Zenn
🐙

NGINX Ingress Controller で 22番ポートを公開する

2022/11/24に公開
Kubernetes
ingress
tech

マニフェストをダウンロード

curl -LO https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/baremetal/deploy.yaml

公開ポートを追加

vim deploy.yaml

350行目あたりのServiceのingress-nginx-controller 

  - appProtocol: ssh
    name: ssh
    port: 22
    protocol: TCP
    targetPort: 22

を追記します。

  apiVersion: v1
  kind: Service
  metadata:
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      app.kubernetes.io/version: 1.5.1
    name: ingress-nginx-controller
    namespace: ingress-nginx
  spec:
    ipFamilies:
    - IPv4
    ipFamilyPolicy: SingleStack
    ports:
    - appProtocol: http
      name: http
      port: 80
      protocol: TCP
      targetPort: http
    - appProtocol: https
      name: https
      port: 443
      protocol: TCP
      targetPort: https
+   - appProtocol: ssh
+     name: ssh
+     port: 22
+     protocol: TCP
+     targetPort: 22
    selector:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
    type: NodePort

410行目あたりのDeploymentのingress-nginx-controller 

        - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services

と

        - containerPort: 22
          name: ssh
          protocol: TCP

を追記します。

  apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
      app.kubernetes.io/version: 1.5.1
    name: ingress-nginx-controller
    namespace: ingress-nginx
  spec:
    minReadySeconds: 0
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
    template:
      metadata:
        labels:
          app.kubernetes.io/component: controller
          app.kubernetes.io/instance: ingress-nginx
          app.kubernetes.io/name: ingress-nginx
      spec:
        containers:
        - args:
          - /nginx-ingress-controller
          - --election-id=ingress-nginx-leader
          - --controller-class=k8s.io/ingress-nginx
          - --ingress-class=nginx
          - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
          - --validating-webhook=:8443
          - --validating-webhook-certificate=/usr/local/certificates/cert
          - --validating-webhook-key=/usr/local/certificates/key
+         - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: LD_PRELOAD
            value: /usr/local/lib/libmimalloc.so
          image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
          imagePullPolicy: IfNotPresent
          lifecycle:
            preStop:
              exec:
                command:
                - /wait-shutdown
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          name: controller
          ports:
          - containerPort: 80
            name: http
            protocol: TCP
          - containerPort: 443
            name: https
            protocol: TCP
          - containerPort: 8443
            name: webhook
            protocol: TCP
+         - containerPort: 22
+           name: ssh
+           protocol: TCP

Serviceに紐付ける

22番ポート宛のパケットをルーティングしたいK8s上のServiceと紐付けるためのConfigMapを作成します。

vim tcp-services.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: tcp-services
  namespace: ingress-nginx
data:
  22: "<namespace>/<service>:22"

"<namespace>/<service>:22"には22番ポート宛のパケットをルーティングしたいK8s上のServiceを記述します。

yamlをapplyする

kubectl apply -f deploy.yaml
kubectl apply -f tcp-services.yaml

参考

Discussion