什么是gRPC？
gRPC（gRPC Remote Procedure Call）是一种开源的远程过程调用（RPC）框架，由Google开发并于2015年发布。它使用HTTP/2协议进行通信，旨在简化跨网络的服务通信和跨语言的服务调用。以下是 gRPC 的一些关键特点和概念：
申请SSL证书
生成CA证书:
# 生成CA根证书私钥：为保证安全，生成一个4096位的私钥，并使用aes方式加密
$ openssl genrsa -aes256 -out kubesre-ca.key 4096
Enter PEM pass phrase: # 密码：12345678
Verifying - Enter PEM pass phrase:
# 通过CA根私钥签发CA根证书
$ openssl req -new -x509 -days 3650 -sha256 -extensions v3_ca -key kubesre-ca.key -out kubesre-ca.cer -subj "/C=CN/ST=shanghai/L=shanghai/O=kubesre/OU=kubesre/CN=*.kubesre.com"
Enter pass phrase for kubesre-ca.key: # 密码：12345678生成服务端证书：
# 生成服务端证书私钥
$ openssl genrsa -out kubesre-server.key 2048
# 生成签发请求csr
$openssl req -new -key kubesre-server.key -out kubesre-server.csr -subj "/C=CN/ST=shanghai/L=shanghai/O=kubesre/OU=kubesre/CN=demo.kubesre.com"
# 用CA证书签发服务端证书
$ openssl x509 -req -days 3650 -sha256 -CA kubesre-ca.cer -CAkey kubesre-ca.key -in kubesre-server.csr -out kubesre-server.cer
Certificate request self-signature ok
subject=C = CN, ST = shanghai, L = shanghai, O = kubesre, OU = kubesre, CN = demo.kubesre.com
Enter pass phrase for kubesre-ca.key: # 密码：12345678
$ ll
total 40
-rw-r--r--@ 1 chuanzhang staff 2.0K 8 13 15:24 kubesre-ca.cer
-rw-------@ 1 chuanzhang staff 3.4K 8 13 15:22 kubesre-ca.key
-rw-r--r--@ 1 chuanzhang staff 1.6K 8 13 15:31 kubesre-server.cer
-rw-r--r--@ 1 chuanzhang staff 1.0K 8 13 15:28 kubesre-server.csr
-rw-------@ 1 chuanzhang staff 1.7K 8 13 15:27 kubesre-server.key创建证书Secret（证书基于Kubernetes Secret进行存储）：
$ kubectl create secret tls kubesre-tls --key kubesre-server.key --cert kubesre-server.cer
secret/kubesre-tls created
$ kubectl get secret
NAME TYPE DATA AGE
kubesre-tls kubernetes.io/tls 2 18sgRPC示例应用部署
部署示例版本：
$ cat demo.yml
apiVersion: apps/v1
kind: Deployment
metadata:
name: grpc-service
spec:
replicas: 1
selector:
matchLabels:
run: grpc-service
template:
metadata:
labels:
run: grpc-service
spec:
containers:
- image: registry.cn-shanghai.aliyuncs.com/kubesre01/grpc-server:latest
imagePullPolicy: Always
name: grpc-service
ports:
- containerPort: 50051
protocol: TCP
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
name: grpc-service
spec:
ports:
- port: 50051
protocol: TCP
targetPort: 50051
selector:
run: grpc-service
# 执行创建操作
$ kubectl apply -f demo.yml
deployment.apps/grpc-service unchanged
service/grpc-service created
# 查看创建状态
kubectl get pods,svc
NAME READY STATUS RESTARTS AGE
pod/grpc-service-56f784fcb5-n72hd 1/1 Running 0 81s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/grpc-service ClusterIP 10.96.239.197 50051/TCP 73s
service/kubernetes ClusterIP 10.96.0.1 443/TCP 11d
# 出现以上情况说明一切就绪创建Ingress gRPC路由规则
$ cat demo-ingress.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: grpc-ingress
annotations:
# 通过注解指定GRPC协议
nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
spec:
ingressClassName: nginx
# 指定证书
tls:
- hosts:
- demo.kubesre.com
secretName: kubesre-tls
rules:
# 制定域名
- host: demo.kubesre.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: grpc-service
port:
number: 50051
kubectl apply -f demo-ingress.yml
ingress.networking.k8s.io/grpc-ingress created验证：
$ grpcurl -insecure -authority demo.kubesre.com 127.0.0.1:443 list
grpc.reflection.v1alpha.ServerReflection
helloworld.Greeter
# 出现如下情况，说明验证成功了，流量成功路由到了后端服务了！什么是WebSocket
WebSocket是一种计算机通信协议，它提供了一种在客户端和服务器之间建立持久性连接的方式，允许双向实时数据传输。WebSocket的主要目的是解决HTTP协议的一些限制，如请求-响应模式和高延迟。以下是WebSocket的一些关键特点和用途：
WebSocket通常用于实现各种实时Web应用程序，例如在线聊天、协作工具、在线游戏、股票市场报价、实时监控和通知系统等。它在那些需要实时数据传输和即时响应的场景中非常有用，因为它可以降低通信延迟，提供更好的用户体验。WebSocket通信建立在TCP协议之上，通常使用端口80（HTTP）或443（HTTPS）来传输数据。
WebSocket示例应用部署
部署示例版本：
# 执行创建操作
$ kubectl apply -f ws.yml
deployment.apps/demo-ws created
service/demo-ws-svc created
# 查看创建状态
kubectl get pod,svc
NAME READY STATUS RESTARTS AGE
pod/demo-ws-79bd8fbdc7-hml6q 1/1 Running 0 2m2s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/demo-ws-svc ClusterIP 10.96.255.28 8080/TCP 2m2s
service/kubernetes ClusterIP 10.96.0.1 443/TCP 82m
# 出现以上情况说明一切就绪创建Ingress WebSocket
Kubernetes Ingress Controller默认已支持WebSocket无需额外配置，并可以通过如下注解做些额外优化配置：
nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"$ demo-ws-ingress.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: demo-ws-ingress
spec:
ingressClassName: nginx
rules:
- host: demo.kubesre.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: demo-ws-svc
port:
number: 8090
# 创建WebSocket Ingress资源对象
$ kubectl apply -f demo-ws-ingress.yml
ingress.networking.k8s.io/demo-ws-ingress created
# 查看状态
$ kubectl get ingress
NAME CLASS HOSTS ADDRESS PORTS AGE
demo-ws-ingress nginx demo.kubesre.com 80 2m6sKubernetes Ingress Controller若默认不支持WebSocket可能是Ingress老版本，则可以通过如下方式进行配置（作为补充知识）：
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: demo-ws-ingress
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_set_header Upgrade "websocket";
proxy_set_header Connection "Upgrade";
spec:
rules:
- host: demo.kubesre.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: demo-ws-svc
port:
number: 8090NGINX Ingress Controller (Nginx官方),可以通过如下方式进行配置（作为补充知识）：
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: demo-ws-ingress
annotations:
nginx.org/websocket-services: "demo-ws-svc" # 具体的服务名
spec:
ingressClassName: nginx
rules:
- host: demo.kubesre.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: demo-ws-svc
port:
number: 8090验证：通过ApiPost工具进行测试验证成功，Ws可以连接成功并可以成功收发消息！
图片
总结
本文介绍了gPRC与WebSocket后端协议Ingress配置方法，并通过实际案例的方式讲解，下一章将讲解Ingress更多企业级实战，请敬请期待！
