Ingress 面试题

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx-public
spec:
  controller: k8s.io/ingress-nginx        # 关联到哪个 Controller
  parameters:
    apiGroup: k8s.io/v1
    kind: ConfigMap
    name: nginx-public-config              # Controller 特定的配置参数

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"  # 标记为默认

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-rewrite
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2           # 关键
    nginx.ingress.kubernetes.io/use-regex: "true"             # 开启正则匹配
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api(/|$)(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: backend-svc
            port:
              number: 80

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: strip-prefix
spec:
  stripPrefix:
    prefixes: ["/api"]
    forceSlash: false
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: app
spec:
  routes:
  - match: Host(`app.example.com`) && PathPrefix(`/api`)
    kind: Rule
    services:
    - name: backend-svc
      port: 80
    middlewares:
    - name: strip-prefix

apiVersion: v1
kind: Secret
metadata:
  name: app-tls
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-cert>
  tls.key: <base64-encoded-key>
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-app
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.example.com
    - api.example.com
    secretName: app-tls                          # 引用 Secret
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-svc
            port: { number: 80 }

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-account
    solvers:
    - http01:
        ingress:
          class: nginx                          # 通过 Ingress 80 完成 HTTP-01 校验
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-app
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod    # 自动签发
spec:
  tls:
  - hosts: [app.example.com]
    secretName: app-tls                              # cert-manager 自动写回
  rules: ...

nginx.ingress.kubernetes.io/proxy-body-size: 50m              # 上传大小
nginx.ingress.kubernetes.io/proxy-read-timeout: "60"          # 读超时（秒）
nginx.ingress.kubernetes.io/proxy-send-timeout: "60"          # 写超时
nginx.ingress.kubernetes.io/proxy-connect-timeout: "10"       # 连接后端超时
nginx.ingress.kubernetes.io/upstream-keepalive-connections: "100"
nginx.ingress.kubernetes.io/upstream-keepalive-timeout: "60"

nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"         # 后端走 HTTPS
nginx.ingress.kubernetes.io/backend-protocol: "GRPC"          # gRPC 透传
nginx.ingress.kubernetes.io/grpc-backend: "true"

nginx.ingress.kubernetes.io/limit-rps: "100"                 # 每秒请求数
nginx.ingress.kubernetes.io/limit-rpm: "5000"                 # 每分钟请求数
nginx.ingress.kubernetes.io/limit-connections: "100"          # 并发连接数
nginx.ingress.kubernetes.io/limit-rate: "1024"                # 带宽（KB/s）

nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/cors-allow-origin: "https://example.com"
nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, OPTIONS"
nginx.ingress.kubernetes.io/cors-allow-credentials: "true"

nginx.ingress.kubernetes.io/canary: "true"
nginx.ingress.kubernetes.io/canary-weight: "20"
nginx.ingress.kubernetes.io/rewrite-target: /$2

nginx.ingress.kubernetes.io/affinity: "cookie"
nginx.ingress.kubernetes.io/session-cookie-name: "route"
nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-rate-limit
  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "100"          # 单 IP 每秒 100 请求
    nginx.ingress.kubernetes.io/limit-connections: "50"    # 单 IP 最多 50 并发
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port: { number: 80 }

# Ingress Annotation 仅支持：limit-rps / limit-rpm / limit-connections / limit-burst-multiplier
nginx.ingress.kubernetes.io/limit-rps: "10"

# 自定义限流 key（如按 Header / Cookie）需通过 ConfigMap 配合 Snippet
# 在 ConfigMap 中使用 limit-req-key 等自定义 key

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
spec:
  rateLimit:
    average: 100
    burst: 200
    period: 1s

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: api-route
spec:
  http:
  - name: api
    match:
      hosts: [api.example.com]
      paths: ["/api/*"]
    backends:
    - serviceName: api-svc
      servicePort: 80
    plugins:
    - name: limit-count                       # 计数限流
      enable: true
      config:
        count: 100
        time_window: 60
        key: remote_addr
        rejected_code: 429

# GatewayClass（平台管理员）
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
# Gateway（基础设施）
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: prod-gateway
spec:
  gatewayClassName: envoy
  listeners:
  - name: http
    port: 80
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            gateway-access: "true"
# HTTPRoute（应用开发者）
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app-route
  namespace: team-a
spec:
  parentRefs:
  - name: prod-gateway
  hostnames: ["app.example.com"]
  rules:
  - matches:
    - path: { type: PathPrefix, value: /api }
    backendRefs:
    - name: app-svc
      port: 80

- **HPA**：CPU > 70% 或 RPS 突增时自动扩容；MinReplicas ≥ 2 防单点。
- **LoadBalancer 健康检查**：云厂商 LB 配置 `/healthz` 探测，Controller 滚动期间流量平滑。

