accesslog：輸出到stdout，通過nginx-configuration中的字段可以配置輸出到哪個文件。輸出到文件后不會自動輪轉或清理
errorlog：輸出到stderr，配置方式與accesslog類似。

給controller日志落盤

給nginx-ingress-controller掛一個hostpath： /data/log/nginx_ingress_controller/ 映射到容器里的/var/log/nginx_ingress_controller/ ，
給nginx-ingress-controller配置log-dir和logtostderr參數，將日志重定向到/var/log/nginx_ingress_controller/中。

controller的日志需要做定時清理。由于controller的日志是通過klog(k8s.io/klog)輸出的，會進行日志滾動，所以我們通過腳本定時清理一定時間之前的日志文件即可。

給nginx日志落盤

修改configmap： nginx-configuration。配置accesslog和errorlog的輸出路徑，替換默認的stdout和stderr。輸出路徑我們可以與controller一致，便于查找。

accesslog和errorlog都只有一個日志文件，我們可以使用logrotate進行日志輪轉，將輸出到宿主機上的日志進行輪轉和清理。配置如：

$ cat /etc/logrotate.d/nginx.log
/data/log/nginx_ingress_controller/access.log {
  su root list
  rotate 7
  daily
  maxsize 50M
  copytruncate
  missingok
  create 0644 www-data root
}

官方提供的模板中，nginx-ingress-controller默認都是以33這個用戶登錄啟動容器的，因此掛載hostpath路徑時存在權限問題。我們需要手動在機器上執行chown -R 33:33 /data/log/nginx_ingress_controller.

自動化ops

nginx日志落盤中，第2、3兩點均需要人工運維，有什么解決辦法嗎？

問題的關鍵是：有什么辦法可以在nginx-ingress-controller容器啟動之前加一個hook，將宿主機的指定目錄執行chown呢？

可以用initContainer。initcontainer必須在containers中的容器運行前運行完畢并成功退出。利用這一k8s特性，我們開發一個docker image，里面只執行如下腳本：

#!/bin/bash
logdir=$LOG_DIR
userID=$USER_ID
echo try to set dir: $logdir \\\'s group as $userID
chown -R $userID:$userID $logdir

腳本讀取一些環境變量， 確認需要修改哪個目錄，改成怎樣的user group。

將腳本打包成dockerimage， 放在nginx-ingress-controller的deploy yaml中，作為initcontainers。 注意要對該initcontainer配置環境變量和volumeMount.

再說第二點，我們注意到nginx-ingress-controller的基礎鏡像中就自帶了logrotate，那么問題就簡單了，我們將寫好的logrotate配置文件以configmap的形式掛載到容器中就可以了。

一個deploy yaml如下：

---
apiVersion: v1
kind: Service
metadata:
 name: ingress-nginx
 namespace: kube-system
spec:
 type: ClusterIP
 ports:
 - name: http
  port: 80
  targetPort: 80
  protocol: TCP
 - name: https
  port: 443
  targetPort: 443
  protocol: TCP
 selector:
  app: ingress-nginx
---
apiVersion: v1
kind: Service
metadata:
 name: default-http-backend
 namespace: kube-system
 labels:
  app: default-http-backend
spec:
 ports:
 - port: 80
  targetPort: 8080
 selector:
  app: default-http-backend
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
 name: default
 namespace: kube-system
spec:
 backend:
  serviceName: default-http-backend
  servicePort: 80
---
kind: ConfigMap
apiVersion: v1
metadata:
 name: nginx-configuration
 namespace: kube-system
 labels:
  app: ingress-nginx
data:
 use-forwarded-headers: true
 # 此處配置nginx日志的重定向目標
 access-log-path: /var/log/nginx_ingress_controller/access.log
 error-log-path: /var/log/nginx_ingress_controller/error.log

---

# 創建一個configmap，配置nginx日志的輪轉策略，對應的是nginx日志在容器內的日志文件
apiVersion: v1
data:
 nginx.log: |
  {{ user_nginx_log.host_path }}/access.log {
    rotate {{ user_nginx_log.rotate_count }}
    daily
    maxsize {{ user_nginx_log.rotate_size }}
    minsize 10M
    copytruncate
    missingok
    create 0644 root root
  }
  {{ user_nginx_log.host_path }}/error.log {
    rotate {{ user_nginx_log.rotate_count }}
    daily
    maxsize {{ user_nginx_log.rotate_size }}
    minsize 10M
    copytruncate
    missingok
    create 0644 root root
  }
kind: ConfigMap
metadata:
 name: nginx-ingress-logrotate
 namespace: kube-system
---

