实践Kong for Kubernetes（K8S）

商飞尘

2023-12-01

使用以下安装方法之一安装Kong for Kubernetes：

YAML清单

要通过部署Kong kubectl，请使用：

kubectl apply -f https://bit.ly/kong-ingress-dbless复制复制

重要！这不是生产级部署。根据您的用例调整“参数”：

副本：确保您正在运行Kong的多个实例，以防止由于单个节点故障而造成的中断。
性能优化：调整Kong的内存设置，并根据使用情况定制部署。
负载均衡器：确保在Kong前面运行基于4层或TCP的均衡器。这使Kong可以提供TLS证书并与证书管理器集成。

helm部署

Kong有一个官方的Helm Chart。要将Kong部署到带有Helm的Kubernetes集群上，请使用：

$ helm repo add kong https://charts.konghq.com
$ helm repo update

# Helm 2
$ helm install kong/kong

# Helm 3
$ helm install kong/kong --generate-name --set ingressController.installCRDs=false复制复制

Kustomize

可以使用Kubernetes的kustomize声明性地修补Kong的Kubernetes清单。远程定制构建的一个示例是：

kustomize build github.com/kong/kubernetes-ingress-controller/deploy/manifests/base复制复制

在Kong的存储库中可以使用Kustomization 进行不同类型的部署。

如果您正在使用云提供商将Kong安装在托管的Kubernetes产品上，例如Google Kubernetes Engine（GKE），Amazon EKS（EKS），Azure Kubernetes Service（AKS）等，请确保已设置Kubernetes群集在云提供程序上，并已kubectl在您的工作站上进行了配置。

一旦您配置了Kubernetes集群并配置了kubectl，任何云提供商的安装都将使用上述方法之一（YAML manifests，Helm Chart或Kustomize）来安装Kong。

每个云提供商在允许如何配置特定资源（例如负载均衡器，存储卷等）方面都有一些细微的不同。我们建议您参考其文档来调整这些设置。

如果您使用的是数据库，我们建议您在Kubernetes内部以内存模式（也称为无DB）运行Kong，因为所有配置都存储在Kubernetes控制面板中。此设置简化了Kong的操作，因此无需担心数据库的设置，备份，可用性，安全性等。如果您决定使用数据库，建议您在Kubernetes之外运行数据库。您可以从云提供商使用Amazon RDS之类的服务或类似的托管Postgres服务来自动执行数据库操作。

我们不建议在Kubernetes部署中将Kong与Cassandra一起使用，因为Kong的Cassandra使用所涵盖的功能是通过Kubernetes中的其他方式处理的。

通过浏览器打开官方下载地址https://bit.ly/kong-ingress-dbless，下载对应的yaml文件

wget https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/master/deploy/single/all-in-one-dbless.yaml
当前kong:2.1，kong-ingress-controller:0.9.1，修改service配置为NodePort，默认是LoadBalancer，整体配置文件如下：

[root@localhost kong-gateway]# cat all-in-one-dbless.yaml
apiVersion: v1
kind: Namespace
metadata:

name: kong

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: kongclusterplugins.configuration.konghq.com
spec:
additionalPrinterColumns:
- JSONPath: .plugin
  description: Name of the plugin
  name: Plugin-Type
  type: string
- JSONPath: .metadata.creationTimestamp
  description: Age
  name: Age
  type: date
- JSONPath: .disabled
  description: Indicates if the plugin is disabled
  name: Disabled
  priority: 1
  type: boolean
- JSONPath: .config description: Configuration of the plugin name: Config priority: 1 type: string group: configuration.konghq.com names: kind: KongClusterPlugin plural: kongclusterplugins shortNames:
  - kcp scope: Cluster validation: openAPIV3Schema: properties: config: type: object configFrom: properties: secretKeyRef: properties: key: type: string name: type: string namespace: type: string required: - name - namespace - key type: object type: object disabled: type: boolean plugin: type: string protocols: items: enum: - http - https - grpc - grpcs - tcp - tls type: string type: array run_on: enum:
    - first
    - second
    - all type: string required:
      - plugin
version: v1

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: kongconsumers.configuration.konghq.com
spec:
additionalPrinterColumns:
- JSONPath: .username
  description: Username of a Kong Consumer
  name: Username
  type: string
- JSONPath: .metadata.creationTimestamp description: Age name: Age type: date group: configuration.konghq.com names: kind: KongConsumer plural: kongconsumers shortNames:
  - kc
    scope: Namespaced
    validation:
    openAPIV3Schema:
    properties:
    credentials:
    items:
    type: string
    type: array
    custom_id:
    type: string
    username:
    type: string
version: v1

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: kongcredentials.configuration.konghq.com
spec:
additionalPrinterColumns:
- JSONPath: .type
  description: Type of credential
  name: Credential-type
  type: string
- JSONPath: .metadata.creationTimestamp
  description: Age
  name: Age
  type: date
- JSONPath: .consumerRef description: Owner of the credential name: Consumer-Ref type: string group: configuration.konghq.com names: kind: KongCredential plural: kongcredentials scope: Namespaced validation: openAPIV3Schema: properties: consumerRef: type: string type: type: string required:
  - consumerRef
  - type
version: v1

