wangbo
2c7ed905a9
为本地三节点验收补齐 Gateway 内部 DNS、TLS CA 信任与端口映射，并让仅限验收命名空间的网络故障代理以所需 UID 获取 NET_ADMIN。\n\n验证：bash -n、ShellCheck、K3d 三节点实测。
173 lines
4.4 KiB
YAML
173 lines
4.4 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: easyai-acceptance-tls-edge
|
|
namespace: easyai
|
|
data:
|
|
default.conf: |
|
|
server {
|
|
listen 8443 ssl;
|
|
server_name gateway.easyai.local;
|
|
client_max_body_size 128m;
|
|
proxy_request_buffering off;
|
|
proxy_read_timeout 900s;
|
|
ssl_certificate /etc/acceptance-tls/tls.crt;
|
|
ssl_certificate_key /etc/acceptance-tls/tls.key;
|
|
location / {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_pass http://LOCAL_API_SERVICE.easyai.svc.cluster.local:8088;
|
|
}
|
|
}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: easyai-acceptance-edge-ningbo
|
|
namespace: easyai
|
|
labels:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: ningbo
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: ningbo
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: ningbo
|
|
spec:
|
|
nodeSelector:
|
|
easyai.io/site: ningbo
|
|
containers:
|
|
- name: edge
|
|
image: easyai-web
|
|
command:
|
|
- /bin/sh
|
|
- -ec
|
|
- sed 's/LOCAL_API_SERVICE/api-ningbo-edge/g' /etc/acceptance-edge/default.conf > /etc/nginx/conf.d/default.conf && exec nginx -g 'daemon off;'
|
|
ports:
|
|
- name: https
|
|
containerPort: 8443
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/acceptance-edge
|
|
readOnly: true
|
|
- name: nginx-config
|
|
mountPath: /etc/nginx/conf.d
|
|
- name: tls
|
|
mountPath: /etc/acceptance-tls
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: easyai-acceptance-tls-edge
|
|
- name: tls
|
|
secret:
|
|
secretName: easyai-acceptance-tls
|
|
- name: nginx-config
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: easyai-acceptance-edge-ningbo
|
|
namespace: easyai
|
|
spec:
|
|
type: NodePort
|
|
externalTrafficPolicy: Local
|
|
selector:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: ningbo
|
|
ports:
|
|
- name: https
|
|
port: 443
|
|
targetPort: https
|
|
nodePort: 31088
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: easyai-acceptance-edge-hongkong
|
|
namespace: easyai
|
|
labels:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: hongkong
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: hongkong
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: hongkong
|
|
spec:
|
|
nodeSelector:
|
|
easyai.io/site: hongkong
|
|
containers:
|
|
- name: edge
|
|
image: easyai-web
|
|
command:
|
|
- /bin/sh
|
|
- -ec
|
|
- sed 's/LOCAL_API_SERVICE/api-hongkong-edge/g' /etc/acceptance-edge/default.conf > /etc/nginx/conf.d/default.conf && exec nginx -g 'daemon off;'
|
|
ports:
|
|
- name: https
|
|
containerPort: 8443
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/acceptance-edge
|
|
readOnly: true
|
|
- name: nginx-config
|
|
mountPath: /etc/nginx/conf.d
|
|
- name: tls
|
|
mountPath: /etc/acceptance-tls
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: easyai-acceptance-tls-edge
|
|
- name: tls
|
|
secret:
|
|
secretName: easyai-acceptance-tls
|
|
- name: nginx-config
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: easyai-acceptance-edge-hongkong
|
|
namespace: easyai
|
|
spec:
|
|
type: NodePort
|
|
externalTrafficPolicy: Local
|
|
selector:
|
|
app.kubernetes.io/name: easyai-acceptance-edge
|
|
easyai.io/site: hongkong
|
|
ports:
|
|
- name: https
|
|
port: 443
|
|
targetPort: https
|
|
nodePort: 31089
|