Two ingress controller on same K8S cluster

问题

I have installed the following two different ingress controllers on my DigitalOcean managed K8S cluster:

• Nginx

• Istio

and they have been assigned to two different IP addresses. My question is, if it is wrong to have two different ingress controllers on the same K8S cluster?

The reason, why I have done it, because nginx is for tools like harbor, argocd, etc. and istio for microservices.

I have also figured out, when both are installed alongside each other, sometimes during the deployment, the K8S suddenly goes down.

For example, I have deployed:

apiVersion: v1
kind: Service
metadata:
  name: hello-kubernetes-first
  namespace: dev
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: hello-kubernetes-first
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-kubernetes-first
  namespace: dev
spec:
  replicas: 3
  selector:
    matchLabels:
      app: hello-kubernetes-first
  template:
    metadata:
      labels:
        app: hello-kubernetes-first
    spec:
      containers:
        - name: hello-kubernetes
          image: paulbouwer/hello-kubernetes:1.7
          ports:
            - containerPort: 8080
          env:
            - name: MESSAGE
              value: Hello from the first deployment!
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: istio
  name: helloworld-ingress
  namespace: dev
spec:
  rules:
    - host: hello.service.databaker.io
      http:
        paths:
          - path: /*
            backend:
              serviceName: hello-kubernetes-first
              servicePort: 80
---

Then I've got:

Error from server (InternalError): error when creating "istio-app.yml": Internal error occurred: failed calling webhook "validate.nginx.ingress.kubernetes.io": Post https://ingress-nginx-controller-admission.nginx.svc:443/extensions/v1beta1/ingresses?timeout=30s: dial tcp 10.245.107.175:443: i/o timeout  

回答1:

You have raised several points - before answering your question, let's take a step back.

---

K8s Ingress not recommended by Istio

It is important to note how Istio does not recommend using K8s Ingress:

Using the Istio Gateway, rather than Ingress, is recommended to make use of the full feature set that Istio offers, such as rich traffic management and security features.

Ref: https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/

As noted, Istio Gateway (Istio IngressGateway and EgressGateway) acts as the edge, which you can find more in https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/.

---

Multiple endpoints within Istio

If you need to assign one public endpoint for business requirement, and another for monitoring (such as Argo CD, Harbor as you mentioned), you can achieve that by using Istio only. There are roughly 2 approaches to this.

1. Create separate Istio IngressGateways - one for main traffic, and another for monitoring
2. Create one Istio IngressGateway, and use Gateway definition to handle multiple access patterns

Both are valid, and depending on requirements, you may need to choose one way or the other.

As to the Approach #2., it is where Istio's traffic management system shines. It is a great example of Istio's power, but the setup is slightly complex if you are new to it. So here goes an example.

Example of Approach #2

When you create Istio IngressGateway by following the default installation, it would create istio-ingressgateway like below (I overly simplified YAML definition):

apiVersion: v1
kind: Service
metadata:
  labels:
    app: istio-ingressgateway
    istio: ingressgateway
  name: istio-ingressgateway
  namespace: istio-system
  # ... other attributes ...
spec:
  type: LoadBalancer
  # ... other attributes ...

This LB Service would then be your endpoint. (I'm not familiar with DigitalOcean K8s env, but I suppose they would handle LB creation.)

Then, you can create Gateway definition like below:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: your-gateway
  namespace: istio-system
spec:
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  servers:
    - port:
        number: 3000
        name: https-your-system
        protocol: HTTPS
      hosts:
        - "your-business-domain.com"
        - "*.monitoring-domain.com"
      # ... other attributes ...

You can then create 2 or more VirtualService definitions.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: business-virtsvc
spec:
  gateways:
    - istio-ingressgateway.istio-system.svc.cluster.local
  hosts:
    - "your-business-domain.com"
  http:
    - match:
        - port: 3000
      route:
        - destination:
            host: some-business-pod
            port:
              number: 3000
    # ... other attributes ...

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: monitoring-virtsvc
spec:
  gateways:
    - istio-ingressgateway.istio-system.svc.cluster.local
  hosts:
    - "harbor.monitoring-domain.com"
  http:
    - match:
        - port: 3000
      route:
        - destination:
            host: harbor-pod
            port:
              number: 3000
    # ... other attributes ...

NOTE: The above is assuming a lot of things, such as port mapping, traffic handling, etc.. Please check out the official doc for details.

---

So, back to the question after long detour:

Question: [Is it] wrong to have two different ingress controllers on the same K8S cluster[?]

I believe it is OK, though this can cause an error like you are seeing, as two ingress controller fight for the K8s Ingress resource.

As mentioned above, if you are using Istio, it's better to stick with Istio IngressGateway instead of K8s Ingress. If you need K8s Ingress for some specific reason, you could use other Ingress controller for K8s Ingress, like Nginx.

As to the error you saw, it's coming from Nginx deployed webhook, that ingress-nginx-controller-admission.nginx.svc is not available. This means you have created a K8s Ingress helloworld-ingress with kubernetes.io/ingress.class: istio annotation, but Nginx webhook is interfering with K8s Ingress handling. The webhook is then failing to handle the resource, as the Pod / Svc responsible for webhook traffic is not found.

The error itself just says something is unhealthy in K8s - potentially not enough Node allocated to the cluster, and thus Pod allocation not happening. It's also good to note that Istio does require some CPU and memory footprint, which may be putting more pressure to the cluster.

回答2:

Both products have distinct characteristics and solve different type of problems. So, no issue in having both installed on your cluster.

To call them Ingress Controller is not correct: - Nginx is a well known web server - Nginx ingress controller is an implementation of a Kubernetes Ingress controller based on Nginx (Load balancing, HTTPS termination, authentication, traffic routing , etc) - Istio is a service mesh (well known to microservice architecture and used to address cross cutting concerns in a standard way - things like, logging, tracing, Https termination, etc - at the POD level)

Can you provide more details to what you mean by "K8S suddenly goes down". Are you talking about the cluster nodes or the PODs running inside?

Thanks.

回答3:

Have you looked specifying the ingress.class (kubernetes.io/ingress.class: "nginx" ), like mentioned here? - https://kubernetes.github.io/ingress-nginx/user-guide/multiple-ingress/

来源：https://stackoverflow.com/questions/61643319/two-ingress-controller-on-same-k8s-cluster