Code Life

#首先安装控制器，
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
#然后创建Service
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/baremetal/service-nodeport.yaml

kubectl -n ingress-nginx get cm ingress-controller-leader-nginx -oyaml
apiVersion: v1
kind: ConfigMap
metadata:
  annotations:
    control-plane.alpha.kubernetes.io/leader: '{"holderIdentity":"nginx-ingress-controller-85f9f75759-4wb8k","leaseDurationSeconds":30,"acquireTime":"2019-04-11T09:11:06Z","renewTime":"2019-04-11T13:12:56Z","leaderTransitions":0}'
  creationTimestamp: "2019-04-11T09:11:06Z"
  name: ingress-controller-leader-nginx
  namespace: ingress-nginx
  resourceVersion: "28998"
  selfLink: /api/v1/namespaces/ingress-nginx/configmaps/ingress-controller-leader-nginx
  uid: bd25d320-5c39-11e9-af65-00163e132347

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginx
  annotations:
    # 这个在多ingress时才需要配置
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: ing.vsxen.me
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx
          servicePort: 80

cat <<EOF | kubectl create -f - 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: host
spec:
  rules:
  - host: echo.vsxen.me
    http:
      paths:
      - path: /
        backend:
          serviceName: echo
          servicePort: 8080
  - host: nginx.vsxen.me
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx
          servicePort: 80    
EOF

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=foo.bar.com/O=foo.bar.com"

kubectl  create secret tls tlskey --key=tls.key --cert=tls.crt

cat <<EOF | kubectl create -f - 
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tls-fanout
spec:
  tls:
  - hosts:
    - foo.bar.com
    secretName: tlskey
  rules:
  - host: foo.bar.com
    http:
      paths:
      - path: /
        backend:
          serviceName: nginx
          servicePort: 80
EOF

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  labels:
    app: nginx
  name: demo
spec:
  rules:
  - host: vsxen.me
    http:
      paths:
      - backend:
          serviceName: backend
          servicePort: 8080
        path: /api
      - backend:
          serviceName: front
          servicePort: 80
        path: /

        volumeMounts:
          - mountPath: /etc/nginx/template
            name: nginx-template-volume
            readOnly: true
      volumes:
        - name: nginx-template-volume
          configMap:
            name: nginx-template
            items:
            - key: nginx.tmpl
              path: nginx.tmpl

        ## start server xxx.com
        server {
                server_name ssl.vsxen.me ;
                listen 80;
                set $proxy_upstream_name "-";
                location / {
                        set $namespace      "default";
                        set $ingress_name   "nginx";
                        set $service_name   "nginx";
                        set $service_port   "80";
                        set $location_path  "/";
                        rewrite_by_lua_block {
                                balancer.rewrite()
                        }
                        header_filter_by_lua_block {
                        }
                        body_filter_by_lua_block {
                        }
                        log_by_lua_block {
                                balancer.log()
                                monitor.call()
                        }
                        port_in_redirect off;
                        set $proxy_upstream_name    "quanke-test-gateway-serv-8092";
                        set $proxy_host             $proxy_upstream_name;
                        client_max_body_size                    20m;
                        proxy_set_header Host                   $best_http_host;
                        # Pass the extracted client certificate to the backend
                        # Allow websocket connections
                        proxy_set_header                        Upgrade           $http_upgrade;
                        proxy_set_header                        Connection        $connection_upgrade;
                        proxy_set_header X-Request-ID           $req_id;
                        proxy_set_header X-Real-IP              $the_real_ip;
                        proxy_set_header X-Forwarded-For        $the_real_ip;
                        proxy_set_header X-Forwarded-Host       $best_http_host;
                        proxy_set_header X-Forwarded-Port       $pass_port;
                        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
                        proxy_set_header X-Original-URI         $request_uri;
                        proxy_set_header X-Scheme               $pass_access_scheme;
                        # Pass the original X-Forwarded-For
                        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
                        # mitigate HTTPoxy Vulnerability
                        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
                        proxy_set_header Proxy                  "";
                        # Custom headers to proxied server
                        proxy_connect_timeout                   5s;
                        proxy_send_timeout                      60s;
                        proxy_read_timeout                      60s;
                        proxy_buffering                         off;
                        proxy_buffer_size                       4k;
                        proxy_buffers                           4 4k;
                        proxy_request_buffering                 on;
                        proxy_http_version                      1.1;
                        proxy_cookie_domain                     off;
                        proxy_cookie_path                       off;
                        # In case of errors try the next upstream server before returning an error
                        proxy_next_upstream                     error timeout;
                        proxy_next_upstream_tries               3;
                        proxy_pass http://upstream_balancer;
                        proxy_redirect                          off;
                }
        }
        ## end server xxx.com

