Use Kourier Ingress in Knative for traffic distribution-Container Compute Service(ACS)-阿里云帮助中心

Kourier is a lightweight ingress controller for Knative based on the Envoy proxy. As an open-source implementation from the Knative community, Kourier routes traffic to Knative Revisions and supports features such as gRPC services, timeouts and retries, TLS certificates, and external authentication and authorization.

Prerequisites

You have deployed Knative in the ACS cluster.
You have enabled DNS-based service discovery for the ACK cluster. For more information, see DNS overview and the CoreDNS component.

Step 1: Deploy Kourier Ingress

Log on to the ACS console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Applications > Knative.
On the Add-ons tab, click Deploy Knative, select the Kourier ingress, and follow the on-screen instructions.

Step 2: Access a service via Kourier Ingress

This section shows you how to create a helloworld-go service and access it over HTTP or HTTPS via Kourier Ingress.

HTTP access

Log on to the ACS console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Applications > Knative.

On the Knative page, click the Services tab. Set Namespace to default, click Create from Template, paste the following YAML sample into the template editor, and then click Create.

This creates a service named helloworld-go.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld-go
spec:
  template:
    spec:
      containers:
      - image: registry.cn-hangzhou.aliyuncs.com/knative-sample/helloworld-go:73fbdd56
        env:
        - name: TARGET
          value: "Knative"

A Status of Success indicates that the service is deployed.

On the Services tab, find the helloworld-go service and obtain its domain name from the Default Domain column and its gateway IP address from the Gateway column.

Run the following command to access the helloworld-go service.

curl -H "Host: helloworld-go.default.example.com" http://8.141.XX.XX # Replace the IP address and domain with your actual values.

Expected output:

Hello Knative!

HTTPS access

Log on to the ACS console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Applications > Knative.

This creates a service named helloworld-go.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: helloworld-go
spec:
  template:
    spec:
      containers:
      - image: registry.cn-hangzhou.aliyuncs.com/knative-sample/helloworld-go:73fbdd56
        env:
        - name: TARGET
          value: "Knative"

A Status of Success indicates that the service is deployed.

Create a certificate.

Run the following commands to generate a TLS certificate.

openssl genrsa -out tls.key 4096
openssl req -subj "/CN=*.example.com/L=*.example.com" -sha256  -new -key tls.key -out tls.csr
echo subjectAltName = DNS:helloworld-go.default.example.com,DNS:helloworld-go.default.example.cn > extfile.cnf
openssl x509 -req -days 3650 -sha256 -in tls.csr -signkey tls.key -out tls.crt -extfile extfile.cnf

Run the following command to create a Secret in the cluster from the generated TLS certificate files.
```
kubectl -n knative-serving create secret tls kourier-cert --key tls.key --cert tls.crt
```

Run the following command to check if a Deployment named net-kourier-controller exists in the knative-serving namespace.
```
kubectl get deployments -n knative-serving
```
Run the following command to configure the certificate information.
```
kubectl -n knative-serving edit deployment net-kourier-controller
```
In the configuration editor for net-kourier-controller, set the following environment variables.
- CERTS_SECRET_NAMESPACE: The namespace that contains the certificate Secret.
- CERTS_SECRET_NAME: The name of the certificate Secret.
```
...
   spec:
      containers:
      - env:
        - name: CERTS_SECRET_NAMESPACE
          value: knative-serving 
        - name: CERTS_SECRET_NAME
          value: kourier-cert
...
```
After you save the configuration, you can run the following command to check the status of the net-kourier-controller pod.
```
kubectl -n knative-serving get po
```
Expected output:
```
NAME                               READY   STATUS    RESTARTS   AGE
net-kourier-controller-******   1/1     Running   0          10s
```

Run the following command to access the service over HTTPS with the certificate.

curl -H "Host: helloworld-go.default.example.com" -k --cert tls.crt --key tls.key https://8.141.XX.XX # Replace the IP address and domain with your actual values.