k8s 1.30 通过helm部署ingress-controller-4.12.1

一、基本概念

        k8s集群中，ingress作为集群内服务对外暴漏的访问接入点，几乎承载着集群内服务访问的所有流量。ingress是k8s中的一个资源对象，用来管理集群外部访问集群内部服务的方式。可以通过ingress资源来配置不同的转发规则，从而达到根据不同的规则设置访问集群内不同的Service后端Pod。

        Ingress资源仅支持http流量的规则，无法配置一些高级特性。如：负载均衡的算法，Sessions Affinity等，这些高级特性都需要再ingress Controller中进行配置。

二、原理

        为了是得ingress资源正常工作，集群中必须要有个ingress controller来解析ingress的转发规则。ingress controller收到请求，匹配ingress转发规则到后端service，而service转发到pod，最终由pod处理请求。k8s中service、ingress、ingress controller有着以下关系：

• service是后端真是服务的抽象，一个serivce可以代表多个相同的后端服务。
• ingress是反向代理规则，用来规定http/https请求因该被转发到那个service上。如根据请求中不同的host和url路径，让请求落到不同的service上。
• ingress controller是一个反向代理程序，负责解析ingress的反向代理规则。如果ingress有增删改的变动，ingress Controller会及时更新自己相应的转发规则，当ingress Controller收到请求后就会根据这些规则将请求转发到对应的service。

ingressController通过api server获取ingress资源的变化，动态生成load Balancer(如nginx)所需要的配置文件(如nginx.conf)，然后重新加载load Balancer(r如：nginx -s reload重新加载nginx)来生成新的路由转发规则。

