Kongシリーズ-09-Kong Ingress Controller紹介と入門

15319 ワード

Kongは以前はAdmin APIを使用して管理されていたが、Kongは主に2つのポート管理ポート8001とエージェントポート8000を暴露し、管理Kongは主に上流サービスのためにサービス、Routes、Plugins、Consumerなどのエンティティリソースを配置し、Kongはこれらの構成規則に従って上流サービスの要求をルーティングし、制御した.Kubernetesクラスタ環境では、Admin API方式はKubernetes宣言管理方式にあまり適応していない.KongはKubernetesクラスタ環境でKong Ingress Controllerを発売した.Kong Ingress Controllerは4つのCRDs(CustomResourceDefinitions)を定義し、基本的に元のAdmin APIの各方面をカバーしている.

kongconsumers:Kongのユーザーは、異なるAPIユーザーに異なる消費者IDを提供します.

kongcredentials:Kongユーザーの認証証明書.

kongingresses:エージェントの動作規則を定義し、Ingressの補足構成です.

kongplugins:プラグインの構成.

Kongが作成したCRDs:

kubectl get crds
NAME                                       CREATED AT
kongconsumers.configuration.konghq.com     2019-12-15T08:02:29Z
kongcredentials.configuration.konghq.com   2019-12-15T08:02:29Z
kongingresses.configuration.konghq.com     2019-12-15T08:02:29Z
kongplugins.configuration.konghq.com       2019-12-15T08:02:29Z

以下はKongシリーズ-04-HelmがKong 1.3.0 with PostgreSQL and with Ingress Controlをインストールする環境で、Kong Podにはingress-controllerとkongの2つのコンテナがあることがわかります.Kongは対外的に2つのサービスを提供し、gateway-kong-adminは管理サービスであり、Admin APIをサポートし、gateway-kong-proxyはエージェントサービスであり、この2つのサービスはkongによって提供され、CRDsのAPIインタフェースはingress-controllerコンテナによって提供されている.

kubectl get all -o wide
NAME                                            READY   STATUS      RESTARTS   AGE   IP            NODE        NOMINATED NODE   READINESS GATES
pod/gateway-kong-79498b67b7-plmlm               2/2     Running     5          34d   10.244.1.13   k8s-node1              
pod/gateway-kong-79498b67b7-zcfh6               2/2     Running     5          34d   10.244.2.10   k8s-node2              
pod/gateway-kong-init-migrations-5qdxc          0/1     Completed   0          34d   10.244.1.10   k8s-node1              
pod/gateway-postgresql-0                        1/1     Running     1          34d   10.244.1.14   k8s-node1              

NAME                                  TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                      AGE   SELECTOR
service/gateway-kong-admin            NodePort    10.1.6.70              8444:32444/TCP               34d   app=kong,component=app,release=gateway
service/gateway-kong-proxy            NodePort    10.1.232.237           80:32080/TCP,443:32443/TCP   34d   app=kong,component=app,release=gateway
service/gateway-postgresql            ClusterIP   10.1.161.34            5432/TCP                     34d   app=postgresql,release=gateway,role=master
service/gateway-postgresql-headless   ClusterIP   None                   5432/TCP                     34d   app=postgresql,release=gateway
service/kubernetes                    ClusterIP   10.1.0.1               443/TCP                      34d   

NAME                                                     READY   UP-TO-DATE   AVAILABLE   AGE   CONTAINERS                IMAGES                                                                                        SELECTOR
deployment.apps/gateway-kong                             2/2     2            2           34d   ingress-controller,kong   kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller:0.6.0,kong:1.3   app=kong,component=app,release=gateway

実はKubernetesクラスタにKongとPostgreSQLを直接配置することもできます.それはKong Ingress Controllerをサポートせず、Admin API管理を直接使用すればいいです.
Kong Ingress Controllerの使い方を紹介します.まずKongを空の構成に初期化します.

curl -i http://192.168.1.55:32080/
HTTP/1.1 404 Not Found
Date: Sun, 22 Dec 2019 11:12:00 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 48
Server: kong/1.3.0

{"message":"no Route matched with those values"}

echoサービスを作成します.

