我有一个带有NGINX Ingress控制器的Kubernetes集群。在集群中,我部署了一个Gitea POD。Web UI和HTTPS访问通过类似于这个的Ingress对象公开:
---
kind: Service
apiVersion: v1
metadata:
name: gitea-service
namespace: gitea-repo
spec:
selector:
app: gitea
ports:
- name: gitea-http
port: 3000
- name: gitea-ssh
port: 22
---
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
name: git-tls
namespace: gitea-repo
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
tls:
- hosts:
- git.foo.com
secretName: tls-gitea
rules:
- host: git.foo.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: gitea-service
port:
number: 3000
对于HTTPS,这一切都很好。
但是Gitea还通过22端口提供SSH访问。我的问题是,我该如何告诉NGINX Ingress Controller也将22端口路由到我的pod?
据我所知,我应该使用类似以下内容修补我的NGINX控制器部署:
spec:
template:
spec:
containers:
- name: controller
# defind cusotm tcp/udp configmap
args:
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-configmap-giteassh
ports:
- name: ssh
containerPort: 22
protocol: TCP
并提供一个配置映射,指向我的gitea服务:
apiVersion: v1
kind: ConfigMap
metadata:
name: tcp-configmap-giteassh
namespace: ingress-nginx
data:
22: "gitea-repo/gitea-service:22"
现在我的Gitea POD是否还需要额外的Ingress配置?
我想知道这是否是正确的方法。为什么我被迫在NGINX控制器中定义它,而不是像HTTP一样在我的POD命名空间中定义呢?这意味着对于每个暴露TCP端口而非HTTP的POD,我都必须调整我的Ingress NGINX Controller吗?