k8s/nginx

1. 拿到集群IP地址

kubectl get endpoints 

2. 安装NFS-CSI驱动

helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
helm install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system --version 4.11.0

3. 创建storageClass

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-csi-cat
provisioner: nfs.csi.k8s.io
parameters:
  server: 10.10.20.1
  share: /volume1/nfs
reclaimPolicy: Retain
volumeBindingMode: Immediate
mountOptions:
  - hard
  - nfsvers=4.1

4. 创建PV和PVC

4.1 动态创建PV

不用指定PV，而直接通过StorgeClass自动创建PV

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-nginx-nfs-cat
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: nfs-csi-cat

4.2 手动创建PV和PVC

需手动创建目录，同时手动创建PV和PVC

---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nginx-nfs-csi-cat
spec:
  accessModes:
    - ReadWriteMany
  capacity:
    storage: 1Gi
  csi:
    driver: nfs.csi.k8s.io
    volumeAttributes:
      server: 10.10.20.1
      share: /volume1/nfs
      subdir: nginx
    volumeHandle: nfs-cat#volume1/nfs/nginx#
  mountOptions:
    - hard
    - nfsvers=4.1
  persistentVolumeReclaimPolicy: Delete
  storageClassName: nfs-csi-cat
  volumeMode: Filesystem

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-nginx-nfs-csi-cat
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: nfs-csi-cat
  volumeName: pv-nginx-nfs-csi-cat

5. 创建部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        volumeMounts:
        - name: data
          mountPath: /usr/share/nginx/html
          readOnly: false
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: pvc-nginx-nfs-csi-cat

6. 创建应用服务

---
apiVersion: v1
kind: Service
metadata:
  name: nginx2
spec:
  selector:
    app: nginx
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  type: ClusterIP

7. 创建Ingress

7.1 Ingress 需要一个IngressClass，所以需要安装IngressClass(Nginx, Treak)

helm repo add traefik https://traefik.github.io/charts

helm install traefik traefik/traefik --namespace kube-system

7.2 创建应用路由

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx
spec:
  ingressClassName: traefik
  rules:
    - host: nginx.k8s.orb.local
      http:
        paths:
          - backend:
              service:
                name: nginx
                port:
                  number: 80
            path: /
            pathType: Prefix

