3. 配置 IP 地址池（示例）

vim metallb-config.yaml

内容示例（把 192.168.57.240-192.168.57.250 换成你实际可用 IP 段）：

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: default-pool
  namespace: metallb-system
spec:
  addresses:
  - 192.168.7.75-192.168.7.79
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: default
  namespace: metallb-system
spec:
  ipAddressPools:
  - default-pool

应用：

kubectl apply -f metallb-config.yaml

然后再看：

kubectl get svc -n ingress-nginx
kubectl get svc

EXTERNAL-IP 应该不再是 <pending>。

八、常用指令汇总

节点

kubectl get nodes -o wide
kubectl describe node <node-name>

Pod

kubectl get pods -o wide
kubectl get pods -A -o wide
kubectl get pods -n ingress-nginx -o wide

Service

kubectl get svc
kubectl get svc -A
kubectl get svc -n ingress-nginx

Ingress

kubectl get ingress
kubectl get ingress -A
kubectl get ingress api-ingress -o yaml

Endpoints

kubectl get endpoints
kubectl get endpoints nginx-svc tomcat-svc

IngressClass

kubectl get ingressclass

externalTrafficPolicy

kubectl get svc -n ingress-nginx ingress-nginx-controller -o yaml | grep -i externalTrafficPolicy
kubectl patch svc -n ingress-nginx ingress-nginx-controller -p '{"spec":{"externalTrafficPolicy":"Cluster"}}'

Controller Pod 状态

kubectl get pods -n ingress-nginx -o wide
kubectl describe pod -n ingress-nginx -l app.kubernetes.io/component=controller

九、排错思路速记

访问不通时，按这个顺序查：

1. ping 域名
   → 检查 hosts 解析对不对

2. ping 节点 IP
   → 检查网络通不通

3. Test-NetConnection IP -Port 端口
   → 检查端口通不通

4. 端口不通
   → 查 externalTrafficPolicy / ufw / Pod 所在节点

5. 端口通但页面错
   → 查 Ingress 规则 / Service Endpoints / Pod 日志

对应 kubectl 命令：

# 1. hosts 解析
ping nginx.test.com

# 2. 节点网络
ping <节点IP>

# 3. 端口
telnet <节点IP> <端口>
# 或 Windows PowerShell:
Test-NetConnection <节点IP> -Port <端口>

# 4. externalTrafficPolicy
kubectl get svc -n ingress-nginx ingress-nginx-controller -o yaml | grep -i externalTrafficPolicy

# 5. Ingress 规则
kubectl get ingress api-ingress -o yaml

# 6. Endpoints
kubectl get endpoints nginx-svc tomcat-svc

# 7. Pod 日志
kubectl logs -n ingress-nginx -l app.kubernetes.io/component=controller
kubectl logs <pod-name>

十、完整操作顺序（照着敲）

 # 1. 每个节点配置 daemon.json
 sudo vim /etc/docker/daemon.json
 # 写入 registry-mirrors + insecure-registries
 sudo systemctl daemon-reload
 sudo systemctl restart docker
 
 # 2. 安装 Ingress-Nginx
 vim Ingress-Nginx-deploy.yaml
 kubectl apply -f Ingress-Nginx-deploy.yaml
 kubectl get pods -n ingress-nginx -o wide
 kubectl get svc -n ingress-nginx
 kubectl get ingressclass
 
 # 3. 部署 Nginx 和 Tomcat
 vim nginx-deployment.yaml
 kubectl apply -f nginx-deployment.yaml
 
 vim tomcat-deployment.yaml
 kubectl apply -f tomcat-deployment.yaml
 
 kubectl get pods -o wide
 
 # 4. 创建 Service
 vim service.yaml
 kubectl apply -f service.yaml
 kubectl get svc
 kubectl get endpoints nginx-svc tomcat-svc
 
 # 5. 创建 Ingress
 vim Ingress.yaml
 kubectl apply -f Ingress.yaml
 kubectl get ingress
 kubectl get ingress api-ingress -o yaml
 
 # 6. 改 hosts 并访问
 sudo vim /etc/hosts
 # 加 节点IP nginx.test.com
 # 加 节点IP tomcat.test.com
 
 curl -I http://nginx.test.com
 curl -I http://tomcat.test.com
 
 # 7. 如果不通，排错
 kubectl get svc -n ingress-nginx ingress-nginx-controller -o yaml | grep -i externalTrafficPolicy
 kubectl patch svc -n ingress-nginx ingress-nginx-controller -p '{"spec":{"externalTrafficPolicy":"Cluster"}}'
 kubectl logs -n ingress-nginx -l app.kubernetes.io/component=controller

FanXing

K8s的lngress简易安装及操作使用

一、部署前准备

1. 配置私有仓库 HTTP 加速与 insecure-registries

1.2 重启 Docker

1.3 验证配置是否生效

二、安装 Ingress-Nginx

1. 创建 Ingress-Nginx 部署文件

2. 应用 YAML

3. 查看安装结果

3.1 查看 namespace

3.2 查看 Pod

3.3 查看 Service

3.4 查看 IngressClass

3.5 查看 controller 详细信息

三、部署测试应用 Nginx 和 Tomcat

1. 创建 nginx-deployment.yaml

2. 创建 tomcat-deployment.yaml

3. 查看 Pod 是否 Running

四、创建 Service

1. 创建 service.yaml

2. 查看 Service

3. 查看 Endpoints

五、创建 Ingress 规则

1. 创建 Ingress.yaml

2. 查看 Ingress

3. 查看某个 Ingress 完整 YAML

六、配置 hosts 并验证访问

1. 查看 Ingress Controller 对外 IP / 端口

2. 查看 externalTrafficPolicy

3. 修改本机 hosts

4. 测试访问

七、MetalLB（可选，未完成部分）

1. 安装 MetalLB

2. 查看 MetalLB Pod

3. 配置 IP 地址池（示例）

八、常用指令汇总

节点

Pod

Service

Ingress

Endpoints

IngressClass

externalTrafficPolicy

Controller Pod 状态

九、排错思路速记

十、完整操作顺序（照着敲）

K8s的lngress简易安装及操作使用

评论交流