This document describes how to use Service and Ingress as entry points to expose workloads to external sources.
- You have created an elastic cluster that is in the Running state. For more information, see Creating a cluster.
- The cluster has an appropriate namespace that is in the Active state.
Service defines policies for accessing backend Pods and provides a fixed virtual IP address for access. It also provides load balancing for all requests to Pods.
Service can be of the following types:
- Public network access: the public network access Service uses operates in Loadbalance and automatically creates a public network CLB instance. Public IP addresses can access backend Pods.
- Intra-cluster access: the intra-cluster access Service operates in ClusterIP mode and is used for access within the cluster.
- VPC private network access: the VPC private network access Service operates in Loadbalance and automatically creates a private network CLB instance. By using
annotations:service.kubernetes.io/qcloud-loadbalancer-internal-subnetid: subnet-xxxxxxxx, you can use a private IP address from the VPC private network to access the backend Pod.
Ingress is a collection of rules that allow access to Services of a cluster. You can configure different forwarding rules to allow different URLs to access different Services.
In order for Ingress resources to operate properly, you must run
Ingress-controller. TKE enables the CLB-based
l7-lb-controller by default and supports HTTP, HTTPS, and nginx-ingress controllers. You can select Ingress controllers according to your needs.
For more information and instructions, see Service Management and Ingress Management.
- Creating ClusterIP Service in an elastic cluster uses IP addresses from the Service CIDR. Make sure there are enough IP addresses in the subnet.
In an elastic cluster, a CLB instance created by the Service binds all ENIs of all Pods within the endpoint.
- In an elastic cluster, Services only supports CLB instances.
- To create a Service using an existing CLB, you must ensure that the CLB is not bound to any listener.