Kubernetes 之Ingress 从基础到实战全解析

一、Ingress 核心概念

1.Ingress是什么?

本质：管理外部 HTTP/HTTPS 流量访问集群内服务的 API 资源对象（七层路由），但不是k8s核心组件的组成部分，在k8s中是可选的，通常以pod形式部署。作用：提供负载均衡、SSL/TLS 终止、基于名称的虚拟主机等。类比： 集群的“智能路由器”或“门户守卫”，根据规则（主机名、路径）将请求分发给不同的后端 Service。

2.为什么需要Ingress？

Service (NodePort/LoadBalancer) 主要解决四层 (TCP/UDP) 访问，缺乏应用层（HTTP）的路由能力（如按域名、路径转发），而Ingress刚好解决了这一点。避免为每个微服务创建昂贵的云负载均衡器。 集中管理外部访问入口和安全策略（如 TLS）。

3.Ingress核心组件

Ingress 资源 (Resource)：定义路由规则的 YAML 文件（声明期望状态）。Ingress 控制器 (Controller)： Ingress Controller 是 Kubernetes 官方设计模式下的标准扩展组件， 实际执行规则的Pod。负责监听 Ingress 资源变化，配置底层的负载均衡器（如 Nginx, Envoy, HAProxy, 云厂商的 LB）或代理来实现规则。Ingress 资源本身不工作，必须配合控制器！

4. Ingress VS Service

特性IngressService工作层应用层 (L7 - HTTP/HTTPS)传输层 (L4 - TCP/UDP/SCTP)路由能力基于主机名、路径、Header仅基于端口和 ClusterIP协议HTTP, HTTPS, gRPC (部分)任意 TCP/UDP实现依赖独立的 Ingress 控制器kube-proxy (iptables/IPVS) 或云 LB主要目的外部 HTTP(S) 流量入口管理集群内部服务发现与负载均衡，暴露端口

5.常用控制器

常用有 Nginx Ingress Controller, Contour, HAProxy Ingress, Traefik等，下面我们采用Nginx Ingress Controller部署。

二、部署Nginx Ingress Controller

1.通过 kubectl 直接部署

1.1 下载官方yaml文件

#下载文件

[root@master-1 ingress]# wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.10.0/deploy/static/provider/cloud/deploy.yaml

1.2 修改关键配置

#修改部署 YAML 中的 image 字段

registry.aliyuncs.com/google_containers/nginx-ingress-controller:v1.10.0

registry.aliyuncs.com/google_containers/kube-webhook-certgen:v1.4.0

#修改service类型

# type: LoadBalancer

type: NodePort

#修改deploy使用宿主机端口

kind: Deployment

...

ports:

- containerPort: 80

name: http

hostPort: 80

protocol: TCP

- containerPort: 443

name: https

hostPort: 443

protocol: TCP

1.3 部署

[root@master-1 ingress]# cat nginx-deploy.yaml

apiVersion: v1

kind: Namespace

metadata:

labels:

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

name: ingress-nginx

---

apiVersion: v1

automountServiceAccountToken: true

kind: ServiceAccount

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx

namespace: ingress-nginx

---

apiVersion: v1

kind: ServiceAccount

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission

namespace: ingress-nginx

---

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx

namespace: ingress-nginx

rules:

- apiGroups:

- ""

resources:

- namespaces

verbs:

- get

- apiGroups:

- ""

resources:

- configmaps

- pods

- secrets

- endpoints

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

- services

verbs:

- get

- list

- watch

- apiGroups:

- networking.k8s.io

resources:

- ingresses

verbs:

- get

- list

- watch

- apiGroups:

- networking.k8s.io

resources:

- ingresses/status

verbs:

- update

- apiGroups:

- networking.k8s.io

resources:

- ingressclasses

verbs:

- get

- list

- watch

- apiGroups:

- coordination.k8s.io

resourceNames:

- ingress-nginx-leader

resources:

- leases

verbs:

- get

- update

- apiGroups:

- coordination.k8s.io

resources:

- leases

verbs:

- create

- apiGroups:

- ""

resources:

- events

verbs:

- create

- patch

- apiGroups:

- discovery.k8s.io

resources:

- endpointslices

verbs:

- list

- watch

- get

---

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission

namespace: ingress-nginx

rules:

- apiGroups:

- ""

resources:

- secrets

verbs:

- get

- create

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

labels:

