kubernetes 1.16安装traefik

秒速五厘米 2023-06-12 04:29 17阅读 0赞

本次所使用的的kubernetes环境为基于kubeadm安装的高可用集群，版本为1.16.0  
![在这里插入图片描述][2019103116081546.png]  
cni插件使用的是calico  
![在这里插入图片描述][20191031161028199.png]  
首先需要获取RBAC授权资源  
traefik-rbac.yaml

apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
      name: ingressroutes.traefik.containo.us
    
    spec:
      group: traefik.containo.us
      version: v1alpha1
      names:
        kind: IngressRoute
        plural: ingressroutes
        singular: ingressroute
      scope: Namespaced
    
    ---
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
      name: ingressroutetcps.traefik.containo.us
    
    spec:
      group: traefik.containo.us
      version: v1alpha1
      names:
        kind: IngressRouteTCP
        plural: ingressroutetcps
        singular: ingressroutetcp
      scope: Namespaced
    
    ---
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
      name: middlewares.traefik.containo.us
    
    spec:
      group: traefik.containo.us
      version: v1alpha1
      names:
        kind: Middleware
        plural: middlewares
        singular: middleware
      scope: Namespaced
    
    ---
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
      name: tlsoptions.traefik.containo.us
    
    spec:
      group: traefik.containo.us
      version: v1alpha1
      names:
        kind: TLSOption
        plural: tlsoptions
        singular: tlsoption
      scope: Namespaced
    
    ---
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: traefik-ingress-controller
    
    rules:
      - apiGroups:
          - ""
        resources:
          - services
          - endpoints
          - secrets
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - extensions
        resources:
          - ingresses
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - extensions
        resources:
          - ingresses/status
        verbs:
          - update
      - apiGroups:
          - traefik.containo.us
        resources:
          - middlewares
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - traefik.containo.us
        resources:
          - ingressroutes
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - traefik.containo.us
        resources:
          - ingressroutetcps
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - traefik.containo.us
        resources:
          - tlsoptions
        verbs:
          - get
          - list
          - watch
    
    ---
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: traefik-ingress-controller
    
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: traefik-ingress-controller
    subjects:
      - kind: ServiceAccount
        name: traefik-ingress-controller
        namespace: default

接下来部署ingress控制器  
traefik-deployment.yaml

apiVersion: v1
    kind: ServiceAccount
    metadata:
      namespace: default
      name: traefik-ingress-controller
    
    ---
    kind: Deployment
    apiVersion: apps/v1
    metadata:
      namespace: default
      name: traefik
      labels:
        app: traefik
    
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: traefik
      template:
        metadata:
          labels:
            app: traefik
        spec:
          serviceAccountName: traefik-ingress-controller
          containers:
            - name: traefik
              image: traefik:v2.0
              args:
                - --api.insecure
                - --accesslog
                - --entrypoints.web.Address=:8000
                - --entrypoints.websecure.Address=:4443
                - --providers.kubernetescrd
                - --certificatesresolvers.default.acme.tlschallenge
                - --certificatesresolvers.default.acme.email=foo@you.com
                - --certificatesresolvers.default.acme.storage=acme.json
                # Please note that this is the staging Let's Encrypt server.
                # Once you get things working, you should remove that whole line altogether.
                - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
              ports:
                - name: web
                  containerPort: 8000
                - name: websecure
                  containerPort: 4443
                - name: admin
                  containerPort: 8080

然后启动服务  
traefik-service.yaml

apiVersion: v1
    kind: Service
    metadata:
      name: traefik
    
    spec:
      ports:
        - protocol: TCP
          name: web
          port: 8000
        - protocol: TCP
          name: admin
          port: 8080
        - protocol: TCP
          name: websecure
          port: 4443
      selector:
        app: traefik

这里你可以根据需要，暴露web端口。  
下面是主页面。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NhcnJ5MWJleW9uZA_size_16_color_FFFFFF_t_70]  
然后创建一个ingressRoute，用来路由现有的服务。  
ingressroute-nginx.yaml

apiVersion: traefik.containo.us/v1alpha1
    kind: IngressRoute
    metadata:
      name: simpleingressroute
      namespace: default
    spec:
      entryPoints:
        - web
      routes:
      - match: Host(`nginx.hk`)
        kind: Rule
        services:
        - name: nginx-service
          port: 8080

这里使用的nginx.hk可以通过配置dns服务器或修改hosts文件的方式完成试验。  
最后访问该地址，即可实现kubernetes的ingress配置。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NhcnJ5MWJleW9uZA_size_16_color_FFFFFF_t_70 1]  
参考了官方文档：https://docs.traefik.io/

[2019103116081546.png]: /images/20230531/d1d1f2397f984123a5baaa0ad26a7a07.png
[20191031161028199.png]: /images/20230531/c14dfece23f7434da73443bd9f71b810.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NhcnJ5MWJleW9uZA_size_16_color_FFFFFF_t_70]: /images/20230531/23a6a512f2994ab7b460d9ab7247a88b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NhcnJ5MWJleW9uZA_size_16_color_FFFFFF_t_70 1]: /images/20230531/4c0f4ce1b27e43d0bcdb3d27aed92f04.png