Azure上的nginx入口设置（不使用helm）疑难解答

我需要一些帮助来实现这两件事：

在AKS上设置我的nginx ingress控制器而不使用helm（我不想）

使我的入口使用资源名为“kubernetes IP”的已保留IP地址

对于第一步，我将不幸运地遵循此文档：

而且我没有忘记强制性的.yaml

我的分步指南：

我有一个基本的kubernetes集群和两个吊舱，如下所示：

NAME                              READY   STATUS    RESTARTS   AGE
activemq-demo-7b769bcc4-jtsj5     1/1     Running   0          55m
ubuntu-dcb9c6ccb-wkz2w            1/1     Running   0          2d

此时，我想添加入口，以便使用我的公共ip地址a.b.c.d访问演示activemq

完成后，我运行kubectl get services-n ingress nginx

NAME            TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                      AGE
ingress-nginx   LoadBalancer   10.0.186.143   zz.zz.zzz.zzz   80:32703/TCP,443:30584/TCP   17s

这很好！看起来工作正常吗？此时，我应该能够连接到这些端口中的任何一个的外部ip地址，但我不能：(

我知道mandatory.yaml对我的保留IP地址一无所知，但我忽略了它，因为我有一个更大的问题，我无法连接

我还忽略了一分钟，即如果我需要运行实际的ingres.yaml，我无法连接测试。因此我使用kubectl apply-f ingres.html（ingres.yaml包含以下代码）

之后，如果我跑kubectl得到ing我得到：

NAME       HOSTS                    ADDRESS         PORTS     AGE
ingress1   amq-test.mydomain.com   zz.zz.zzz.zzz   80, 443   66s

但还是一样，我无法连接：

来自WSL

$ telnet zz.zz.zzz.zzz 80
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

$ telnet zz.zz.zzz.zzz 443
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

$ telnet zz.zz.zzz.zzz 80
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

$ telnet zz.zz.zzz.zzz 443
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

老实说，我不确定我遗漏了什么，这应该是非常直接的官方文档，我不知道我是否必须在Azure中启用其他东西

感谢阅读，任何帮助都将不胜感激

编辑2020年3月7日：activemq演示部署与服务@Jean-Philippe Bond

apiVersion: apps/v1
kind: Deployment
metadata:
  name: activemq-demo
  labels:
    app: activemq-demo
    tier: backend
spec:
  revisionHistoryLimit: 1
  replicas: 1
  selector:
    matchLabels:
      app: activemq-demo
  template:
    metadata:
      labels:
        app: activemq-demo
        tier: backend
    spec:
      containers:
      - name: activemq-demo
        image: myproject.azurecr.io/activemq-slim:5.15.9-3
        imagePullPolicy: "Always"
        command: ["/start.sh"]
        args: ["somename"]
        env:
        - name: LANG
          value: "C.UTF-8"
        ports:
        - containerPort: 8161
        - containerPort: 61616
        livenessProbe:
          exec:
            command:
            - /isAlive.sh
            - somename
          initialDelaySeconds: 15
          periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: activemq-demo-service
  labels:
    tier: controller
spec:
  type: NodePort
  ports:
    - name: http
      protocol: TCP
      port: 8161
      targetPort: 8161
    - name: acceptor
      protocol: TCP
      port: 61616
      targetPort: 61616
  selector:
    app: activemq-demo
    tier: backend

请注意，我只想从外部访问ActiveMQ默认在端口8161上提供的HTTP web服务

编辑2020年3月9日：@HelloWorld请求

来自WSL的telnet

$ telnet zz.zz.zzz.zzz 80
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

$ telnet zz.zz.zzz.zzz 443
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

$ telnet zz.zz.zzz.zzz 80
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

$ telnet zz.zz.zzz.zzz 443
Trying zz.zz.zzz.zzz...
(a long time later...)
telnet: Unable to connect to remote host: Resource temporarily unavailable

来自macos的telnet

$ telnet zz.zz.zzz.zzz 80
Trying zz.zz.zzz.zzz...
telnet: connect to address zz.zz.zzz.zzz: Operation timed out
telnet: Unable to connect to remote host

$ telnet zz.zz.zzz.zzz 443
Trying zz.zz.zzz.zzz...
telnet: connect to address zz.zz.zzz.zzz: Operation timed out
telnet: Unable to connect to remote host