vi echo-service.yaml
apiVersion: v1
kind: Service
metadata:
  labels:
    app: echo
  name: echo
spec:
  ports:
  - name: http
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app: echo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: echo
  name: echo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: echo
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: echo
    spec:
      containers:
      - image: e2eteam/echoserver:2.2
        name: echo
        ports:
        - containerPort: 8080
        env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
        resources: {}

kubectl apply -f echo-service.yaml

Ingressを作成し、ルーティングルールを定義します.

vi echo-ingress.yaml
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: echo-ingress
spec:
  rules:
  - http:
      paths:
      - path: /foo
        backend:
          serviceName: echo
          servicePort: 80    

kubectl apply -f echo-ingress.yaml

Ingressルールに従って、echoサービスにアクセスします.

curl -i http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Sun, 22 Dec 2019 11:34:02 GMT
Server: echoserver
X-Kong-Upstream-Latency: 6
X-Kong-Proxy-Latency: 13
Via: kong/1.3.0


Hostname: echo-75cf96d976-4qvx4

Pod Information:
        node name:      k8s-node1
        pod name:       echo-75cf96d976-4qvx4
        pod namespace:  default
        pod IP: 10.244.1.21

Server values:
        server_version=nginx: 1.14.2 - lua: 10015

Request Information:
        client_address=10.244.1.20
        method=GET
        real path=/
        query=
        request_version=1.1
        request_scheme=http
        request_uri=http://192.168.1.55:8080/

Request Headers:
        accept=*/*
        connection=keep-alive
        host=192.168.1.55:32080
        user-agent=curl/7.29.0
        x-forwarded-for=10.244.0.0
        x-forwarded-host=192.168.1.55
        x-forwarded-port=8000
        x-forwarded-proto=http
        x-real-ip=10.244.0.0

Request Body:
        -no body in request-

プラグインの使用方法をもう一度説明します.プラグインはIngressで有効になります.
まずCorrelation IDプラグインを作成します.Correlation IDは、要求ヘッダにUUIDを追加してもよいし、要求応答ペアを追跡するために応答ヘッダに戻ってもよい.

vi correlation-id-plugin.yaml
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: request-id
config:
  header_name: my-request-id
  generator: uuid#counter
  echo_downstream: true
plugin: correlation-id

kubectl apply -f correlation-id-plugin.yaml

新しいIngressを作成し、新しいプラグインをIngressに適用します.注意Correlation IDプラグインは前のIngressに適用されていません.

vi echo-ingress-2.yaml
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: echo-ingress-2
  annotations:
    plugins.konghq.com: request-id
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /bar
        backend:
          serviceName: echo
          servicePort: 80

kubectl apply -f echo-ingress-2.yaml

効果をテストして、/barパスにアクセスして、プラグインが有効になっていることを発見して、要求と応答の中ですべてヘッドmy-request-idを増加しました:6827852 e-c 165-4479-b 5 c 9-a 953 ca 3 ff 69 b 1

curl -i -H "Host: example.com" http://192.168.1.55:32080/bar/sample
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Sat, 18 Jan 2020 10:00:06 GMT
Server: echoserver
my-request-id: 6827852e-c165-4479-b5c9-a953ca3ff69b#1
X-Kong-Upstream-Latency: 5
X-Kong-Proxy-Latency: 166
Via: kong/1.3.0


Hostname: echo-75cf96d976-sl7xs

Pod Information:
        node name:      k8s-node2
        pod name:       echo-75cf96d976-sl7xs
        pod namespace:  default
        pod IP: 10.244.2.12

Server values:
        server_version=nginx: 1.14.2 - lua: 10015

Request Information:
        client_address=10.244.2.10
        method=GET
        real path=/sample
        query=
        request_version=1.1
        request_scheme=http
        request_uri=http://example.com:8080/sample

Request Headers:
        accept=*/*
        connection=keep-alive
        host=example.com
        my-request-id=6827852e-c165-4479-b5c9-a953ca3ff69b#1
        user-agent=curl/7.29.0
        x-forwarded-for=10.244.0.0
        x-forwarded-host=example.com
        x-forwarded-port=8000
        x-forwarded-proto=http
        x-real-ip=10.244.0.0

