一、Traefik简介

Træfɪk 是一个为了让部署微服务更加便捷而诞生的现代HTTP反向代理、负载均衡工具。 它支持多种后台 (Docker, Swarm, Kubernetes, Marathon, Mesos, Consul, Etcd, Zookeeper, BoltDB, Rest API, file…) 来自动化、动态的应用它的配置文件设置。

除了众多的功能之外，Traefik 的与众不同之处还在于它会自动发现适合你服务的配置。当 Traefik 在检查你的服务时，会找到服务的相关信息并找到合适的服务来满足对应的请求。

使用 Traefik，不需要维护或者同步一个独立的配置文件：因为一切都会自动配置，实时操作的（无需重新启动，不会中断连接）。使用 Traefik，你可以花更多的时间在系统的开发和新功能上面，而不是在配置和维护工作状态上面花费大量时间。

aHR0cHM6Ly93d3cucWlrcWlhay5jb20vazhzdHJhaW4vYXNzZXRzL2ltZy9uZXR3b3JrL3RyYWVmaWstYXJjaGl0ZWN0dXJlLnBuZw.png

相关概念

Traefik 是一个边缘路由器，是你整个平台的大门，拦截并路由每个传入的请求：它知道所有的逻辑和规则，这些规则确定哪些服务处理哪些请求；传统的反向代理需要一个配置文件，其中包含路由到你服务的所有可能路由，而 Traefik 会实时检测服务并自动更新路由规则，可以自动服务发现。

aHR0cHM6Ly93d3cucWlrcWlhay5jb20vazhzdHJhaW4vYXNzZXRzL2ltZy9uZXR3b3JrL3RyYWVmaWstYXJjaGl0ZWN0dXJlLW92ZXJ2aWV3LnBuZw.png

首先，当启动 Traefik 时，需要定义 entrypoints（入口点），然后，根据连接到这些 entrypoints 的路由来分析传入的请求，来查看他们是否与一组规则相匹配，如果匹配，则路由可能会将请求通过一系列中间件转换过后再转发到你的服务上去。

在了解 Traefik 之前有几个核心概念我们必须要了解：

  • Providers 用来自动发现平台上的服务，可以是编排工具、容器引擎或者 key-value 存储等，比如 Docker、Kubernetes、File
  • Entrypoints 监听传入的流量（端口等…），是网络入口点，它们定义了接收请求的端口（HTTP 或者 TCP）。
  • Routers 分析请求（host, path, headers, SSL, …），负责将传入请求连接到可以处理这些请求的服务上去。
  • Services 将请求转发给你的应用（load balancing, …），负责配置如何获取最终将处理传入请求的实际服务。
  • Middlewares 中间件，用来修改请求或者根据请求来做出一些判断（authentication, rate limiting, headers, …），中间件被附件到路由上，是一种在请求发送到你的服务之前（或者在服务的响应发送到客户端之前）调整请求的一种方法。

二、安装Traefik

使用Helm安装

添加仓库并更新：

  1. helm repo add traefik https://helm.traefik.io/traefik
  2. helm repo update

先创建一个namespace，以免默认添加到default：

  1. kubectl create ns traefik

部署Traefik：

  1. helm install traefik traefik/traefik -n traefik

部署完，会在控制台中打印：

  1. W1102 00:33:27.555359   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  2. W1102 00:33:27.561760   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  3. W1102 00:33:27.568528   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  4. W1102 00:33:27.584942   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  5. W1102 00:33:27.596107   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  6. W1102 00:33:27.618944   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  7. W1102 00:33:27.641876   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  8. W1102 00:33:29.647233   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  9. W1102 00:33:29.648860   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  10. W1102 00:33:29.651210   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  11. W1102 00:33:29.653531   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  12. W1102 00:33:29.655136   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  13. W1102 00:33:29.657001   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  14. W1102 00:33:29.658686   88295 warnings.go:67] apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use apiextensions.k8s.io/v1 CustomResourceDefinition
  15. NAME: traefik
  16. LAST DEPLOYED: Mon Nov  2 00:33:29 2020
  17. NAMESPACE: traefik
  18. STATUS: deployed
  19. REVISION: 1
  20. TEST SUITE: None

