Building Production Topology with Google Cloud - Part 5
In
this chapter, we would deploy Nginx Ingress Controller instead of GCE.
NGINX, by default, provides a lot of additional
capabilities as compared to the default GKE Ingress controller like URL
rewriting, whitelisting, load balancing over HTTPS and websocket and advanced
features through Nginx Plus. For details, refer to https://www.nginx.com/products/nginx/.
It is assumed that you have executed Step 1 - 7 as per the previous article.
Install Nginx Ingress
The first step is to install Nginx Ingress in our
cluster. Navigate to Cloud Console - > Kubernetes Engine -> Cluster.
Click on the connect button for backend-cluster. This will launch the cloud
shell as shown below. Click ok to Run in cloud shell to connect to the
backend-cluster.
Figure 35: Cloud Shell
Next, we will install Helm which allows us to install and manage Kubernetes applications and resources effectively. Helm has two parts: a client (helm) which runs on cloud shell and a server
(tiller) which runs inside of the kubernetes cluster and manages the
installation.
Install the latest version of Helm by running the
following command:
curl -o get_helm.sh https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get
chmod +x get_helm.sh
./get_helm.sh
Next, we would Install Tiller. Run the following
commands to install the server-side tiller to the Kubernetes cluster. The below
command creates a service account and the cluster-admin role to manage the
cluster.
kubectl create serviceaccount —namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule —clusterrole=cluster-admin
—serviceaccount=kube-system:tiller
helm init —service-account tiller
The following image shows the command
interactions and output at the google cloud shell.
Figure 36: Cloud Shell -> Installation of Helm
Next, we will install the Nginx Ingress through
Helm. Installing Nginx Ingress will configure a Service type of LoadBalancer in
our cluster which will route all the incoming requests as per the rules you
define in the deployment file (we will look at this later while deploying the
ingress.yaml file).
LoadBalancer should listen over an IP. The IP can
be automatically assigned by the network system or you can create a static IP
address and use the ip address while installing Nginx. We will create a static IP
address since this IP address can then be mapped to your domain name where you
want to expose the service for public consumption (i.e. similar to domain like api.naveenbalani.dev
that we went through in Solution 1). SSL certificate can also be installed on
the domain, so you can receive HTTPS requests.
Create a static IP address of type Regional and
select the region (select the same region as that of your VPN). Please note
that Global Type would not work with Nginx Ingress LoadBalancer. Following
image shows the configuration.
Figure 37: Create Static IP
Create the IP and note the IP address.
Next, go back to cloud shell and install
Nginx Ingress by running the following command. Replace 35.231.11.11 by the IP
from the earlier step.
helm install —name nginx-ingress stable/nginx-ingress \
—set
controller.service.loadBalancerIP=35.231.11.11\
—set rbac.create=true \
—set
controller.publishService.enabled=true
The above command would create a Nginx
Ingress Controller of type HTTP Load Balancer at 35.231.11.11.
You can also enable SSL while installing
Nginx Ingress. If you have an SSL certificate for your domain, you can enable
SSL while installing Nginx ingress.
First, you need to create the secret
based on your domain certificate and private key.
kubectl create secret tls backend-api-ssl-secret \
—cert /Users/navveenbalani/<domain.com>/certificate.crt —key
/Users/navveenbalani/<domain.com>/private.key
Next, you need to reference the
backend-api-ssl-secret while installing Nginx Ingress. Use the following
command to enable SSL during installation:
helm install —name nginx-ingress
stable/nginx-ingress \
—set
controller.service.loadBalancerIP=35.231.11.11\
—set rbac.create=true \
—set
controller.publishService.enabled=true \
—set controller.extraArgs.default-ssl-
certificate=default/backend-ssl-secret
After running the command, you should get the following
message on the console:
The nginx-ingress controller has been installed.
*It may take a few minutes for the LoadBalancer IP
to be available.*
To see the status of the Nginx Ingress
controller, run the following command:
kubectl —namespace default get services -o wide -w nginx-ingress-controller
If you see an external IP (the one that we
provided earlier), that implies the Nginx Controller is listening on the
configured external IP.
Figure 38: Nginx Ingress Status
If you navigate to Kubernetes Engine ->
Service & Ingress, you will see nginx-ingress-controller listening on the
ip address that we configured earlier as shown in the figure below. You would
also see a service named “nginx-ingress-default-backend”. The nginx-ingress-default-backend
service provides default backend which handles all URL paths and hosts the nginx controller doesn’t
understand (i.e., all the requests that are not mapped with an Ingress).
Basically, a default backend exposes two URLs: - /healthz that returns 200 and / that return 404. You can use the Nginx default backend service
for the health check instead of providing your own heath check service implementation,
that we discussed earlier in Solution 1.
Figure 39: Nginx Ingress Status in Cloud Console
With the Ingress controller setup, we would
execute the deployment scripts.