完整一键 YAML安装（Deployment + Service + Ingress规则）

有已经存在的业务镜像上传在阿里云的容器镜像服务，镜像地址：registry.cn-hangzhou.aliyuncs.com/yihan/dotnet6-demo:0.0.2

 

 创建阿里云容器镜像的访问权限：

方案一：纯命令创建secret

kubectl create secret docker-registry aliyun-secret \
--docker-server=registry.cn-hangzhou.aliyuncs.com \
--docker-username=你的阿里云登录账号 \
--docker-password=阿里云容器镜像仓库密码 \
--docker-email=任意邮箱

 

 

方案二：直接创建 reg-aliyun-secret.yaml 文件

apiVersion: v1
kind: Secret
metadata:
  name: aliyun-secret
  namespace: default
type: kubernetes.io/dockerconfigjson
stringData:
  .dockerconfigjson: |
    {
      "auths": {
        "registry.cn-hangzhou.aliyuncs.com": {
          "username": "阿里云登录帐号",
          "password": "阿里云登录密码",
          "email": "任意邮箱"
        }
      }
    }

 

或者 .dockerconfigjson的值填json转成base64后的字符串：

apiVersion: v1
kind: Secret
metadata:
  name: aliyun-secret
  namespace: default
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: ewogICAgICAiYXV0aHMiOiB7CiAgICAgICAgInJlZ2lzdHJ5LmNuLWhhbmd6aG91LmFsaXl1bmNzLmNvbSI6IHsKICAgICAgICAgICJ1c2VybmFtZSI6ICLpmL/ph4zkupHnmbvlvZXluJDlj7ciLAogICAgICAgICAgInBhc3N3b3JkIjogIumYv+mHjOS6keeZu+W9leWvhueggSIsCiAgICAgICAgICAiZW1haWwiOiAi5Lu75oSP6YKu566xIgogICAgICAgIH0KICAgICAgfQogICAgfQ==

 

执行创建

kubectl apply -f reg-aliyun-secret.yaml

 

查看secret

kubectl get secret

测试secret是否有效：

kubectl run test-demo-pod \
--image=registry.cn-hangzhou.aliyuncs.com/yihan/dotnet6-demo:0.0.2 \
--image-pull-secret=aliyun-secret \
--restart=Never

如果输出 error: unknown flag: --image-pull-secret ，就换一种方式测试secret是否有效：

kubectl run test-demo-pod \
--image=registry.cn-hangzhou.aliyuncs.com/yihan/dotnet6-demo:0.0.2 \
--restart=Never \
--overrides='{"spec":{"imagePullSecrets":[{"name":"aliyun-secret"}]}}'

输出 pod/test-demo-pod created 表示创建pod成功，代表 设置的secret正确。

 

查看pod状态：

kubectl get pod test-demo-pod

 

 

然后删除测试用的pod：

kubectl delete pod test-demo-pod

 

【修改默认 ServiceAccount（全局生效，推荐长期使用）】

给当前命名空间默认账号绑定 aliyun-secret，后续所有 pod/deployment 自动带拉取密钥，不用每次配置：

kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"aliyun-secret"}]}'

 

【安装Ingress组件】

清理之前按装的ingress

kubectl delete ns ingress-nginx --force --grace-period=0
kubectl get crd | grep ingress | awk '{print $1}' | xargs kubectl delete crd

 

安装K8s v1.26.15版（ingress v1.11.8 ）

curl -o ingress-1.11.8.yaml https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.11.8/deploy/static/provider/baremetal/deploy.yaml
sed -i 's|registry.k8s.io|k8s.m.daocloud.io|g' ingress-1.11.8.yaml
kubectl apply -f ingress-1.11.8.yaml

 

安装K8s v1.33.6版（ingress v1.13.6 ）

curl -o ingress-1.13.6.yaml https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.13.6/deploy/static/provider/baremetal/deploy.yaml
sed -i 's|registry.k8s.io|k8s.m.daocloud.io|g' ingress-1.13.6.yaml
kubectl apply -f ingress-1.13.6.yaml

 

安装最新版ingress

#拉取官方部署文件
curl -o ingress-install.yaml https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/baremetal/deploy.yaml
#替换DaoCloud标准镜像域名替换
# sed -i 's|registry.k8s.io|m.daocloud.io/registry.k8s.io|g' ingress-install.yaml
sed -i 's|registry.k8s.io|k8s.m.daocloud.io|g' ingress-install.yaml
#部署
kubectl apply -f ingress-install.yaml

 

下载的 install-ingress.yaml文件安装的igress组件，默认对外暴露的端口是随机的，如果是指定ingress服务组件的端口，按照下面方式更改：

如果要修改为固定端口，固定 HTTP 端口 32590、HTTPS 32591

步骤 1：找到 ingress-nginx-controller Service 片段

搜索 kind: Service，名称为 ingress-nginx-controller，原始配置默认 type: LoadBalancer，无 nodePort：

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.10.1
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - appProtocol: http
    name: http
    port: 80
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    port: 443
    protocol: TCP
    targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: NodePort

 

步骤 2：修改三处

1. type: LoadBalancer → type: NodePort
2. http 端口增加 nodePort: 30080
3. https 端口增加 nodePort: 30443