kind: ConfigMap
apiVersion: v1
metadata:
 name: tcp-services
 namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
 name: udp-services
 namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
 name: nginx-ingress-serviceaccount
 namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
 name: nginx-ingress-clusterrole
rules:
 - apiGroups:
   - 
  resources:
   - configmaps
   - endpoints
   - nodes
   - pods
   - secrets
  verbs:
   - list
   - watch
 - apiGroups:
   - 
  resources:
   - nodes
  verbs:
   - get
 - apiGroups:
   - 
  resources:
   - services
  verbs:
   - get
   - list
   - watch
 - apiGroups:
   - extensions
  resources:
   - ingresses
  verbs:
   - get
   - list
   - watch
 - apiGroups:
   - 
  resources:
    - events
  verbs:
    - create
    - patch
 - apiGroups:
   - extensions
  resources:
   - ingresses/status
  verbs:
   - update
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
 name: nginx-ingress-role
 namespace: kube-system
rules:
 - apiGroups:
   - 
  resources:
   - configmaps
   - pods
   - secrets
   - namespaces
  verbs:
   - get
 - apiGroups:
   - 
  resources:
   - configmaps
  resourceNames:
   # Defaults to <election-id>-<ingress-class>
   # Here: <ingress-controller-leader>-<nginx>
   # This has to be adapted if you change either parameter
   # when launching the nginx-ingress-controller.
   - ingress-controller-leader-nginx
  verbs:
   - get
   - update
 - apiGroups:
   - 
  resources:
   - configmaps
  verbs:
   - create
 - apiGroups:
   - 
  resources:
   - endpoints
  verbs:
   - get
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
 name: nginx-ingress-role-nisa-binding
 namespace: kube-system
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: Role
 name: nginx-ingress-role
subjects:
 - kind: ServiceAccount
  name: nginx-ingress-serviceaccount
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
 name: nginx-ingress-clusterrole-nisa-binding
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: nginx-ingress-clusterrole
subjects:
 - kind: ServiceAccount
  name: nginx-ingress-serviceaccount
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
 name: ingress-nginx
 namespace: kube-system
spec:
 selector:
  matchLabels:
   app: ingress-nginx
 template:
  metadata:
   labels:
    app: ingress-nginx
   annotations:
    prometheus.io/port: \\\'10254\\\'
    prometheus.io/scrape: \\\'true\\\'
  spec:
   serviceAccountName: nginx-ingress-serviceaccount
   tolerations:
   - key: dedicated
    value: ingress-nginx
    effect: NoSchedule
   affinity:
    nodeAffinity:
     requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
       - key: system/ingress
        operator: In
        values:
        - true
   dnsPolicy: ClusterFirstWithHostNet
   hostNetwork: true
   # 配置initcontainer，確保在nginx-ingress-controller容器啟動前將日志目錄的權限配置好
   initContainers:
   - name: adddirperm
    image: {{ image_registry.addr }}/{{ image.adddirperm }}
    env:
    - name: LOG_DIR
     value: /var/log/nginx_ingress_controller
    - name: USER_ID
      value: 33
    volumeMounts:
    - name: logdir
     mountPath: /var/log/nginx_ingress_controller
   containers:
   - name: nginx-ingress-controller
    image: {{ image_registry.addr }}/{{ image.ingress }}
    imagePullPolicy: IfNotPresent
    args:
    - /nginx-ingress-controller
    - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
    - --configmap=$(POD_NAMESPACE)/nginx-configuration
    - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
    - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
    - --publish-service=$(POD_NAMESPACE)/ingress-nginx
    - --annotations-prefix=nginx.ingress.kubernetes.io
    
    # 設置controller日志的輸出路徑和方式
    - --log_dir=/var/log/nginx_ingress_controller
    - --logtostderr=false
    securityContext:
     capabilities:
       drop:
       - ALL
       add:
       - NET_BIND_SERVICE
     # www-data -> 33
     runAsUser: 33
    env:
     - name: POD_NAME
      valueFrom:
       fieldRef:
        fieldPath: metadata.name
     - name: POD_NAMESPACE
      valueFrom:
       fieldRef:
        fieldPath: metadata.namespace
    ports:
    - name: http
     containerPort: 80
    - name: https
     containerPort: 443
    resources:
     requests:
      cpu: 100m
      memory: 256Mi
    livenessProbe:
     failureThreshold: 3
     httpGet:
      path: /healthz
      port: 10254
      scheme: HTTP
     initialDelaySeconds: 10
     periodSeconds: 10
     successThreshold: 1
     timeoutSeconds: 1
    readinessProbe:
     failureThreshold: 3
     httpGet:
      path: /healthz
      port: 10254
      scheme: HTTP
     periodSeconds: 10
     successThreshold: 1
     timeoutSeconds: 1
    volumeMounts:
    # 配置掛載容器中控制器組件和nginx的日志輸出路徑
    - name: logdir
     mountPath: /var/log/nginx_ingress_controller
    # 配置nginx日志的logrotate配置掛載路徑
    - name: logrotateconf
     mountPath: /etc/logrotate.d/nginx.log
     subPath: nginx.log
   volumes:
   # 控制器組件和nginx的日志輸出路徑為宿主機的hostpath
   - name: logdir
    hostPath:
     path: {{ user_nginx_log.host_path }}
     type: 
   # nginx日志的輪轉配置文件來自于configmap
   - name: logrotateconf
    configMap:
     name: nginx-ingress-logrotate
     items:
     - key: nginx.log
      path: nginx.log
---

