K8S實(shí)踐Traefik-Ingress部署
Traefik 是一款開源的邊緣路由器，它可以讓發(fā)布服務(wù)變得輕松有趣。它代表您的系統(tǒng)接收請(qǐng)求，并找出負(fù)責(zé)處理這些請(qǐng)求的組件。與眾不同之處在于，除了它的許多特性之外，它還可以自動(dòng)為您的服務(wù)發(fā)現(xiàn)正確的配置。當(dāng) Traefik 檢查您的基礎(chǔ)設(shè)施時(shí)，它會(huì)發(fā)現(xiàn)相關(guān)信息，并發(fā)現(xiàn)哪個(gè)服務(wù)為哪個(gè)請(qǐng)求提供服務(wù)。
Traefik 與每個(gè)主要的集群技術(shù)都是原生兼容的，比如 Kubernetes、Docker、Docker Swarm、AWS、Mesos、Marathon 等等;并且可以同時(shí)處理多個(gè)。(它甚至適用于運(yùn)行在裸機(jī)上的遺留軟件。) 使用 Traefik，不需要維護(hù)和同步單獨(dú)的配置文件:所有事情都是實(shí)時(shí)自動(dòng)發(fā)生的(沒有重啟，沒有連接中斷)。使用 Traefik，只需要花費(fèi)時(shí)間開發(fā)和部署新功能到您的系統(tǒng)，而不是配置和維護(hù)其工作狀態(tài)。
項(xiàng)目地址：https://github.com/traefik/traefik
官網(wǎng)文檔：https://doc.traefik.io/traefik/
二、部署Traefik
2.1：創(chuàng)建名稱空間
[root@k8s-master1 ~]# cd /opt/k8s/work/
[root@k8s-master1 work]# mkdir traefik
[root@k8s-master1 work]# cd traefik/
[root@k8s-master1 traefik]# kubectl create ns ingress-traefik
2.2：創(chuàng)建CRD資源
在?traefik v2.0?版本后，開始使用?CRD（Custom Resource Definition）來完成路由配置等，所以需要提前創(chuàng)建 CRD 資源。
[root@k8s-master1 traefik]# vim traefik-crd.yaml
## IngressRoute
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutes.traefik.containo.us
spec:
scope: Namespaced
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRoute
plural: ingressroutes
singular: ingressroute
---
## IngressRouteTCP
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutetcps.traefik.containo.us
spec:
scope: Namespaced
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteTCP
plural: ingressroutetcps
singular: ingressroutetcp
---
## Middleware
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: middlewares.traefik.containo.us
spec:
scope: Namespaced
group: traefik.containo.us
version: v1alpha1
names:
kind: Middleware
plural: middlewares
singular: middleware
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsoptions.traefik.containo.us
spec:
scope: Namespaced
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSOption
plural: tlsoptions
singular: tlsoption
---
## TraefikService
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: traefikservices.traefik.containo.us
spec:
scope: Namespaced
group: traefik.containo.us
version: v1alpha1
names:
kind: TraefikService
plural: traefikservices
singular: traefikservice
---
## TraefikTLSStore
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsstores.traefik.containo.us
spec:
scope: Namespaced
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSStore
plural: tlsstores
singular: tlsstore
---
## IngressRouteUDP
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressrouteudps.traefik.containo.us
spec:
scope: Namespaced
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteUDP
plural: ingressrouteudps
singular: ingressrouteudp
#創(chuàng)建資源
[root@k8s-master1 traefik]# kubectl apply -f traefik-crd.yaml
#查看crd資源
[root@k8s-master1 traefik]# kubectl get crd | grep traefik
