Oracle Cloud K8s集群复用LoadBalancer多服务共享方案咨询

Absolutely! Reusing a single LoadBalancer for multiple Kubernetes Services in OCI is not just possible—it's a smart practice that cuts down on unnecessary cloud resource costs and lets you centralize all your TLS configuration in one place. Let's break down how to do this, and answer your specific questions along the way.

Core Approach: Use a Kubernetes Ingress Controller #

Instead of creating a LoadBalancer for each Service, you'll deploy an Ingress Controller (backed by one OCI LoadBalancer) that acts as a single entry point for all your cluster traffic. Your individual Services will run as ClusterIP types (internal-only), and the Ingress Controller will route external traffic to them based on rules you define. This is the standard way to centralize TLS and avoid redundant LoadBalancers.

Step-by-Step Implementation #

1. Update Your Existing Service to ClusterIP #

First, modify your my-nginx-svc to be a ClusterIP Service (this is the default if you omit the type field). It no longer needs its own LoadBalancer, since traffic will come through the Ingress Controller:

apiVersion: v1
kind: Service
metadata:
  name: my-nginx-svc
  labels:
    app: nginx
spec:
  ports:
  - port: 80
  selector:
    app: nginx

2. Deploy an Ingress Controller #

You'll need an Ingress Controller running in your cluster. For OCI, you can use the popular NGINX Ingress Controller or OCI's native managed Ingress Controller. Below is a quick setup using the NGINX controller (its Service will create the single OCI LoadBalancer you'll reuse):

Install via Helm (the easiest method):

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install nginx-ingress ingress-nginx/ingress-nginx

After installation, verify the controller's Service has an OCI LoadBalancer IP assigned:

kubectl get svc nginx-ingress-ingress-nginx-controller

3. Create an Ingress Resource for Routing & TLS #

Next, define an Ingress resource that tells the controller how to route traffic to your Services. This is where you'll centralize your TLS configuration too.

Example manifest with TLS and routing rules:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cluster-shared-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  # Centralized TLS configuration
  tls:
  - hosts:
    - your-domain.com  # Replace with your actual domain
    secretName: oci-tls-secret  # Secret storing your TLS cert/key
  # Routing rules for your Services
  rules:
  - host: your-domain.com
    http:
      paths:
      - path: /nginx
        pathType: Prefix
        backend:
          service:
            name: my-nginx-svc
            port:
              number: 80
      # Add more rules for other Services here
      - path: /blog
        pathType: Prefix
        backend:
          service:
            name: blog-service-svc
            port:
              number: 8080

4. Set Up Your TLS Certificate #

Create a Kubernetes Secret to store your TLS certificate and private key:

kubectl create secret tls oci-tls-secret --cert=./your-cert.crt --key=./your-private.key

For OCI-specific workflows, you can also use the OCI Certificates Service to manage certificates and sync them automatically to Kubernetes Secrets.

Answering Your Specific Questions #

• Can a Deployment point directly to an existing LoadBalancer?
  No—Deployments are responsible for managing Pod replicas and don't interact with LoadBalancers directly. All traffic to Pods must flow through a Kubernetes Service (in this case, ClusterIP Services).
• Do I need to create Services first before routing via the LoadBalancer?
  Yes. Every application you want to expose must first be wrapped in a ClusterIP Service. The Ingress Controller (backed by your single LoadBalancer) then routes external traffic to these internal Services based on the rules you define.

Key Benefits #

• Only one OCI LoadBalancer resource is provisioned, reducing cloud costs.
• TLS configuration is centralized in one Ingress resource, eliminating per-Service TLS setup.
• Adding new Services is as simple as updating the Ingress manifest with new routing rules.

内容的提问来源于stack exchange，提问作者Martin Andersen