為基本正式環境叢集設定網路

本教學課程適用於對下列主題感興趣的雲端架構師和作業管理員：將網頁應用程式部署至 Google Kubernetes Engine (GKE) 叢集，並透過 HTTPS 負載平衡器公開該應用程式。

建立 GKE 叢集

下列 Terraform 檔案會建立 GKE 叢集：


terraform {
  required_version = "~> 1.3"
}

provider "google" {}

variable "region" {
  type        = string
  description = "Region where the cluster will be created."
  default     = "us-central1"
}

variable "cluster_name" {
  type        = string
  description = "Name of the cluster"
  default     = "networking-cluster"
}

resource "google_container_cluster" "default" {
  name             = var.cluster_name
  description      = "Cluster for sample web application"
  location         = var.region
  enable_autopilot = true

  ip_allocation_policy {}
}

output "region" {
  value       = var.region
  description = "Compute region"
}

output "cluster_name" {
  value       = google_container_cluster.default.name
  description = "Cluster name"
}

下列 Terraform 檔案會建立全域 IP 位址和 Cloud DNS 區域：


terraform {
  required_version = "~> 1.3"
}

variable "base_domain" {
  type        = string
  description = "Your base domain"
}

variable "name" {
  type        = string
  description = "Name of resources"
  default     = "networking-tutorial"
}

data "google_client_config" "current" {}

resource "google_compute_global_address" "default" {
  name = var.name
}

resource "google_dns_managed_zone" "default" {
  name        = var.name
  dns_name    = "${var.name}.${var.base_domain}."
  description = "DNS Zone for web application"
}

resource "google_dns_record_set" "a" {
  name         = google_dns_managed_zone.default.dns_name
  type         = "A"
  ttl          = 300
  managed_zone = google_dns_managed_zone.default.name

  rrdatas = [google_compute_global_address.default.address]
}

resource "google_dns_record_set" "cname" {
  name         = join(".", compact(["www", google_dns_record_set.a.name]))
  type         = "CNAME"
  ttl          = 300
  managed_zone = google_dns_managed_zone.default.name

  rrdatas = [google_dns_record_set.a.name]
}

output "dns_zone_name_servers" {
  value       = google_dns_managed_zone.default.name_servers
  description = "Write these virtual name servers in your base domain."
}

output "domain" {
  value = trim(google_dns_record_set.a.name, ".")
}

  1. 初始化 Terraform：

    terraform init

  2. 查看基礎架構變更：

    terraform plan

    系統顯示提示訊息時，請輸入網域，例如 my-domain.net。

  3. 套用 Terraform 設定：

    terraform apply --auto-approve

    系統顯示提示訊息時，請輸入網域，例如 my-domain.net。

    輸出結果會與下列內容相似：

    Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

cluster_name = "networking-cluster"
region = "us-central1"

建立外部應用程式負載平衡器

  1. 下列資訊清單說明 ManagedCertificate、FrontendConfig、Deployment、Service 和 Ingress：

    ---
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: networking-managed-cert
spec:
  domains:
    - DOMAIN_NAME
    - www.DOMAIN_NAME
---
apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
  name: networking-fc
spec:
  redirectToHttps:
    enabled: true
    responseCodeName: MOVED_PERMANENTLY_DEFAULT
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  selector:
    matchLabels:
      app: frontend
  replicas: 2
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
      - name: echo-amd64
        image: us-docker.pkg.dev/google-samples/containers/gke/hello-app-cdn:1.0
---
apiVersion: v1
kind: Service
metadata:
  name: frontend
spec:
  type: LoadBalancer
  selector:
    app: frontend
  ports:
  - name: http
    port: 80
    targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: frontend
  annotations:
    networking.gke.io/managed-certificates: networking-managed-cert
    networking.gke.io/v1beta1.FrontendConfig: networking-fc
    kubernetes.io/ingress.global-static-ip-name: networking-tutorial
    kubernetes.io/ingress.class: gce
  labels:
    app: frontend
spec:
  defaultBackend:
    service:
      name: frontend
      port:
        number: 80

    將 DOMAIN_NAME 替換為您的網域名稱，例如 my-domain.net。

    這個資訊清單具有下列屬性：

    • networking.gke.io/managed-certificates：ManagedCertificate 的名稱。
    • networking.gke.io/v1beta1.FrontendConfig：FrontendConfig 資源的名稱。
    • kubernetes.io/ingress.global-static-ip-name：IP 位址的名稱。
    • kubernetes.io/ingress.class：指示 GKE Ingress 控制器建立外部應用程式負載平衡器。

  2. 將資訊清單套用至叢集：

    kubectl apply -f kubernetes-manifests.yaml

  3. 確認 Ingress 是否已建立：

    kubectl describe ingress frontend

    輸出結果會與下列內容相似：

    ...
  Events:
    Type    Reason  Age   From                     Message
    ----    ------  ----  ----                     -------
    Normal  ADD     2m    loadbalancer-controller  default/frontend
    Normal  CREATE  1m    loadbalancer-controller  ip: 203.0.113.2
...

    Ingress 可能需要幾分鐘才能完成佈建。

測試應用程式

  1. 檢查 SSL 憑證的狀態：

    kubectl get managedcertificates.networking.gke.io networking-managed-cert

    佈建 SSL 憑證最多可能需要 30 分鐘。下列輸出內容表示 SSL 憑證已準備就緒：

    NAME                      AGE   STATUS
networking-managed-cert   28m   Active

  2. 執行 curl 指令：

    curl -Lv https://DOMAIN_NAME

    輸出結果會與下列內容相似：

    *   Trying 34.160.115.33:443...
* Connected to DOMAIN_NAME (34.160.115.33) port 443 (#0)
...
* TLSv1.3 (IN), TLS handshake, Certificate (11):
...
* Server certificate:
*  subject: CN=DOMAIN_NAME
...
> Host: DOMAIN_NAME