apiVersion: apps/v1
kind: DaemonSet
metadata:
 name: default-http-backend
 namespace: kube-system
 labels:
  app: default-http-backend
spec:
 selector:
  matchLabels:
   app: default-http-backend
 template:
  metadata:
   labels:
    app: default-http-backend
  spec:
   terminationGracePeriodSeconds: 60
   tolerations:
   - key: dedicated
    value: ingress-nginx
    effect: NoSchedule
   affinity:
    nodeAffinity:
     requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
       - key: system/ingress
        operator: In
        values:
        - true
   containers:
   - name: default-http-backend
    # Any image is permissible as long as:
    # 1. It serves a 404 page at /
    # 2. It serves 200 on a /healthz endpoint
    image: {{ image_registry.addr }}/{{ image.http_backend }}
    imagePullPolicy: IfNotPresent
    livenessProbe:
     httpGet:
      path: /healthz
      port: 8080
      scheme: HTTP
     initialDelaySeconds: 30
     timeoutSeconds: 5
    ports:
    - containerPort: 8080
    resources:
     limits:
      cpu: 10m
      memory: 20Mi
     requests:
      cpu: 10m
      memory: 20Mi
---

最后，有的人建議將initcontainer去掉，改為基于原有的nginx-ingress-controller鏡像加一層layer，將配置路徑權限的腳本放在該層執行。 個人認為這種方法既不美觀，也不方便。唯一的好處僅在于deploy yaml仍然簡潔（但少不了volumeMount之類的配置）。不過還是看個人使用感受吧~

到此這篇關于nginx-ingress-controller日志持久化方案的解決的文章就介紹到這了,更多相關nginx ingress controller日志持久化內容請搜索三五互聯以前的文章或繼續瀏覽下面的相關文章希望大家以后多多支持三五互聯！

更多關于云服務器，域名注冊，虛擬主機的問題，請訪問三五互聯官網：m.shinetop.cn

贊(0)
聲明：本網站發布的內容（圖片、視頻和文字）以原創、轉載和分享網絡內容為主，如果涉及侵權請盡快告知，我們將會在第一時間刪除。文章觀點不代表本網站立場，如需處理請聯系客服。郵箱：3140448839@qq.com。本站原創內容未經允許不得轉載，或轉載時需注明出處：三五互聯知識庫 » nginx-ingress-controller日志持久化方案的解決

登錄

找回密碼

注冊

主站蜘蛛池模板： 国产高清亚洲一区亚洲二区| 把女人弄爽大黄A大片片| 久久久综合九色合综| 亚洲综合无码久久精品综合| 国产精品自产在线观看一| 中文字幕无码av激情不卡 | 亚洲最大福利视频网| 色呦呦九九七七国产精品| 永久免费无码国产| 日韩精品无码一区二区视频| 国产免费一区二区三区在线观看 | 久久久无码精品国产一区| 亚洲av日韩av永久无码电影| 亚洲综合区激情国产精品| 日韩美a一级毛片| 日韩欧美aⅴ综合网站发布| 亚洲综合高清一区二区三区| 人人澡人人妻人人爽人人蜜桃| 国产成人一区二区三区免费 | 久久精品午夜视频| 婷婷六月综合缴情在线| 欧美成人精品手机在线| 无码加勒比一区二区三区四区| 女同在线观看亚洲国产精品| 九九re线精品视频在线观看视频| 亚洲av成人午夜福利| 精品一区二区三区蜜桃麻豆| 久久99国产精品久久99| 国产精品国产精品国产专区不卡 | 亚洲中文字幕无码爆乳| 亚洲人成网站免费播放| 房产| 欧美做受视频播放| 成人免费无遮挡在线播放| 欧美成a人片在线观看久| 久久夜色精品国产亚av| 另类 专区 欧美 制服| 色综合久久一区二区三区| 国内熟妇与亚洲洲熟妇妇| 成年视频人免费网站动漫在线| 偷拍精品一区二区三区|