Traefik 使用

由于微服务架构以及 Docker 技术和 kubernetes 编排工具最近几年才开始逐渐流行，所以一开始的反向代理服务器比如 nginx、apache 并未提供其支持，毕竟他们也不是先知；所以才会出现 Ingress Controller 这种东西来做 kubernetes 和前端负载均衡器如 nginx 之间做衔接；即 Ingress Controller 的存在就是为了能跟 kubernetes 交互，又能写 nginx 配置，还能 reload 它，这是一种折中方案；而最近开始出现的 traefik 天生就是提供了对 kubernetes 的支持，也就是说 traefik 本身就能跟 kubernetes API 交互，感知后端变化，因此可以得知: 在使用 traefik 时，Ingress Controller 已经无卵用了，所以整体架构如下

traefik部署在k8s上分为daemonset和deployment两种方式各有优缺点：
daemonset 能确定有哪些node在运行traefik，所以可以确定的知道后端ip，但是不能方便的伸缩
deployment 可以更方便的伸缩，但是不能确定有哪些node在运行traefik所以不能确定的知道后端ip

一般部署两种不同类型的traefik:
面向内部(internal)服务的traefik，建议可以使用deployment的方式
面向外部(external)服务的traefik，建议可以使用daemonset的方式

建议使用traffic-type标签
traffic-type: external
traffic-type: internal

traefik相应地使用labelSelector
traffic-type=internal
traffic-type=external

已经从大体上搞懂了 Ingress 和 traefik，那么部署起来就很简单

traefik部署

Daemon Set 部署

[root@k8s01 traefik]# kubectl apply -f traefik-ds.yaml
[root@k8s01 traefik]# kubectl apply -f traefik-rbac.yaml
[root@k8s01 traefik]# kubectl apply -f traefik-config.yaml
[root@k8s01 traefik]# kubectl apply -f ui.yaml
[root@k8s01 traefik]# cat traefik-ds.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      volumes:
      - name: ssl
        secret:
          secretName: anxin-cert
      - configMap:
          name: traefik-conf
        name: config
      containers:
      - image: traefik:v1.6
        imagePullPolicy: Always
        name: traefik-ingress-lb
        volumeMounts:
        - mountPath: /etc/kubernetes/ssl
          name: ssl
        - mountPath: /config
          name: config     
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        - name: https
          containerPort: 443
          hostPort: 443
        - name: admin
          containerPort: 8080
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        args:
        - --api
        - --kubernetes
        - --logLevel=INFO
        - --configfile=/congfig/traefik.toml
---
kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 8080
      name: admin

[root@k8s01 traefik]# cat traefik-rbac.yaml
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: kube-system

[root@k8s01 traefik]# cat traefik-config.yaml
apiVersion: v1
data:
  traefik.toml: |
    insecureSkipVerify = true
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
        [entryPoints.http.redirect]    #强制跳转https（可选）
        entryPoint = "https"
      [entryPoints.https]
      address = ":443"
        [entryPoints.https.tls]
          [[entryPoints.https.tls.certificates]] 
          certFile = "/etc/kubernetes/ssl/axhome.com.cn.pem"    #域名证书目录
          keyFile = "/etc/kubernetes/ssl/axhome.com.cn.key"
kind: ConfigMap
metadata:
  name: traefik-conf
  namespace: kube-system

[root@k8s01 traefik]# cat ui.yaml
apiVersion: v1
kind: Service
metadata:
  name: traefik-web-ui
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
  - name: web
    port: 80
    targetPort: 8080
  - name: https
    port: 443
    targetPort: 443
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-web-ui
  namespace: kube-system
spec:
  rules:
  - host: traefik-ui.axhome.com.cn   #根据自己的域名而定
    http:
      paths:
      - path: /
        backend:
          serviceName: traefik-web-ui
          servicePort: web