「Ingress」- 暴露 HTTP and HTTPS 服务 | Kubernetes API Resource

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx-example                           # 指定 IngressClass 参数
  rules:
  - http:
      paths:
      - path: /testpath
        pathType: Prefix
        backend:
          service:
            name: test
            port:
              number: 80

kubectl create secret tls mytlssecret \
  --cert=/path/to/cert/file           \
  --key=/path/to/key/file

# 注意事项：
# --cert must be .PEM encoded (Base64-encoded DER format)
# --key must be in what is commonly called PEM private key format, unencrypted.
# 这两个文件的开始和结尾行都会被忽略；

# 如果需要生成 Secret 资源文件，使用：
kubectl create secret tls mytlssecret               \
  --cert=/path/to/cert/file --key=/path/to/key/file \
  --dry-run=true -o yaml > mytlssecret.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-example-ingress
spec:
  tls:
  - hosts:
      - https-example.foo.com
    secretName: mytlssecret
  rules:
  - host: https-example.foo.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: service1
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example
  namespace: foo
spec:
  ingressClassName: nginx
  rules:
    - host: www.example.com
      http:
        paths:
          - pathType: Prefix
            backend:
              service:
                name: exampleService
                port:
                  number: 80
            path: /
  # This section is only required if TLS is to be enabled for the Ingress
  tls:
    - hosts:
      - www.example.com
      secretName: example-tls

# If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:

apiVersion: v1
kind: Secret
metadata:
  name: example-tls
  namespace: foo
data:
  tls.crt: <base64 encoded cert>
  tls.key: <base64 encoded key>
type: kubernetes.io/tls

kubectl create secret tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none]

kubectl create secret tls tls-secret --cert=path/to/tls.crt --key=path/to/tls.key

# 更新证书

kubectl create secret tls example-tls --cert=./example.com.pem --key=example.com.key --save-config \
    --dry-run=client -o yaml | kubectl apply -f -

for ns in $(kubectl get namespaces -o jsonpath='{.items..metadata.name}')
do
    echo "############## NAMESPACE: ${ns} ##############"
    for ingress in $(kubectl get -n $ns ingresses.extensions -o jsonpath='{.items..metadata.name}')
    do
        # 为了防止命令出错，这里只打印将执行的命令，以进行预览
        echo kubectl patch -n $ns ingresses.extensions $ingress --type merge \
            -p \''{"metadata": {"annotations": {"kubernetes.io/ingress.class": "nginx"}}}'\'
    done
done