IngressController的session stick问题
周末爬坑，IngressController恢复因为镜像下载和版本问题折腾一下午，晚上终于折腾出个眉目。首先，在Kubernetes的service中是可以设置Session Affinity的。例子如下：
# cat rc.yaml
apiVersion: v1
kind: ReplicationController
metadata:
name: helloworld
-service
spec:
replicas:
2 template:
metadata:
labels:
weblogic
-app: "helloworld" version:
"0.1" spec:
containers:
- name: weblogichelloworld image:
1213-helloworld:v2 ports:
- containerPort: 7001
---
apiVersion: v1
kind: Service
metadata:
name: helloworldsvc
labels:
weblogic-app: helloworld
spec:
type: NodePort
ports:
- port: 7001
protocol: TCP
targetPort: 7001
name: http
nodePort: 30005
selector:
weblogic-app: helloworld
sessionAffinity: ClientIP
最核心就是最后那句，会基于客户端访问服务的ip进行hash运算后把同一ip的请求路由到同一个pod.这样通过nodePort方式过来的请求就不会到处分发了。
但这并不意味着通过IngressController过来的请求不会到处发，实际上在gcr.io/google_containers/nginx-ingress-controller:0.61版本就加上了session stick的功能，需要你在
创建Ingress对象的时候添加Annotation,比如:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: dashboard
-weblogic-ingress
annotations:
ingress.kubernetes.io
/affinity: "cookie" ingress.kubernetes.io
/session-cookie-name: "route" ingress.kubernetes.io
/session-cookie-hash: "sha1"
spec:
rules:
- host: helloworld.paic.test http:
paths:
- backend: serviceName: helloworldsvc
servicePort:
7001 path:
/
如何验证这个annotation已经生效了呢？这个问题我折腾了很久，因为按照文档的说法通过
curl -v http://<ingress-svc-address> -H 'Host: example.com'
kubectlexec -n kube-system nginx-ingress-lb-303jx-- curl -v localhost-H'Host: helloworld.test'
全部返回的是404,503,并没有以下的cookie
< Set-Cookie: route=dc89ae303c62a8bfce8bf32f06d27c31f0980ef7; Path=/; HttpOnly
无奈进入IngressController,查看具体的最终Nginx配置
在 /etc/nginx/nginx.conf 中。
https://images2017.cnblogs.com/blog/892532/201711/892532-20171118222418968-260794574.png
而Pod的信息是
https://images2017.cnblogs.com/blog/892532/201711/892532-20171118222432452-2036932162.png
可见Nginx是绕开了Service,直接把pod的ip写入到配置文件，所以也就是Service中的Session Affinity设置应该不起作用。
但Cookie到底有没有设置成功呢，通过chrome访问网站，然后查看Cookie
https://images2017.cnblogs.com/blog/892532/201711/892532-20171118222635577-829162518.png
成功看到，验证的时候也没问题，所以应该配置生效。
最后贴一个ingress-controller的yaml
# cat nginx-ingress-controller.yaml
apiVersion: v1
kind: ReplicationController
metadata:
name: nginx
-ingress-lb labels:
name: nginx
-ingress-lbnamespace: kube-system
spec:
replicas:
1 template:
metadata:
labels:
name: nginx
-ingress-lb annotations:
prometheus.io
/port: '10254' prometheus.io
/scrape: 'true' spec:
terminationGracePeriodSeconds:
60 hostNetwork:
true containers:
- image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.7 name: nginx
-ingress-lb readinessProbe:
httpGet:
path:
/healthz port:
10254 scheme: HTTP
livenessProbe:
httpGet:
path:
/healthz port:
10254 scheme: HTTP
initialDelaySeconds:
10 timeoutSeconds:
1 ports:
- containerPort: 80 hostPort:
80 - containerPort: 443
hostPort: 443
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: KUBERNETES_MASTER
value: http://192.168.0.104:8080
args:
- /nginx-ingress-controller
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
- --apiserver-host=http://192.168.0.104:8080
页:
[1]