ingress-nginx 实操

1. 使用ingress-nginx通过域名代理到后端服务

ingress-nginx 安装查考：https://blog.csdn.net/qq_50247813/article/details/152899573

在这里插入图片描述

资源清单如下：
template01.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-svc
  name: nginx-svc
spec:
  ports:
  - name: web
    port: 80
    targetPort: 80
  selector:
    app: nginx
  type: ClusterIP
---
# nginx-ingress 配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress		# nginx-ingress名称
spec:  
  rules:
  - host: www.template.com        		# 虚拟主机名称
    http:
      paths:
      - backend:
          service:
            name: nginx-svc 	# 访问到 nginx-ingress 的80端口时被代理到 svc.nginx:80
            port:
              number: 80
        path: /
        pathType: Prefix

kubectl apply -f  template01.yaml
kubectl  get ingress

NAME            CLASS   HOSTS              ADDRESS   PORTS   AGE
nginx-ingress   nginx   www.template.com             80      38m

访问测试提前写好host解析：
在这里插入图片描述

2. 使用ingress-nginx通过不同前缀代理到不同svc

在这里插入图片描述
template02.yaml:

---
# web 配置
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: web
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: nginx:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: web-svc
  name: web-svc
spec:
  ports:
  - name: web
    port: 80
    targetPort: 80
  selector:
    app: web
  type: ClusterIP
---
# api 配置
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: api
  name: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
      - name: api
        image: kennethreitz/httpbin:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: api-svc
  name: api-svc
spec:
  ports:
  - name: api
    port: 80
    targetPort: 80
  selector:
    app: api
  type: ClusterIP

---
# ingress-nginx 配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2		# 开启路径重写 将访问 /web 到svc时取消 /web后缀，默认是匹配到svc/web
spec:
  rules:
  - host: www.template.com
    http:
      paths:
        - path: /web(/|$)(.*)			# 正则表达式，当访问到 www.template.com/web/url 时会被改写成 web-svc/url
          pathType: ImplementationSpecific	# 由 Ingress 控制器自行解析路径规则，支持正则表达式
          backend:
            service:
              name: web-svc
              port:
                number: 80
        - path: /api(/|$)(.*)
          pathType: ImplementationSpecific
          backend:
            service:
              name: api-svc
              port:
                number: 80

kubectl apply -f  template02.yaml

访问测试：
在这里插入图片描述

在这里插入图片描述
在这里插入图片描述

3. 通过不同的虚拟主机访问不同的svc

在这里插入图片描述

template03.yaml:

---
# web 配置
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: web
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: nginx:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: web-svc
  name: web-svc
spec:
  ports:
  - name: web
    port: 80
    targetPort: 80
  selector:
    app: web
  type: ClusterIP
---
# api 配置
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: api
  name: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
      - name: api
        image: kennethreitz/httpbin:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: api-svc
  name: api-svc
spec:
  ports:
  - name: api
    port: 80
    targetPort: 80
  selector:
    app: api
  type: ClusterIP

---
# ingress-nginx 配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  rules:
  - host: www.template01.com			# 主机一
    http:
      paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: web-svc
              port:
                number: 80
  - host: www.template02.com		# 主机二
    http:
      paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: api-svc
              port:
                number: 80

kubectl  apply -f template03.yaml
kubectl  get ingress

NAME            CLASS   HOSTS                                   ADDRESS   PORTS   AGE
nginx-ingress   nginx   www.template01.com,www.template02.com             80      4m8s

访问测试：
在这里插入图片描述
在这里插入图片描述

4. 为虚拟主机配置ssl证书

实验环境实验openssl自建证书：

openssl genrsa -out tls.key 2048
openssl req -x509 -new -nodes -key tls.key -days 36500 -out tls.crt -subj "/CN=www.template.com"

创建创建secret保存证书：

kubectl create secret tls template-tls-secret   --cert=./tls.crt  --key=./tls.key
kubectl  get  secret

