K8S部署ingress-nginx主机模式

前言

使用helm 3.0+ 方式部署 ingress-nginx
官方地址：https://kubernetes.github.io/ingress-nginx/

使用了hostNetwork模式部署ingress-nginx组件，调整了如下参数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
controller:
  # 启用hostNetwork使用宿主机网络
  hostNetwork: true
  # 调整DNS策略以适应hostNetwork模式
  dnsPolicy: ClusterFirstWithHostNet
  # 强制使用节点IP报告Ingress状态
  reportNodeInternalIp: true
  
  # 关闭控制器的Service
  service:
    enabled: false  # 完全禁用Service创建
    external:
      enabled: false  # 显式关闭外部Service
    internal:
      enabled: false  # 显式关闭内部Service

  # 禁用通过Service发布状态（因Service已关闭）
  publishService:
    enabled: false

  # （可选）确保hostPort配置与hostNetwork一致
  hostPort:
    enabled: false  # hostNetwork模式下通常不需要单独启用hostPort

Helm安装部署

Helm添加仓库并拉取chart包

1
2
3
4
5
6
7
8
9
10
$ helm version
version.BuildInfo{Version:"v3.6.0", GitCommit:"7f2df6467771a75f5646b7f12afb408590ed1755", GitTreeState:"clean", GoVersion:"go1.16.3"}

$ helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx

$ helm search repo ingress-nginx
NAME                       	CHART VERSION	APP VERSION	DESCRIPTION                                     
ingress-nginx/ingress-nginx	4.12.0       	1.12.0     	Ingress controller for Kubernetes using NGINX a...

$ helm pull ingress-nginx/ingress-nginx --version 4.12.0

配置values

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434

global:
  image:
    registry: registry.k8s.io

namespaceOverride: ""
commonLabels: {}

controller:
  name: controller
  enableAnnotationValidations: true
  image:
    chroot: false
    image: ingress-nginx/controller
    tag: "v1.12.0"
    pullPolicy: IfNotPresent
    runAsNonRoot: true
    runAsUser: 101
    runAsGroup: 82
    allowPrivilegeEscalation: false
    seccompProfile:
      type: RuntimeDefault
    readOnlyRootFilesystem: false
  containerName: controller
  containerPort:
    http: 80
    https: 443
  config: {}
  configAnnotations: {}
  proxySetHeaders: {}
  addHeaders: {}
  dnsConfig: {}
  hostAliases: []
  hostname: {}
  dnsPolicy: ClusterFirstWithHostNet
  reportNodeInternalIp: true
  watchIngressWithoutClass: false
  ingressClassByName: false
  enableTopologyAwareRouting: false
  disableLeaderElection: false
  electionTTL: ""
  allowSnippetAnnotations: false
  hostNetwork: true
  hostPort:
    enabled: false
    ports:
      http: 80
      https: 443
  networkPolicy:
    enabled: false
  electionID: ""
  ingressClassResource:
    name: nginx
    enabled: true
    default: false
    annotations: {}
    controllerValue: k8s.io/ingress-nginx
    aliases: []
    parameters: {}
  ingressClass: nginx
  podLabels: {}

  podSecurityContext: {}
  sysctls: {}
  containerSecurityContext: {}
  publishService:
    enabled: false
    pathOverride: ""
  scope:
    enabled: false
    namespace: ""
    namespaceSelector: ""
  configMapNamespace: ""
  tcp:
    configMapNamespace: ""
    annotations: {}
  udp:
    configMapNamespace: ""
    annotations: {}
  maxmindLicenseKey: ""
  extraArgs: 
    update-status: "false"

  extraEnvs: []

  kind: Deployment
  annotations: {}

  labels: {}

  updateStrategy: {}

  progressDeadlineSeconds: 0
  minReadySeconds: 0
  tolerations: []

  affinity: {}


  topologySpreadConstraints: []