来自macos的卷曲-HTTP

$ curl -v -X GET http://amq-test.mydomain.com
Note: Unnecessary use of -X or --request, GET is already inferred.
*   Trying zz.zz.zzz.zzz:80...
* TCP_NODELAY set
* Connection failed
* connect to zz.zz.zzz.zzz port 80 failed: Operation timed out
* Failed to connect to amq-test.mydomain.com port 80: Operation timed out
* Closing connection 0
curl: (7) Failed to connect to amq-test.mydomain.com port 80: Operation timed out

来自macos的卷曲-HTTPS

$ curl -v -X GET https://amq-test.mydomain.com
Note: Unnecessary use of -X or --request, GET is already inferred.
*   Trying zz.zz.zzz.zzz:443...
* TCP_NODELAY set
* Connection failed
* connect to zz.zz.zzz.zzz port 443 failed: Operation timed out
* Failed to connect to amq-test.mydomain.com port 443: Operation timed out
* Closing connection 0
curl: (7) Failed to connect to amq-test.mydomain.com port 443: Operation timed out

编辑2020年3月10日：从头开始（多次）

我删除了整件事，开始“新鲜”，没有更多的运气，但我注意到一些事情，希望能引发一些想法在那里

基本要素：

• 我已经有一个正在使用的资源组：MyResourceGroup
• 我已经有一个带有子网的虚拟网络MyVirtualNet
• 我已经保留了一个用于入口的公共IP地址，这是一个静态IP，我希望在时间结束前阻止更改（或删除）：a.B.C.D
• 我已经有了自己的域名，我已经将其路由到A.B.C.D:amq test.mydomain.com

我的程序：

我正在使用Azure Web界面创建一个新的Kubernetes服务，我要确保选择我的资源组以及虚拟网络和子网

当我创建基本Kubernetes服务时，我注意到它创建了一个具有不同公共IP地址（我无法控制）的负载平衡器，我认为这是因为该IP地址将被用作kubectl和远程管理之类的主要入口点

通过集群live，我创建了我之前共享的基本ActiveMQ映像

现在，我从入口nginx开始，部署

然后我添加了Azure服务yaml，但这次做了两次修改，使其使用我的公共IP地址

在无错误运行的情况下，一切正常：

我部署了最后一部分，对吗？我的入口。yaml：

这运行时没有问题，当我检查时：

$ kubectl describe ingress
Name:             ingress1
Namespace:        default
Address:          A.B.C.D
Default backend:  default-http-backend:80 (<none>)
Rules:
  Host  Path  Backends
  ----  ----  --------
  *
        /*   queue-callbacks-service:8161 (10.94.20.14:8161)
Annotations:
  kubernetes.io/ingress.class:                         nginx
  nginx.ingress.kubernetes.io/cors-allow-credentials:  true
  nginx.ingress.kubernetes.io/cors-allow-methods:      *
  nginx.ingress.kubernetes.io/cors-allow-origin:       *
  nginx.ingress.kubernetes.io/enable-cors:             true
  kubectl.kubernetes.io/last-applied-configuration:    {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{"kubernetes.io/ingress.class":"nginx","nginx.ingress.kubernetes.io/cors-allow-credentials":"true","nginx.ingress.kubernetes.io/cors-allow-methods":"*","nginx.ingress.kubernetes.io/cors-allow-origin":"*","nginx.ingress.kubernetes.io/enable-cors":"true"},"name":"ingress1","namespace":"default"},"spec":{"rules":[{"http":{"paths":[{"backend":{"serviceName":"queue-callbacks-service","servicePort":8161},"path":"/callbacks/*"}]}}]}}

Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  CREATE  35m   nginx-ingress-controller  Ingress default/ingress1
  Normal  UPDATE  34m   nginx-ingress-controller  Ingress default/ingress1

---

ActiveMQ

可以通过

TCP

访问，而不是

HTTP

和Kubernetes入口并不是为了支持

TCP

服务而构建的。也就是说，

Nginx

确实支持

TCP

负载平衡，如果您真的想使用它，但您将无法像以前那样使用基于主机的入口规则ce这是为

HTTP/HTTPS

保留的。您最好的选择可能是直接使用Azure L4负载平衡器，而不是通过入口控制器

如果要使用

Nginx

，则需要修改

mandatory.yaml

中的

yaml

以公开

Nginx

部署上的

ActiveMQ

端口

kind: ConfigMap
apiVersion: v1
metadata:
  name: tcp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
data:
  9000: "default/activemq-demo-service:8161"