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx

rules:

- apiGroups:

- ""

resources:

- configmaps

- endpoints

- nodes

- pods

- secrets

- namespaces

verbs:

- list

- watch

- apiGroups:

- coordination.k8s.io

resources:

- leases

verbs:

- list

- watch

- apiGroups:

- ""

resources:

- nodes

verbs:

- get

- apiGroups:

- ""

resources:

- services

verbs:

- get

- list

- watch

- apiGroups:

- networking.k8s.io

resources:

- ingresses

verbs:

- get

- list

- watch

- apiGroups:

- ""

resources:

- events

verbs:

- create

- patch

- apiGroups:

- networking.k8s.io

resources:

- ingresses/status

verbs:

- update

- apiGroups:

- networking.k8s.io

resources:

- ingressclasses

verbs:

- get

- list

- watch

- apiGroups:

- discovery.k8s.io

resources:

- endpointslices

verbs:

- list

- watch

- get

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission

rules:

- apiGroups:

- admissionregistration.k8s.io

resources:

- validatingwebhookconfigurations

verbs:

- get

- update

---

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx

namespace: ingress-nginx

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: Role

name: ingress-nginx

subjects:

- kind: ServiceAccount

name: ingress-nginx

namespace: ingress-nginx

---

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission

namespace: ingress-nginx

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: Role

name: ingress-nginx-admission

subjects:

- kind: ServiceAccount

name: ingress-nginx-admission

namespace: ingress-nginx

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

labels:

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: ingress-nginx

subjects:

- kind: ServiceAccount

name: ingress-nginx

namespace: ingress-nginx

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: ingress-nginx-admission

subjects:

- kind: ServiceAccount

name: ingress-nginx-admission

namespace: ingress-nginx

---

apiVersion: v1

data:

allow-snippet-annotations: "false"

kind: ConfigMap

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-controller

namespace: ingress-nginx

---

apiVersion: v1

kind: Service

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-controller

namespace: ingress-nginx

spec:

externalTrafficPolicy: Local

ipFamilies:

- IPv4

ipFamilyPolicy: SingleStack

ports:

- appProtocol: http

name: http

port: 80

protocol: TCP

targetPort: http

- appProtocol: https

name: https

port: 443

protocol: TCP

targetPort: https

selector:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

type: NodePort

---

apiVersion: v1

kind: Service

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-controller-admission

namespace: ingress-nginx

spec:

ports:

- appProtocol: https

name: https-webhook

port: 443

targetPort: webhook

selector:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

type: ClusterIP

---

apiVersion: apps/v1

kind: Deployment

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-controller

namespace: ingress-nginx

spec:

minReadySeconds: 0

revisionHistoryLimit: 10

selector:

matchLabels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

strategy:

rollingUpdate:

maxUnavailable: 1

type: RollingUpdate

template:

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

spec:

containers:

- args:

- /nginx-ingress-controller

- --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller

- --election-id=ingress-nginx-leader

- --controller-class=k8s.io/ingress-nginx

- --ingress-class=nginx

- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller

- --validating-webhook=:8443

- --validating-webhook-certificate=/usr/local/certificates/cert

- --validating-webhook-key=/usr/local/certificates/key

- --enable-metrics=false

env:

- name: POD_NAME

valueFrom:

fieldRef:

fieldPath: metadata.name

- name: POD_NAMESPACE

valueFrom:

fieldRef:

fieldPath: metadata.namespace

- name: LD_PRELOAD

value: /usr/local/lib/libmimalloc.so

image: registry.aliyuncs.com/google_containers/nginx-ingress-controller:v1.10.0

imagePullPolicy: IfNotPresent

lifecycle:

preStop:

exec:

command:

- /wait-shutdown

livenessProbe:

failureThreshold: 5

httpGet:

path: /healthz

port: 10254

scheme: HTTP

initialDelaySeconds: 10

periodSeconds: 10

successThreshold: 1

timeoutSeconds: 1

name: controller

ports:

- containerPort: 80

name: http

hostPort: 80

protocol: TCP

- containerPort: 443

name: https

hostPort: 443

protocol: TCP

- containerPort: 8443

name: webhook

protocol: TCP

readinessProbe:

failureThreshold: 3

httpGet:

path: /healthz

port: 10254

scheme: HTTP

initialDelaySeconds: 10

periodSeconds: 10

successThreshold: 1

timeoutSeconds: 1

resources:

requests:

cpu: 100m

memory: 90Mi

securityContext:

allowPrivilegeEscalation: false

capabilities:

add:

- NET_BIND_SERVICE

drop:

- ALL

readOnlyRootFilesystem: false

runAsNonRoot: true

runAsUser: 101

seccompProfile:

type: RuntimeDefault

volumeMounts:

- mountPath: /usr/local/certificates/

name: webhook-cert

readOnly: true

dnsPolicy: ClusterFirst

nodeSelector:

kubernetes.io/os: linux

serviceAccountName: ingress-nginx

terminationGracePeriodSeconds: 300

volumes:

- name: webhook-cert

secret:

secretName: ingress-nginx-admission

---

apiVersion: batch/v1

kind: Job

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission-create

namespace: ingress-nginx

spec:

template:

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission-create

spec:

containers:

- args:

- create

- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc

- --namespace=$(POD_NAMESPACE)

- --secret-name=ingress-nginx-admission

env:

- name: POD_NAMESPACE

valueFrom:

fieldRef:

fieldPath: metadata.namespace

image: registry.aliyuncs.com/google_containers/kube-webhook-certgen:v1.4.0

imagePullPolicy: IfNotPresent

name: create

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsUser: 65532

seccompProfile:

type: RuntimeDefault

nodeSelector:

kubernetes.io/os: linux

restartPolicy: OnFailure

serviceAccountName: ingress-nginx-admission

---

apiVersion: batch/v1

kind: Job

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission-patch

namespace: ingress-nginx

spec:

template:

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission-patch

spec:

containers:

- args:

- patch

- --webhook-name=ingress-nginx-admission

- --namespace=$(POD_NAMESPACE)

- --patch-mutating=false

- --secret-name=ingress-nginx-admission

- --patch-failure-policy=Fail

env:

- name: POD_NAMESPACE

valueFrom:

fieldRef:

fieldPath: metadata.namespace

image: registry.aliyuncs.com/google_containers/kube-webhook-certgen:v1.4.0

imagePullPolicy: IfNotPresent

name: patch

securityContext:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsUser: 65532

seccompProfile:

type: RuntimeDefault

nodeSelector:

kubernetes.io/os: linux

restartPolicy: OnFailure

serviceAccountName: ingress-nginx-admission

---

apiVersion: networking.k8s.io/v1

kind: IngressClass

metadata:

labels:

app.kubernetes.io/component: controller

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: nginx

spec:

controller: k8s.io/ingress-nginx

---

apiVersion: admissionregistration.k8s.io/v1

kind: ValidatingWebhookConfiguration

metadata:

labels:

app.kubernetes.io/component: admission-webhook

app.kubernetes.io/instance: ingress-nginx

app.kubernetes.io/name: ingress-nginx

app.kubernetes.io/part-of: ingress-nginx

app.kubernetes.io/version: 1.10.0

name: ingress-nginx-admission

webhooks:

- admissionReviewVersions:

- v1

clientConfig:

service:

name: ingress-nginx-controller-admission

namespace: ingress-nginx

path: /networking/v1/ingresses

failurePolicy: Fail

matchPolicy: Equivalent

name: validate.nginx.ingress.kubernetes.io

rules:

- apiGroups:

- networking.k8s.io

apiVersions:

- v1

operations:

- CREATE

- UPDATE

resources:

- ingresses

sideEffects: None

[root@master-1 ingress]# kubectl apply -f nginx-deploy.yaml

1.4 验证

2.通过 Helm 部署（推荐生产环境）

2.1 添加更新仓库

# 添加仓库 & 更新

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx

helm repo update

2.2 拉取代码

[root@master-1 ingress]# helm pull ingress-nginx/ingress-nginx

#内网环境可直接从外网下载

https://github.com/kubernetes/ingress-nginx/releases/download/helm-chart-4.12.3/ingress-nginx-4.12.3.tgz

2.3 修改关键配置

[root@master-1 ingress]# cd /root/ingress/ingress-nginx

[root@master-1 ingress-nginx]# vim values.yaml

global:

image:

# -- Registry host to pull images from.

registry: registry.aliyuncs.com

controller:

image:

# registry: registry.k8s.io

image: google_containers/nginx-ingress-controller

## repository:

tag: "v1.10.0"

admissionWebhooks:

patch:

image:

# registry: registry.k8s.io

image: google_containers/kube-webhook-certgen

## repository:

tag: v1.4.0

hostPort:

# -- Enable 'hostPort' or not

enabled: true

ports:

# -- 'hostPort' http port

http: 80

# -- 'hostPort' https port

https: 443

service:

type: NodePort

2.4 部署

[root@master-1 ingress-nginx]# cd ../

#部署ingress-nginx

[root@master-1 ingress]# helm install ingress-nginx ingress-nginx -n ingress-nginx --create-namespace -f ingress-nginx/values.yaml

#查看

[root@master-1 ingress]# helm list -n ingress-nginx

NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION

ingress-nginx ingress-nginx 1 2025-07-01 14:42:20.362166146 +0800 CST deployed ingress-nginx-4.12.3 1.12.3

2.5 验证

2.6 补充helm常用命令

helm详细教程尽情期待下一章节

#搜索ingress-nginx

[root@master-1 ingress]# helm search repo ingress-nginx

NAME CHART VERSION APP VERSION DESCRIPTION

ingress-nginx/ingress-nginx 4.12.3 1.12.3 Ingress controller for Kubernetes using NGINX a...

# 下载ingress-nginx

[root@master-1 ingress]# helm pull ingress-nginx/ingress-nginx

#安装 ingress-nginx ingress-nginx 第一个是为ingress服务取名称为ingress-nginx，第二个是目录名

[root@master-1 ingress]# helm install ingress-nginx ingress-nginx -n ingress-nginx --create-namespace -f ingress-nginx/values.yaml

#卸载 ingress-ngin

[root@master-1 ingress]# helm uninstall ingress-nginx -n ingress-nginx

三、配置ingress路由规则

1.ingress http配置

1.1 部署nginx应用通过ingress访问

[root@master-1 ~]# cat nginx.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

name: nginx

spec:

replicas: 3

#基于标签关联pod，会关联env=test或者env=prod的pod

selector:

matchExpressions:

- key: env

values:

- "test"

- "prod"

operator: In

template:

metadata:

#为pod设置了两个标签

labels:

app: nginx

env: test

spec:

containers:

- name: nginx

image: nginx:latest

imagePullPolicy: IfNotPresent

---

apiVersion: v1

kind: Service

metadata:

name: nginx-service

spec:

# 指定svc的类型为NodePort，也就是在默认的ClusterIP基础之上多监听所有worker节点的端口而已。

type: NodePort

# 基于标签选择器关联Pod

selector:

app: nginx

# 配置端口映射

ports:

# 指定Service服务本身的端口号

- port: 80

# 后端Pod提供服务的端口号

targetPort: 80

1.2 创建 Ingress 规则

[root@master-1 ~]# cat nginx-route.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: ingress-route

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /

spec:

ingressClassName: nginx

rules:

- host: nginx.liux.com

http:

paths:

- path: /

pathType: Prefix

backend:

service:

name: nginx-service

port:

number: 80

#ingressClassName: nginx 可以通过以下方式查看

[root@master-1 ~]# kubectl get ingressclasses

NAME CONTROLLER PARAMETERS AGE

nginx k8s.io/ingress-nginx 31m

#部署

[root@master-1 ~]# kubectl apply -f nginx-route.yaml

1.3 测试访问

#本地配置hosts

192.168.91.21 nginx.liux.com

#页面访问 显示nginx页面

http://nginx.liux.com/

2.ingress https配置

2.1 生成自签证书

[root@master-1 ~]# openssl req -x509 -newkey rsa:2048 -nodes -keyout tls.key -out tls.crt -days 365 -subj "/CN=nginx.liux.com"

2.2 证书存储在secret

[root@master-1 ~]# kubectl create secret tls liux-tls --cert=tls.crt --key=tls.key

[root@master-1 ~]# kubectl get secret | grep liux-tls

liux-tls kubernetes.io/tls 2 54s

2.3 创建ingress https路由规则

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: ingress-route

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /

spec:

ingressClassName: nginx

rules:

- host: nginx.liux.com

http:

paths:

- path: /

pathType: Prefix

backend:

service:

name: nginx-service

port:

number: 80

#https相关

tls:

- hosts:

- nginx.liux.com

secretName: liux-tls

[root@master-1 ~]# kubectl apply -f nginx-route.yaml

查看ingress发现多了一个443端口

2.4 测试访问

发现使用https正常访问到nginx页面