三、修改文件

# egrep -v "^$|^#|^ *#" values.yaml
global:
  image:
    registry: k8s.kubesre.xyz
namespaceOverride: ""
commonLabels: {}
controller:
  name: controller
  enableAnnotationValidations: true
  image:
    chroot: false
    registry: registry-cn-hangzhou.ack.aliyuncs.com
    image: acs/aliyun-ingress-controller
    tag: "v1.11.5-aliyun.1"
    pullPolicy: IfNotPresent
    runAsNonRoot: true
    runAsUser: 101
    runAsGroup: 82
    allowPrivilegeEscalation: false
    seccompProfile:
      type: RuntimeDefault
    readOnlyRootFilesystem: false
  containerName: controller
  containerPort:
    http: 80
    https: 443
  config: {}
  configAnnotations: {}
  proxySetHeaders: {}
  addHeaders: {}
  dnsConfig: {}
  hostAliases: []
  hostname: {}
  dnsPolicy: ClusterFirst
  reportNodeInternalIp: false
  watchIngressWithoutClass: false
  ingressClassByName: false
  enableTopologyAwareRouting: false
  disableLeaderElection: false
  electionTTL: ""
  allowSnippetAnnotations: false
  hostNetwork: true
  hostPort:
    enabled: false
    ports:
      http: 80
      https: 443
  networkPolicy:
    enabled: false
  electionID: ""
  ingressClassResource:
    name: nginx
    enabled: true
    default: false
    annotations: {}
    controllerValue: k8s.io/ingress-nginx
    aliases: []
    parameters: {}
  ingressClass: nginx
  podLabels: {}
  podSecurityContext: {}
  sysctls: {}
  containerSecurityContext: {}
  publishService:
    enabled: true
    pathOverride: ""
  scope:
    enabled: false
    namespace: ""
    namespaceSelector: ""
  configMapNamespace: ""
  tcp:
    configMapNamespace: ""
    annotations: {}
  udp:
    configMapNamespace: ""
    annotations: {}
  maxmindLicenseKey: ""
  extraArgs: {}
  extraEnvs: []
  kind: DaemonSet
  annotations: {}
  labels: {}
  updateStrategy: {}
  progressDeadlineSeconds: 0
  minReadySeconds: 0
  tolerations:
    - key: ""
      operator: "Exists"
      value: ""
  affinity: {}
  topologySpreadConstraints: []
  terminationGracePeriodSeconds: 300
  nodeSelector:
    kubernetes.io/os: linux
    boge/ingress-controller-ready: "true"
  livenessProbe:
    httpGet:
      path: "/healthz"
      port: 10254
      scheme: HTTP
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 1
    successThreshold: 1
    failureThreshold: 5
  readinessProbe:
    httpGet:
      path: "/healthz"
      port: 10254
      scheme: HTTP
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 1
    successThreshold: 1
    failureThreshold: 3
  healthCheckPath: "/healthz"
  healthCheckHost: ""
  podAnnotations: {}
  replicaCount: 1
  minAvailable: 1
  unhealthyPodEvictionPolicy: ""
  resources:
    limits:
      cpu: 6
      memory: 12Gi
    requests:
      cpu: 2
      memory: 4Gi
  autoscaling:
    enabled: false
    annotations: {}
    minReplicas: 1
    maxReplicas: 11
    targetCPUUtilizationPercentage: 50
    targetMemoryUtilizationPercentage: 50
    behavior: {}
  autoscalingTemplate: []
  keda:
    apiVersion: "keda.sh/v1alpha1"
    enabled: false
    minReplicas: 1
    maxReplicas: 11
    pollingInterval: 30
    cooldownPeriod: 300
    restoreToOriginalReplicaCount: false
    scaledObject:
      annotations: {}
    triggers: []
    behavior: {}
  enableMimalloc: true
  customTemplate:
    configMapName: ""
    configMapKey: ""
  service:
    enabled: true
    external:
      enabled: true
    annotations: {}
    labels: {}
    type: ClusterIP
    clusterIP: ""
    externalIPs: []
    loadBalancerIP: ""
    loadBalancerSourceRanges: []
    loadBalancerClass: ""
    externalTrafficPolicy: ""
    sessionAffinity: ""
    ipFamilyPolicy: SingleStack
    ipFamilies:
      - IPv4
    enableHttp: true
    enableHttps: true
    ports:
      http: 80
      https: 443
    targetPorts:
      http: http
      https: https
    appProtocol: true
    nodePorts:
      http: ""
      https: ""
      tcp: {}
      udp: {}
    internal:
      enabled: false
      annotations: {}
      type: ""
      clusterIP: ""
      externalIPs: []
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      loadBalancerClass: ""
      externalTrafficPolicy: ""
      sessionAffinity: ""
      ipFamilyPolicy: SingleStack
      ipFamilies:
        - IPv4
      ports: {}
      targetPorts: {}
      appProtocol: true
      nodePorts:
        http: ""
        https: ""
        tcp: {}
        udp: {}
  shareProcessNamespace: false
  extraContainers: []
  extraVolumeMounts: []
  extraVolumes: []
  extraInitContainers: []
  extraModules: []
  admissionWebhooks:
    name: admission
    annotations: {}
    enabled: true
    extraEnvs: []
    failurePolicy: Fail
    port: 8443
    certificate: "/usr/local/certificates/cert"
    key: "/usr/local/certificates/key"
    namespaceSelector: {}
    objectSelector: {}
    labels: {}
    service:
      annotations: {}
      externalIPs: []
      loadBalancerSourceRanges: []
      servicePort: 443
      type: ClusterIP
    createSecretJob:
      name: create
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        allowPrivilegeEscalation: false
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop:
            - ALL
        readOnlyRootFilesystem: true
      resources: {}
    patchWebhookJob:
      name: patch
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        allowPrivilegeEscalation: false
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop:
            - ALL
        readOnlyRootFilesystem: true
      resources: {}
    patch:
      enabled: true
      image:
        registry: registry.k8s.io
        image: ingress-nginx/kube-webhook-certgen
        tag: v1.5.2
        pullPolicy: IfNotPresent
      priorityClassName: ""
      podAnnotations: {}
      networkPolicy:
        enabled: false
      nodeSelector:
        kubernetes.io/os: linux
        boge/ingress-controller-ready: "true"
      tolerations:
        - operator: Exists
      labels: {}
      securityContext: {}
      rbac:
        create: true
      serviceAccount:
        create: true
        name: ""
        automountServiceAccountToken: true
    certManager:
      enabled: false
      rootCert:
        duration: ""
      admissionCert:
        duration: ""
  metrics:
    port: 10254
    portName: metrics
    enabled: false
    service:
      enabled: true
      annotations: {}
      labels: {}
      externalIPs: []
      loadBalancerSourceRanges: []
      servicePort: 10254
      type: ClusterIP
    serviceMonitor:
      enabled: false
      additionalLabels: {}
      annotations: {}
      namespace: ""
      namespaceSelector: {}
      scrapeInterval: 30s
      targetLabels: []
      relabelings: []
      metricRelabelings: []
    prometheusRule:
      enabled: false
      additionalLabels: {}
      annotations: {}
      rules: []
  lifecycle:
    preStop:
      exec:
        command:
          - /wait-shutdown
  priorityClassName: ""
revisionHistoryLimit: 10
defaultBackend:
  enabled: false
  name: defaultbackend
  image:
    registry: registry.k8s.io
    image: defaultbackend-amd64
    tag: "1.5"
    pullPolicy: IfNotPresent
    runAsNonRoot: true
    runAsUser: 65534
    runAsGroup: 65534
    allowPrivilegeEscalation: false
    seccompProfile:
      type: RuntimeDefault
    readOnlyRootFilesystem: true
  extraArgs: {}
  serviceAccount:
    create: true
    name: ""
    automountServiceAccountToken: true
  extraEnvs: []
  port: 8080
  livenessProbe:
    failureThreshold: 3
    initialDelaySeconds: 30
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 5
  readinessProbe:
    failureThreshold: 6
    initialDelaySeconds: 0
    periodSeconds: 5
    successThreshold: 1
    timeoutSeconds: 5
  updateStrategy: {}
  minReadySeconds: 0
  tolerations: 
    - key: ""
      operator: "Exists"
      value: ""
  affinity: {}
  topologySpreadConstraints: []
  podSecurityContext: {}
  containerSecurityContext: {}
  podLabels: {}
  nodeSelector:
    kubernetes.io/os: linux
    boge/ingress-controller-ready: "true"
  podAnnotations: {}
  replicaCount: 1
  minAvailable: 1
  unhealthyPodEvictionPolicy: ""
  resources: {}
  extraVolumeMounts: []
  extraVolumes: []
  extraConfigMaps: []
  autoscaling:
    annotations: {}
    enabled: false
    minReplicas: 1
    maxReplicas: 2
    targetCPUUtilizationPercentage: 50
    targetMemoryUtilizationPercentage: 50
  networkPolicy:
    enabled: false
  service:
    annotations: {}
    externalIPs: []
    loadBalancerSourceRanges: []
    servicePort: 80
    type: ClusterIP
  priorityClassName: ""
  labels: {}
rbac:
  create: true
  scope: false
serviceAccount:
  create: true
  name: ""
  automountServiceAccountToken: true
  annotations: {}
imagePullSecrets: []
tcp: {}
udp: {}
portNamePrefix: ""
dhParam: ""

# helm upgrade --install ingress-nginx -n ingress-nginx . -f values.yaml