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: kongingresses.configuration.konghq.com
spec:
group: configuration.konghq.com
names:
kind: KongIngress
plural: kongingresses
shortNames:
- ki
scope: Namespaced
validation:
openAPIV3Schema:
properties:
proxy:
properties:
connect_timeout:
minimum: 0
type: integer
path:
pattern: ^/.$ type: string protocol: enum: - http - https - grpc - grpcs - tcp - tls type: string read_timeout: minimum: 0 type: integer retries: minimum: 0 type: integer write_timeout: minimum: 0 type: integer type: object route: properties: headers: additionalProperties: items: type: string type: array type: object https_redirect_status_code: type: integer methods: items: type: string type: array path_handling: enum: - v0 - v1 type: string preserve_host: type: boolean protocols: items: enum: - http - https - grpc - grpcs - tcp - tls type: string type: array regex_priority: type: integer strip_path: type: boolean upstream: properties: algorithm: enum: - round-robin - consistent-hashing - least-connections type: string hash_fallback: type: string hash_fallback_header: type: string hash_on: type: string hash_on_cookie: type: string hash_on_cookie_path: type: string hash_on_header: type: string healthchecks: properties: active: properties: concurrency: minimum: 1 type: integer healthy: properties: http_statuses: items: type: integer type: array interval: minimum: 0 type: integer successes: minimum: 0 type: integer type: object http_path: pattern: ^/.$
type: string
timeout:
minimum: 0
type: integer
unhealthy:
properties:
http_failures:
minimum: 0
type: integer
http_statuses:
items:
type: integer
type: array
interval:
minimum: 0
type: integer
tcp_failures:
minimum: 0
type: integer
timeout:
minimum: 0
type: integer
type: object
type: object
passive:
properties:
healthy:
properties:
http_statuses:
items:
type: integer
type: array
interval:
minimum: 0
type: integer
successes:
minimum: 0
type: integer
type: object
unhealthy:
properties:
http_failures:
minimum: 0
type: integer
http_statuses:
items:
type: integer
type: array
interval:
minimum: 0
type: integer
tcp_failures:
minimum: 0
type: integer
timeout:
minimum: 0
type: integer
type: object
type: object
threshold:
type: integer
type: object
host_header:
type: string
slots:
minimum: 10
type: integer
type: object

version: v1

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: kongplugins.configuration.konghq.com
spec:
additionalPrinterColumns:
- JSONPath: .plugin
  description: Name of the plugin
  name: Plugin-Type
  type: string
- JSONPath: .metadata.creationTimestamp
  description: Age
  name: Age
  type: date
- JSONPath: .disabled
  description: Indicates if the plugin is disabled
  name: Disabled
  priority: 1
  type: boolean
- JSONPath: .config description: Configuration of the plugin name: Config priority: 1 type: string group: configuration.konghq.com names: kind: KongPlugin plural: kongplugins shortNames:
  - kp scope: Namespaced validation: openAPIV3Schema: properties: config: type: object configFrom: properties: secretKeyRef: properties: key: type: string name: type: string required: - name - key type: object type: object disabled: type: boolean plugin: type: string protocols: items: enum: - http - https - grpc - grpcs - tcp - tls type: string type: array run_on: enum:
    - first
    - second
    - all type: string required:
      - plugin
version: v1

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tcpingresses.configuration.konghq.com
spec:
additionalPrinterColumns:
- JSONPath: .status.loadBalancer.ingress[*].ip
  description: Address of the load balancer
  name: Address
  type: string
- JSONPath: .metadata.creationTimestamp
  description: Age
  name: Age
  type: date
  group: configuration.konghq.com
  names:
  kind: TCPIngress
  plural: tcpingresses
  scope: Namespaced
  subresources:
  status: {}
  validation:
  openAPIV3Schema:
  properties:
  apiVersion:
  type: string
  kind:
  type: string
  metadata:
  type: object
  spec:
  properties:
  rules:
  items:
  properties:
  backend:
  properties:
  serviceName:
  type: string
  servicePort:
  format: int32
  type: integer
  type: object
  host:
  type: string
  port:
  format: int32
  type: integer
  type: object
  type: array
  tls:
  items:
  properties:
  hosts:
  items:
  type: string
  type: array
  secretName:
  type: string
  type: object
  type: array
  type: object
  status:
  type: object
  version: v1beta1
  status:
  acceptedNames:
  kind: ""
  plural: ""
  conditions: []
storedVersions: []

