离线安装ingress

一，卸载旧版 ingress 

kubectl delete ns ingress-nginx --force --grace-period=0
kubectl get crd | grep ingress | awk '{print $1}' | xargs kubectl delete crd

 

二，在master节点安装ingress-nginx-v1.15.1

1，下载，另存为 ingress-nginx-v1.15.1.yaml，上传到master节点 

https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/baremetal/deploy.yaml

2，查看ingress-nginx-v1.15.1.yaml需要哪些镜像

grep 'image:' ingress-nginx-v1.15.1.yaml | awk '{print $2}' | sort -u

输出：

registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd

去掉@及后面的字符串就是镜像名称。

 

4，批量删除 ingress-nginx-v1.15.1.yaml 里所有镜像后的 sha256 摘要

sed -i 's/@sha256:[0-9a-fA-Z]*//g' ingress-nginx-v1.15.1.yaml

kubelet 识别逻辑：镜像地址带 @sha256 时，必须本地存在完全一致哈希的镜像，否则无视本地同名 tag，强制拉取外网，离线环境直接超时。

 

3，下载镜像，上传到master节点

nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/controller:v1.15.1
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9
#改标签
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/controller:v1.15.1  registry.k8s.io/ingress-nginx/controller:v1.15.1
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9  registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9
# 导出离线镜像包
nerdctl save -o ingress-nginx-images-v1.15.1.tar \
registry.k8s.io/ingress-nginx/controller:v1.15.1 \
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9

 

3，部署ingress-nginx

#导入镜像
nerdctl -n k8s.io load -i ingress-nginx-images-v1.15.1.tar
#应用
kubectl apply -f ingress-nginx-v1.15.1.yaml

 

4，验证部署状态

# 查看命名空间
kubectl get ns ingress-nginx
#查看服务
kubectl get svc -n ingress-nginx
# 查看ingress控制器class
kubectl get ingressclasses
# 查看pod，全部running即成功
kubectl get pods -n ingress-nginx -w

 

 输出如下，表示ingress-nginx安装成功：

 

5，删除weebhook勾子才能创建ingress规则：

kubectl delete ValidatingWebhookConfiguration ingress-nginx-admission --ignore-not-found

不删除webhook验证，会输出错误：

Error from server (BadRequest): error when creating "dotnet-demo-v1-ingress.yaml": admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: nginx.ingress.kubernetes.io/server-snippet annotation cannot be used. Snippet directives are disabled by the Ingress administrator

 

6，更改ingress对外访问的端口为 30080 / 30443

kubectl edit svc ingress-nginx-controller -n ingress-nginx

 

找到 spec.ports 区域，示例默认配置：

spec:
  clusterIP: 10.96.3.243
  clusterIPs:
  - 10.96.3.243
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - appProtocol: http
    name: http
    nodePort: 30080    #修改为你要对外的端口
    port: 80                 #service内部端口
    protocol: TCP
    targetPort: http
  - appProtocol: https
    name: https
    nodePort: 30443      #修改为你要对外的端口
    port: 443                 #service内部端口