8. 创建tls证书和配置https访问

---
apiVersion: v1
data:
  tls.crt: >-
    LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUU5VENDQTkyZ0F3SUJBZ0lTQnE3ZjBMaG9hYmFaQnhsL3RlNi9XZFkvTUEwR0NTcUdTSWIzRFFFQkN3VUEKTURNeEN6QUpCZ05WQkFZVEFsVlRNUll3RkFZRFZRUUtFdzFNWlhRbmN5QkZibU55ZVhCME1Rd3dDZ1lEVlFRRApFd05TTVRBd0hoY05NalV3TlRJNU1ESXpNak0wV2hjTk1qVXdPREkzTURJek1qTXpXakFYTVJVd0V3WURWUVFECkV3eGthWE11WkhRdGIyc3VZMjR3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ1QKZzgyWDM5UkQySFNka25sVEVxYmVOa21kS2JncjNVNVRwNjVBVUVkdDFlRmczMDhDZlAyZUdWbSs1dlV0bkZlQwprRmdFbjhpc0tvLzRaNkVrWUh3SXdxZzJXZTBHZ1Nya0lxTStzN1d0ZHA3MEoxZ1YxS3BVamlZZXMxZHJFa0pKCmwvOC84cHRBNkZiVHJhTFBOUUl1aXA2RnU1a3dlMUJPRGpLaGMzRW43ZWxTQStDWU05TUFPWU1pZHlOVjNma3cKd01sczl6QkNDK3p3UUZxRlhLV3U2VkNIUHg2TnhieWY3OC9VVW9KdHZXWmZPTzF0WGl3Y3Jwb3RXNW9SMHIrSQo5UkhCK29UcG55Ym9xdzBkb1pXc3Z5cm1hK2ZxdWVuWXc3aWdKOUYxVHUvSk10VmlaQVg4KzJCV0R3M0lmSC9vClpROG1OekN2bG1rc3ArdHhsNXhUQWdNQkFBR2pnZ0lkTUlJQ0dUQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWUQKVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwTwpCQllFRkwyRjR4MjgxeGF5eTJQSjRLeWxSZ2NHeUJJRU1COEdBMVVkSXdRWU1CYUFGTHU4dzBlbDVMeXB4c09rCmNnd1FqYUkxNGNqb01ETUdDQ3NHQVFVRkJ3RUJCQ2N3SlRBakJnZ3JCZ0VGQlFjd0FvWVhhSFIwY0RvdkwzSXgKTUM1cExteGxibU55TG05eVp5OHdGd1lEVlIwUkJCQXdEb0lNWkdsekxtUjBMVzlyTG1OdU1CTUdBMVVkSUFRTQpNQW93Q0FZR1o0RU1BUUlCTUM0R0ExVWRId1FuTUNVd0k2QWhvQitHSFdoMGRIQTZMeTl5TVRBdVl5NXNaVzVqCmNpNXZjbWN2TmpRdVkzSnNNSUlCQlFZS0t3WUJCQUhXZVFJRUFnU0I5Z1NCOHdEeEFIY0F6UHNQYW9WeENXWCsKbFp0VHp1bXlmQ0xwaFZ3Tmw0MjJxWDVVd1A1TURiQUFBQUdYR2hmckF3QUFCQU1BU0RCR0FpRUEvZDBSNGpwcApoOXFHK2txWUFlSFJyWkRWSDRBRVhkUFI1ZDFmektCZ3JEWUNJUURmanQ0ZlE5M2dDdy9xWEliQ0JVNlN1T2MrCmJFNjNNOWpkTHVvM1J2NklUd0IyQUJMeFRqUzlVM0pNaEFZWnc0OC9laFA0NTdWaWg0aWNiVEFGaE92bGhpWTYKQUFBQmx4b1g2dmNBQUFRREFFY3dSUUloQU00eUhHbHUwNEVNMlNEMSsxek5YclpsYUQ4SDNLUVZXR1d2LzNTbgpXMml4QWlBM0I2WXdudmdCeVR3RUptemN5bWhZU3NPMDd3MmZ2NUtacFNnZG8rMUZ2akFOQmdrcWhraUc5dzBCCkFRc0ZBQU9DQVFFQWY4bEdrKzFiS0VCRUdQcFpTSnI0ZHR5RzRZUld4SkJRT3hpdC9DS2I4ZmxyWCtvaW5GQ1cKOU83M0wwR2tFNHZrQ3JuU3hXUERYVU94UWgzdVRjNU9YN1VuV3lMNmtpbjNrQ0JiM2pKVm55MDBoRzBVbUhwcQpMTjNyRzl6bUpvWHdrQUhFVHJ0ck5EbVFPV3JCNTJtTjNjNDVydEFsb2lpY01RVUVXMkthem95L2QrRUJ1ZVFMCmdVR0J4RVpFUUloTUV6TzdDTmo1Z0JwanY1VjNvL3BYN05Qb2loRkhoOU9GQko3TER2ZlFjZldVaHY4V0VObEUKbUZCWW5vMDJmV05DWjl5WXliMHVUWVBxalNkUE9vNStvcWM4M1pyWkZBaDV4WmJFOGhSb1M5U0V0bFFSa2ZELwpKeWlZeE5KTnN0TnZpeEJXcHdRanNHY0h5aFRONkxIeTNnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJRkJUQ0NBdTJnQXdJQkFnSVFTNmhTay9lYUw2SnpCa3VvQkkxMTBEQU5CZ2txaGtpRzl3MEJBUXNGQURCUApNUXN3Q1FZRFZRUUdFd0pWVXpFcE1DY0dBMVVFQ2hNZ1NXNTBaWEp1WlhRZ1UyVmpkWEpwZEhrZ1VtVnpaV0Z5ClkyZ2dSM0p2ZFhBeEZUQVRCZ05WQkFNVERFbFRVa2NnVW05dmRDQllNVEFlRncweU5EQXpNVE13TURBd01EQmEKRncweU56QXpNVEl5TXpVNU5UbGFNRE14Q3pBSkJnTlZCQVlUQWxWVE1SWXdGQVlEVlFRS0V3MU1aWFFuY3lCRgpibU55ZVhCME1Rd3dDZ1lEVlFRREV3TlNNVEF3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUURQVitYbXhGUVM3YlJIL3NrbldIWkdVQ2lNSFQ2STN3V2QxYlVZS2IzZHRWcS8rdmJPbzc2dkFDRkwKWWxwYVBBRXZ4VmdEOW9uL2poRkQ2OEcxNEJRSGxvOXZIOWZudW9FNUNYVmx0OEt2R0ZzM0ppam5vL1FISzIwYQovNnRZdkpXdVFQL3B5MWZFdFZ0L2VBMFlZYndYNTFUR3UwbVJ6VzRZMFlDRjdxWmxOcngwNnJ4UVRPcjhJZk00CkZwT1V1ckRUYXpnR3pSWVNlc3BTZGNpdGRyTENuRjJZUlZ4dllYdkdMZTQ4RTFLR0FkbFg1amdjMzQyMUg1S1IKbXVkS0hNeEZxSEpWOExEbW93ZnMvYWNiWnA0L1NJdHhoSEZZeVRyNjcxN3lXMFFyUEhUbmo3Skh3UWRxelpxMwpEWmIzRW9FbVVWUUs3R0gyOS9YaThvcklsUTJOQWdNQkFBR2pnZmd3Z2ZVd0RnWURWUjBQQVFIL0JBUURBZ0dHCk1CMEdBMVVkSlFRV01CUUdDQ3NHQVFVRkJ3TUNCZ2dyQmdFRkJRY0RBVEFTQmdOVkhSTUJBZjhFQ0RBR0FRSC8KQWdFQU1CMEdBMVVkRGdRV0JCUzd2TU5IcGVTOHFjYkRwSElNRUkyaU5lSEk2REFmQmdOVkhTTUVHREFXZ0JSNQp0Rm5tZTdibDVBRnpnQWlJeUJwWTl1bWJiakF5QmdnckJnRUZCUWNCQVFRbU1DUXdJZ1lJS3dZQkJRVUhNQUtHCkZtaDBkSEE2THk5NE1TNXBMbXhsYm1OeUxtOXlaeTh3RXdZRFZSMGdCQXd3Q2pBSUJnWm5nUXdCQWdFd0p3WUQKVlIwZkJDQXdIakFjb0JxZ0dJWVdhSFIwY0RvdkwzZ3hMbU11YkdWdVkzSXViM0puTHpBTkJna3Foa2lHOXcwQgpBUXNGQUFPQ0FnRUFrckhuUVRmcmVaMkI1czNpSmVFNklPbVFSSldqZ1Z6UHcxMzl2YUJ3MWJHV0tDSUwwdklvCnp3em4xT1pEakNRaUhjRkNrdEVKcjU5TDlNaHdUeUFXc1ZyZEFmWWYrQjloYXhRbnNIS05ZNjd1NHM1THp6ZmQKdTZQVXplZXRVSzI5ditQc1BtSTJjSmt4cCtpTjNlcGk0aEt1OVp6VVBTd01xdENjZWI3cVBWeEVicFl4WTFwOQoxbjVQSktCTEJYOWViOUxVNmw4elN4UFdWN2JLM2xHNFhhTUpnblQ5eDNpZXM3bXNGdHBLSzViRHRvdGlqL2wwCkdhS2VBOTdwYjV1d0Q5S2dXdmFGWE1JRXQ4alZUakxFdndSZHZDbjI5NEdQREYwOFU4bEFrSXY3dGdobHVhUWgKMVFubEU0U0VONExPRUNqOGRzSUdKWHBHVWszYVUzS2tKejlpY0t5K2FVZ0ErMmNQMjF1aDZOY0RJUzNYeWZhWgpRam1EUTk5M0NoSUk4U1hXdXBRWlZCaUlwY1dPNFJxWmszbHI3Qno1TVVDd3pESUEzNTllNTdTU3E1Q0NrWTBOCjRCNlZ1bGs3TGt0ZndyZEdOVkk1QnNDOXFxeFN3U0tnUkplWjl3eWdJYWVoYkhGSEZoY0JhTURLcGlabEJIeXoKcnNubmxGWENiNXM4SEtuNUxzVWdHdkIyNEw3c0dOWlAyQ1g3ZGhIb3YrWWhEK2pvekxXMnA5VzQ5NTlCejJFaQpSbXFEdG1pWExuenFUcFhiSStzdXlDc29oS1JnNlVuMFJDNDcrY3BpVndIaVhaQVcrY244ZWlOSWpxYlZnWEx4CktQcGR6dnZ0VG5PUGxDN1NRWlNZbWR1bnIzQmY5Yjc3QWlDL1ppZHN0SzM2ZFJJTEt6N09BNTQ9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: >-
    LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBazRQTmw5L1VROWgwblpKNVV4S20zalpKblNtNEs5MU9VNmV1UUZCSGJkWGhZTjlQCkFuejluaGxadnViMUxaeFhncEJZQkovSXJDcVArR2VoSkdCOENNS29ObG50Qm9FcTVDS2pQck8xclhhZTlDZFkKRmRTcVZJNG1Ick5YYXhKQ1NaZi9QL0tiUU9oVzA2Mml6elVDTG9xZWhidVpNSHRRVGc0eW9YTnhKKzNwVWdQZwptRFBUQURtREluY2pWZDM1TU1ESmJQY3dRZ3ZzOEVCYWhWeWxydWxRaHo4ZWpjVzhuKy9QMUZLQ2JiMW1Yemp0CmJWNHNISzZhTFZ1YUVkSy9pUFVSd2ZxRTZaOG02S3NOSGFHVnJMOHE1bXZuNnJucDJNTzRvQ2ZSZFU3dnlUTFYKWW1RRi9QdGdWZzhOeUh4LzZHVVBKamN3cjVacExLZnJjWmVjVXdJREFRQUJBb0lCQUJVYXBpODBOb24rVGJDOQpZOTRlclFEZGcycVlyV0NaS0x1UEliN1J2V1paVXdVbzdZVE5uUHNoWlZXS2RVa3hOTlBaRXI2V25YOEVGOVRSCi9wdlZzZWtPOEVIV1c3S3lpQkJiWkQ5ME5tbTZyc0wvWGZyQmtoekd1VzFxK3ZhMmhnVkJXYU1zY2ttMjg3VVYKQWxYaW40MUpCNlRhVWZBOXRCOTJxSWV3bkYrNTBpdjlobWRudlo5ZkE4TWxCS1NLR3hxblJZZThxWlZ1U251SQp5QnM1ZkdxdTJvVm16SEN0MHRrZ1RsMUhaTjFRVDIwOGpoU05mdjIwRXIvbnVrM2R4a29qSkkwU1BScVYwRTdhCm4zWDBudStySDJ1SE1YUkYraGJzaU11ZGhPQWFwbTdTTUxzcHU0N2FWSE1lUWhJU1BoK3ZBSEVTUVdueUVENDIKNjhDaVp3RUNnWUVBeEpOQ0ZUSUplYXBTS2p0VHRML29pWUFUWDYzazJEK3ZrV0hjdGhxbHVDNThDcWE1YmhFTQp3aFJpUEpib2Z1NjAxTFJ1Z21nTmZ6TFN4b01NekJ3RExZZTEzTyt4eHNhR0lRSG9wTUpsZFJUWHlLUEpaN2JWClZGVFBLZ0dwU0VDVnZ3S09lZUthcTZHNE1NSmZHdTFMQ2VIUmFxSGhhSkgwOTR0ZkJYcjg3L2NDZ1lFQXdCdlIKQk80VVhtSTZROS9vcmhzOE42UmhaUGZOdUgrR1RHOUlkU0JucGI0bk83YU1NU2dnMnViRlNlblJEZG95S09OQgpYekgrNHNkRFdhdzB3RVBKeHhYMWFhejNOWHlUQytQVy9HK241ZS9mKzJxbE5GQVYvbkpNejMwZTJhY3hsZDV2CkVwMms2UG11a0RGUjRjOUh2RTY4dEQzdFRlWU44WjlYZXJudVY0VUNnWUJnSGhVSTRoK0o4d01jRFVnL3NEcVcKeVI0d0FZcE5SczZsQ3JIdUJSZVUrSDNFZzROVjAxWm1xNnJoTDNUZFpBRGRwS0FJZWJKbnlNVVJOZEVUR0h0aApUdU5ZOVliNngrV2J6Q0FpTjc5K1FVUEZvbmgva3dHNnE0RmthODJITzdVODRaWWkrTzlpRHNCT2J5d3JzVzJvCmxsZGNpV3o3UWFzRFE0MmgwMkpNUHdLQmdBUW5WZENlZVRCRlBXOUVReHFvbWhlMTVTa3l0bTc3eXVLU01XWGUKNm43SjZyMCt5Qzh6NStuenZXWkl1TzFzdjFMay92L1k2K0xwWGdwdFQ4S3NkSXRxYlNENHpXdUpvd0JKejljcgpidHpvMzlYbXkyV2pLYWFUd0Jkb1pDZGVseExmZVZWVXRVRVlUTzd2TWc4STFVczhCSlo5RkVsdjVQTkpkN0crCm5XbWxBb0dCQUtDQXA5QWN1NmtNWGNpWXB2R3ZuNTE3cnRieTJDcnRjUm9VVXZHNXpMQkhxTFllVm9WUzk4MkYKOUU4TURsMUE4YVRRSXp3bjlzOENRajdZcDkrcGYrSExJd1lLeHlZem1BOWlkRHltTUZ3MG9MNFdPMTVrcGc0TwozckVib1JUNHErQ3Q2Q00zdVEwUFZmZnEzL2s3NDZ0aGFYcHBKU3o0b2wyYUtiRVJwV0FuCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
kind: Secret
metadata:
  name: nginx-k8s-orb-local-tls
type: kubernetes.io/tls

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx
spec:
  ingressClassName: traefik
  rules:
    - host: nginx.k8s.orb.local
      http:
        paths:
          - backend:
              service:
                name: nginx
                port:
                  number: 80
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - nginx.k8s.orb.local
      secretName: nginx-k8s-orb-local-tls