当前位置：首页 > news >正文

k8s:利用kubectl部署nginx

news 2025/7/27 8:09:32

本文介绍了在离线环境下基于Hygon C86处理器和麒麟操作系统部署HTTPS服务的完整流程。首先通过CA签发服务器证书并创建Kubernetes Secret存储证书密钥，然后配置Nginx服务（包含HTTP/HTTPS监听端口），接着创建PV/PVC存储和部署Nginx容器，最后通过NodePort服务暴露端口。关键步骤包括：1)使用ConfigMap管理Nginx配置；2)通过Secret挂载TLS证书；3)绑定本地存储路径；4)实现双端口(80/443)服务暴露。最终可通过NodePort端口同时提供HTTP和HTTPS访问。

一.离线环境

CPU:Hygon C86 7285 32-core Processor
操作系统：麒麟操作系统
containerd：1.7.27
Kubernetes:1.26.12
KubeSphere:4.1.2
kubekey：3.1.10
Harbor:2.13.1

二、CA 签发服务器证书

详见通过HTTPS访问Harbor的配置《生成服务器证书》

三、创建 Kubernetes Secret 来存储证书和密钥

kubectl create secret tls nginx-tls \
--cert=/app/cert/172.23.123.117.crt \
--key=/app/cert/172.23.123.117.key

四、创建 Nginx 配置文件（ConfigMap）

apiVersion: v1

kind: ConfigMap

metadata:

  name: nginx-conf

  namespace: default

data:

  nginx.conf: |

    user nginx;

    worker_processes auto;

    error_log /var/log/nginx/error.log notice;

    pid        /var/run/nginx.pid;

    events {

        worker_connections 1024;

    }

    http {

        include       /etc/nginx/mime.types;

        default_type application/octet-stream;

        sendfile        on;

        keepalive_timeout 65;

        server {

            listen       80;

            server_name localhost;

            location / {

                root   /usr/share/nginx/html;

                index index.html index.htm;

            }

            error_page   500 502 503 504 /50x.html;

            location = /50x.html {

                root   /usr/share/nginx/html;

            }

        }

        server {

            listen              443 ssl;

            server_name         localhost;

            ssl_certificate     /etc/nginx/tls/tls.crt;

            ssl_certificate_key /etc/nginx/tls/tls.key;

            ssl_protocols       TLSv1.2 TLSv1.3;

            ssl_prefer_server_ciphers on;

            location / {

                root   /usr/share/nginx/html;

                index index.html index.htm;

            }

        }

    }

这里我们定义了两个 server 块：一个监听 HTTP 请求（端口 80），另一个监听 HTTPS 请求（端口 443）。HTTPS 服务器块中指定了证书和密钥的位置。

五、创建PV

apiVersion: v1

kind: PersistentVolume

metadata:

  name: webapp-pv

spec:

  capacity:

    storage: 10Gi

  accessModes:

    - ReadWriteOnce

  persistentVolumeReclaimPolicy: Retain

  storageClassName: local

  local:

    path: /app/data

  nodeAffinity:

    required:

      nodeSelectorTerms:

      - matchExpressions:

        - key: kubernetes.io/hostname

          operator: In

          values:

          - node2

六、创建PVC

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

  name: webapp-pvc

spec:

  volumeName: webapp-pv

  accessModes:

    - ReadWriteOnce

  storageClassName: local

  resources:

    requests:

      storage: 10Gi

七、创建Deploy

apiVersion: apps/v1

kind: Deployment

metadata:

  name: nginx

spec:

  replicas: 1

  selector:

    matchLabels:

      app: nginx

  template:

    metadata:

      labels:

        app: nginx

    spec:

      containers:

      - name: nginx

        image: 172.23.123.117:8443/library/nginx:latest

        ports:

        - containerPort: 80

        - containerPort: 443

        volumeMounts:

        - name: webapp

          mountPath: /usr/share/nginx/html

        - name: nginx-config

          mountPath: /etc/nginx/nginx.conf

          subPath: nginx.conf

        - name: nginx-tls

          mountPath: /etc/nginx/tls

          readOnly: true

      volumes:

        - name: webapp

          persistentVolumeClaim:

             claimName: webapp-pvc

        - name: nginx-config

          configMap:

              name: nginx-conf

        - name: nginx-tls

          secret:

           secretName: nginx-tls

将 ConfigMap 和 Secret 分别挂载到了 /etc/nginx/nginx.conf 和 /etc/nginx/tls 路径下

八、创建Service

apiVersion: v1

kind: Service

metadata:

  name: nginx-service

spec:

  selector:

    app: nginx

  ports:

    - protocol: TCP

      port: 80

      targetPort: 80

    - protocol: TCP

      port: 443

      targetPort: 443

  type: NodePort