  terminationGracePeriodSeconds: 300
  nodeSelector:
    kubernetes.io/os: linux
  livenessProbe:
    httpGet:
      path: "/healthz"
      port: 10254
      scheme: HTTP
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 1
    successThreshold: 1
    failureThreshold: 5
  readinessProbe:
    httpGet:
      path: "/healthz"
      port: 10254
      scheme: HTTP
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 1
    successThreshold: 1
    failureThreshold: 3
  healthCheckPath: "/healthz"
  healthCheckHost: ""
  podAnnotations: {}
  replicaCount: 1
  minAvailable: 1
  unhealthyPodEvictionPolicy: ""
  resources:
    requests:
      cpu: 100m
      memory: 90Mi
  autoscaling:
    enabled: false
    annotations: {}
    minReplicas: 1
    maxReplicas: 11
    targetCPUUtilizationPercentage: 50
    targetMemoryUtilizationPercentage: 50
    behavior: {}
  autoscalingTemplate: []

  keda:
    apiVersion: "keda.sh/v1alpha1"
    enabled: false
    minReplicas: 1
    maxReplicas: 11
    pollingInterval: 30
    cooldownPeriod: 300
    restoreToOriginalReplicaCount: false
    scaledObject:
      annotations: {}
    triggers: []

    behavior: {}
  enableMimalloc: true
  customTemplate:
    configMapName: ""
    configMapKey: ""
  service:
    enabled: false
    external:
      enabled: false
    annotations: {}
    labels: {}
    type: ClusterIP 
    clusterIP: ""
    externalIPs: []
    loadBalancerIP: ""
    loadBalancerSourceRanges: []
    loadBalancerClass: ""

    externalTrafficPolicy: ""
    sessionAffinity: ""

    ipFamilyPolicy: SingleStack
    ipFamilies:
      - IPv4
    enableHttp: true
    enableHttps: true
    ports:
      http: 80
      https: 443
    targetPorts:
      http: http
      https: https
    appProtocol: true
    nodePorts:
      http: ""
      https: ""
      tcp: {}
      udp: {}
    internal:
      enabled: false
      annotations: {}
      type: ""
      clusterIP: ""
      externalIPs: []
      loadBalancerIP: ""
      loadBalancerSourceRanges: []
      loadBalancerClass: ""

      externalTrafficPolicy: ""
      sessionAffinity: ""

      ipFamilyPolicy: SingleStack
      ipFamilies:
        - IPv4
      ports: {}

      targetPorts: {}

      appProtocol: true
      nodePorts:
        http: ""
        https: ""
        tcp: {}
        udp: {}
  shareProcessNamespace: false
  extraContainers: []

  extraVolumeMounts: []

  extraVolumes: []

  extraInitContainers: []

  extraModules: []

  admissionWebhooks:
    name: admission
    annotations: {}

    enabled: true
    extraEnvs: []
    failurePolicy: Fail
    port: 8443
    certificate: "/usr/local/certificates/cert"
    key: "/usr/local/certificates/key"
    namespaceSelector: {}
    objectSelector: {}
    labels: {}
    service:
      annotations: {}
      externalIPs: []
      loadBalancerSourceRanges: []
      servicePort: 443
      type: ClusterIP
    createSecretJob:
      name: create
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        allowPrivilegeEscalation: false
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop:
            - ALL
        readOnlyRootFilesystem: true
      resources: {}
    patchWebhookJob:
      name: patch
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        allowPrivilegeEscalation: false
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop:
            - ALL
        readOnlyRootFilesystem: true
      resources: {}
    patch:
      enabled: true
      image:
        image: ingress-nginx/kube-webhook-certgen
        tag: v1.5.0
      priorityClassName: ""
      podAnnotations: {}
      networkPolicy:
        enabled: false
      nodeSelector:
        kubernetes.io/os: linux
      tolerations: []
      labels: {}
      securityContext: {}
      rbac:
        create: true
      serviceAccount:
        create: true
        name: ""
        automountServiceAccountToken: true
    certManager:
      enabled: false
      rootCert:
        duration: ""
      admissionCert:
        duration: ""
  metrics:
    port: 10254
    portName: metrics
    enabled: false
    service:
      enabled: true
      annotations: {}
      labels: {}