2.3：創(chuàng)建RBAC權(quán)限
Traefik?需要一定的權(quán)限，所以這里提前創(chuàng)建好?Traefik ServiceAccount?并分配一定的權(quán)限。
[root@k8s-master1 traefik]# vim traefik-rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: ingress-traefik
name: traefik-ingress-controller
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups: [""]
resources: ["services","endpoints","secrets"]
verbs: ["get","list","watch"]
- apiGroups: ["extensions"]
resources: ["ingresses"]
verbs: ["get","list","watch"]
- apiGroups: ["extensions"]
resources: ["ingresses/status"]
verbs: ["update"]
- apiGroups: ["traefik.containo.us"]
resources: ["middlewares"]
verbs: ["get","list","watch"]
- apiGroups: ["traefik.containo.us"]
resources: ["ingressroutes","traefikservices"]
verbs: ["get","list","watch"]
- apiGroups: ["traefik.containo.us"]
resources: ["ingressroutetcps","ingressrouteudps"]
verbs: ["get","list","watch"]
- apiGroups: ["traefik.containo.us"]
resources: ["tlsoptions","tlsstores"]
verbs: ["get","list","watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: ingress-traefik
#創(chuàng)建資源
[root@k8s-master1 traefik]# kubectl apply -f traefik-rbac.yaml
#檢查資源
[root@k8s-master1 traefik]# kubectl get secrets -n ingress-traefik|grep traefik
[root@k8s-master1 traefik]# kubectl get clusterrole -n ingress-traefik|grep traefik
2.4：創(chuàng)建配置文件
[root@k8s-master1 traefik]# vim traefik-config.yaml
kind: ConfigMap
apiVersion: v1
metadata:
name: traefik-config
namespace: ingress-traefik
data:
traefik.yaml: |-
ping: "" ## 啟用 Ping
serversTransport:
insecureSkipVerify: true ## Traefik 忽略驗(yàn)證代理服務(wù)的 TLS 證書
api:
insecure: true ## 允許 HTTP 方式訪問 API
dashboard: true ## 啟用 Dashboard
debug: false ## 啟用 Debug 調(diào)試模式
metrics:
prometheus: "" ## 配置 Prometheus 監(jiān)控指標(biāo)數(shù)據(jù)，并使用默認(rèn)配置
entryPoints:
web:
address: ":80" ## 配置 80 端口，并設(shè)置入口名稱為 web
websecure:
address: ":443" ## 配置 443 端口，并設(shè)置入口名稱為 websecure
providers:
kubernetesCRD: "" ## 啟用 Kubernetes CRD 方式來配置路由規(guī)則
kubernetesIngress: "" ## 啟動(dòng) Kubernetes Ingress 方式來配置路由規(guī)則
log:
filePath: "" ## 設(shè)置調(diào)試日志文件存儲(chǔ)路徑，如果為空則輸出到控制臺(tái)
level: error ## 設(shè)置調(diào)試日志級(jí)別
format: json ## 設(shè)置調(diào)試日志格式
accessLog:
filePath: "" ## 設(shè)置訪問日志文件存儲(chǔ)路徑，如果為空則輸出到控制臺(tái)
format: json ## 設(shè)置訪問調(diào)試日志格式
bufferingSize: 0 ## 設(shè)置訪問日志緩存行數(shù)
filters:
#statusCodes: ["200"] ## 設(shè)置只保留指定狀態(tài)碼范圍內(nèi)的訪問日志
retryAttempts: true ## 設(shè)置代理訪問重試失敗時(shí)，保留訪問日志
minDuration: 20 ## 設(shè)置保留請(qǐng)求時(shí)間超過指定持續(xù)時(shí)間的訪問日志
fields: ## 設(shè)置訪問日志中的字段是否保留（keep 保留、drop 不保留）
defaultMode: keep ## 設(shè)置默認(rèn)保留訪問日志字段
names: ## 針對(duì)訪問日志特別字段特別配置保留模式
ClientUsername: drop
headers: ## 設(shè)置 Header 中字段是否保留
defaultMode: keep ## 設(shè)置默認(rèn)保留 Header 中字段
names: ## 針對(duì) Header 中特別字段特別配置保留模式
User-Agent: redact
Authorization: drop
Content-Type: keep
