helm安装ingress(使用网络代理方式）

原创已于 2025-06-29 09:36:34 修改 · 531 阅读

5 ·

CC 4.0 BY-SA版权

文章标签：

#网络

于 2025-06-22 17:35:17 首次发布

最近新部署了一个k8s集群，需要helm来安装ingress，记录下helm的安装以及使用helm安装ingress的过程。
helm的安装比较简单，就是直接下载可执行文件然后放到系统目录即可。选择了v3.18.2版本，软件包下载路径：

https://get.helm.sh/helm-v3.18.2-linux-amd64.tar.gz
解压：
tar xzvf helm-v3.18.2-linux-amd64.tar.gz
拷贝到系统目录：
cp -a linux-amd64/helm /usr/bin/helm

解决墙的问题：
以笔记本为代理，前提是笔记本是可以访问外面的并且开启了代理：

export http_proxy="http://192.168.170.34:1082"
export https_proxy="http://192.168.170.34:1082"

sudo mkdir -p /etc/systemd/system/containerd.service.d

cat <<EOF | sudo tee /etc/systemd/system/containerd.service.d/http-proxy.conf
[Service]
Environment="HTTP_PROXY=192.168.170.34:1082"
Environment="HTTPS_PROXY=192.168.170.34:1082"
EOF
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl restart containerd

一键关闭代理脚本stop-proxy.sh：
sed -i ‘s/export http_proxy/#export http_proxy/g’ /root/.bashrc
sed -i ‘s/export https_proxy/#export https_proxy/g’ /root/.bashrc
unset http_proxy && unset https_proxy
mv /etc/systemd/system/docker.service.d/http-proxy.conf /etc/systemd/system/docker.service.d/http-proxy.conf.bak
mv /etc/systemd/system/containerd.service.d/http-proxy.conf /etc/systemd/system/containerd.service.d/http-proxy.conf.bak
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl restart containerd

一键开启代理脚本start-proxy.sh：
sed -i ‘s/#export http_proxy/export http_proxy/g’ /root/.bashrc
sed -i ‘s/#export https_proxy/export https_proxy/g’ /root/.bashrc
. /root/.bashrc
mv /etc/systemd/system/docker.service.d/http-proxy.conf.bak /etc/systemd/system/docker.service.d/http-proxy.conf
mv /etc/systemd/system/containerd.service.d/http-proxy.conf.bak /etc/systemd/system/containerd.service.d/http-proxy.conf
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl restart containerd

删除老的release（如果有）：

helm list --all-namespaces --all
 helm uninstall ingress-nginx -n ingress-nginx

在自己MacOS上安装helm：
brew install helm
然后这MacOS上拉取chart：
helm pull ingress-nginx --repo https://kubernetes.github.io/ingress-nginx --untar
上传到服务器：
scp -r ingress-nginx root@你的服务器:/root/
然后在服务器上再次安装：
helm install ingress-nginx ./ingress-nginx --namespace ingress-nginx --create-namespace
忘了修改chart里面相关的源到国内源，失败了，因此先卸载：
helm uninstall ingress-nginx --namespace ingress-nginx

修改chart里面涉及的源到国内的源，具体参考https://www.cnblogs.com/syushin/p/15271304.html
注意，由于上面这个博客使用的docker.io也无法访问了，因此没有修改 ingress-nginx-contorller 的镜像仓库地址，我这个环境使用http代理后可以访问k8s.gcr.io。做了如下修改：

修改 hostNetwork 的值为 true；修改 dnsPolicy的值改为: ClusterFirstWithHostNet，
nodeSelector 添加标签: ingress: “true”，用于部署 ingress-controller 到指定节点
kind类型更改为：DaemonSet kube-webhook-certgen的镜像地址改为国内仓库地址
registry.aliyuncs.com/google_containers/kube-webhook-certgen

给master节点打上标签ingress=true
kubectl label node k8s-master-1 ingress=true

再次执行并得到结果：

[root@k8s-master-1 k8s]# helm install ingress-nginx ./ingress-nginx --namespace ingress-nginx --create-namespace
NAME: ingress-nginx
LAST DEPLOYED: Fri Jun 20 09:29:38 2025
NAMESPACE: ingress-nginx
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
The ingress-nginx controller has been installed.
It may take a few minutes for the load balancer IP to be available.
You can watch the status by running 'kubectl get service --namespace ingress-nginx ingress-nginx-controller --output wide --watch'

An example Ingress that makes use of the controller:
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: example
    namespace: foo
  spec:
    ingressClassName: nginx
    rules:
      - host: www.example.com
        http:
          paths:
            - pathType: Prefix
              backend:
                service:
                  name: exampleService
                  port:
                    number: 80
              path: /
    # This section is only required if TLS is to be enabled for the Ingress
    tls:
      - hosts:
        - www.example.com
        secretName: example-tls

If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:

  apiVersion: v1
  kind: Secret
  metadata:
    name: example-tls
    namespace: foo
  data:
    tls.crt: <base64 encoded cert>
    tls.key: <base64 encoded key>
  type: kubernetes.io/tls

注意上面的结果输出，提供了后面使用ingress的yaml格式模板供参考。

检查ingress组件结果发现还是拉取image失败，可能是校验码变了，先编辑daemonset，将校验码部分删除：
kubectl edit ds ingress-nginx-controller -n ingress-nginx
image: registry.k8s.io/ingress-nginx/controller:v1.12.3@sha256:ac444cd9515af325ba577b596fe4f27a34be1aa330538e8b317ad9d6c8fb94ee
修改为：
image: registry.k8s.io/ingress-nginx/controller:v1.12.3

直接在服务器k8s-master-1上拉取
docker pull registry.k8s.io/ingress-nginx/controller:v1.12.3

然后delete相应的pod让它重新启动：

[root@k8s-master-1 ingress-nginx]# kubectl get po -n ingress-nginx
NAME                             READY   STATUS             RESTARTS   AGE
ingress-nginx-controller-vb6d8   0/1     ImagePullBackOff   0          7m6s
[root@k8s-master-1 ingress-nginx]# kubectl delete po ingress-nginx-controller-vb6d8 -n ingress-nginx
pod "ingress-nginx-controller-vb6d8" deleted

参考：官网安装指导：
https://kubernetes.github.io/ingress-nginx/deploy/