      externalIPs: []
      loadBalancerSourceRanges: []
      servicePort: 10254
      type: ClusterIP
    serviceMonitor:
      enabled: false
      additionalLabels: {}
      annotations: {}
      namespace: ""
      namespaceSelector: {}
      scrapeInterval: 30s
      targetLabels: []
      relabelings: []
      metricRelabelings: []
    prometheusRule:
      enabled: false
      additionalLabels: {}
      annotations: {}
      rules: []
  lifecycle:
    preStop:
      exec:
        command:
          - /wait-shutdown
  priorityClassName: ""
revisionHistoryLimit: 10
defaultBackend:
  enabled: false
  name: defaultbackend
  image:
    image: defaultbackend-amd64
    tag: "1.5"
    pullPolicy: IfNotPresent
    runAsNonRoot: true
    runAsUser: 65534
    runAsGroup: 65534
    allowPrivilegeEscalation: false
    seccompProfile:
      type: RuntimeDefault
    readOnlyRootFilesystem: true
  extraArgs: {}
  serviceAccount:
    create: true
    name: ""
    automountServiceAccountToken: true
  extraEnvs: []
  port: 8080
  livenessProbe:
    failureThreshold: 3
    initialDelaySeconds: 30
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 5
  readinessProbe:
    failureThreshold: 6
    initialDelaySeconds: 0
    periodSeconds: 5
    successThreshold: 1
    timeoutSeconds: 5
  updateStrategy: {}

  minReadySeconds: 0
  tolerations: []

  affinity: {}


  topologySpreadConstraints: []
  podSecurityContext: {}
  containerSecurityContext: {}
  podLabels: {}

  nodeSelector:
    kubernetes.io/os: linux
  podAnnotations: {}
  replicaCount: 1
  minAvailable: 1
  unhealthyPodEvictionPolicy: ""
  resources: {}

  extraVolumeMounts: []

  extraVolumes: []

  extraConfigMaps: []

  autoscaling:
    annotations: {}
    enabled: false
    minReplicas: 1
    maxReplicas: 2
    targetCPUUtilizationPercentage: 50
    targetMemoryUtilizationPercentage: 50
  networkPolicy:
    enabled: false
  service:
    annotations: {}

    externalIPs: []
    loadBalancerSourceRanges: []
    servicePort: 80
    type: ClusterIP
  priorityClassName: ""
  labels: {}
rbac:
  create: true
  scope: false
serviceAccount:
  create: true
  name: ""
  automountServiceAccountToken: true
  annotations: {}
imagePullSecrets: []

tcp: {}

udp: {}

portNamePrefix: ""
dhParam: ""

安装部署

1
2
3
4
5
6
7
8
9
10
11
12
13
14
$ helm install ingress-nginx  -n ingress-nginx --create-namespace  -f values.yaml .

$ kubectl get all -n ingress-nginx
NAME                                            READY   STATUS    RESTARTS   AGE
pod/ingress-nginx-controller-5db47578f5-cvsv9   1/1     Running   0          51m

NAME                                         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
service/ingress-nginx-controller-admission   ClusterIP   10.96.215.211   <none>        443/TCP   51m

NAME                                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ingress-nginx-controller   1/1     1            1           51m

NAME                                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/ingress-nginx-controller-5db47578f5   1         1         1       51m

测试验证

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
$ cat test_ingress.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.24.0
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
spec:
  ingressClassName: nginx     
  rules:
  - host: nginx.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-service
            port:
              number: 80

测试

1
2
3
4
5
6
7
8
9
10
11
12
13
$ kubectl get ingress
NAME            CLASS   HOSTS               ADDRESS   PORTS   AGE
nginx-ingress   nginx   nginx.example.com             80      141m

$ curl -I  nginx.example.com
HTTP/1.1 200 OK
Date: Mon, 10 Mar 2025 09:51:34 GMT
Content-Type: text/html
Content-Length: 615
Connection: keep-alive
Last-Modified: Tue, 11 Apr 2023 01:45:34 GMT
ETag: "6434bbbe-267"
Accept-Ranges: bytes
K8S部署ingress-nginx主机模式
http://example.com/2025/03/10/K8S部署ingress-nginx/
作者
种田人
发布于
2025年3月10日
许可协议