创建并使用Nginx Ingress对外暴露服务

控制台

kubectl

1. 获取集群KubeConfig并通过kubectl工具连接集群。

2. 创建test-deployment-service.yaml文件。

   YAML文件示例

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: coffee
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: coffee
     template:
       metadata:
         labels:
           app: coffee
       spec:
         containers:
         - name: coffee
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: coffee-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: coffee
     type: ClusterIP
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: tea
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: tea
     template:
       metadata:
         labels:
           app: tea
       spec:
         containers:
         - name: tea
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: tea-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: tea
     type: ClusterIP

3. 创建Deployment和Service。

   kubectl apply -f test-deployment-service.yaml

4. 查看coffee和tea的创建进度。

   kubectl get deployment coffee tea

   预期输出：

   NAME     READY   UP-TO-DATE   AVAILABLE   AGE
   coffee   2/2     2            2           14m
   tea      2/2     2            2           14m

5. 查看coffee-svc和tea-svc服务。

   kubectl get service coffee-svc tea-svc

   预期输出：

   NAME         TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)   AGE
   coffee-svc   ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m
   tea-svc      ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m

控制台

kubectl

1. 登录数字证书管理服务控制台。在左侧导航栏，选择证书管理 > SSL证书管理。

2. 在正式证书或个人测试证书（原免费证书）页签，选中需要下载的证书，在证书列表左下方单击下载。

3. 在弹出的对话框，选择Nginx服务器类型下载证书包并解压。

4. 使用已下载的证书文件（.pem）和证书私钥文件（.key）创建保密字典。

   kubectl create secret tls nginx-ingress-tls --cert test-nginx-ingress.com.pem --key test-nginx-ingress.com.key -n default

5. 为test-nginx-ingress路由添加TLS配置。请将命令中的test-nginx-ingress.com替换为实际注册域名。

   kubectl patch ingress test-nginx-ingress -p '{"spec":{"tls":[{"hosts":["test-nginx-ingress.com"],"secretName":"nginx-ingress-tls"}]}}'

6. 请使用实际的弹性公网IP，验证通过HTTPS加密通信的方式访问域名及业务路径生效。

   curl -v -k https://8.xxx.xxx.117/coffee -H "Host: test-nginx-ingress.com"

   • 参数说明：

     • -v：显示详细的通信过程，包括TLS握手信息等。

     • -k（或 --insecure）：若使用自签名证书可以忽略证书验证。

   • 预期输出：

     ...
     *   Trying 8.xxx.xxx.117:443...
     * Connected to 8.xxx.xxx.117 (8.xxx.xxx.117) port 443
     * ALPN: curl offers h2,http/1.1
     * (304) (OUT), TLS handshake, Client hello (1):
     * (304) (IN), TLS handshake, Server hello (2):
     * (304) (IN), TLS handshake, Unknown (8):
     * (304) (IN), TLS handshake, Certificate (11):
     * (304) (IN), TLS handshake, CERT verify (15):
     * (304) (IN), TLS handshake, Finished (20):
     * (304) (OUT), TLS handshake, Finished (20):
     ...
     <title>Hello World</title>
     ...
     <p><span>Server&nbsp;address:</span> <span>10.xxx.xxx.159:80</span></p>
     <p><span>Server&nbsp;name:</span> <span>coffee-96d4bc87-6cstv</span></p>
     <p class="smaller"><span>Date:</span> <span>14/Aug/2025:09:27:42 +0000</span></p>
     <p class="smaller"><span>URI:</span> <span>/coffee</span></p>
     ...
         <div id="footer">
             <div id="center" align="center">
                 Request ID: fee5fe107106748a35d99a2dbbbc6652<br/>
                 &copy; NGINX, Inc. 2018
             </div>
         </div>
     ...