#創(chuàng)建資源
[root@k8s-master1 traefik]# kubectl apply -f traefik-config.yaml
configmap/traefik-config created
#查看資源
[root@k8s-master1 traefik]# kubectl get cm -n ingress-traefik
NAME DATA AGE
traefik-config 1 13s
2.5：節(jié)點(diǎn)添加標(biāo)簽
[root@k8s-master1 traefik]# kubectl get nodes
#添加標(biāo)簽
[root@k8s-master1 traefik]# kubectl label nodes k8s-node1 IngressProxy=true
[root@k8s-master1 traefik]# kubectl label nodes k8s-node2 IngressProxy=true
[root@k8s-master1 traefik]# kubectl label nodes k8s-node3 IngressProxy=true
#查看標(biāo)簽
[root@k8s-master1 traefik]# kubectl get nodes --show-labels
2.6：部署Traefik
2.6.1：創(chuàng)建Service
[root@k8s-master1 traefik]# vim traefik-service.yaml
apiVersion: v1
kind: Service
metadata:
name: traefik
namespace: ingress-traefik
spec:
type: NodePort
ports:
- name: web
port: 80
- name: websecure
port: 443
- name: admin
port: 8080
selector:
app: traefik
2.6.2：創(chuàng)建DaemonSet
[root@k8s-master1 traefik]# vim traefik-deploy.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: traefik-ingress-controller
namespace: ingress-traefik
labels:
app: traefik
spec:
selector:
matchLabels:
app: traefik
template:
metadata:
name: traefik
labels:
app: traefik
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 1
containers:
- image: traefik:v2.3.5
name: traefik-ingress-lb
ports:
- name: web
containerPort: 80
hostPort: 80 ## 將容器端口綁定所在服務(wù)器的 80 端口
- name: websecure
containerPort: 443
hostPort: 443 ## 將容器端口綁定所在服務(wù)器的 443 端口
- name: admin
containerPort: 8080 ## Traefik Dashboard 端口
resources:
limits:
cpu: 2000m
memory: 1024Mi
requests:
cpu: 1000m
memory: 1024Mi
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
args:
- --configfile=/config/traefik.yaml
volumeMounts:
- mountPath: "/config"
name: "config"
volumes:
- name: config
configMap:
name: traefik-config
tolerations: ## 設(shè)置容忍所有污點(diǎn)，防止節(jié)點(diǎn)被設(shè)置污點(diǎn)
- operator: "Exists"
nodeSelector: ## 設(shè)置node篩選器，在特定label的節(jié)點(diǎn)上啟動(dòng)
IngressProxy: "true"
#創(chuàng)建資源
[root@k8s-master1 traefik]# kubectl apply -f traefik-deploy.yaml
#檢查資源
[root@k8s-master1 traefik]# kubectl get po -n ingress-traefik
2.7：創(chuàng)建路由規(guī)則
我這里以traefik的面板和K8S Dashboard面板進(jìn)行演示
方式1：通過CRD配置路由規(guī)則
（1）配置HTTP協(xié)議的訪問路由規(guī)則
這里以traefik的看板進(jìn)行演示
[root@k8s-master1 traefik]# vim traefik-dashboard-route.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard-route
namespace: ingress-traefik
spec:
entryPoints:
- web
routes:
- match: Host(`traefik.dqzboy.com`)
kind: Rule
services:
- name: traefik #綁定至上面創(chuàng)建的service資源的名稱
port: 8080
在PC機(jī)上將DaemonSet調(diào)度的節(jié)點(diǎn)物理IP與CRD資源中掛載的Host域名進(jìn)行綁定，然后瀏覽器中輸入traefik.dqzboy.com即可訪問traefik的看板了
（2）配置HTTPS協(xié)議的訪問路由規(guī)則
這里以K8S的官方面板進(jìn)行樣式
#首先我們需要先生成證書文件
[root@k8s-master1 traefik]# openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout traefik.key -out traefik.crt -subj "/CN=dqzboy"
