第 56 课·网络进阶

Ingress 规则

kubernetesnetworkingingress

Ingress 规则

学习目标

  1. 掌握 Ingress 规则的详细配置
  2. 理解基于域名和路径的路由
  3. 了解默认后端和通配符域名的使用

核心概念

一句话解释

Ingress 规则定义了如何将外部 HTTP/HTTPS 请求路由到集群内部的 Service，支持基于域名和路径的灵活路由。

Ingress 规则结构

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  ingressClassName: nginx  # 指定 Ingress Controller
  rules:                    # 路由规则列表
  - host: app.example.com  # 域名
    http:
      paths:               # 路径列表
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

基于域名的路由

多个域名 → 不同的 Service：

┌─────────────────────────────────────────┐
│        Ingress Controller               │
│        Public IP: 1.2.3.4               │
└─────────────────────────────────────────┘
                    ↓
    ┌───────────────┼───────────────┐
    ↓               ↓               ↓
app.example.com  api.example.com  admin.example.com
    ↓               ↓               ↓
┌───────┐      ┌───────┐      ┌───────┐
│Svc A  │      │Svc B  │      │Svc C  │
└───────┘      └───────┘      └───────┘

# 基于域名的路由配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: domain-routing
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 80
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
  - host: admin.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 80

基于路径的路由

同一域名，不同路径 → 不同的 Service：

app.example.com
    ↓
┌─────────────────────────────────────────┐
│        Ingress Controller               │
└─────────────────────────────────────────┘
    ↓
    ├── /api    → Service B
    ├── /web    → Service A
    └── /admin  → Service C

# 基于路径的路由配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: path-routing
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
      - path: /admin
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 80

路径类型详解

类型匹配规则示例
Prefix前缀匹配（按 / 分隔）/api 匹配 /api、/api/users
Exact精确匹配/api 只匹配 /api
ImplementationSpecific由 Controller 决定取决于实现
Prefix 匹配规则：

路径: /api
  ✓ /api          (精确匹配)
  ✓ /api/         (带斜杠)
  ✓ /api/users    (子路径)
  ✓ /api/v1/roles (深层子路径)
  ✗ /apis         (不是前缀)
  ✗ /api-other    (不是子路径)

路径: /
  ✓ /             (根路径)
  ✓ /anything     (所有路径)

Exact 匹配规则：

路径: /api
  ✓ /api
  ✗ /api/
  ✗ /api/users

默认后端

# 默认后端配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: with-default-backend
spec:
  ingressClassName: nginx
  defaultBackend:  # 当没有匹配的规则时使用
    service:
      name: default-service
      port:
        number: 80
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

默认后端处理流程：

请求: unknown.example.com/anything
          ↓
    匹配 Ingress 规则
          ↓
    没有匹配的规则
          ↓
    使用默认后端
          ↓
    转发到 default-service

通配符域名

# 通配符域名配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: wildcard-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: "*.example.com"  # 匹配所有子域名
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: wildcard-service
            port:
              number: 80

通配符匹配：

*.example.com
  ✓ app.example.com
  ✓ api.example.com
  ✓ admin.example.com
  ✗ example.com (不匹配根域名)
  ✗ sub.app.example.com (只匹配一级子域名)

多路径和多域名组合

# 复杂路由配置
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: complex-routing
spec:
  ingressClassName: nginx
  rules:
  # 域名 1：应用主站
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
  # 域名 2：管理后台
  - host: admin.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 80
  # 域名 3：文档站点
  - host: docs.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: docs-service
            port:
              number: 80

实践练习

练习 1：创建基于域名的路由

# 创建两个应用
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-v1
spec:
  replicas: 2
  selector:
    matchLabels:
      app: v1
  template:
    metadata:
      labels:
        app: v1
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-v2
spec:
  replicas: 2
  selector:
    matchLabels:
      app: v2
  template:
    metadata:
      labels:
        app: v2
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
---
# 创建 Service
apiVersion: v1
kind: Service
metadata:
  name: service-v1
spec:
  selector:
    app: v1
  ports:
  - port: 80
    targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: service-v2
spec:
  selector:
    app: v2
  ports:
  - port: 80
    targetPort: 80
---
# 创建 Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: domain-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: v1.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: service-v1
            port:
              number: 80
  - host: v2.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: service-v2
            port:
              number: 80

# 应用配置
kubectl apply -f deployment.yaml
kubectl apply -f service.yaml
kubectl apply -f ingress.yaml

# 测试访问
curl http://v1.example.com
curl http://v2.example.com

练习 2：创建基于路径的路由

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: path-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

# 测试路径路由
curl http://app.example.com/api
curl http://app.example.com/web

练习 3：测试路径类型

# 测试 Exact 匹配
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: exact-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: test.example.com
    http:
      paths:
      - path: /api
        pathType: Exact
        backend:
          service:
            name: exact-service
            port:
              number: 80

# 测试 Exact 匹配
curl http://test.example.com/api    # 匹配
curl http://test.example.com/api/   # 不匹配
curl http://test.example.com/api/users  # 不匹配

常见误解

1. 路径匹配是字符串匹配

错误理解：/api 匹配所有以 /api 开头的路径
正确理解：Prefix 按 / 分隔符匹配

/api 匹配：
  ✓ /api
  ✓ /api/users
  ✗ /apis
  ✗ /api-other

2. 通配符域名匹配根域名

错误理解：*.example.com 匹配 example.com
正确理解：只匹配子域名

*.example.com
  ✓ app.example.com
  ✗ example.com

小结

要点说明
基于域名路由不同域名转发到不同 Service
基于路径路由不同路径转发到不同 Service
路径类型Prefix、Exact、ImplementationSpecific
默认后端没有匹配规则时的兜底配置
通配符域名支持 *.example.com 格式

练习编辑器

bash
Loading...

继续学习

完成本课后，建议继续学习下一课「TLS 终止」 以巩固所学知识。