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.10.1
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - appProtocol: http
    name: http
    port: 80
    nodePort: 30080
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    port: 443
    nodePort: 30443
    protocol: TCP
    targetPort: https
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: NodePort

 

步骤 3：执行部署ingress组件

# k8s v1.26.x版本
# kubectl apply -f ingress-1.8.5.yaml
# k8s v1.33.x版本
kubectl apply -f ingress-1.10.1.yaml

 

查看ingress部署状态

# 查看ingress命名空间pod
kubectl get pods -n ingress-nginx
# 查看ingress对外service（自动分配NodePort 80/443端口）
kubectl get svc -n ingress-nginx
# 确认IngressClass存在（新版k8s必须）
kubectl get ingressclasses

 

【给 dotnet-demo-v1-svc 创建 Ingress规则 】 

先删除校验勾子，不删除创建不了ingress

kubectl delete ValidatingWebhookConfiguration ingress-nginx-admission --ignore-not-found

 如果不删除校验勾子，部署ingress的时候，会报如下错误：

Error from server (InternalError): error when creating "dotnet-demo-v1-ingress.yaml": Internal error occurred: failed calling webhook "validate.nginx.ingress.kubernetes.io": failed to call webhook: Post "https://ingress-nginx-controller-admission.ingress-nginx.svc:443/networking/v1/ingresses?timeout=10s": no endpoints available for service "ingress-nginx-controller-admission"

 

【修改ingress控制器对外端口】

1，先切换编辑器避免报错

export KUBE_EDITOR="nano"
kubectl edit svc ingress-nginx-controller -n ingress-nginx

 

2，找到 spec.ports 区域，示例默认配置：

spec:
  clusterIP: 10.96.3.243
  clusterIPs:
  - 10.96.3.243
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - appProtocol: http
    name: http
    nodePort: 30080    #修改为你要对外的端口
    port: 80                 #service内部端口
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    nodePort: 30443      #修改为你要对外的端口
    port: 443                 #service内部端口

 

直接修改 nodePort 数值（范围 30000-32767），保存退出即可，控制器自动滚动更新。

 

【部署业务deployment、service、ingress规则】

说明：

1. 镜像拉取使用阿里云私有镜像密钥 aliyun-secret
2. Deployment：dotnet-demo-v2
3. Service：dotnet-demo-v2-svc
4. Ingress 复用已有 ingress 资源名 dotnet-demo-ingress，新增 /v2 路由规则，和 /v1 共存
5. Ingress 复用已有dotnet-demo-ingress，新增/v2路由指向 v2 服务，保留原有/v1路由
6. 访问入口：
   • IP 地址：http://121.40.63.235:32590/v2
   • 域名可直接复用 Ingress 原有域名，同域名下 /v2 分流到新版本

创建 yaml文件：vi dotnet-demo-app-v2.yaml, 包含deploy、service、ingress三个配置：

# Deployment dotnet-demo-v2
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dotnet-demo-v2
  labels:
    app: dotnet-demo
    version: v2
spec:
  replicas: 2
  selector:
    matchLabels:
      app: dotnet-demo
      version: v2
  template:
    metadata:
      labels:
        app: dotnet-demo
        version: v2
    spec:
      imagePullSecrets:
        - name: aliyun-secret
      containers:
        - name: dotnet-demo
          image: registry.cn-hangzhou.aliyuncs.com/yihan/dotnet6-demo:0.0.2
          ports:
            - containerPort: 80
          resources:
            limits:
              cpu: "500m"
              memory: "512Mi"
            requests:
              cpu: "200m"
              memory: "256Mi"
---
# Service dotnet-demo-v2-svc
apiVersion: v1
kind: Service
metadata:
  name: dotnet-demo-v2-svc
spec:
  selector:
    app: dotnet-demo
    version: v2
  ports:
    - port: 80                  #内部端口,多个 Service 完全可以都写 port:80，互不冲突！最好跟targetPort端口一致。
      targetPort: 80         #pod容器端口,比如redis是6379,sqlserver是1433，mysql是3306 
      nodePort: 30092    #范围30000-32767 ，宿主机外网入口，同一个集群内所有 NodePort Service 的 nodePort 不能重复，全局唯一。
  type: NodePort

---
# Service dotnet-demo-v2-ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dotnet-demo-v2-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  ingressClassName: nginx
  rules:
  - host: demo2-test.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: dotnet-demo-v2-svc
            port:
              number: 80
  - http:
      paths:
      - path: /v2(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: dotnet-demo-v2-svc
            port:
              number: 80

 

ingress域名访问路径可以不加前缀 /v2，ip访问需要加，避免跟其它服务的ingress的路径冲突。

校验yaml文件

kubectl apply -f dotnet-demo-v2-app.yaml --dry-run=client

 

部署工作负载 dotnet-demo-v2  、应用服务dotnet-demo-v2-svc、dotnet-demo-v2-ingress

#部署deploy、service、ingress
kubectl apply -f dotnet-demo-v2-app.yaml

#查看ingress使用的端口
kubectl get svc -n ingress-nginx

#查看deploy
kubectl get deploy

#查看service
kubectl get svc

#查看ingress
kubectl get ingress

 

 

外网访问ingress

http://公网ip:30080/v2
http://你的域名:30080

 

30080端口是ingress对外暴露的端口。

 
如果要修改Ingress使用80端口访问，参照 https://www.cnblogs.com/yyee/p/21913914 修改。