log_format upstreaminfo
    '{{ if $cfg.useProxyProtocol }}$proxy_protocol_addr{{ else }}$remote_addr{{ end }} - '
    '[$the_real_ip] - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" "$http_user_agent" '
    '$request_length $request_time [$proxy_upstream_name] $upstream_addr '
    '$upstream_response_length $upstream_response_time $upstream_status $req_id';

  log-format-upstream: '{"proxy_protocol_addr": "$proxy_protocol_addr","remote_addr":
    "$remote_addr", "proxy_add_x_forwarded_for": "$proxy_add_x_forwarded_for", "remote_user":
    "$remote_user", "time_local": "$time_local", "request" : "$request", "status":
    "$status", "body_bytes_sent": "$body_bytes_sent", "http_referer":  "$http_referer",
    "http_user_agent": "$http_user_agent", "request_length" : "$request_length", "request_time"
    : "$request_time", "proxy_upstream_name": "$proxy_upstream_name", "upstream_addr":
    "$upstream_addr",  "upstream_response_length": "$upstream_response_length", "upstream_response_time":
    "$upstream_response_time", "upstream_status": "$upstream_status", "req_id":"$req_id"}'

203.110.179.243 - [203.110.179.243] - - [11/Jan/2019:14:44:55 +0800] "GET /favicon.ico HTTP/1.1" 404 196 "http://nginx.cf86fc3209f4e483493e504197bfdd22f.cn-hangzhou.alicontainer.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" 458 0.001 [default-nginx-80] 172.16.1.173:80 555 0.000 404 7b02134be96609d93aa4318a826a40b3    

    <source>
      @id fluentd-containers.log
      @type tail
      path /var/log/containers/*.log
      pos_file /var/log/es-containers.log.pos
      tag raw.kubernetes.*
      read_from_head true
      <parse>
        @type multi_format
        <pattern>
          format json
          time_key time
          time_format %Y-%m-%dT%H:%M:%S.%NZ
        </pattern>
        <pattern>
          format /^(?<time>.+) (?<stream>stdout|stderr) [^ ]* (?<log>.*)$/
          time_format %Y-%m-%dT%H:%M:%S.%N%:z
        </pattern>
      </parse>
    </source>

    # Detect exceptions in the log output and forward them as one log entry.
    <match raw.kubernetes.**>
      @id raw.kubernetes
      @type detect_exceptions
      remove_tag_prefix raw
      message log
      stream stream
      multiline_flush_interval 5
      max_bytes 500000
      max_lines 1000
    </match>

    # Concatenate multi-line logs
    <filter **>
      @id filter_concat
      @type concat
      key message
      multiline_end_regexp /\n$/
      separator ""
    </filter>

    # Enriches records with Kubernetes metadata
    <filter kubernetes.**>
      @id filter_kubernetes_metadata
      @type kubernetes_metadata
    </filter>

    # Fixes json fields in Elasticsearch
    <filter kubernetes.**>
      @id filter_parser
      @type parser
      key_name log
      reserve_data true
      remove_key_name_field true
      <parse>
        @type multi_format
        <pattern>
          format json
        </pattern>
        <pattern>
          format none
        </pattern>
      </parse>
    </filter>

    <match **>
      @id elasticsearch
      @type elasticsearch
      @log_level info
      type_name _doc
      include_tag_key true
      host 1.1.1.1
      port 9200
      logstash_format true
      logstash_prefix audit
      <buffer>
        @type file
        path /var/log/fluentd-buffers/kubernetes.system.buffer
        flush_mode interval
        retry_type exponential_backoff
        flush_thread_count 2
        flush_interval 5s
        retry_forever
        retry_max_interval 30
        chunk_limit_size 2M
        queue_limit_length 8
        overflow_action block
      </buffer>
    </match>