apiVersion: v1
kind: ServiceAccount
metadata:
name: kong-serviceaccount

namespace: kong

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: kong-ingress-clusterrole
rules:
- apiGroups:
  - ""
    resources:
  - endpoints
  - nodes
  - pods
  - secrets
    verbs:
  - list
  - watch
- apiGroups:
  - ""
    resources:
  - nodes
    verbs:
  - get
- apiGroups:
  - ""
    resources:
  - services
    verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  - extensions
  - networking.internal.knative.dev
    resources:
  - ingresses
    verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
    resources:
  - events
    verbs:
  - create
  - patch
- apiGroups:
  - networking.k8s.io
  - extensions
  - networking.internal.knative.dev
    resources:
  - ingresses/status
    verbs:
  - update
- apiGroups:
  - configuration.konghq.com
    resources:
  - tcpingresses/status
    verbs:
  - update
- apiGroups:
  - configuration.konghq.com
    resources:
  - kongplugins
  - kongclusterplugins
  - kongcredentials
  - kongconsumers
  - kongingresses
  - tcpingresses
    verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
    resources:
  - configmaps
    verbs:
  - create
  - get
- update

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: kong-ingress-clusterrole-nisa-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kong-ingress-clusterrole
subjects:
- kind: ServiceAccount
  name: kong-serviceaccount
namespace: kong

apiVersion: v1
kind: Service
metadata:
annotations:
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
service.beta.kubernetes.io/aws-load-balancer-type: nlb
name: kong-proxy
namespace: kong
spec:
ports:
- name: proxy
  port: 80
  protocol: TCP
  targetPort: 8000
- name: proxy-ssl
  port: 443
  protocol: TCP
  targetPort: 8443
  selector:
  app: ingress-kong
type: NodePort

apiVersion: v1
kind: Service
metadata:
name: kong-validation-webhook
namespace: kong
spec:
ports:
- name: webhook
  port: 443
  protocol: TCP
  targetPort: 8080
  selector:
app: ingress-kong

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: ingress-kong
name: ingress-kong
namespace: kong
spec:
replicas: 1
selector:
matchLabels:
app: ingress-kong
template:
metadata:
annotations:
kuma.io/gateway: enabled
prometheus.io/port: "8100"
prometheus.io/scrape: "true"
traffic.sidecar.istio.io/includeInboundPorts: ""
labels:
app: ingress-kong
spec:
containers:
- env:
- name: KONG_PROXY_LISTEN
value: 0.0.0.0:8000, 0.0.0.0:8443 ssl http2
- name: KONG_ADMIN_LISTEN
value: 127.0.0.1:8444 ssl
- name: KONG_STATUS_LISTEN
value: 0.0.0.0:8100
- name: KONG_DATABASE
value: "off"
- name: KONG_NGINX_WORKER_PROCESSES
value: "1"
- name: KONG_ADMIN_ACCESS_LOG
value: /dev/stdout
- name: KONG_ADMIN_ERROR_LOG
value: /dev/stderr
- name: KONG_PROXY_ERROR_LOG
value: /dev/stderr
image: kong:2.1
lifecycle:
preStop:
exec:
command:
- /bin/sh
- -c
- kong quit
livenessProbe:
failureThreshold: 3
httpGet:
path: /status
port: 8100
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: proxy
ports:
- containerPort: 8000
name: proxy
protocol: TCP
- containerPort: 8443
name: proxy-ssl
protocol: TCP
- containerPort: 8100
name: metrics
protocol: TCP
readinessProbe:
failureThreshold: 3
httpGet:
path: /status
port: 8100
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
securityContext:
runAsUser: 1000
- env:
- name: CONTROLLER_KONG_ADMIN_URL
value: https://127.0.0.1:8444
- name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
value: "true"
- name: CONTROLLER_PUBLISH_SERVICE
value: kong/kong-proxy
- name: POD_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
image: kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller:0.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: ingress-controller
ports:
- containerPort: 8080
name: webhook
protocol: TCP
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
serviceAccountName: kong-serviceaccount
执行该yaml 文件

[root@localhost kong-gateway]# kubectl apply -f all-in-one-dbless.yaml
namespace/kong created
customresourcedefinition.apiextensions.k8s.io/kongclusterplugins.configuration.konghq.com created
customresourcedefinition.apiextensions.k8s.io/kongconsumers.configuration.konghq.com created
customresourcedefinition.apiextensions.k8s.io/kongcredentials.configuration.konghq.com created
customresourcedefinition.apiextensions.k8s.io/kongingresses.configuration.konghq.com created
customresourcedefinition.apiextensions.k8s.io/kongplugins.configuration.konghq.com created
customresourcedefinition.apiextensions.k8s.io/tcpingresses.configuration.konghq.com created
serviceaccount/kong-serviceaccount created
clusterrole.rbac.authorization.k8s.io/kong-ingress-clusterrole created
clusterrolebinding.rbac.authorization.k8s.io/kong-ingress-clusterrole-nisa-binding created
service/kong-proxy created
service/kong-validation-webhook created
deployment.apps/ingress-kong created

实践Kong for Kubernetes（K8S）

YAML清单

helm部署

Kustomize

name: kong

version: v1

version: v1

version: v1

version: v1

version: v1

storedVersions: []

namespace: kong

- update

namespace: kong

type: NodePort

app: ingress-kong

相关阅读

相关文章

相关问答

相关文档