Container Service for Kubernetes:Criar e usar um NGINX Ingress

Console

kubectl

1. Obtana coluna KubeConfig for your cluster e use kubectl para conectar-se ao cluster.

2. Crie um arquivo chamado test-deployment-service.yaml com o seguinte conteúdo.

   Arquivo YAML de exemplo

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: coffee
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: coffee
     template:
       metadata:
         labels:
           app: coffee
       spec:
         containers:
         - name: coffee
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: coffee-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: coffee
     type: ClusterIP
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: tea
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: tea
     template:
       metadata:
         labels:
           app: tea
       spec:
         containers:
         - name: tea
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: tea-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: tea
     type: ClusterIP

3. Aplique a configuração para criar o Deployment e o Service.

   kubectl apply -f test-deployment-service.yaml

4. Verifique o status dos coffee and tea Deployments.

   kubectl get deployment coffee tea

   Saída esperada:

   NAME     READY   UP-TO-DATE   AVAILABLE   AGE
   coffee   2/2     2            2           14m
   tea      2/2     2            2           14m

5. Verifique o status dos coffee-svc and tea-svc Services.

   kubectl get service coffee-svc tea-svc

   Saída esperada:

   NAME         TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)   AGE
   coffee-svc   ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m
   tea-svc      ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m

Console

Kubectl

1. Faça login no Certificate Management Service console. No painel de navegação à esquerda, escolha Certificate Management > SSL Certificate Management.

2. Na página Commercial Certificates tab, select the certificate you want to download, e clique em Download na coluna bottom-left corner of the certificate list.

3. Na caixa de diálogo exibida, selecione Nginx como tipo de servidor, baixe o pacote do certificado e descompacte-o.

4. Use o arquivo de certificado baixado (.pem) e o arquivo de chave privada (.key) para criar um Secret.

   kubectl create secret tls nginx-ingress-tls --cert test-nginx-ingress.com.pem --key test-nginx-ingress.com.key -n default

5. Adicione uma configuração TLS ao Ingress test-nginx-ingress . Substitua test-nginx-ingress.com na coluna command with your actual registered domain name.

   kubectl patch ingress test-nginx-ingress -p '{"spec":{"tls":[{"hosts":["test-nginx-ingress.com"],"secretName":"nginx-ingress-tls"}]}}'

6. Verifique o acesso HTTPS criptografado ao caminho do serviço executando o seguinte comando com seu Elastic IP Address real.

   curl -v -k https://8.xxx.xxx.117/coffee -H "Host: test-nginx-ingress.com"

   • Parâmetros:

     • -v: Exibe saída detalhada, incluindo o handshake TLS.

     • -k (ou --insecure): Ignora a verificação do certificado. Use esta opção se estiver usando um certificado autoassinado.

   • Saída esperada:

     ...
     *   Trying 8.xxx.xxx.117:443...
     * Connected to 8.xxx.xxx.117 (8.xxx.xxx.117) port 443
     * ALPN: curl offers h2,http/1.1
     * (304) (OUT), TLS handshake, Client hello (1):
     * (304) (IN), TLS handshake, Server hello (2):
     * (304) (IN), TLS handshake, Unknown (8):
     * (304) (IN), TLS handshake, Certificate (11):
     * (304) (IN), TLS handshake, CERT verify (15):
     * (304) (IN), TLS handshake, Finished (20):
     * (304) (OUT), TLS handshake, Finished (20):
     ...
     <title>Hello World</title>
     ...
     <p><span>Server&nbsp;address:</span> <span>10.xxx.xxx.159:80</span></p>
     <p><span>Server&nbsp;name:</span> <span>coffee-96d4bc87-6cstv</span></p>
     <p class="smaller"><span>Date:</span> <span>14/Aug/2025:09:27:42 +0000</span></p>
     <p class="smaller"><span>URI:</span> <span>/coffee</span></p>
     ...
         <div id="footer">
             <div id="center" align="center">
                 Request ID: fee5fe107106748a35d99a2dbbbc6652<br/>
                 &copy; NGINX, Inc. 2018
             </div>
         </div>
     ...