Kubernetes进入外部服务？

Question

说我有一个不在Kubernetes上托管的服务。我还在kubernetes集群上设置了一个入口控制器和证书管理器。

由于使用kubernetes入口来控制对服务的访问是如此简单和容易，因此我想拥有一个指向非kubernetes服务的kubernetes入口。

例如，我有一个托管在的服务https://10.0.40.1:5678（需要ssl，但具有自签名证书），并且想要访问service.example.com。

Answer 1

所以我使用ingress-nginx通过非标准端口代理托管外部服务

apiVersion: v1
kind: Service
metadata:
  name: external-service-expose
  namespace: default
spec:
  type: ExternalName
  externalName: <external-service> # eg example.example.com
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: external-service-expose
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" #important
spec:
  rules:
  - host: <some-host-on-your-side> # eg external-service.yourdomain.com
    http:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: external-service
            port:
              number: <port of external service> # eg 4589
  tls:
  - hosts:
    - external-service.yourdomain.com
    secretName: <tls secret for your domain>

当然，您需要确保可以从集群内部访问托管 url，可以通过启动调试 pod 并执行以下操作来完成简单的检查

curl -v https://example.example.com:4589

Answer 2

我只是想根据 Kubernetes 版本 v1.21.1 更新 @Moulick 的答案，至于 ingress，配置发生了一些变化。在我的示例中，我对 nginx 控制器使用 Let's Encrypt：

apiVersion: v1
kind: Service
metadata:
  name: external-service
  namespace: default
spec:
  type: ExternalName
  externalName: <some-host-on-your-side> eg managed.yourdomain.com
  ports:
  - port: <port of external service> eg 4589

---
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: external-service
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" #important
spec:
  tls:
  - hosts:
    - <some-host-on-your-side> eg managed.yourdomain.com
    secretName: tls-external-service
  rules:
  - host: <some-host-on-your-side> eg managed.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: external-service
            port:
              number: <port of external service> eg 4589

Answer 3

您可以通过为外部服务器手动创建Service和Endpoint对象来实现。

对象将如下所示：

apiVersion: v1
kind: Service
metadata:
  name: external-ip
spec:
  ports:
  - name: app
    port: 80
    protocol: TCP
    targetPort: 5678
  clusterIP: None
  type: ClusterIP
---
apiVersion: v1
kind: Endpoints
metadata:
  name: external-ip
subsets:
- addresses:
  - ip: 10.0.40.1
  ports:
  - name: app
    port: 5678
    protocol: TCP

然后，您可以创建一个Ingress对象，该对象指向external-ip带有port的Service 80：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: external-service
spec:
  rules:
  - host: service.example.com
    http:
      paths:
      - backend:
          serviceName: external-ip
          servicePort: 80
        path: /

Answer 4

如果您的外部服务上配置了 dns 条目，您可以使用 kubernetes externalName 服务。

---
apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: prod
spec:
  type: ExternalName
  externalName: myexternal.http.service.com
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: externalNameservice
  namespace: prod
spec:
  rules:
  - host: service.example.com
    http:
      paths:
      - backend:
          serviceName: my-service
          servicePort: 80
        path: /

这样kubernetes创建cname记录my-service指向myexternal.http.service.com