Kubernetes ( k8s ) Ingress Controller 之 Traefik 部署

0.集群环境

Kubernetes v1.16.6
traefik v2.0.7

1. 创建Traefik CRD资源

traefik v2.0 版本后，开始使用CRD（Custom Resource Definition）来完成路由配置

文件名: traefik_crd.yaml

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutes.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRoute
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutetcps.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRouteTCP
    plural: ingressroutetcps
    singular: ingressroutetcp
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: middlewares.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: Middleware
    plural: middlewares
    singular: middleware
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tlsoptions.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TLSOption
    plural: tlsoptions
    singular: tlsoption
  scope: Namespaced

$ kubectl apply -f traefik_crd.yaml
customresourcedefinition.apiextensions.k8s.io/ingressroutes.traefik.containo.us created
customresourcedefinition.apiextensions.k8s.io/ingressroutetcps.traefik.containo.us created
customresourcedefinition.apiextensions.k8s.io/middlewares.traefik.containo.us created
customresourcedefinition.apiextensions.k8s.io/tlsoptions.traefik.containo.us created

2.创建 RBAC 资源授权

文件名: traefik_rbac.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.containo.us
    resources:
      - middlewares
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutetcps
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - tlsoptions
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: kube-system

$ kubectl apply -f traefik_rbac.yaml
serviceaccount/traefik-ingress-controller created
clusterrole.rbac.authorization.k8s.io/traefik-ingress-controller created
clusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created

4.节点设置Label 标签

标签: ing: "traefik"
当前使用DeamonSet 的方式部署traefik，先给节点设置 label，当程序部署时pod会自动调度到对应的 label 的节点。

# 当前 lable
$ kubectl get node --show-labels
NAME             STATUS   ROLES    AGE   VERSION   LABELS
linuxhub-k8s-n-51   Ready    <none>   28h   v1.16.6   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=linuxhub-k8s-n-51,kubernetes.io/os=linux
linuxhub-k8s-n-52   Ready    <none>   29h   v1.16.6   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=linuxhub-k8s-n-52,kubernetes.io/os=linux
linuxhub-k8s-n-53   Ready    <none>   29h   v1.16.6   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,kubernetes.io/arch=amd64,kubernetes.io/hostname=linuxhub-k8s-n-53,kubernetes.io/os=linux

创建 label

# 创建 节点 label 
$ kubectl label nodes linuxhub-k8s-n-51 ing=traefik
node/linuxhub-k8s-n-51 labeled

$ kubectl label nodes linuxhub-k8s-n-52 ing=traefik
node/linuxhub-k8s-n-52 labeled

$ kubectl label nodes linuxhub-k8s-n-53 ing=traefik
node/linuxhub-k8s-n-53 labeled

查看 label

$ kubectl get node --show-labels
NAME             STATUS   ROLES    AGE   VERSION   LABELS
linuxhub-k8s-n-51   Ready    <none>   28h   v1.16.6   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,ing=traefik,kubernetes.io/arch=amd64,kubernetes.io/hostname=linuxhub-k8s-n-51,kubernetes.io/os=linux
linuxhub-k8s-n-52   Ready    <none>   29h   v1.16.6   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,ing=traefik,kubernetes.io/arch=amd64,kubernetes.io/hostname=linuxhub-k8s-n-52,kubernetes.io/os=linux
linuxhub-k8s-n-53   Ready    <none>   29h   v1.16.6   beta.kubernetes.io/arch=amd64,beta.kubernetes.io/os=linux,ing=traefik,kubernetes.io/arch=amd64,kubernetes.io/hostname=linuxhub-k8s-n-53,kubernetes.io/os=linux

$ kubectl get node -l ing=traefik
NAME             STATUS   ROLES    AGE   VERSION
linuxhub-k8s-n-51   Ready    <none>   28h   v1.16.6
linuxhub-k8s-n-52   Ready    <none>   29h   v1.16.6
linuxhub-k8s-n-53   Ready    <none>   29h   v1.16.6

4.部署 traefik ingress 控制器

使用 DaemonSet 方式部署，便于在多服务器间扩展, 并使用 hostPort的方式让其监听每个 node 的 80 与 443 端口

文件名: traefik_ds.yaml

kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: traefik
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      restartPolicy: Always
      tolerations:
      - operator: "Exists"
      containers:
      - image: traefik:v2.0.7
        name: traefik-ingress-lb
        resources:
          limits:
            cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 1000m
            memory: 1024Mi
        ports:
        - name: web
          containerPort: 80
          hostPort: 80
        - name: websecure
          containerPort: 443
          hostPort: 443
        - name: admin
          containerPort: 8080
        args:
        - --entrypoints.web.Address=:80
        - --entrypoints.websecure.Address=:443
        - --api.insecure=true
        - --metrics.prometheus=true
        - --api.dashboard=true
        - --providers.kubernetescrd
        - --api
        - --accesslog
      nodeSelector:
        ing: "traefik"
---

kind: Service
apiVersion: v1
metadata:
  name: traefik
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 8080
      name: admin

$ kubectl apply -f traefik_ds.yaml
daemonset.apps/traefik created
service/traefik created

查看部署状态

$ kubectl -n kube-system get all -l k8s-app=traefik-ingress-lb
NAME                READY   STATUS    RESTARTS   AGE
pod/traefik-3rxsp   1/1     Running   0          3m2s
pod/traefik-p8b6c   1/1     Running   0          3m2s
pod/traefik-sfbx9   1/1     Running   0          3m2s

NAME                     DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/traefik   3         3         3       3            3           ing=traefik     3m2s

4.配置 Traefik 路由规则

Traefik Dashboard 服务

$ kubectl -n kube-system get svc
NAME       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                  AGE
traefik    ClusterIP   10.254.115.210   <none>        8080/TCP                 34m

配置通过域名对外暴露访问内部traefik服务8080端口
域名: k8s-traefik.linuxhub.cn

文件： traefik_ingressroute.yaml

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-webui
  namespace: kube-system
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`k8s-traefik.linuxhub.cn`)
    kind: Rule
    services:
    - name: traefik
      port: 8080

$ kubectl apply -f  traefik_ingressroute.yaml
ingressroute.traefik.containo.us/traefik-webui created

5.访问 Traefik Dashboard

通过域名访问 http://k8s-traefik.linuxhub.cn

image.png

最后编辑于：2020.04.11 15:52:54

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 204,921评论 6赞 478
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 87,635评论 2赞 381
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 151,393评论 0赞 338
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 54,836评论 1赞 277
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 63,833评论 5赞 368
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 48,685评论 1赞 281
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 38,043评论 3赞 399
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 36,694评论 0赞 258
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 42,671评论 1赞 300
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 35,670评论 2赞 321
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 37,779评论 1赞 332
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 33,424评论 4赞 321
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 39,027评论 3赞 307
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 29,984评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 31,214评论 1赞 260
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 45,108评论 2赞 351
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 42,517评论 2赞 343