手动通过YAML部署

如果想要更加灵活地调整Traefik的参数，也可以创建以下一系列的YAML，手动部署。

traefik-crd.yaml 

  1. ## IngressRoute
  2. apiVersion: apiextensions.k8s.io/v1beta1
  3. kind: CustomResourceDefinition
  4. metadata:
  5.   name: ingressroutes.traefik.containo.us
  6. spec:
  7.   scope: Namespaced
  8.   group: traefik.containo.us
  9.   version: v1alpha1
  10.   names:
  11.     kind: IngressRoute
  12.     plural: ingressroutes
  13.     singular: ingressroute
  14. ---
  15. ## IngressRouteTCP
  16. apiVersion: apiextensions.k8s.io/v1beta1
  17. kind: CustomResourceDefinition
  18. metadata:
  19.   name: ingressroutetcps.traefik.containo.us
  20. spec:
  21.   scope: Namespaced
  22.   group: traefik.containo.us
  23.   version: v1alpha1
  24.   names:
  25.     kind: IngressRouteTCP
  26.     plural: ingressroutetcps
  27.     singular: ingressroutetcp
  28. ---
  29. ## Middleware
  30. apiVersion: apiextensions.k8s.io/v1beta1
  31. kind: CustomResourceDefinition
  32. metadata:
  33.   name: middlewares.traefik.containo.us
  34. spec:
  35.   scope: Namespaced
  36.   group: traefik.containo.us
  37.   version: v1alpha1
  38.   names:
  39.     kind: Middleware
  40.     plural: middlewares
  41.     singular: middleware
  42. ---
  43. ## TLSOption
  44. apiVersion: apiextensions.k8s.io/v1beta1
  45. kind: CustomResourceDefinition
  46. metadata:
  47.   name: tlsoptions.traefik.containo.us
  48. spec:
  49.   scope: Namespaced
  50.   group: traefik.containo.us
  51.   version: v1alpha1
  52.   names:
  53.     kind: TLSOption
  54.     plural: tlsoptions
  55.     singular: tlsoption
  56. ---
  57. ## TraefikService
  58. apiVersion: apiextensions.k8s.io/v1beta1
  59. kind: CustomResourceDefinition
  60. metadata:
  61.   name: traefikservices.traefik.containo.us
  62. spec:
  63.   scope: Namespaced
  64.   group: traefik.containo.us
  65.   version: v1alpha1
  66.   names:
  67.     kind: TraefikService
  68.     plural: traefikservices
  69.     singular: traefikservice
  70. ---
  71. ## TLSStore
  72. apiVersion: apiextensions.k8s.io/v1beta1
  73. kind: CustomResourceDefinition
  74. metadata:
  75.   name: tlsstores.traefik.containo.us
  76. spec:
  77.   group: traefik.containo.us
  78.   version: v1alpha1
  79.   names:
  80.     kind: TLSStore
  81.     plural: tlsstores
  82.     singular: tlsstore
  83.   scope: Namespaced
  84. ---
  85. ## IngressRouteUDP
  86. apiVersion: apiextensions.k8s.io/v1beta1
  87. kind: CustomResourceDefinition
  88. metadata:
  89.   name: ingressrouteudps.traefik.containo.us
  90. spec:
  91.   group: traefik.containo.us
  92.   version: v1alpha1
  93.   names:
  94.     kind: IngressRouteUDP
  95.     plural: ingressrouteudps
  96.     singular: ingressrouteudp
  97.   scope: Namespaced

traefik-rbac.yaml 

## ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: traefik
  name: traefik-ingress-controller
---
## ClusterRole
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups: [""]
    resources: ["services","endpoints","secrets"]
    verbs: ["get","list","watch"]
  - apiGroups: ["extensions"]
    resources: ["ingresses"]
    verbs: ["get","list","watch"]
  - apiGroups: ["extensions"]
    resources: ["ingresses/status"]
    verbs: ["update"]
  - apiGroups: ["traefik.containo.us"]
    resources: ["middlewares","ingressroutes","ingressroutetcps","tlsoptions","ingressrouteudps","traefikservices","tlsstores"]
    verbs: ["get","list","watch"]
---
## ClusterRoleBinding
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: traefik

