如何配置Ingress访问DaemonSet的所有Pod并提供REST列表接口？

针对你用DaemonSet部署硬件依赖Pod，需要通过https://domain/{pod-hostname}/动态访问，同时提供REST接口列出Pod信息的需求，以下是可行的实现方案：

一、动态路由到DaemonSet Pod（基于Hostname） #

1. 配置Headless Service #

创建Headless Service关联DaemonSet Pod，让每个Pod拥有独立DNS记录：

apiVersion: v1
kind: Service
metadata:
  name: daemon-pods-service
  namespace: your-namespace
spec:
  clusterIP: None
  selector:
    app: your-daemon-app  # 匹配DaemonSet Pod的标签
  ports:
  - name: http
    port: 80
    targetPort: 8080  # Pod的监听端口
  publishNotReadyAddresses: true  # 可选：允许访问未就绪的Pod

Headless Service的DNS格式为：{pod-hostname}.daemon-pods-service.your-namespace.svc.cluster.local（若Pod显式设置了hostname字段），默认用Pod名：{pod-name}.daemon-pods-service.your-namespace.svc.cluster.local。

2. 配置NGINX Ingress实现动态路由 #

利用正则路径捕获和变量转发，将https://domain/{pod-hostname}/请求转发到对应Pod：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: daemon-pods-ingress
  namespace: your-namespace
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      set $pod_host $1;
      proxy_pass http://$pod_host.daemon-pods-service.your-namespace.svc.cluster.local$2;
spec:
  tls:
  - hosts:
    - domain
    secretName: your-tls-secret  # HTTPS证书Secret
  rules:
  - host: domain
    http:
      paths:
      - path: /([a-z0-9-]+)(/.*)?
        pathType: ImplementationSpecific
        backend:
          service:
            name: daemon-pods-service  # 仅用于Ingress校验，实际转发依赖变量
            port:
              number: 80

说明：

• 正则/([a-z0-9-]+)(/.*)?捕获路径中的hostname（第一组）和后续子路径（第二组）
• configuration-snippet自定义NGINX规则，将请求转发到对应Pod的DNS地址
• 若Pod hostname和Pod名不一致，需在DaemonSet模板中显式设置hostname，比如用节点名作为标识：

  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: your-daemon-set
    namespace: your-namespace
  spec:
    template:
      spec:
        hostname: "{{ spec.nodeName }}"  # 用节点名作为Pod hostname
        containers:
        - name: your-container
          image: your-image:tag
          ports:
          - containerPort: 8080
  

二、实现REST接口列出Pod Hostname/名称 #

部署轻量级服务调用K8s API，返回DaemonSet Pod的列表信息：

1. 创建服务账号与权限 #

给服务授予读取Pod的权限：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: pod-lister-sa
  namespace: your-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pod-lister-binding
subjects:
- kind: ServiceAccount
  name: pod-lister-sa
  namespace: your-namespace
roleRef:
  kind: ClusterRole
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

2. 部署列表服务（Python Flask示例） #

创建Deployment和Service：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: pod-lister
  namespace: your-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pod-lister
  template:
    metadata:
      labels:
        app: pod-lister
    spec:
      serviceAccountName: pod-lister-sa
      containers:
      - name: pod-lister
        image: python:3.11-slim
        command: ["python3"]
        args:
        - -c
        - |
          from flask import Flask, jsonify
          from kubernetes import client, config

          app = Flask(__name__)
          config.load_incluster_config()
          v1 = client.CoreV1Api()

          @app.route('/api/pods', methods=['GET'])
          def get_pods():
              pods = v1.list_namespaced_pod(namespace='your-namespace', label_selector='app=your-daemon-app')
              pod_list = []
              for pod in pods.items:
                  pod_list.append({
                      'name': pod.metadata.name,
                      'hostname': pod.spec.hostname or pod.metadata.name,
                      'node_name': pod.spec.node_name
                  })
              return jsonify(pod_list)

          if __name__ == '__main__':
              app.run(host='0.0.0.0', port=5000)
        ports:
        - containerPort: 5000
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  name: pod-lister-service
  namespace: your-namespace
spec:
  selector:
    app: pod-lister
  ports:
  - name: http
    port: 80
    targetPort: 5000

3. 暴露REST接口 #

在之前的Ingress中添加路径规则：

# 追加到Ingress的paths数组中
- path: /api/pods
  pathType: Prefix
  backend:
    service:
      name: pod-lister-service
      port:
        number: 80

现在访问https://domain/api/pods即可获取所有DaemonSet Pod的名称、hostname和节点名的JSON列表。

注意事项 #

• 若NGINX Ingress Controller版本较低，需确保支持configuration-snippet注解
• 若Pod hostname包含特殊字符，需调整Ingress的正则匹配规则
• 生产环境建议给REST接口添加认证（如API Key、OAuth2），避免未授权访问K8s资源

内容的提问来源于stack exchange，提问作者Uriel