#將證書存儲(chǔ)到 Kubernetes Secret 中
[root@k8s-master1 traefik]# kubectl create secret generic k8s-dashboard-tls --from-file=traefik.crt --from-file=traefik.key -n kubernetes-dashboard
#創(chuàng)建HTTPS的官方面板訪問路由規(guī)則
[root@k8s-master1 traefik]# vim k8s-dashboard-router.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: kubernetes-dashboard-route
namespace: kubernetes-dashboard #dashboard所屬的名稱空間
spec:
entryPoints:
- websecure
tls:
secretName: k8s-dashboard-tls #上面導(dǎo)入的secret資源名稱
routes:
- match: Host(`k8sboard.dqzboy.com`)
kind: Rule
services:
- name: kubernetes-dashboard #注意此名必須與之前部署k8s面板時(shí)的yaml文件中Service上下文中metadata段中的name段名稱保持一致(也就是svc服務(wù))
port: 443
#創(chuàng)建路由規(guī)則
[root@k8s-master1 traefik]# kubectl apply -f k8s-dashboard-router.yaml
同樣我們需要在自己的PC機(jī)上進(jìn)行解析域名
方式2：通過Ingress配置路由規(guī)則
（1）創(chuàng)建traefik路由規(guī)則
[root@k8s-master1 traefik]# vim traefik-dashboard-ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-dashboard-ingress
namespace: ingress-traefik #traefik服務(wù)所屬的名稱空間
annotations:
kubernetes.io/ingress.class: traefik
traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
rules:
- host: traefik01.dqzboy.com
http:
paths:
- path: /
backend:
serviceName: traefik
servicePort: 8080
#創(chuàng)建路由
[root@k8s-master1 traefik]# kubectl apply -f traefik-dashboard-ingress.yaml
#檢查服務(wù)
[root@k8s-master1 traefik]# kubectl get ing -n ingress-traefik
NAME CLASS HOSTS ADDRESS PORTS AGE
traefik-dashboard-ingress
自己的PC的hosts文件中進(jìn)行域名解析，然后通過瀏覽器進(jìn)行訪問
(2）創(chuàng)建K8S面板路由規(guī)則
#首先我們需要先生成證書文件
[root@k8s-master1 traefik]# openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout traefik.key -out traefik.crt -subj "/CN=dqzboy"
#將證書存儲(chǔ)到 Kubernetes Secret 中
[root@k8s-master1 traefik]# kubectl create secret generic k8s-dashboard-tls --from-file=traefik.crt --from-file=traefik.key -n kubernetes-dashboard
#創(chuàng)建資源
[root@k8s-master1 traefik]#
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: kubernetes-dashboard-ingress
namespace: kubernetes-dashboard #dashboard服務(wù)所屬名稱空間
annotations:
kubernetes.io/ingress.class: traefik
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
tls:
- secretName: k8s-dashboard-tls
rules:
- host: k8sboard01.dqzboy.com
http:
paths:
- path: /
backend:
serviceName: kubernetes-dashboard #dashboard對(duì)應(yīng)的service服務(wù)
servicePort: 443
[root@k8s-master1 traefik]# kubectl apply -f k8s-dashboard-ing.yaml
#檢查服務(wù)
[root@k8s-master1 traefik]# kubectl get ing -n ingress-traefik
本機(jī)PC進(jìn)行域名解析，然后瀏覽器中進(jìn)行訪問
Kubernetes NAT
版權(quán)聲明：本文內(nèi)容由網(wǎng)絡(luò)用戶投稿，版權(quán)歸原作者所有，本站不擁有其著作權(quán)，亦不承擔(dān)相應(yīng)法律責(zé)任。如果您發(fā)現(xiàn)本站中有涉嫌抄襲或描述失實(shí)的內(nèi)容，請(qǐng)聯(lián)系我們jiasou666@gmail.com 處理，核實(shí)后本網(wǎng)站將在24小時(shí)內(nèi)刪除侵權(quán)內(nèi)容。
相關(guān)文章
