第42章 可落地完整参考实现：一套能跑的多协议转发栈

apiVersion: v1
kind: Namespace
metadata: { name: demo }

apiVersion: apps/v1
kind: Deployment
metadata: { name: code-server, namespace: demo }
spec:
  replicas: 1                                   # WS 长连接：单副本省心（第40章）
  selector: { matchLabels: { app: code-server } }
  template:
    metadata: { labels: { app: code-server } }
    spec:
      containers:
      - name: code-server
        image: codercom/code-server:latest      # 替换为你的镜像
        args: ["--bind-addr", "0.0.0.0:8080", "--auth", "password"]
        env: [{ name: PASSWORD, value: "change-me" }]
        ports: [{ containerPort: 8080 }]
---
apiVersion: v1
kind: Service
metadata: { name: code-server, namespace: demo }
spec:
  selector: { app: code-server }
  ports: [{ port: 8080, targetPort: 8080 }]
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ide
  namespace: demo
  annotations:
    # 铁律一：长超时（WS 空闲不被掐）；铁律二对 WS 无害
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
spec:
  ingressClassName: nginx
  tls: [{ hosts: [ide.demo.com], secretName: ide-tls }]
  rules:
  - host: ide.demo.com
    http: { paths: [{ path: /, pathType: Prefix, backend: { service: { name: code-server, port: { number: 8080 } } } }] }

apiVersion: apps/v1
kind: Deployment
metadata: { name: sse-app, namespace: demo }
spec:
  selector: { matchLabels: { app: sse-app } }
  template:
    metadata: { labels: { app: sse-app } }
    spec:
      containers:
      - name: sse
        image: your/sse-demo:latest             # 一个发 text/event-stream 的小服务
        ports: [{ containerPort: 8090 }]
        # 应用响应里带：Content-Type: text/event-stream + X-Accel-Buffering: no（第40章）
---
apiVersion: v1
kind: Service
metadata: { name: sse-app, namespace: demo }
spec: { selector: { app: sse-app }, ports: [{ port: 8090, targetPort: 8090 }] }
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: sse
  namespace: demo
  annotations:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"   # 铁律一
    nginx.ingress.kubernetes.io/proxy-buffering: "off"       # 铁律二：流式必须
spec:
  ingressClassName: nginx
  tls: [{ hosts: [sse.demo.com], secretName: sse-tls }]
  rules:
  - host: sse.demo.com
    http: { paths: [{ path: /, pathType: Prefix, backend: { service: { name: sse-app, port: { number: 8090 } } } }] }

apiVersion: apps/v1
kind: Deployment
metadata: { name: grpc-backend, namespace: demo }
spec:
  replicas: 3                                   # 多副本演示 gRPC 负载（第41章）
  selector: { matchLabels: { app: grpc-backend } }
  template:
    metadata: { labels: { app: grpc-backend } }
    spec:
      containers:
      - name: grpc
        image: your/grpc-server:latest          # 在 50051 提供 gRPC
        ports: [{ containerPort: 50051 }]
---
apiVersion: v1
kind: Service
metadata: { name: grpc-backend, namespace: demo }
spec: { selector: { app: grpc-backend }, ports: [{ port: 50051, targetPort: 50051 }] }
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grpc
  namespace: demo
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"     # 关键：h2+trailers（第41章）
spec:
  ingressClassName: nginx
  tls: [{ hosts: [grpc.demo.com], secretName: grpc-tls }]
  rules:
  - host: grpc.demo.com
    http: { paths: [{ path: /, pathType: Prefix, backend: { service: { name: grpc-backend, port: { number: 50051 } } } }] }

apiVersion: apps/v1
kind: Deployment
metadata: { name: sshd, namespace: demo }
spec:
  selector: { matchLabels: { app: sshd } }
  template:
    metadata: { labels: { app: sshd } }
    spec:
      containers:
      - name: sshd
        image: linuxserver/openssh-server:latest   # 替换/配置好账号密钥
        ports: [{ containerPort: 22 }]
---
apiVersion: v1
kind: Service
metadata: { name: sshd, namespace: demo }
spec: { selector: { app: sshd }, ports: [{ port: 22, targetPort: 22 }] }
# 节点 2222 → demo/sshd:22 已在第一步 tcp-services 配好（L4，无 Ingress 资源）

apiVersion: v1
kind: ConfigMap
metadata: { name: edge-nginx-conf, namespace: demo }
data:
  nginx.conf: |
    map $http_upgrade $connection_upgrade { default upgrade; '' close; }
    upstream ingress { server ingress-nginx-controller.ingress-nginx:443; keepalive 64; }
    server {
        listen 443 ssl;
        server_name *.demo.com;
        ssl_certificate     /etc/certs/tls.crt;
        ssl_certificate_key /etc/certs/tls.key;
        client_max_body_size 0;                      # 大文件每跳放开（第41章）
        location / {
            proxy_pass https://ingress;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;            # 铁律三
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 3600s; proxy_send_timeout 3600s;  # 铁律一
            proxy_buffering off;                                  # 铁律二
        }
    }
# 配 Deployment 挂这个 ConfigMap + 证书 secret 即可（略）