NAME                  TYPE                DATA   AGE
template-tls-secret   kubernetes.io/tls   2      67s

kubectl  get  secret  template-tls-secret -o yaml

apiVersion: v1
data:
  # 保存证书
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURHVENDQWdHZ0F3SUJBZ0lVY1NtMlV2VUtkaXNGWGhjK2h0V1JXR3ByMk5rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0d6RVpNQmNHQTFVRUF3d1FkM2QzTG5SbGJYQnNZWFJsTG1OdmJUQWdGdzB5TlRFd01UQXlNekk0TXpsYQpHQTh5TVRJMU1Ea3hOakl6TWpnek9Wb3dHekVaTUJjR0ExVUVBd3dRZDNkM0xuUmxiWEJzWVhSbExtTnZiVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTnpUd2wwQ0VNb2FLNk1haksxNkZ2UmsKOHNMYm84M2syZGM4REVMRG94c240NVIzbitZcmwzUE9GTjJINFdGN0ZwM2VyQmd3b0dlbE5RVVp4aGYydzU2NQp0YU5YNWp6Y01makpWU2dVT0pzU0E1aFcxRjNRa3YwREp6ZTlHV2Z3RlNHOW5zZmZ0cHk4V1V1UENiQ296a1dvClZsYURCUjNEYU1YRStTZkZvQXdNdXZqaWZhREpYNGc0ZlpHNHFIaGhaWHpBdXVja3pkK29uNGxSZnZjam1YbEkKWi9DblIwS3MxQXNuaXhPOXlRSzRNM2xacGxoQnB2dldPOHh3MSt6ZE9uRzVzajM0WWdUTW5JcG1BaHV1Y3UxVgpZS3A4a0JjZ3NYRkRYT0kxaW5TSGMzSFUzUUphdTJsQWFZUTZtZ0oyM0VIMmxCbGxSTlIyM2tYMXdHNlpyYzhDCkF3RUFBYU5UTUZFd0hRWURWUjBPQkJZRUZMaDByT3hVdklBZTdJaC9JaG15bXpBMVpqZHZNQjhHQTFVZEl3UVkKTUJhQUZMaDByT3hVdklBZTdJaC9JaG15bXpBMVpqZHZNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSQpodmNOQVFFTEJRQURnZ0VCQUtmZVJOc3M1bzFuSzNNWFdKSjdXVGJLaGxHYUNCU3FmNjAvRFpzQXQrZVFYVGpiCmNxZHE0bVV5Y1JPUW4wcGx2Q1NWeCtHb2NQeWM4N0FrMXVLTzlhTkJxeHNJQ1ozYnhlTlg5eUFZcm1tTWVxekoKaUprOXpZendOeFlvOW9KK0lBZndtUi9ocmtJODY0MWkwYjlReGdSZFhGWVV0VWlrRFQ4QkVDVmE3YWh1YnYzdQpVZHpjL2pzV0tucVYrcVJadS9oRVh5VWZHL2N4aVZaeDlNaWlqbVZsSVdWV1JSMXVieW4zK1BIbHFINysrRXpkCnhNaEJKQU5XK3lmL0tnTGJFTlJSTFQxUERVd3UyQlNwdjFVbFZjSlZLUXYyWkpSb2R2bFBxQnVNQnhOR3ZldXYKdlorSFVpd2JEMXQxQWM3TXRnQnZIbnVZTGttbjFlR2dMK1J3UGhFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  # 保存私钥
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRRGMwOEpkQWhES0dpdWoKR295dGVoYjBaUExDMjZQTjVOblhQQXhDdzZNYkorT1VkNS9tSzVkenpoVGRoK0ZoZXhhZDNxd1lNS0JucFRVRgpHY1lYOXNPZXViV2pWK1k4M0RINHlWVW9GRGliRWdPWVZ0UmQwSkw5QXljM3ZSbG44QlVodlo3SDM3YWN2RmxMCmp3bXdxTTVGcUZaV2d3VWR3MmpGeFBrbnhhQU1ETHI0NG4yZ3lWK0lPSDJSdUtoNFlXVjh3THJuSk0zZnFKK0oKVVg3M0k