时间：2023-02-21 13:57:01 | 来源：建站知识
时间：2023-02-21 13:57:01 来源：建站知识
Kubernetes 泛域名动态 Service 转发解决方案：
在线咨询
*.test.imroc.io），现希望根据请求中不同 Host 转发到不同的后端 Service。比如 a.test.imroc.io 的请求被转发到 my-svc-a，b.test.imroc.io 的请求转发到 my-svc-bapiVersion: extensions/v1beta1kind: Ingressmetadata: name: my-ingressspec: rules: - host: a.test.imroc.io http: paths: - backend: serviceName: my-svc-a servicePort: 80 path: / - host: b.test.imroc.io http: paths: - backend: serviceName: my-svc-b servicePort: 80 path: /但是！如果 Host 非常多会怎样？（比如200+）* 号匹配到的字符跟 Service 的名字相关联（可以是相等，或者 Service 统一在前面加个前缀，比如 a.test.imroc.io 转发到 my-svc-a 这个 Service)，集群内起一个反向代理服务，匹配泛域名的请求全部转发到这个代理服务上，这个代理服务只做一件简单的事，解析 Host，正则匹配抓取泛域名中 * 号这部分，把它转换为 Service 名字，然后在集群里转发（集群 DNS 解析)proxy_pass 来反向代理到后端服务，proxy_pass 后面跟的变量，我们需要用 lua 来判断 Host 修改变量proxy_pass 后面跟的如果是可变的域名（非IP，需要 dns 解析)，它需要一个域名解析器，不会走默认的 dns 解析，需要在 nginx.conf 里添加 resolver 配置项来设置一个外部的 dns 解析器nginx.conf 里关键的配置如下图所示：proxy.yaml:apiVersion: apps/v1beta1kind: Deploymentmetadata: labels: component: nginx name: proxyspec: replicas: 1 selector: matchLabels: component: nginx template: metadata: labels: component: nginx spec: containers: - name: nginx image: "openresty/openresty:centos" ports: - name: http containerPort: 80 protocol: TCP volumeMounts: - mountPath: /usr/local/openresty/nginx/conf/nginx.conf name: config subPath: nginx.conf - name: dnsmasq image: "janeczku/go-dnsmasq:release-1.0.7" args: - --listen - "127.0.0.1:53" - --default-resolver - --append-search-domains - --hostsfile=/etc/hosts - --verbose volumes: - name: config configMap: name: configmap-nginx---apiVersion: v1kind: ConfigMapmetadata: labels: component: nginx name: configmap-nginxdata: nginx.conf: |- worker_processes 1; error_log /error.log; events { accept_mutex on; multi_accept on; use epoll; worker_connections 1024; } http { include mime.types; default_type application/octet-stream; log_format main '$time_local $remote_user $remote_addr $host $request_uri $request_method $http_cookie ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for" ' '$request_time $upstream_response_time "$upstream_cache_status"'; log_format browser '$time_iso8601 $cookie_km_uid $remote_addr $host $request_uri $request_method ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for" ' '$request_time $upstream_response_time "$upstream_cache_status" $http_x_requested_with $http_x_real_ip $upstream_addr $request_body'; log_format client '{"@timestamp":"$time_iso8601",' '"time_local":"$time_local",' '"remote_user":"$remote_user",' '"http_x_forwarded_for":"$http_x_forwarded_for",' '"host":"$server_addr",' '"remote_addr":"$remote_addr",' '"http_x_real_ip":"$http_x_real_ip",' '"body_bytes_sent":$body_bytes_sent,' '"request_time":$request_time,' '"status":$status,' '"upstream_response_time":"$upstream_response_time",' '"upstream_response_status":"$upstream_status",' '"request":"$request",' '"http_referer":"$http_referer",' '"http_user_agent":"$http_user_agent"}'; access_log /access.log main; sendfile on; keepalive_timeout 120s 100s; keepalive_requests 500; send_timeout 60000s; client_header_buffer_size 4k; proxy_ignore_client_abort on; proxy_buffers 16 32k; proxy_buffer_size 64k; proxy_busy_buffers_size 64k; proxy_send_timeout 60000; proxy_read_timeout 60000; proxy_connect_timeout 60000; proxy_cache_valid 200 304 2h; proxy_cache_valid 500 404 2s; proxy_cache_key $host$request_uri$cookie_user; proxy_cache_methods GET HEAD POST; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Frame-Options SAMEORIGIN; server_tokens off; client_max_body_size 50G; add_header X-Cache $upstream_cache_status; autoindex off; resolver 127.0.0.1:53 ipv6=off; server { listen 80; location / { set $service ''; rewrite_by_lua ' local host = ngx.var.host local m = ngx.re.match(host, "(.+).test.imroc.io") if m then ngx.var.service = "my-svc-" .. m[1] end '; proxy_pass http://$service; } } }让该代理服务暴露公网访问可以用 Service 或 Ingressservice.yaml):apiVersion: v1kind: Servicemetadata: labels: component: nginx name: service-nginxspec: type: LoadBalancer ports: - name: http port: 80 targetPort: http selector: component: nginx用 Ingress 的示例 (ingress.yaml):apiVersion: extensions/v1beta1kind: Ingressmetadata: name: ingress-nginxspec: rules: - host: "*.test.imroc.io" http: paths: - backend: serviceName: service-nginx servicePort: 80 path: /关键词：解决,方案,动态
