Container Service for Kubernetes：建立並使用Nginx Ingress對外暴露服務

控制台

kubectl

1. 擷取叢集KubeConfig並通過kubectl工具串連叢集。

2. 建立test-deployment-service.yaml檔案。

   YAML檔案樣本

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: coffee
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: coffee
     template:
       metadata:
         labels:
           app: coffee
       spec:
         containers:
         - name: coffee
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: coffee-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: coffee
     type: ClusterIP
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: tea
     namespace: default
   spec:
     replicas: 2
     selector:
       matchLabels:
         app: tea
     template:
       metadata:
         labels:
           app: tea
       spec:
         containers:
         - name: tea
           image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
           ports:
           - containerPort: 80
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: tea-svc
     namespace: default
   spec:
     ports:
     - port: 80
       targetPort: 80
       protocol: TCP
     selector:
       app: tea
     type: ClusterIP

3. 建立Deployment和Service。

   kubectl apply -f test-deployment-service.yaml

4. 查看coffee和tea的建立進度。

   kubectl get deployment coffee tea

   預期輸出：

   NAME     READY   UP-TO-DATE   AVAILABLE   AGE
   coffee   2/2     2            2           14m
   tea      2/2     2            2           14m

5. 查看coffee-svc和tea-svc服務。

   kubectl get service coffee-svc tea-svc

   預期輸出：

   NAME         TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)   AGE
   coffee-svc   ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m
   tea-svc      ClusterIP   192.168.xxx.xxx   <none>        80/TCP    15m

控制台

kubectl

1. 登入數位憑證管理服務控制台。在左側導覽列，選擇证书管理 > SSL證書管理。

2. 在正式認證頁簽，選中需要下載的認證，在認證列表左下方單擊下載。

3. 在彈出的對話方塊，選擇Nginx伺服器類型下載認證包並解壓。

4. 使用已下載的認證檔案（.pem）和認證私密金鑰檔案（.key）建立保密字典。

   kubectl create secret tls nginx-ingress-tls --cert test-nginx-ingress.com.pem --key test-nginx-ingress.com.key -n default

5. 為test-nginx-ingress路由添加TLS配置。請將命令中的test-nginx-ingress.com替換為實際註冊網域名稱。

   kubectl patch ingress test-nginx-ingress -p '{"spec":{"tls":[{"hosts":["test-nginx-ingress.com"],"secretName":"nginx-ingress-tls"}]}}'

6. 請使用實際的Elastic IP Address，驗證通過HTTPS加密通訊的方式訪問網域名稱及業務路徑生效。

   curl -v -k https://8.xxx.xxx.117/coffee -H "Host: test-nginx-ingress.com"

   • 參數說明：

     • -v：顯示詳細的通訊過程，包括TLS握手資訊等。

     • -k（或 --insecure）：若使用自我簽署憑證可以忽略認證驗證。

   • 預期輸出：

     ...
     *   Trying 8.xxx.xxx.117:443...
     * Connected to 8.xxx.xxx.117 (8.xxx.xxx.117) port 443
     * ALPN: curl offers h2,http/1.1
     * (304) (OUT), TLS handshake, Client hello (1):
     * (304) (IN), TLS handshake, Server hello (2):
     * (304) (IN), TLS handshake, Unknown (8):
     * (304) (IN), TLS handshake, Certificate (11):
     * (304) (IN), TLS handshake, CERT verify (15):
     * (304) (IN), TLS handshake, Finished (20):
     * (304) (OUT), TLS handshake, Finished (20):
     ...
     <title>Hello World</title>
     ...
     <p><span>Server&nbsp;address:</span> <span>10.xxx.xxx.159:80</span></p>
     <p><span>Server&nbsp;name:</span> <span>coffee-96d4bc87-6cstv</span></p>
     <p class="smaller"><span>Date:</span> <span>14/Aug/2025:09:27:42 +0000</span></p>
     <p class="smaller"><span>URI:</span> <span>/coffee</span></p>
     ...
         <div id="footer">
             <div id="center" align="center">
                 Request ID: fee5fe107106748a35d99a2dbbbc6652<br/>
                 &copy; NGINX, Inc. 2018
             </div>
         </div>
     ...