Request Body:
        -no body in request-

/fooパスにアクセスすると、リクエストヘッダが変更されていないことがわかります.

curl -i http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Sat, 18 Jan 2020 09:59:10 GMT
Server: echoserver
X-Kong-Upstream-Latency: 3
X-Kong-Proxy-Latency: 17
Via: kong/1.3.0


Hostname: echo-75cf96d976-g9db2

Pod Information:
        node name:      k8s-node1
        pod name:       echo-75cf96d976-g9db2
        pod namespace:  default
        pod IP: 10.244.1.15

Server values:
        server_version=nginx: 1.14.2 - lua: 10015

Request Information:
        client_address=10.244.1.13
        method=GET
        real path=/
        query=
        request_version=1.1
        request_scheme=http
        request_uri=http://192.168.1.55:8080/

Request Headers:
        accept=*/*
        connection=keep-alive
        host=192.168.1.55:32080
        user-agent=curl/7.29.0
        x-forwarded-for=10.244.0.0
        x-forwarded-host=192.168.1.55
        x-forwarded-port=8000
        x-forwarded-proto=http
        x-real-ip=10.244.0.0

Request Body:
        -no body in request-

プラグインがServiceで有効になっていることを再確認します.制限速度プラグインRate Limitingは、一定時間以内に要求できる回数を以下のように設定できます.

vi rate-limiting-plugin.yaml
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: rl-by-ip
config:
  minute: 5
  limit_by: ip
  policy: local
plugin: rate-limiting

kubectl apply -f rate-limiting-plugin.yaml

プラグインをServiceで有効にします.

kubectl patch service echo \
  -p '{"metadata":{"annotations":{"plugins.konghq.com": "rl-by-ip
"}}}'

サードパーティ

#HTTP requests with /foo -> Kong enforces rate-limit -> echo server
curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:10 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 4
X-Kong-Upstream-Latency: 3
X-Kong-Proxy-Latency: 4
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:11 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 3
X-Kong-Upstream-Latency: 2
X-Kong-Proxy-Latency: 0
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:13 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 4
X-Kong-Upstream-Latency: 2
X-Kong-Proxy-Latency: 1
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:13 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 3
X-Kong-Upstream-Latency: 2
X-Kong-Proxy-Latency: 3
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:14 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 2
X-Kong-Upstream-Latency: 1
X-Kong-Proxy-Latency: 3
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:14 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 1
X-Kong-Upstream-Latency: 1
X-Kong-Proxy-Latency: 3
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:15 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 0
X-Kong-Upstream-Latency: 1
X-Kong-Proxy-Latency: 2
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 429 Too Many Requests
Date: Sun, 22 Dec 2019 12:01:15 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 37
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 0
Server: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:16 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 2
X-Kong-Upstream-Latency: 3
X-Kong-Proxy-Latency: 5
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:17 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 1
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 4
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:01:17 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 0
X-Kong-Upstream-Latency: 4
X-Kong-Proxy-Latency: 4
Via: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 429 Too Many Requests
Date: Sun, 22 Dec 2019 12:01:17 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 37
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 0
Server: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 429 Too Many Requests
Date: Sun, 22 Dec 2019 12:01:18 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 37
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 0
Server: kong/1.3.0

curl -I http://192.168.1.55:32080/foo
HTTP/1.1 429 Too Many Requests
Date: Sun, 22 Dec 2019 12:01:19 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 37
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 0
Server: kong/1.3.0

/barパスにアクセスすると、2つのプラグインが同時に有効になっていることがわかります.

#HTTP requests with /bar -> Kong enforces rate-limit +   -> echo-server
#   on example.com          injects my-request-id header
curl -I -H "Host: example.com" http://192.168.1.55:32080/bar/sample
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Connection: keep-alive
Date: Sun, 22 Dec 2019 12:10:21 GMT
Server: echoserver
X-RateLimit-Limit-minute: 5
X-RateLimit-Remaining-minute: 4
my-request-id: 0eee7f62-7681-45d7-85b2-3b8f8ff63a0f#3
X-Kong-Upstream-Latency: 11
X-Kong-Proxy-Latency: 27
Via: kong/1.3.0

JavaScriptモード(8):関数【概要】

動的計画総括(一)