个人工做中很重要的一部分是参加各类各样的技术会议。最近参加的是去年11月的北美KubeCon,在会议的最后一天,全部人都焦头烂额,我也一直机械地向不一样的人重复个人自我介绍。后来,我已经十分烦躁,决定逃离人群好好听一场演讲。无心间,我碰上了Darren Shepherd的演讲,他是Rancher的CTO,他的演讲主题是“K3s的背后:构建一个生产级轻量Kubernetes发行版”。我被演讲深深吸引,此后我开始慢慢深刻了解K3s。node
K3s是由业界应用最为普遍的Kubernetes管理平台建立者Rancher Labs打造的面向物联网和边缘计算的轻量级Kubernetes发行版,它是100%开源的。它拥有小型的二进制文件而且针对ARM进行了优化使得它很是适合个人IoT家庭项目。接着,我开始思考如何让K3s上运行的Kong网关暴露K3s server内的服务。git
出乎我意料的是,K3s在默认状况下是带有一个Ingress controller的。虽然默认的proxy/负载均衡器能够工做,但我须要一些插件的功能它并不支持,除非我使用Kong网关。因此,让咱们经过一个快速指南来了解如何在Ubuntu中启动K3s,配置它以支持Kubernetes的Kong,并部署一些服务/插件。github
首先,从https://get.k3s.io 使用安装脚本在systemd和基于openrc的系统上将K3s做为一个服务进行安装。可是咱们须要添加一些额外的环境变量来配置安装。首先--no-deploy
,这一命令能够关掉现有的ingress controller,由于咱们想要部署Kong以利用一些插件。其次--write-kubeconfig-mode
,它容许写入kubeconfig文件。这对于容许将K3s集群导入Rancher颇有用。web
$ curl -sfL https://get.k3s.io | sh -s - --no-deploy traefik --write-kubeconfig-mode 644 [INFO] Finding release for channel stable [INFO] Using v1.18.4+k3s1 as release [INFO] Downloading hash https://github.com/rancher/k3s/releases/download/v1.18.4+k3s1/sha256sum-amd64.txt [INFO] Downloading binary https://github.com/rancher/k3s/releases/download/v1.18.4+k3s1/k3s [INFO] Verifying binary download [INFO] Installing k3s to /usr/local/bin/k3s [INFO] Skipping /usr/local/bin/kubectl symlink to k3s, already exists [INFO] Creating /usr/local/bin/crictl symlink to k3s [INFO] Skipping /usr/local/bin/ctr symlink to k3s, command exists in PATH at /usr/bin/ctr [INFO] Creating killall script /usr/local/bin/k3s-killall.sh [INFO] Creating uninstall script /usr/local/bin/k3s-uninstall.sh [INFO] env: Creating environment file /etc/systemd/system/k3s.service.env [INFO] systemd: Creating service file /etc/systemd/system/k3s.service [INFO] systemd: Enabling k3s unit Created symlink from /etc/systemd/system/multi-user.target.wants/k3s.service to /etc/systemd/system/k3s.service. [INFO] systemd: Starting k3s
要检查节点和 pod是否都已启动并运行,使用 k3s kubectl...
运行与 kubectl 相同的命令。json
$ k3s kubectl get nodes NAME STATUS ROLES AGE VERSION ubuntu-xenial Ready master 4m38s v1.18.4+k3s1 $ k3s kubectl get pods -A NAMESPACE NAME READY STATUS RESTARTS AGE kube-system metrics-server-7566d596c8-vqqz7 1/1 Running 0 4m30s kube-system local-path-provisioner-6d59f47c7-tcs2l 1/1 Running 0 4m30s kube-system coredns-8655855d6-rjzrq 1/1 Running 0 4m30s
K3s启动并运行后,你能够按照正常的步骤安装Kong for Kubernetes,好比以下所示的manifest:ubuntu
$ k3s kubectl create -f https://bit.ly/k4k8s namespace/kong created customresourcedefinition.apiextensions.k8s.io/kongclusterplugins.configuration.konghq.com created customresourcedefinition.apiextensions.k8s.io/kongconsumers.configuration.konghq.com created customresourcedefinition.apiextensions.k8s.io/kongcredentials.configuration.konghq.com created customresourcedefinition.apiextensions.k8s.io/kongingresses.configuration.konghq.com created customresourcedefinition.apiextensions.k8s.io/kongplugins.configuration.konghq.com created customresourcedefinition.apiextensions.k8s.io/tcpingresses.configuration.konghq.com created serviceaccount/kong-serviceaccount created clusterrole.rbac.authorization.k8s.io/kong-ingress-clusterrole created clusterrolebinding.rbac.authorization.k8s.io/kong-ingress-clusterrole-nisa-binding created service/kong-proxy created service/kong-validation-webhook created deployment.apps/ingress-kong created
