1
apiVersion: v1
2
kind: Endpoints
3
metadata:
4
  name: nginx-svc          # 与 Service 同名
5
subsets:
6
  - addresses:
7
      - ip: 10.244.1.5
8
      - ip: 10.244.2.3
9
      - ip: 10.244.3.7
10
    ports:
11
      - port: 8080

1
apiVersion: discovery.k8s.io/v1
2
kind: EndpointSlice
3
metadata:
4
  name: nginx-svc-abc123
5
  labels:
6
    kubernetes.io/service-name: nginx-svc
7
addressType: IPv4
8
endpoints:
9
  - addresses:
10
      - 10.244.1.5
11
    conditions:
12
      ready: true
13
  - addresses:
14
      - 10.244.2.3
15
    conditions:
16
      ready: true
17
ports:
18
  - port: 8080

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: my-ingress
5
  annotations:
6
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
7
spec:
8
  ingressClassName: nginx       # 指定 Ingress Controller
9
  tls:
10
    - hosts:
11
        - api.example.com
12
        - web.example.com
13
      secretName: tls-secret
14
  rules:
15
    - host: api.example.com
16
      http:
17
        paths:
18
          - path: /
19
            pathType: Prefix
20
            backend:
21
              service:
22
                name: api-svc
23
                port:
24
                  number: 80
25
    - host: web.example.com
26
      http:
27
        paths:
28
          - path: /
29
            pathType: Prefix
30
            backend:
31
              service:
32
                name: web-svc
33
                port:
34
                  number: 80
35
          - path: /api
36
            pathType: Prefix
37
            backend:
38
              service:
39
                name: api-svc
40
                port:
41
                  number: 80

1
# 在集群内查询 Service DNS
2
nslookup nginx-svc
3
# Server:    10.96.0.10
4
# Name:      nginx-svc.default.svc.cluster.local
5
# Address:   10.96.0.100
6

7
# 同 Namespace 下可以简写
8
curl http://nginx-svc:80
9

10
# 跨 Namespace 需要全限定名
11
curl http://nginx-svc.production.svc:80

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: coredns
5
  namespace: kube-system
6
data:
7
  Corefile: |
8
    .:53 {
9
        errors
10
        health {
11
            lameduck 5s
12
        }
13
        ready
14
        kubernetes cluster.local in-addr.arpa ip6.arpa {
15
            pods insecure
16
            fallthrough in-addr.arpa ip6.arpa
17
            ttl 30
18
        }
19
        prometheus :9153
20
        forward . /etc/resolv.conf {
21
            max_concurrent 1000
22
        }
23
        cache 30
24
        loop
25
        reload
26
        loadbalance
27
    }

1
# kube-proxy 创建的 iptables 规则（简化）
2
-A KUBE-SERVICES -d 10.96.0.100/32 -j KUBE-SVC-NGINX
3
-A KUBE-SVC-NGINX -m statistic --mode random --probability 0.333 -j KUBE-SEP-POD1
4
-A KUBE-SVC-NGINX -m statistic --mode random --probability 0.500 -j KUBE-SEP-POD2
5
-A KUBE-SVC-NGINX -j KUBE-SEP-POD3
6
-A KUBE-SEP-POD1 -s 10.244.1.5/32 -j MARK --set-xmark 0x4000/0x4000
7
-A KUBE-SEP-POD1 -p tcp -m tcp -j DNAT --to-destination 10.244.1.5:8080

1
# kube-proxy 创建的 IPVS 规则
2
ipvsadm -Ln
3
# TCP  10.96.0.100:80 rr
4
#   -> 10.244.1.5:8080         Masq    1      0          0
5
#   -> 10.244.2.3:8080         Masq    1      0          0
6
#   -> 10.244.3.7:8080         Masq    1      0          0

1
# 查看 kube-proxy 当前模式
2
kubectl get configmap kube-proxy -n kube-system -o yaml | grep mode
3

4
# 切换到 IPVS 模式
5
kubectl edit configmap kube-proxy -n kube-system
6
# 将 mode: "" 改为 mode: "ipvs"
7

8
# 重启 kube-proxy
9
kubectl rollout restart daemonset kube-proxy -n kube-system

1
apiVersion: networking.k8s.io/v1
2
kind: NetworkPolicy
3
metadata:
4
  name: api-policy
5
  namespace: production
6
spec:
7
  podSelector:
8
    matchLabels:
9
      app: api               # 策略应用到 app=api 的 Pod
10
  policyTypes:
11
    - Ingress
12
    - Egress
13
  ingress:
14
    - from:
15
        - podSelector:       # 允许来自 app=web 的 Pod
16
            matchLabels:
17
              app: web
18
      ports:
19
        - port: 8080
20
        - port: 443
21
    - from:
22
        - namespaceSelector: # 允许来自 monitoring Namespace
23
            matchLabels:
24
              name: monitoring
25
      ports:
26
        - port: 9090         # 监控端口
27
  egress:
28
    - to:
29
        - podSelector:       # 允许访问 app=mysql 的 Pod
30
            matchLabels:
31
              app: mysql
32
      ports:
33
        - port: 3306
34
    - to:                    # 允许 DNS 解析
35
        - namespaceSelector: {}
36
      ports:
37
        - port: 53
38
          protocol: UDP