您还需要在服务资源上添加

tcp服务

端口。例如：

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  type: LoadBalancer
  ports:
    - name: http
      port: 80
      targetPort: 80
      protocol: TCP
    - name: https
      port: 443
      targetPort: 443
      protocol: TCP
    - name: proxied-tcp-9000
      port: 9000
      targetPort: 9000
      protocol: TCP
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

---

以下是Nginx Ingress中TCP/UDP支持的主要功能。

我不久前写了一篇可能对您有用的文章：

好的观点，但是我并不试图访问ActiveMQ来通过TCP发布或使用消息，我试图访问他的web控制台（http）如果您在本地运行它并从web浏览器访问它，您会这样做。您不能使用外部ip地址，因为您的入口规则基于主机。在执行重定向之前，Nginx正在检查主机头是否与amq-test.mydomain.com匹配。请尝试删除主机，并仅使用入口规则上的路径检查它是否工作。W我会尝试一下，但是我拥有这个域，并且有一个指向我的外部IP地址的条目。你能为ActiveMQ添加部署和服务吗？当然，很抱歉我的延迟：）。我将在几分钟内添加一个包含信息的编辑。您使用WSL吗？curl是否会导致与telnet相同的错误？如果是，请将

curl-v amq test.mydomain.com

的输出添加到您的question@HelloWorld是的，当时我正在使用WSL，我只是添加了您要求的信息（使用macos，因为我现在在不同的位置）。谢谢你的评论你检查Azure上的防火墙规则了吗？通告"ti行动

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress1
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "*"
    nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
    nginx.ingress.kubernetes.io/cors-allow-methods: "*"
spec:
  rules:
  - http:
      paths:
      - path: /*
        backend:
          serviceName: activemq-demo-service
          servicePort: 8161

$ kubectl describe ingress
Name:             ingress1
Namespace:        default
Address:          A.B.C.D
Default backend:  default-http-backend:80 (<none>)
Rules:
  Host  Path  Backends
  ----  ----  --------
  *
        /*   queue-callbacks-service:8161 (10.94.20.14:8161)
Annotations:
  kubernetes.io/ingress.class:                         nginx
  nginx.ingress.kubernetes.io/cors-allow-credentials:  true
  nginx.ingress.kubernetes.io/cors-allow-methods:      *
  nginx.ingress.kubernetes.io/cors-allow-origin:       *
  nginx.ingress.kubernetes.io/enable-cors:             true
  kubectl.kubernetes.io/last-applied-configuration:    {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{"kubernetes.io/ingress.class":"nginx","nginx.ingress.kubernetes.io/cors-allow-credentials":"true","nginx.ingress.kubernetes.io/cors-allow-methods":"*","nginx.ingress.kubernetes.io/cors-allow-origin":"*","nginx.ingress.kubernetes.io/enable-cors":"true"},"name":"ingress1","namespace":"default"},"spec":{"rules":[{"http":{"paths":[{"backend":{"serviceName":"queue-callbacks-service","servicePort":8161},"path":"/callbacks/*"}]}}]}}

Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  CREATE  35m   nginx-ingress-controller  Ingress default/ingress1
  Normal  UPDATE  34m   nginx-ingress-controller  Ingress default/ingress1

$ nmap -Pn zz.zz.zz.zzz -p 80,443
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-15 11:01 Pacific SA Standard Time

Nmap scan report for zz.zz.zz.zzz
Host is up.

PORT    STATE    SERVICE
80/tcp  filtered http
443/tcp filtered https

Nmap done: 1 IP address (1 host up) scanned in 4.62 seconds

kind: ConfigMap
apiVersion: v1
metadata:
  name: tcp-services
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
data:
  9000: "default/activemq-demo-service:8161"

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  type: LoadBalancer
  ports:
    - name: http
      port: 80
      targetPort: 80
      protocol: TCP
    - name: https
      port: 443
      targetPort: 443
      protocol: TCP
    - name: proxied-tcp-9000
      port: 9000
      targetPort: 9000
      protocol: TCP
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx