minikube Traefik 2.0建置

Traefik簡介

ingress相當於從kubernetes複製到外部訪問可訪問的入口，將用戶的URL請求轉發到不同的服務上。Ingress相當於nginx，apache等負載均衡反向代理服務器，其中還包括規則定義，即URL的路由信息。

 

Traefik是一種開源的反向的代理與負載均衡工具。它最大的優點是能夠與常見的微服務系統直接整合，實現自動化動態配置。Trafik通過不斷地跟kubernetes API打交道，實時的感知定位服務， pod等變化，例如pod，服務增加與減少等；當得到這些變化信息後，Ingress自動更新配置並熱重載，達到服務發現的作用。

 

traefik整體架構如下所示。

建置環境minikube

 

mkdir traefik

vi traefik-system.yaml

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutes.traefik.containo.us
spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRoute
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: middlewares.traefik.containo.us
spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: Middleware
    plural: middlewares
    singular: middleware
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tlsoptions.traefik.containo.us
spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TLSOption
    plural: tlsoptions
    singular: tlsoption
  scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutetcps.traefik.containo.us
spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRouteTCP
    plural: ingressroutetcps
    singular: ingressroutetcp
  scope: Namespaced
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik
rules:
- apiGroups:
  - ""
  resources:
  - services
  - endpoints
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - "extensions"
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - ingresses/status
  verbs:
  - update
- apiGroups:
  - "traefik.containo.us"
  resources:
  - middlewares
  - ingressroutes
  - ingressroutetcps
  - tlsoptions
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik
subjects:
- kind: ServiceAccount
  name: traefik
  namespace: traefik-system
---
apiVersion: v1
kind: Namespace
metadata:
  name: traefik-system
---
apiVersion: v1
data:

  config.yaml: |
    serversTransport:
      insecureSkipVerify: true
    api:
      insecure: true
      dashboard: true
      debug: true
    metrics:
      prometheus: ""
    entryPoints:
      web:
        address: ":80"
        forwardedHeaders:
          insecure: true
      websecure:
        address: ":443"
        forwardedHeaders:
          insecure: true
    providers:
      kubernetesCRD: ""
    log:
      filePath: ""
      level: error
      format: json
    accessLog:
      filePath: ""
      format: json
      bufferingSize: 0
      filters:
        retryAttempts: true
        minDuration: 20
      fields:
        defaultMode: keep
        names:
          ClientUsername: drop
        headers:
          defaultMode: keep
          names:
            User-Agent: redact
            Authorization: drop
            Content-Type: keep
kind: ConfigMap
metadata:
  name: traefik
  namespace: traefik-system

---
apiVersion: apps/v1
kind: DaemonSet
#kind: Deployment
metadata:
  labels:
    app: traefik
  name: traefik
  namespace: traefik-system
spec:
  #replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      containers:
      - args:
        - --configFile=/etc/traefik/config.yaml
        image: traefik:latest
        name: traefik
        ports:
        - containerPort: 8080
          name: admin
          protocol: TCP
        - containerPort: 80
          name: http
          protocol: TCP
        - containerPort: 443
          name: https
          protocol: TCP
        volumeMounts:
        - name: config
          mountPath: /etc/traefik
      volumes:
      - name: config
        configMap:
          name: traefik
      serviceAccount: traefik
---
apiVersion: v1
kind: Service
metadata:
  name: traefik-ingress
  namespace: traefik-system
  labels:
    app: traefik
spec:
  ports:
  - name: https
    protocol: TCP
    port: 443
    targetPort: 443
  - name: http
    protocol: TCP
    port: 80
    targetPort: 80
  type: LoadBalancer
  selector:
    app: traefik
---
apiVersion: v1
kind: Service
metadata:
  name: traefik-admin
  namespace: traefik-system
  labels:
    app: traefik
spec:
  ports:
  - name: admin
    protocol: TCP
    port: 8080
    targetPort: 8080
  type: ClusterIP
  selector:
    app: traefik
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik
  namespace: traefik-system
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
  namespace: traefik-system
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`traefik-dashboard.itnotetk.com`)
    kind: Rule
    services:
    - name: traefik-admin
      port: 8080
    middlewares:
    - name: ip-ipwhitelist
---

vi traefik-nginx.yaml

---
# declare Traefik deployment
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: nginx-demo
  namespace: traefik-system
  labels:
    app: nginx-demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-demo
  template:
    metadata:
      labels:
        app: nginx-demo
    spec:
      containers:
      - name: nginx
        image: "nginx"
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx-http-route
  namespace: traefik-system
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`nginx.itnotetk.com`)
      kind: Rule
      services:
        - name: nginx-demo
          port: 80
      middlewares:
        - name: redirect

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx-https-route
  namespace: traefik-system
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`nginx.itnotetk.com`)
      kind: Rule
      services:
        - name: nginx-demo
          port: 80
    - match: Host(`nginx.itnotetk.com`) && Path(`/v2`)
      kind: Rule
      services:
        - name: nginx-demo
          port: 80
  tls:
    secretName: web-ssl

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: redirect
  namespace: traefik-system
spec:
  redirectScheme:
    scheme: https
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
      protocol: TCP
      targetPort: 443
    - name: http


  tls.key: |
   yoursslkey-start...........................................................................................................................yoursslkey-end
---

vi traefik-ipwhitelist.yaml

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: ip-ipwhitelist
  namespace: traefik-system
spec:
  ipWhiteList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.30

kubectl apply -f traefik-system.yaml

kubectl apply -f traefik-nginx.yaml

ubectl apply -f traefik-ipwhitelist.yaml

 

 

 

開啟dashboard監控

kubectl port-forward -n traefik-system svc/traefik-admin --address='0.0.0.0' 8080:8080

開啟prometheus監控

kubectl port-forward -n monitoring svc/kube-prometheus-grafana --address='0.0.0.0' 3000:80

開啟Prometheus Operator後台

kubectl port-forward -n monitoring service/prometheus-operated --address='0.0.0.0' 9090:9090