部署

移除 traefik

修改 systemd

systemctl edit --full k3s

编辑下面这行，增加 --disable=traefik

ExecStart=/usr/local/bin/k3s \
    server --disable=traefik

重启服务

systemctl restart k3s

部署 ingress-nginx

创建 ingress-nginx.yaml

apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: ingress-nginx
  namespace: kube-system
spec:
  chart: https://github.com/kubernetes/ingress-nginx/releases/download/helm-chart-4.13.3/ingress-nginx-4.13.3.tgz
#  repo:  https://helm-charts.itboon.top/ingress-nginx
#  chart: ingress-nginx
  version: 4.13.3
  set:
    controller.service.type: "LoadBalancer"
    controller.replicaCount: "1"
    global.image.registry: "k8s.nju.edu.cn"

注：若 chart 拉取失败可以考虑使用镜像仓库。

部署

kubectl -f ingress-nginx.yaml

配置 HTTPS

1.申请证书
略

2.生成secret

kubectl create secret tls nginx-tls-secret \
  --cert=tls.crt \
  --key=tls.key \
  -n kube-system

3.修改 ingress-nginx.yaml

apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: ingress-nginx
  namespace: kube-system
spec:
  chart: https://xxxx/ingress-nginx-4.13.3.tgz
  version: 4.13.3
  set:
    controller.service.type: "LoadBalancer"
    controller.replicaCount: "1"
    global.image.registry: "k8s.nju.edu.cn"
    controller.extraArgs.default-ssl-certificate: "kube-system/nginx-tls-secret" # 新增

4.重新部署

kubectl -f ingress-nginx.yaml

k3s ingress 服务架构说明

L4 层负载均衡

• 服务名称: svclb-ingress-nginx-controller-037bed5e-tzwzx
• 工作层级: L4（传输层）
• 部署方式: 每个节点部署一个实例
• 主要职责: 拦截节点流量并转发至 L7 层的 Ingress Controller

L7 层 Ingress 控制器

• 服务名称: ingress-nginx-con troller-589bfd97d9-zh6vc
• 工作层级: L7（应用层）
• 部署方式: 单一实例（高可用场景可扩展）
• 主要职责: 根据域名将流量路由至对应的后端服务

流量流向

客户端请求 → L4 负载均衡 → L7 Ingress Controller → 后端服务

路由配置

示例1：部署 rabbitmq

部署 rabbitmq 服务：rabbitmq.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: msq
---
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: rabbitmq
  namespace: kube-system
spec:
  repo: https://helm-charts.itboon.top/bitnami
  chart: rabbitmq
  version: 16.0.14
  targetNamespace: msq
  #set:
    #global.imageRegistry: docker.m.daocloud.io
  valuesContent: |-
    communityPlugins: "https://github.com/rabbitmq/rabbitmq-delayed-message-exchange/releases/download/v4.1.0/rabbitmq_delayed_message_exchange-4.1.0.ez"
    extraPlugins: "rabbitmq_auth_backend_ldap rabbitmq_delayed_message_exchange"
    auth:
      username: xxxx
      password: aaaa

配置路由：rabbitmq-ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rabbitmq-management-ingress
  namespace: msq
spec:
  ingressClassName: nginx
  rules:
  - host: xxx-rabbitmq.domain.com
    http:
      paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: rabbitmq
              port:
                number: 15672

示例2：部署静态网站

准备静态文件：/www/plane/index.html, /www/plane/js/**, /www/plane/css/** 等

准备通用的 nginx 配置文件：spa.nginx.conf

server {
    listen 80 default_server;
    #listen  [::]:80;
    gzip_static on;
    gzip_proxied  any;
    root   /usr/share/nginx/html;
    location / {
        index  index.html index.htm;
        try_files $uri $uri/ /index.html;
    }
    location = /index.html {
        expires -1;
    }
    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|js|css)$ {
        expires 14d;
    }
}

部署 webapp 服务：plweb.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: plweb-deploy
  namespace: xxxx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: plweb
  template:
    metadata:
      labels:
        app: plweb
    spec:
      containers:
      - name: plweb
        image: nginx:alpine
        ports:
        - containerPort: 80
        volumeMounts:
        - name: plweb
          mountPath: /usr/share/nginx/html
        - name: nginxconf
          mountPath: /etc/nginx/conf.d/default.conf
      volumes:
      - name: plweb
        hostPath:
          path: /www/plane
          type: Directory
      - name: nginxconf
        hostPath:
          path: /www/spa.nginx.conf
          type: File
---
apiVersion: v1
kind: Service
metadata:
  name: plweb-svc
  namespace: xxxx
spec:
  selector:
    app: plweb
  ports:
  - port: 80
    targetPort: 80

配置路由：webapp-ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
  namespace: xxxx
spec:
  ingressClassName: nginx
  rules:
  - host: xx.xxx.com
    http:
      paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: plweb-svc
              port:
                number: 80

示例3：kubernetes-dashboard

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: k8s-dashboard-ingress
  namespace: kubernetes-dashboard
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/ssl-verify: "false"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
  - host: k8s-dashboard.xxxx.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port:
              number: 443