Kubernetes/Ingress controller - Revision history

Pio2pio: /* Ingress object */

2020-06-13T16:18:25Z

Ingress object

← Older revision		Revision as of 18:18, 13 June 2020
Line 76:		Line 76:
	inet 127.0.0.1/8 scope host lo		inet 127.0.0.1/8 scope host lo
	inet 172.18.0.1/16 brd 172.18.255.255 scope global docker0		inet 172.18.0.1/16 brd 172.18.255.255 scope global docker0
	inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0		inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0 # <- K8s node ip
	</source>		</source>

Pio2pio: /* Ingress object */

2020-06-13T16:16:54Z

Ingress object

← Older revision		Revision as of 18:16, 13 June 2020
Line 34:		Line 34:
	namespace: default		namespace: default
	spec:		spec:
	rules:		# backend: # <Object> default backend
	- host: echo-1.ingress.k8s.acme.cloud		serviceName: # <string>
	http:		servicePort: # <string>
	paths:		rules: # <[]object> list of host rules, if not specified sent to default backend
			- host: echo-1.ingress.k8s.acme.cloud # fqdn of a network host, IPs are not allowed
			http: # `:` is not respected because ports are not allowed
			paths: # currently the port of an Ingress is http:80 and :443 for https
	- backend:		- backend:
	serviceName: http-svc		serviceName: http-svc
	servicePort: 80		servicePort: 80
	path: /		path: /
			# tls: # <[]Object> TLS configuration, currently supports a single TLS port:443
			# - secretName: tls-certificate # secret used to terminate SSL traffic on 443
			# hosts: # optional rules.host is used if unspecified; must match names in tlsSecret
			# - echo-1.ingress.k8s.acme.cloud
	status:		status:
	loadBalancer:		loadBalancer:

Pio2pio: /* Ingress object */

2020-06-13T15:52:17Z

Ingress object

← Older revision		Revision as of 17:52, 13 June 2020
Line 27:		Line 27:
	metadata:		metadata:
	annotations:		annotations:
			kubernetes.io/ingress.class: nginx # useful annotation
	nginx.ingress.kubernetes.io/auth-realm: Authentication Required - foo		nginx.ingress.kubernetes.io/auth-realm: Authentication Required - foo
	nginx.ingress.kubernetes.io/auth-secret: basic-auth		nginx.ingress.kubernetes.io/auth-secret: basic-auth

Pio2pio: /* Ingress object */

2020-06-13T15:46:17Z

Ingress object

@@ Line 8: / Line 8: @@
 The difference between the LoadBalancer service and the Ingress in how the traffic routing is realized. In the case of the LoadBalancer service, the traffic that enters through the external load balancer is forwarded to the '''kube-proxy''' that in turn forwards the traffic to the selected pods. The '''Ingress load balancer''' forwards the traffic straight to the selected pods which is more efficient.
 = Ingress object =
 <source lang=yaml>
 apiVersion: extensions/v1beta1
 kind: Ingress

Pio2pio: /* Ingress object */

2020-06-13T15:38:32Z

Ingress object

← Older revision		Revision as of 17:38, 13 June 2020
Line 62:		Line 62:
	<source lang=bash>		<source lang=bash>
	# $ minikube addons enable ingress # Running		# $ minikube addons enable ingress # Running
			$ sudo ss -lntp \| tail +1 \| sort -k4
	State Recv-Q Send-Q Local Address:Port Peer Address:Port		State Recv-Q Send-Q Local Address:Port Peer Address:Port
	LISTEN 0 128 :10250 :* users:(("kubelet",pid=5342,fd=28))		LISTEN 0 128 :10250 :* users:(("kubelet",pid=5342,fd=28))
Line 71:		Line 72:
	LISTEN 0 128 :30932 :* users:(("kube-proxy",pid=6679,fd=13))		LISTEN 0 128 :30932 :* users:(("kube-proxy",pid=6679,fd=13))
	LISTEN 0 128 :32392 :* users:(("kube-proxy",pid=6679,fd=11))		LISTEN 0 128 :32392 :* users:(("kube-proxy",pid=6679,fd=11))
	LISTEN 0 128 :443 :* users:(("docker-proxy",pid=8486,fd=4)) # <- added by nginx-controller		LISTEN 0 128 # -> :443 :* users:(("docker-proxy",pid=8486,fd=4)) # <- added by nginx-controller
	LISTEN 0 128 :80 :* users:(("docker-proxy",pid=8505,fd=4)) # <- added by nginx-controller		LISTEN 0 128 # -> :80 :* users:(("docker-proxy",pid=8505,fd=4)) # <- added by nginx-controller
	LISTEN 0 128 :8443 :* users:(("kube-apiserver",pid=5917,fd=3))		LISTEN 0 128 :8443 :* users:(("kube-apiserver",pid=5917,fd=3))
	LISTEN 0 128 [::]:111 [::]:* users:(("rpcbind",pid=77,fd=6),("systemd",pid=1,fd=47))		LISTEN 0 128 [::]:111 [::]:* users:(("rpcbind",pid=77,fd=6),("systemd",pid=1,fd=47))

Pio2pio: /* Ingress object */

2020-06-13T13:33:42Z

Ingress object

@@ Line 42: / Line 42: @@
 <source lang=bash>
 .17.0.2 echo-1.ingress.k8s.acme.cloud
 </source>

Pio2pio: /* Ingress object */

2020-06-13T13:03:25Z

Ingress object

← Older revision		Revision as of 15:03, 13 June 2020
Line 37:		Line 37:
	</source>		</source>
	<code>Status.Address</code> update is a background goroutine that runs once a minute, queries the IP address of the node on which the Nginx ingress controller is running, and simply updates the <code>Status.Address</code> to that value.		<code>Status.Address</code> update is a background goroutine that runs once a minute, queries the IP address of the node on which the Nginx ingress controller is running, and simply updates the <code>Status.Address</code> to that value.


			Simple <code>/etc/hosts</code> entry will make your local machine to access an application exposed via Ingress
			<source lang=bash>
			172.17.0.2 echo-1.ingress.k8s.acme.cloud
			</source>

	= [https://kubernetes.github.io/ingress-nginx/examples/ Nginx ingress controller] =		= [https://kubernetes.github.io/ingress-nginx/examples/ Nginx ingress controller] =

Pio2pio: /* Ingress object */

2020-06-13T12:46:09Z

Ingress object

← Older revision		Revision as of 14:46, 13 June 2020
Line 33:		Line 33:
	- ip: 172.17.0.2 # Kubernetes API server IP		- ip: 172.17.0.2 # Kubernetes API server IP
	# public IP address on which this Ingress is available		# public IP address on which this Ingress is available
			# this is nginx-controller pod (leader) node IP

	</source>		</source>

Pio2pio at 15:15, 11 June 2020

2020-06-11T15:15:13Z

← Older revision		Revision as of 17:15, 11 June 2020
Line 1:		Line 1:
	The [http://alesnosek.com/blog/2017/02/14/accessing-kubernetes-pods-from-outside-of-the-cluster/ Ingress] resource type was introduced in Kubernetes version 1.1. The Kubernetes cluster must have an Ingress controller deployed in order for you to be able to create Ingress resources. What is the Ingress controller? The Ingress controller is deployed as a Docker container on top of Kubernetes. Its Docker image contains a load balancer like nginx or HAProxy and a controller daemon. The controller daemon receives the desired Ingress configuration from Kubernetes. It generates an nginx or HAProxy configuration file and restarts the load balancer process for changes to take effect. In other words, Ingress controller is a load balancer managed by Kubernetes.		The [http://alesnosek.com/blog/2017/02/14/accessing-kubernetes-pods-from-outside-of-the-cluster/ Ingress] resource type was introduced in Kubernetes version 1.1. The Kubernetes cluster must have an Ingress controller deployed in order for you to be able to create Ingress resources. What is the Ingress controller? The Ingress controller is deployed as a Docker container on top of Kubernetes. Its Docker image contains a load balancer like nginx or HAProxy and a controller daemon. The controller daemon receives the desired Ingress configuration from Kubernetes. It generates an nginx or HAProxy configuration file and restarts the load balancer process for changes to take effect. In other words, Ingress controller is a load balancer managed by Kubernetes.


			Ingress resources don't do anything by themselves: they are processed by ingress controllers, which vanilla Kubernetes does not provide by default.

Pio2pio: /* Nginx ingress controller */

2020-06-11T15:14:49Z

Nginx ingress controller

← Older revision		Revision as of 17:14, 11 June 2020
Line 37:		Line 37:
	:[[File:ClipCapIt-200611-143445.PNG]]		:[[File:ClipCapIt-200611-143445.PNG]]


			;Events changes watch
	Nginx controller listens for events on the following resource types changes:		Nginx controller listens for events on the following resource types changes:
	* Ingresses		* Ingresses
Line 42:		Line 44:
	* Secrets		* Secrets
	* ConfigMaps		* ConfigMaps


	Events get into the queue represented by <code>controller.syncQueue</code> and the [https://github.com/kubernetes/ingress-nginx/blob/nginx-0.9.0/internal/ingress/controller/listers.go#L63 internal/ingress/controller/controller.go queue handler function], <code>function syncIngress()</code>. This function collects all necessary information to regenerate the Nginx config file: it fetches all relevant Ingress objects and looks up associated Pods' IP addresses that the Ingresses should route to.		Events get into the queue represented by <code>controller.syncQueue</code> and the [https://github.com/kubernetes/ingress-nginx/blob/nginx-0.9.0/internal/ingress/controller/listers.go#L63 internal/ingress/controller/controller.go queue handler function], <code>function syncIngress()</code>. This function collects all necessary information to regenerate the Nginx config file: it fetches all relevant Ingress objects and looks up associated Pods' IP addresses that the Ingresses should route to.


			;Build new configuration and reload
	<code>syncIngress()</code> then calls [https://github.com/kubernetes/ingress-nginx/blob/nginx-0.9.0/internal/ingress/controller/nginx.go#L456 internal/ingress/controller/nginx.go function OnUpdate()] to actually write out the new Nginx config file and to reload Nginx.		<code>syncIngress()</code> then calls [https://github.com/kubernetes/ingress-nginx/blob/nginx-0.9.0/internal/ingress/controller/nginx.go#L456 internal/ingress/controller/nginx.go function OnUpdate()] to actually write out the new Nginx config file and to reload Nginx.


	Resources;		;Ingress <code>Status.Address</code> determination
			A background goroutine which, once a minute, queries the IP address of the node on which the Nginx ingress controller is running, and simply updates the "Status.Address" to that value. With multiple controller pods running, the leader's IP is used.


			;Not using Services
			ingress-nginx-controller does not route traffic to the associated Service's virtual IP address. Instead it routes directly to the pods' IP addresses, using the endpoints API
			Resources. This allows for session affinity, custom load balancing algorithms, less overhead, such as conntrack entries for iptables DNAT.


			;Resources
	* [https://www.joyfulbikeshedding.com/blog/2018-03-26-studying-the-kubernetes-ingress-system.html Studying kubernetes-ingress-system]		* [https://www.joyfulbikeshedding.com/blog/2018-03-26-studying-the-kubernetes-ingress-system.html Studying kubernetes-ingress-system]