当Kong proxy和ingress controller安装到K3s server上后,你检查服务应该能看到kong-proxy LoadBalancer的外部IP。api
$ k3s kubectl get svc --namespace kong NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE kong-validation-webhook ClusterIP 10.43.157.178 <none> 443/TCP 61s kong-proxy LoadBalancer 10.43.63.117 10.0.2.15 80:32427/TCP,443:30563/TCP
运行如下命令,将IP导出为一个变量:服务器
$ PROXY_IP=$(k3s kubectl get services --namespace kong kong-proxy -o jsonpath={.status.loadBalancer.ingress[0].ip})
最后,在咱们抛出proxy后的任何服务以前,检查proxy是否有响应:app
$ curl -i $PROXY_IP HTTP/1.1 404 Not Found Date: Mon, 29 Jun 2020 20:31:16 GMT Content-Type: application/json; charset=utf-8 Connection: keep-alive Content-Length: 48 X-Kong-Response-Latency: 0 Server: kong/2.0.4 {"message":"no Route matched with those values"}
它应该返回404,由于咱们尚未在K3s中添加任何服务。但正如你在请求头(header)中看到的那样,它正在被最新版本的Kong代理,并显示了一些额外的信息,好比响应延迟。负载均衡
如今,让咱们在K3s中设置一个回显服务器(echo server)应用程序以演示如何使用Kong Ingress Controller:
$ k3s kubectl apply -f https://bit.ly/echo-service service/echo created deployment.apps/echo created
接下来,建立一个ingress规则以代理以前建立的echo-server:
$ echo " apiVersion: extensions/v1beta1 kind: Ingress metadata: name: demo spec: rules: - http: paths: - path: /foo backend: serviceName: echo servicePort: 80 " | k3s kubectl apply -f - ingress.extensions/demo created
测试Ingress 规则:
$ curl -i $PROXY_IP/foo HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Date: Mon, 29 Jun 2020 20:31:07 GMT Server: echoserver X-Kong-Upstream-Latency: 0 X-Kong-Proxy-Latency: 1 Via: kong/2.0.4 Hostname: echo-78b867555-jkhhl Pod Information: node name: ubuntu-xenial pod name: echo-78b867555-jkhhl pod namespace: default pod IP: 10.42.0.7 <-- clipped -->
若是一切都部署正确,你应该看到以上响应。这验证了Kong能够正确路由流量到运行在Kubernetes中的应用程序。
Kong Ingress容许插件在服务级别上执行,也就是说,每当一个请求被发送到一个特定的K3s服务时,不管它来自哪一个Ingress路径,Kong都会执行一个插件。你也能够在Ingress路径上附加插件。但在下面的步骤中,我将使用限制速率插件来限制IP在任何一个特定的服务上发出过多的请求。
建立一个KongPlugin资源:
$ echo " apiVersion: configuration.konghq.com/v1 kind: KongPlugin metadata: name: rl-by-ip config: minute: 5 limit_by: ip policy: local plugin: rate-limiting " | k3s kubectl apply -f - kongplugin.configuration.konghq.com/rl-by-ip created
接下来,在须要限制速率的K3s服务上应用konghq.com/plugins注释。
$ k3s kubectl patch svc echo -p '{"metadata":{"annotations":{"konghq.com/plugins": "rl-by-ip\n"}}}' service/echo patched
如今,任何发送到这项服务的请求都将受到Kong执行的速率限制的保护:
$ curl -I $PROXY_IP/foo HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Connection: keep-alive Date: Mon, 29 Jun 2020 20:35:40 GMT Server: echoserver X-RateLimit-Remaining-Minute: 4 X-RateLimit-Limit-Minute: 5 RateLimit-Remaining: 4 RateLimit-Limit: 5 RateLimit-Reset: 20 X-Kong-Upstream-Latency: 5 X-Kong-Proxy-Latency: 2 Via: kong/2.0.4
从这一个小小的实践能够看出来,K3s其实拥有无限可能,由于你能够将任何插件添加到任何Ingress路径或服务上。你能够从Kong Hub上找到全部插件。在家庭自动化项目中,这十分方便,你还能够利用树莓派来运行K3s,并经过各种插件赋予K3s更多可能。