1bDVTR2Z3cDBkQ3JOUUxKNHNUdmNrQ3VETjVXYVpZUWFiNzFqdk1jTmZzM1RweHViSTkrR0lFekp5SwpaZ0licm5MdFZXQ3FmSkFYSUxGeFExemlOWXAwaDNOeDFOMENXcnRwUUdtRU9wb0NkdHhCOXBRWlpVVFVkdDVGCjljQnVtYTNQQWdNQkFBRUNnZ0VBRGM5V1o5K2hzaW5wMGJUdTJFaDYyQVRhSTdKOXIzb2czM043WnM5NlMwLzIKelFtZ0g5SlpFZDV3OHB1MVRoWFhCNzl0cnNPWHZIT1orYnd2WmI5Q1k1SkVtRGIraUk3U3R6Yk1Fd29Vc2lueAp2Snl0Z2tKeGRzNDBMU212eFk2L201RVN0WGc1b05xc2tPdWNsUVl4aEN5dlhaQ3JDTDM0TnVvSEZPUW9pcWhCClo3RUpHY2ZtS3pTcXdMYmFhUXc3N0hiWnR0Z2hMck1la2hvU0xSbmVzV0hSNkVNTkpkNW1GMSt4Y3doWk9Nb0sKU0VjUGwwU3padzMyNUxKNjRFL0l5ZmFrTXAySU91MWFuVFA5L2IvK3Y5T05lNUJGNnFnbVVQY1ZwTy9NZEcvMgpwQXl1VlB1MVVPNnBTYjI1ZFVvN3VwSXc1VzNqUnRkSXVaYUZSZ3FPNVFLQmdRRHp1M1ZBRWpqNmxPNUpUUFNDCkwzWnlZM0l1dHRuaDVTV3RsMllkZGhBdkpsY2VWVkRnaGJOYnFPbDFVMUNGSERlZ0tFN1VKSkFLeFlBb1dBV0cKSmZubGlRLysxV2o5c0R1bXZZY2JvSnpvYzNwUVppT0gxMCtCUGdaRy80bnJFUHo3R2NLb2VYQVExenpnWEZsQwp0MlJ1ejJiK3dqdDJyOWRqdGdTR3FhR1hOUUtCZ1FEbjhTb2JYdGZhbHpzM1JqSTdGMEJtTkNYM3JHSUg4TitmCkkxRmxIY0l5VDZtWUxjQXZwdHd0bVpEanBLVFhKVXFTbkJHYlB3TXN1NnRlOWdrWDgwSFVpTUhORUhGN2VablQKd1VjREdyalFXY3M5eTEvWGdJNERJSEdiN1dMY2ZqZWNDa2sxMWhYM0E5SWRXa2xEM2VCczljUmRuZkl6aVI3TgpuUU5CS3RMZGN3S0JnUUNUemVkUnZuczlRcG1xYS9lUEJ6ZGVNUDVxWThxSG1jMmFrc2lETHppclR5WGZxRDlPCm1PWG12TzB1a0NLeFJpWlpnbmdqWURUVncyVnZrY2x2eTVIYTU1NkNuR3A2QmFoMitsSjNwNVBmeHoreWgrNGUKRDYwUUpFdnNQRVVuL3ZwYlVBamk0Qm5jckpvbk9QbU1ZdWlONWtxQVRjdC9zeXo4TThKVTQ0T3h6UUtCZ0FNYgplZ0x2M0ZoeldqbTlXUUx0cHRFM3RhS0J6clpvaGJadUZMTVVHUHZ2a1VnV3BOSittOGlJbkNaUW1GekJoU1E5CnJ3YXphMmw0QWkyOWdoV3VEcDI0VDFCZC9nYzNjOVlnYXNFaDVJUDJFQUQ5N29UR2xpQjRtTTBMK3gwVkc4MmQKWGFtNCtvWmFxTC8zNjY5YkU1eWlGa1ZpemxIZWJtazJ4MHBpTm56OUFvR0FaUGh6YTZMdnEvNGZtU0lscDAxNApHNmp6RW1vWFpId252ZGZ6RWE0OFhMWTNxS1FqVDQ3aUhUaXhPemd4QjdXV3gxaDFTOGtib0FQOXAxNXNvbHF6CnVHZnVxQXZ1eTEwZjdXTVBWc3hrbTFobWN4bm9TTlJUaEtvbzRmbExOZ1A3eHRJVHM4b2hScG1ZVEdPWlBOVXYKeVlsYjF4Y3lHaXo0NDlBSmlvOTVkWDQ9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
kind: Secret
metadata:
  creationTimestamp: "2025-10-10T23:30:18Z"
  name: template-tls-secret
  namespace: default
  resourceVersion: "71613"
  uid: b48fe1eb-16bc-4562-b9f1-d41b1c8022fd
type: kubernetes.io/tls

