摘要
Ingress的设计旨在提供一种统一的方式来管理和暴露集群中的服务，以及灵活地配置和调整服务的访问规则。通过与底层的网络实现解耦，Ingress使得服务的部署和调度更加灵活，同时通过SSL/TLS加密和负载均衡等功能，保证了服务的安全和可用性。
其设计和实现涉及以下几个关键点：
- 抽象化和解耦：Ingress通过抽象化网络层面的路由规则，将服务的访问方式与底层的网络实现解耦。这样，服务的部署和调度可以独立于具体的网络配置，并且可以在运行时动态调整和更新路由规则。
- 动态可配置性：Ingress的设计允许管理员在集群运行时根据需求动态配置和管理路由规则，而无需修改后端服务的代码或重新部署服务。这样可以大大简化服务的运维工作，并且提供了更高的灵活性和可扩展性。
- 多协议和多种策略支持：Ingress支持HTTP、HTTPS和TCP等多种协议，并且提供了多种路由策略供管理员选择。例如，基于路径的路由、基于子域名的路由、基于请求头的路由等。这样可以满足不同服务的复杂路由需求，实现更精细的流量调度。
- SSL/TLS加密支持：Ingress提供了对SSL/TLS证书的支持，可以配置在Ingress资源中使用HTTPS协议来保护流量的安全性。这样可以确保在集群内外传输的数据安全，并提供对敏感信息的保护。
- 域名解析和负载均衡：Ingress通过域名解析和负载均衡将外部流量路由到正确的后端服务。DNS解析将域名映射到Ingress Controller的IP地址，然后Ingress Controller将流量根据配置的路由规则分发给对应的后端服务实例，实现请求的负载均衡和高可用性。
- 插件化和扩展性：Ingress的设计允许不同的Cloud Provider或第三方开发者提供自定义的Ingress Controller实现，以适配不同的环境和场景。这样可以满足特定需求，并且为用户提供更多选择。
Simply put
Its design and implementation involve several key aspects:
- Abstraction and Decoupling: Ingress abstracts the network layer routing rules, decoupling the access methods of services from the underlying network implementation. This enables independent deployment and scheduling of services, providing the ability to dynamically adjust and update routing rules at runtime.
- Dynamic Configurability: Ingress allows administrators to dynamically configure and manage routing rules in the cluster based on their requirements, without modifying the code or redeploying the backend services. This simplifies operations and maintenance tasks, while providing higher flexibility and scalability.
- Support for Multiple Protocols and Strategies: Ingress supports multiple protocols such as HTTP, HTTPS, and TCP, and provides various routing strategies for administrators to choose from. For instance, path-based routing, subdomain-based routing, and header-based routing. This enables meeting complex routing requirements and achieving fine-grained traffic routing.
- SSL/TLS Encryption Support: Ingress offers support for SSL/TLS certificates, allowing administrators to configure HTTPS protocol in Ingress resources for securing traffic. This ensures the security of data transmitted within and outside the cluster, providing protection for sensitive information.
- Domain Resolution and Load Balancing: Ingress routes external traffic to the appropriate backend services through domain resolution and load balancing. DNS resolution maps the domain name to the IP address of the Ingress Controller, which then distributes the traffic to the corresponding backend service instances based on the configured routing rules, achieving load balancing and high availability.
- Plugin System and Extensibility: Ingress is designed to allow different cloud providers or third-party developers to provide custom Ingress Controller implementations to adapt to different environments and use cases. This enables meeting specific requirements and provides users with more choices.
In summary, Ingress is designed to offer a unified approach to manage and expose services within a cluster, as well as to flexibly configure and adjust service access rules. By abstracting network implementation, Ingress enables more flexibility in service deployment and scheduling. Through features like SSL/TLS encryption and load balancing, it ensures the security and availability of services.
On the other hand
Once upon a time, in a distant future where technology had evolved to unimaginable heights, a new era of intergalactic communication and connectivity emerged. This era was dominated by a cluster of interconnected celestial entities, known as the Kubernetes Cosmos.
Deep within this cosmic network, there existed a mysterious force called the Ingress. Legends whispered of its power to bridge the gap between the outer universe and the inner realms of the Kubernetes Cosmos. It possessed the ability to shape and control the flow of cosmic energy, directing it towards specific entities within the cluster.
The Ingress, an enigmatic being, appeared as a luminescent portal, radiating ethereal energy that transcended space and time. It was said that the Ingress had the power to listen to the whispers of the stars and understand the desires of the cosmic travelers seeking access to the services within the Kubernetes Universe.
To unlock the true potential of the Ingress, brave sysadmins ventured into the unknown realms of configuration files, armed with knowledge passed down through generations. They invoked the mystical YAML scripts, intricately crafting routing rules that would guide the flow of cosmic energy towards designated services.
As these sysadmins delved deeper into the art of Ingress design, they discovered the artistry of abstraction and decoupling. The Ingress bestowed upon them the power to detach the services from the terrestrial bindings of network implementation. They could shape the destiny of services, dynamically reconfiguring routing rules to adapt to the ever-changing cosmic currents.
Across the Kubernetes Cosmos, administrators gazed at the star-filled skies, their fingers weaving intricate patterns in the command line interfaces. They envisioned HTTP, HTTPS, and TCP protocols harmoniously coexisting, and multiple routing strategies converging into seamless paths. The Ingress allowed them to achieve the impossible, catering to the individual desires of each cosmic voyager.
In the darkest corners of the Kubernetes Universe, where security was paramount, the Ingress emerged as a champion of protection. It wielded the power of SSL/TLS encryption, wrapping the cosmic energy within an impenetrable shield. Sensitive data traversed the vastness of space with utter security, guarded by the Ingress' mystical SSL/TLS certificates.
With each passing epoch, the Ingress evolved, absorbing the wisdom and creativity of the Kubernetes Cosmos' inhabitants. It became a canvas for the creation of custom Ingress Controllers, as developers stretched the boundaries of imagination to sculpt unique implementations. The cosmic energies flowed through these Controllers, shaping the destiny of services in new and unforeseen ways.
Thus, the Ingress continued its journey through the realms of Kubernetes, forever a beacon of connectivity and cosmic harmony. As long as the Kubernetes Cosmos existed, the Ingress would remain a conduit for the exchange of cosmic energies, empowering the denizens of the celestial cluster to unlock the infinite possibilities within.