Skip to content

Commit c243d93

Browse files
bprashanthbprashanth
committed
Add an example for static-ip and deployment
1 parent 3e87a2d commit c243d93

15 files changed

+544
-3
lines changed

‎examples/deployment/gce/README.md

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# Deploying the GCE Ingress controller
2+
3+
This example demonstrates the deployment of a GCE Ingress controller.
4+
5+
Note: __all GCE/GKE clusters already have an Ingress controller running
6+
on the master. The only reason to deploy another GCE controller is if you want
7+
to debug or otherwise observe its operation (eg via kubectl logs). Before
8+
deploying another one in your cluster, make sure you disable the master
9+
controller.__
10+
11+
## Disabling the master controller
12+
13+
As of Kubernetes 1.3, GLBC runs as a static pod on the master. If you want to
14+
totally disable it, you can ssh into the master node and delete the GLBC
15+
manifest file found at `/etc/kubernetes/manifests/glbc.manifest`. You can also
16+
disable it on GKE at cluster bring-up time through the `disable-addons` flag:
17+
18+
```console
19+
gcloud container clusters create mycluster --network "default" --num-nodes 1 \
20+
--machine-type n1-standard-2 --zone $ZONE \
21+
--disable-addons HttpLoadBalancing \
22+
--disk-size 50 --scopes storage-full
23+
```
24+
25+
## Deploying a new controller
26+
27+
The following command deploys a GCE Ingress controller in your cluster
28+
29+
```console
30+
$ kubectl create -f gce-ingress-controller.yaml
31+
service "default-http-backend" created
32+
replicationcontroller "l7-lb-controller" created
33+
34+
$ kubectl get po -l name=glbc
35+
NAME READY STATUS RESTARTS AGE
36+
l7-lb-controller-1s22c 2/2 Running 0 27s
37+
```
38+
39+
now you can create an Ingress and observe the controller
40+
41+
```console
42+
$ kubectl create -f gce-tls-ingress.yaml
43+
ingress "test" created
44+
45+
$ kubectl logs l7-lb-controller-1s22c -c l7-lb-controller
46+
I0201 01:03:17.387548 1 main.go:179] Starting GLBC image: glbc:0.9.0, cluster name
47+
I0201 01:03:18.459740 1 main.go:291] Using saved cluster uid "32658fa96c080068"
48+
I0201 01:03:18.459771 1 utils.go:122] Changing cluster name from to 32658fa96c080068
49+
I0201 01:03:18.461652 1 gce.go:331] Using existing Token Source &oauth2.reuseTokenSource{new:google.computeSource{account:""}, mu:sync.Mutex{state:0, sema:0x0}, t:(*oauth2.Token)(nil)}
50+
I0201 01:03:18.553142 1 cluster_manager.go:264] Created GCE client without a config file
51+
I0201 01:03:18.553773 1 controller.go:234] Starting loadbalancer controller
52+
I0201 01:04:58.314271 1 event.go:217] Event(api.ObjectReference{Kind:"Ingress", Namespace:"default", Name:"test", UID:"73549716-e81a-11e6-a8c5-42010af00002", APIVersion:"extensions", ResourceVersion:"673016", FieldPath:""}): type: 'Normal' reason: 'ADD' default/test
53+
I0201 01:04:58.413616 1 instances.go:76] Creating instance group k8s-ig--32658fa96c080068 in zone us-central1-b
54+
I0201 01:05:01.998169 1 gce.go:2084] Adding port 30301 to instance group k8s-ig--32658fa96c080068 with 0 ports
55+
I0201 01:05:02.444014 1 backends.go:149] Creating backend for 1 instance groups, port 30301 named port &{port30301 30301 []}
56+
I0201 01:05:02.444175 1 utils.go:495] No pod in service http-svc with node port 30301 has declared a matching readiness probe for health checks.
57+
I0201 01:05:02.555599 1 healthchecks.go:62] Creating health check k8s-be-30301--32658fa96c080068
58+
I0201 01:05:11.300165 1 gce.go:2084] Adding port 31938 to instance group k8s-ig--32658fa96c080068 with 1 ports
59+
I0201 01:05:11.743914 1 backends.go:149] Creating backend for 1 instance groups, port 31938 named port &{port31938 31938 []}
60+
I0201 01:05:11.744008 1 utils.go:495] No pod in service default-http-backend with node port 31938 has declared a matching readiness probe for health checks.
61+
I0201 01:05:11.811972 1 healthchecks.go:62] Creating health check k8s-be-31938--32658fa96c080068
62+
I0201 01:05:19.871791 1 loadbalancers.go:121] Creating l7 default-test--32658fa96c080068
63+
...
64+
65+
$ kubectl get ing test
66+
NAME HOSTS ADDRESS PORTS AGE
67+
test * 35.186.208.106 80, 443 4m
68+
69+
$ curl 35.186.208.106 -kL
70+
CLIENT VALUES:
71+
client_address=10.180.3.1
72+
command=GET
73+
real path=/
74+
query=nil
75+
request_version=1.1
76+
request_uri=http://35.186.208.106:8080/
77+
...
78+
```