**2. 容量规划**

- **Controller 资源**：单 Pod 起步 `requests: { cpu: "500m", memory: "1Gi" }`，根据 QPS 调优。
- **Nginx worker 数**：ConfigMap `worker-processes: "auto"`（与 CPU 核数对齐）。
- **共享内存**：`proxy-body-size` 大文件上传需配大 `proxy-buffering` 与 `client-body-buffer-size`。
- **连接数上限**：内核 `net.core.somaxconn` ≥ 65535，`net.ipv4.tcp_max_syn_backlog` 同步调大。

**3. 可观测性**

- **Metrics**：开启 Prometheus `/metrics`（v1.9+ 默认启用，端口 **10254**，与 Nginx 业务端口隔离），关键指标 `nginx_ingress_controller_requests`、`nginx_ingress_controller_request_duration_seconds`。Helm 部署需配置 `controller.metrics.serviceMonitor.enabled=true` 才能被 Prometheus Operator 自动发现。
- **日志**：access log 输出 JSON 格式（`log-format-upstream` 自定义），接 Loki/ES，包含 `request_id`、`upstream_addr`、`upstream_response_time`。
- **Tracing**：开启 OpenTelemetry（OTel）透传，关联后端 TraceID。
- **Dashboard**：Grafana 官方 Dashboard ID 9614（nginx-ingress）。

**4. 安全加固**

- **真实 IP 透传**：`use-forwarded-headers: "true"` + `compute-full-forwarded-for: "true"`，后端 Service 用 `X-Forwarded-For` 取客户端真实 IP。
- **关闭 SNAT**（保留客户端源 IP）：`Service.spec.externalTrafficPolicy: Local`（K8s 层），或 ingress-nginx 启动参数 `--enable-snat=false`（v1.10+ 默认已为 false）。注意 `enable-ssl-chain-completion` 是 NGINX Plus 的**证书链补全**参数，与 SNAT 无关，**不可**用作 SNAT 关闭。
- **真实 IP 透传**：`use-forwarded-headers: "true"` + `compute-full-forwarded-for: "true"`，后端 Service 用 `X-Forwarded-For` 取客户端真实 IP。
- **WAF 联动**：与 ModSecurity/Coraza 集成（ingress-nginx 通过 Sidecar 注入），防 SQL 注入/XSS。
- **Admin API 隔离**：Nginx Plus / APISIX / Kong 的 Admin API 绝不暴露公网，必须走 `kubectl port-forward` 或内网 Ingress。

**5. 配置管理**

- **GitOps 化**：所有 Ingress YAML 入 Git（ArgoCD/Flux），避免 `kubectl apply` 漂移。
- **变更审计**：Critical 路径（支付、登录）配置变更需 Code Review + 灰度。
- **回滚预案**：Controller 升级或 ConfigMap 变更失败时，5 分钟内一键回滚（Git 仓库 + ArgoCD 同步窗口）。

**6. 灰度与多环境**

- **环境隔离**：dev/staging/prod 用 **独立 IngressClass + 独立 Controller + 独立 LB**，避免测试流量污染生产。
- **Header 灰度**：使用 `canary-by-header`（如 `X-Canary: true`）做内部人员先行验证，再按权重放量。
- **流量录制**：生产环境通过 **ingress-nginx + go-httpbin** 录制真实流量到 staging 回放。

# 1. 确认 Controller 状态
kubectl -n ingress-nginx get pods -l app.kubernetes.io/name=ingress-nginx

# 2. 查看 Ingress 是否被接管
kubectl describe ingress <name> | grep -A 5 "Events"
kubectl describe ingress <name> | grep "Class"

# 3. 看 Controller 渲染后的 Nginx 配置
kubectl -n ingress-nginx exec <pod> -- cat /etc/nginx/nginx.conf | less

# 4. 验证 Service 后端 Endpoints
kubectl get endpoints <svc-name> -o wide
kubectl get pod -l app=<label> -o wide

# 5. 从 Controller Pod 内访问后端 Service
kubectl -n ingress-nginx exec <pod> -- curl -v http://<svc>.<ns>.svc.cluster.local/

# 6. 抓包看真实流量
kubectl -n ingress-nginx exec <pod> -- tcpdump -i eth0 -nn -s 0 -w /tmp/cap.pcap port 80

# 7. 看 access log 实时
kubectl -n ingress-nginx logs -f <pod> | grep "<host>"
```text

**应急止血：**

- 路由异常：临时回滚 Ingress YAML（`kubectl rollout undo` ArgoCD Application）。
- Controller 故障：`kubectl -n ingress-nginx rollout restart deployment` 触发滚动重启。
- 证书过期：`kubectl create secret tls` 临时续命，配合 cert-manager 排查续期失败原因。

**生产排障原则：**

- 任何变更**先在 staging 复现**，再在生产动手。
- 变更前后**对比 metric**（QPS / P99 latency / 5xx rate），避免"修了 A 坏了 B"。
- **保留现场**：Controller 故障时先 `kubectl describe` + `kubectl logs --previous`，不要急着重启。