Kubernetes : exposer ses applications (Services, Ingress et Gateway API)

1. Les Services #

Un point d'accès stable.

Les types de Service #

apiVersion: v1
kind: Service
metadata: { name: web }
spec:
  selector: { app: web }
  ports: [{ port: 80, targetPort: 8080 }]
  type: ClusterIP

kubectl get svc,endpoints web
kubectl run curl --rm -it --image=curlimages/curl --restart=Never -- curl -s http://web.default.svc.cluster.local
kubectl get endpointslices -l kubernetes.io/service-name=web

2. Ingress #

Routage HTTP/HTTPS.

Installer un contrôleur puis déclarer des règles #

# Ingress NGINX (exemple)
helm upgrade --install ingress-nginx ingress-nginx --repo https://kubernetes.github.io/ingress-nginx -n ingress-nginx --create-namespace
kubectl -n ingress-nginx get svc ingress-nginx-controller      # IP externe du load balancer
kubectl get ingressclass

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/proxy-body-size: "20m"
spec:
  ingressClassName: nginx
  tls:
    - hosts: [app.exemple.fr]
      secretName: app-tls
  rules:
    - host: app.exemple.fr
      http:
        paths:
          - { path: /api, pathType: Prefix, backend: { service: { name: api, port: { number: 80 } } } }
          - { path: /,    pathType: Prefix, backend: { service: { name: web, port: { number: 80 } } } }

kubectl get ingress
kubectl describe ingress web
curl -H 'Host: app.exemple.fr' http://<IP_DU_LB>/ -v

Certificats TLS avec cert-manager #

helm upgrade --install cert-manager cert-manager --repo https://charts.jetstack.io -n cert-manager --create-namespace --set crds.enabled=true
cat <<'EOF' | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata: { name: letsencrypt }
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@exemple.fr
    privateKeySecretRef: { name: letsencrypt-key }
    solvers: [{ http01: { ingress: { ingressClassName: nginx } } }]
EOF
kubectl get certificate,certificaterequest,order,challenge -A

3. Gateway API #

Le successeur d'Ingress.

Concepts et exemple #

La Gateway API sépare les rôles : l'infrastructure définit une GatewayClass et une Gateway (listeners, TLS), les équipes applicatives déclarent des HTTPRoute. Elle gère nativement les répartitions de trafic pondérées, les redirections et les en-têtes.

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: { name: public, namespace: infra }
spec:
  gatewayClassName: haproxy
  listeners:
    - { name: https, port: 443, protocol: HTTPS, tls: { certificateRefs: [{ name: wildcard-tls }] } }
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: web }
spec:
  parentRefs: [{ name: public, namespace: infra }]
  hostnames: [app.exemple.fr]
  rules:
    - matches: [{ path: { type: PathPrefix, value: / } }]
      backendRefs:
        - { name: web-v1, port: 80, weight: 90 }      # canary : 90 / 10
        - { name: web-v2, port: 80, weight: 10 }

kubectl get gatewayclass,gateway,httproute -A
kubectl describe httproute web

Bonne Pratique : Pour un nouveau projet, privilégiez la Gateway API si votre contrôleur la supporte (HAProxy, Traefik, NGINX Gateway Fabric, Envoy Gateway) ; l'API Ingress est gelée.