‎examples/deployment/gce/gce-ingress-controller.yaml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
# This must match the --default-backend-service argument of the l7 lb
5+
# controller and is required because GCE mandates a default backend.
6+
name: default-http-backend
7+
labels:
8+
k8s-app: glbc
9+
spec:
10+
# The default backend must be of type NodePort.
11+
type: NodePort
12+
ports:
13+
- port: 80
14+
targetPort: 8080
15+
protocol: TCP
16+
name: http
17+
selector:
18+
k8s-app: glbc
19+
20+
---
21+
apiVersion: v1
22+
kind: ReplicationController
23+
metadata:
24+
name: l7-lb-controller
25+
labels:
26+
k8s-app: glbc
27+
version: v0.9.0
28+
spec:
29+
# There should never be more than 1 controller alive simultaneously.
30+
replicas: 1
31+
selector:
32+
k8s-app: glbc
33+
version: v0.9.0
34+
template:
35+
metadata:
36+
labels:
37+
k8s-app: glbc
38+
version: v0.9.0
39+
name: glbc
40+
spec:
41+
terminationGracePeriodSeconds: 600
42+
containers:
43+
- name: default-http-backend
44+
# Any image is permissable as long as:
45+
# 1. It serves a 404 page at /
46+
# 2. It serves 200 on a /healthz endpoint
47+
image: gcr.io/google_containers/defaultbackend:1.0
48+
livenessProbe:
49+
httpGet:
50+
path: /healthz
51+
port: 8080
52+
scheme: HTTP
53+
initialDelaySeconds: 30
54+
timeoutSeconds: 5
55+
ports:
56+
- containerPort: 8080
57+
resources:
58+
limits:
59+
cpu: 10m
60+
memory: 20Mi
61+
requests:
62+
cpu: 10m
63+
memory: 20Mi
64+
- image: gcr.io/google_containers/glbc:0.9.0-beta.1
65+
livenessProbe:
66+
httpGet:
67+
path: /healthz
68+
port: 8081
69+
scheme: HTTP
70+
initialDelaySeconds: 30
71+
timeoutSeconds: 5
72+
name: l7-lb-controller
73+
resources:
74+
limits:
75+
cpu: 100m
76+
memory: 100Mi
77+
requests:
78+
cpu: 100m
79+
memory: 50Mi
80+
args:
81+
- --default-backend-service=default/default-http-backend
82+
- --sync-period=300s

‎examples/tls-termination/gce-tls-ingress.yaml renamed to ‎examples/deployment/gce/gce-tls-ingress.yaml

File renamed without changes.

‎examples/static-ip/gce.md

-3
This file was deleted.

