k8s服务网关ambassador部署

1、ambassador是datawire开源的服务网关，很好的支持kubernetes。具体详细介绍参考官网：https://www.getambassador.io/about/why-ambassador

本节主要讲述整个部署过程和简单实用，具体详细的资料抢参考官网。

2、部署

本次主要介绍将ambassador部署到自己的kubernetes集群里面，根据官网介绍部署方式有几种：

1）yaml部署，即定义yaml文件，使用kubectl 直接部署

2) helm部署，如果用helm部署则需要在kubernetes中现安装tiller（helm的server端）

yaml部署：

新版本的k8s集群都开启了rbac认证，所以需要提前创建rbac文件，进行授权：

wget   https://getambassador.io/yaml/ambassador/ambassador-rbac.yaml

---
apiVersion: v1
kind: Service
metadata:
  labels:
    service: ambassador-admin
  name: ambassador-admin
  namespace: tiller-world
spec:
  type: NodePort
  ports:
  - name: ambassador-admin
    port:
    targetPort:
  selector:
    service: ambassador---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: ambassador
rules:
- apiGroups: [""]
  resources:
  - services
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:
  - configmaps
  verbs: ["create", "update", "patch", "get", "list", "watch"]
- apiGroups: [""]
  resources:
  - secrets
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:
  - namespaces
  verbs: ["get", "list", "watch"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ambassador
  namespace: tiller-world
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: ambassador
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ambassador
subjects:
- kind: ServiceAccount
  name: ambassador
  namespace: tiller-world
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: ambassador
  namespace: tiller-world
spec:
  replicas:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
        "consul.hashicorp.com/connect-inject": "false"
      labels:
        service: ambassador
    spec:
      serviceAccountName: ambassador
      containers:
      - name: ambassador
        image: quay.io/datawire/ambassador:0.50.-rc5
        resources:
          limits:
            cpu: 200m
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 100Mi
        env:
        - name: AMBASSADOR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        ports:
        - name: http
          containerPort:
        - name: https
          containerPort:
        - name: admin
          containerPort:
        livenessProbe:
          httpGet:
            path: /ambassador/v0/check_alive
            port:
          initialDelaySeconds:
          periodSeconds:
        readinessProbe:
          httpGet:
            path: /ambassador/v0/check_ready
            port:
          initialDelaySeconds:
          periodSeconds:
      restartPolicy: Always

我只修改了部署的namespace，tiller-world这个namespace是创建用helm部署程序用的。

创建角色及权限

kubectl  apply -f  ambassador-rbac.yaml

接下来创建ambassador的service：

暴漏服务有多种方式：LoadBalancer、NodePort、Ingress

这里我们使用NodePort暴漏服务，k8s默认的服务暴漏端口范围是30000～32767，当然这个端口的范围可以在启动apiserver的时候进行修改，指定--service-node-port-range=1-65535，修改为需要的端口范围，最好是不要将常见服务的端口包含在内，否则容易冲突。

# cat ambassador-svc.yaml
---
apiVersion: v1
kind: Service
metadata:
  labels:
    service: ambassador
  name: ambssador
  namespace: tiller-world
spec:
  type: NodePort
  ports:
  - port:
    targetPort:
    nodePort:
  selector:
    service: ambassador

这里采用NodePort方式暴漏到服务器的30009端口。可以根据需要自己制定。

创建一个测试route：

# cat httpbin.yaml
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  annotations:
    getambassador.io/config: |
       ---
       apiVersion: ambassador/v0
       kind: Mapping
       name: httpbin_mapping
       prefix: /httpbin/
       service: httpbin.org:
       host_rewrite: httpbin.org
spec:
  ports:
  - name: httpbin
    port: 

# kubectl apply -f httpbin.yaml

查看部署：

# kubectl get pods -n tiller-world
NAME                             READY   STATUS    RESTARTS   AGE
ambassador-5f66f5fd89-b2tqh      /     Running             138m
ambassador-5f66f5fd89-nbrgj      /     Running             138m
ambassador-5f66f5fd89-qxz55      /     Running             138m

# kubectl get  svc -n tiller-world
NAME               TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
ambassador-admin   NodePort    10.108.245.217   <none>        :/TCP   138m
ambssador          NodePort    10.105.112.156   <none>        :/TCP     104m
httpbin            ClusterIP   10.103.94.31     <none>        /TCP           104m

测试访问：

访问的url：http://ip:30009/httpbin/,ip为kubernetes服务器的ip

部署一个service测试，部署qotm服务：

# cat qotm.yaml
---
apiVersion: v1
kind: Service
metadata:
  name: qotm
  annotations:
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v0
      kind: Mapping
      name: qot_mapping
      prefix: /qotm/
      service: qotm
spec:
  selector:
    app: qotm
  ports:
  - port:
    name: http-qotm
    targetPort: http-api
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: qotm
spec:
  replicas:
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: qotm
    spec:
      containers:
      - name: qotm
        image: datawire/qotm:1.1
        ports:
        - name: http-api
          containerPort:
        resources:
          limits:
            cpu: "0.1"
            memory: 100Mi

kubectl  apply  -f  qotm.yaml

service使用ambassador，只需要在service的定义里面添加注解就可以自动识别：

 annotations:
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v0
      kind: Mapping
      name: qot_mapping
      prefix: /qotm/
      service: qotm

这里使用的是Mapping,uri前缀是/qotm/。详细的配置参考官网：https://www.getambassador.io/reference/mappings

先查看一下部署的服务：

# kubectl get svc  -n tiller-world
NAME               TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
ambassador-admin   NodePort    10.108.245.217   <none>        :/TCP   147m
ambssador          NodePort    10.105.112.156   <none>        :/TCP     113m
httpbin            ClusterIP   10.103.94.31     <none>        /TCP           113m
qotm               ClusterIP   10.108.253.202   <none>        /TCP           72m
tiller-deploy      ClusterIP   10.102.176.214   <none>        /TCP        4h47m

访问地址：http://ip:30009/qotm/

helm部署：

helm repo add datawire https://www.getambassador.io

helm upgrade --install --wait ambassador datawire/ambassador

当然也可以直接将chart  fetch到本地，自己根据需求进行定制：

helm  fetch --name ambassador datawire/ambassador