template04.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-svc
  name: nginx-svc
spec:
  ports:
  - name: web
    port: 80
    targetPort: 80
  selector:
    app: nginx
  type: ClusterIP
---
# nginx-ingress 配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60s"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/ssl-redirect: "true"			# 是否301强制https，默认80 443共存
spec:
  tls:		# 证书导入
  - hosts:
      - www.template.com		# 给需要加密的域名配置证书
    secretName: template-tls-secret		#  www.template.com的证书
  rules:
  - host: www.template.com
    http:
      paths:
      - backend:
          service:
            name: nginx-svc
            port:
              number: 80
        path: /
        pathType: Prefix

访问测试：
在这里插入图片描述

5. 域名重定向

template05.yaml：

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx-svc
  name: nginx-svc
spec:
  ports:
  - name: web
    port: 80
    targetPort: 80
  selector:
    app: nginx
  type: ClusterIP
---
# nginx-ingress 配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/permanent-redirect: https://www.baidu.com		# 重定向到百度
    nginx.ingress.kubernetes.io/permanent-redirect-code: '301'					# 使用301 强制重定向

spec:
  rules:
  - host: www.template.com
    http:
      paths:
      - backend:
          service:
            name: nginx-svc
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific

6. 四层代理配置

修改nginx-ingress 控制器启动参数：
添加udp和tcp cm配置名称，后端会通过cm配置文件来实现四层代理

- args:
  - --tcp-services-configmap=$(POD_NAMESPACE)/nginx-ingress-tcp-configmap
  - --tcp-services-configmap=$(POD_NAMESPACE)/nginx-ingress-udp-configmap

nginx-ingress-tcp-configmap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-ingress-tcp-configmap
  namespace: ingress-nginx
data:
  "9000": "default/nginx-svc:80"			# 访问本地9000端口代理default/nginx-svc:80
  "9001": "default/nginx-svc:443"

nginx-ingress-udp-configmap

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-ingress-udp-configmap
  namespace: ingress-nginx
data:
  "53": "kube-system/kube-dns:53"

kubectl  apply -f nginx-ingress-tcp-configmap
kubectl  apply -f nginx-ingress-udp-configmap

访问测试：
在这里插入图片描述

或者查看pod中nginx.conf配置。

# kubernetes # nginx # linux
Logo
码道开发者社区

码道开发者社区，聚焦华为云码道 CodeArts 代码智能体，沉淀 Agent、Skill、鸿蒙开发实战内容，供开发者查阅资料、交流技术、分享工程实践

更多推荐

cover

AI 已经能直接改设计稿了:Windows部署Penpot，接入Codex MCP实测

avatar 码道开发者社区

Agent 敢开写权限吗？——从「误改文件」到「凌晨3点推生产」，写权限的边界到底划在哪

分级、隔离、复核都做了，还是可能出意外。审计与回滚。全量操作日志：Agent 的每一次写操作都应该被记录。改了什么文件、执行了什么命令、调用了什么 API，全部留痕。这样出了问题，你能快速定位是哪个环节出的错。Claude Code 默认会在下记录会话日志，包括每一次工具调用。一键回滚：基于 Git 的自动 checkpoint。在 Agent 开始工作前，自动创建一个 commit 作为「安全点

avatar 码道开发者社区
cover

Codex CLI实战 从一句模糊需求到可执行可测试可验收的开发任务把“帮我优化一下”变成 Codex 能执行、团队能复核、测试能证明的工程任务

avatar 码道开发者社区