K8S私有化非标准端口方案

背景:

在以往安装部署阶段客户域名都是采用80 443标准端口来实施,但有的客户不采用标准端口而是9000 9443端口.

方案:

网络出去采用Nodeport形式

1.修改nodeport端口范围

在 k8s 集群中，NodePort 默认范围是 30000-32767
所以需要修改master节点配置
cat /etc/kubernetes/manifests/kube-apiserver.yaml
添加这行参数
- --service-node-port-range=1-65535

所有的master都做统一修改然后重启kubelet

2.修改ingress-svc配置

在安装Ingress的时候会创建svc地址如图所示

为了不破坏LoadBalancer 所以新增一个node-svc地址
kubectl get svc ingress-nginx-controller -oyaml > node-svc.yaml
参考如下

apiVersion: v1
kind: Service
metadata:
  annotations:    
    meta.helm.sh/release-name: ingress-nginx
    meta.helm.sh/release-namespace: default
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.2.1
    helm.sh/chart: ingress-nginx-4.1.4
  name: ingress-nginx-controller-nodeport
  namespace: default
spec:
  ports:
  - appProtocol: http
    name: http
    nodePort: 9000
    port: 9000
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    nodePort: 9443
    port: 9443
    protocol: TCP
    targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  sessionAffinity: None
  type: NodePort