‎examples/static-ip/gce/README.md

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Static IPs
2+
3+
This example demonstrates how to assign a [static-ip](https://cloud.google.com/compute/docs/configure-instance-ip-addresses#reserve_new_static) to an Ingress on GCE.
4+
5+
## Prerequisites
6+
7+
You need a [TLS cert](/examples/PREREQUISITES.md#tls-certificates) and a [test HTTP service](/examples/PREREQUISITES.md#test-http-service) for this example.
8+
You will also need to make sure you Ingress targets exactly one Ingress
9+
controller by specifying the [ingress.class annotation](/examples/PREREQUISITES.md#ingress-class).
10+
11+
## Acquiring a static IP
12+
13+
In GCE, static IP belongs to a given project until the owner decides to release
14+
it. If you create a static IP and assign it to an Ingress, deleting the Ingress
15+
or tearing down the GKE cluster *will not* delete the static IP. You can check
16+
the static IPs you have as follows
17+
18+
```console
19+
$ gcloud compute addresses list --global
20+
NAME REGION ADDRESS STATUS
21+
test-ip 35.186.221.137 RESERVED
22+
23+
$ gcloud compute addresses list
24+
NAME REGION ADDRESS STATUS
25+
test-ip 35.186.221.137 RESERVED
26+
test-ip us-central1 35.184.21.228 RESERVED
27+
```
28+
29+
Note the difference between a regional and a global static ip. Only global
30+
static-ips will work with Ingress. If you don't already have an IP, you can
31+
create it
32+
33+
```console
34+
$ gcloud compute addresses create test-ip --global
35+
Created [https://www.googleapis.com/compute/v1/projects/kubernetesdev/global/addresses/test-ip].
36+
---
37+
address: 35.186.221.137
38+
creationTimestamp: '2017-01-31T10:32:29.889-08:00'
39+
description: ''
40+
id: '9221457935391876818'
41+
kind: compute#address
42+
name: test-ip
43+
selfLink: https://www.googleapis.com/compute/v1/projects/kubernetesdev/global/addresses/test-ip
44+
status: RESERVED
45+
```
46+
47+
## Assigning a static IP to an Ingress
48+
49+
You can now add the static IP from the previous step to an Ingress,
50+
by specifying the `kubernetes.io/global-static-ip-name` annotation,
51+
the example yaml in this directory already has it set to `test-ip`
52+
53+
```console
54+
$ kubectl create -f gce-static-ip-ingress.yaml
55+
ingress "static-ip" created
56+
57+
$ gcloud compute addresses list test-ip
58+
NAME REGION ADDRESS STATUS
59+
test-ip 35.186.221.137 IN_USE
60+
test-ip us-central1 35.184.21.228 RESERVED
61+
62+
$ kubectl get ing
63+
NAME HOSTS ADDRESS PORTS AGE
64+
static-ip * 35.186.221.137 80, 443 1m
65+
66+
$ curl 35.186.221.137 -Lk
67+
CLIENT VALUES:
68+
client_address=10.180.1.1
69+
command=GET
70+
real path=/
71+
query=nil
72+
request_version=1.1
73+
request_uri=http://35.186.221.137:8080/
74+
...
75+
```
76+
77+
## Retaining the static IP
78+
79+
You can test retention by deleting the Ingress
80+
81+
```console
82+
$ kubectl delete -f gce-static-ip-ingress.yaml
83+
ingress "static-ip" deleted
84+
85+
$ kubectl get ing
86+
No resources found.
87+
88+
$ gcloud compute addresses list test-ip --global
89+
NAME REGION ADDRESS STATUS
90+
test-ip 35.186.221.137 RESERVED
91+
```
92+
93+
## Promote ephemeral to static IP
94+
95+
If you simply create a HTTP Ingress resource, it gets an ephemeral IP
96+
97+
```console
98+
$ kubectl create -f gce-http-ingress.yaml
99+
ingress "http-ingress" created
100+
101+
$ kubectl get ing
102+
NAME HOSTS ADDRESS PORTS AGE
103+
http-ingress * 35.186.195.33 80 1h
104+
105+
$ gcloud compute forwarding-rules list
106+
NAME REGION IP_ADDRESS IP_PROTOCOL TARGET
107+
k8s-fw-default-http-ingress--32658fa96c080068 35.186.195.33 TCP k8s-tp-default-http-ingress--32658fa96c080068
108+
```
109+
110+
Note that because this is an ephemeral IP, it won't show up in the output of
111+
`gcloud compute addresses list`.
112+
113+
If you either directly create an Ingress with a TLS section, or modify a HTTP
114+
Ingress to have a TLS section, it gets a static IP.
115+
116+
```console
117+
$ kubectl patch ing http-ingress -p '{"spec":{"tls":[{"secretName":"tls-secret"}]}}'
118+
"http-ingress" patched
119+
120+
$ kubectl get ing
121+
NAME HOSTS ADDRESS PORTS AGE
122+
http-ingress * 35.186.195.33 80, 443 1h
123+
124+
$ gcloud compute addresses list
125+
NAME REGION ADDRESS STATUS
126+
k8s-fw-default-http-ingress--32658fa96c080068 35.186.195.33 IN_USE
127+
```
128+

‎examples/static-ip/gce/gce-http-ingress.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: extensions/v1beta1
2+
kind: Ingress
3+
metadata:
4+
name: http-ingress
5+
annotations:
6+
kubernetes.io/ingress.class: "gce"
7+
spec:
8+
backend:
9+
# This assumes http-svc exists and routes to healthy endpoints.
10+
serviceName: http-svc
11+
servicePort: 80
12+

‎examples/static-ip/gce/gce-static-ip-ingress.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: extensions/v1beta1
2+
kind: Ingress
3+
metadata:
4+
name: static-ip
5+
# Assumes a global static ip with the same name exists.
6+
# You can acquire a static IP by running
7+
# gcloud compute addresses create test-ip --global
8+
annotations:
9+
kubernetes.io/ingress.global-static-ip-name: "test-ip"
10+
kubernetes.io/ingress.class: "gce"
11+
spec:
12+
tls:
13+
# This assumes tls-secret exists.
14+
- secretName: tls-secret
15+
backend:
16+
# This assumes http-svc exists and routes to healthy endpoints.
17+
serviceName: http-svc
18+
servicePort: 80
19+

0 commit comments

Comments
 (0)