traefik-config.yaml 

kind: ConfigMap
apiVersion: v1
metadata:
  name: traefik-config
data:
  traefik.yaml: |-
    ping: ""                    ## 启用 Ping
    serversTransport:
      insecureSkipVerify: true  ## Traefik 忽略验证代理服务的 TLS 证书
    api:
      insecure: true            ## 允许 HTTP 方式访问 API
      dashboard: true           ## 启用 Dashboard
      debug: false              ## 启用 Debug 调试模式
    metrics:
      prometheus: ""            ## 配置 Prometheus 监控指标数据，并使用默认配置
    entryPoints:
      web:
        address: ":80"          ## 配置 80 端口，并设置入口名称为 web
      websecure:
        address: ":443"         ## 配置 443 端口，并设置入口名称为 websecure
    providers:
      kubernetesCRD: ""         ## 启用 Kubernetes CRD 方式来配置路由规则
      kubernetesIngress: ""     ## 启动 Kubernetes Ingress 方式来配置路由规则
    log:
      filePath: ""              ## 设置调试日志文件存储路径，如果为空则输出到控制台
      level: error              ## 设置调试日志级别
      format: json              ## 设置调试日志格式
    accessLog:
      filePath: ""              ## 设置访问日志文件存储路径，如果为空则输出到控制台
      format: json              ## 设置访问调试日志格式
      bufferingSize: 0          ## 设置访问日志缓存行数
      filters:
        #statusCodes: ["200"]   ## 设置只保留指定状态码范围内的访问日志
        retryAttempts: true     ## 设置代理访问重试失败时，保留访问日志
        minDuration: 20         ## 设置保留请求时间超过指定持续时间的访问日志
      fields:                   ## 设置访问日志中的字段是否保留（keep 保留、drop 不保留）
        defaultMode: keep       ## 设置默认保留访问日志字段
        names:                  ## 针对访问日志特别字段特别配置保留模式
          ClientUsername: drop  
        headers:                ## 设置 Header 中字段是否保留
          defaultMode: keep     ## 设置默认保留 Header 中字段
          names:                ## 针对 Header 中特别字段特别配置保留模式
            User-Agent: redact
            Authorization: drop
            Content-Type: keep
    #tracing:                     ## 链路追踪配置,支持 zipkin、datadog、jaeger、instana、haystack 等 
    #  serviceName:               ## 设置服务名称（在链路追踪端收集后显示的服务名）
    #  zipkin:                    ## zipkin配置
    #    sameSpan: true           ## 是否启用 Zipkin SameSpan RPC 类型追踪方式
    #    id128Bit: true           ## 是否启用 Zipkin 128bit 的跟踪 ID
    #    sampleRate: 0.1          ## 设置链路日志采样率（可以配置0.0到1.0之间的值）
    #    httpEndpoint: http://localhost:9411/api/v2/spans     ## 配置 Zipkin Server 端点

traefik-deploy.yaml 

apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  ports:
    - name: web
      port: 80
    - name: websecure
      port: 443
    - name: admin
      port: 8080
  selector:
    app: traefik
  type: LoadBalancer
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: traefik-ingress-controller
  labels:
    app: traefik
spec:
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      name: traefik
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 1
      containers:
        - image: traefik:v2.3.1
          name: traefik-ingress-lb
          ports:
            - name: web
              containerPort: 80
              hostPort: 80         ## 将容器端口绑定所在服务器的 80 端口
            - name: websecure
              containerPort: 443
              hostPort: 443        ## 将容器端口绑定所在服务器的 443 端口
            - name: admin
              containerPort: 8080  ## Traefik Dashboard 端口
          resources:
            limits:
              cpu: 2000m
              memory: 1024Mi
            requests:
              cpu: 1000m
              memory: 1024Mi
          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
          args:
            - --configfile=/config/traefik.yaml
          volumeMounts:
            - mountPath: "/config"
              name: "config"
          readinessProbe:
            httpGet:
              path: /ping
              port: 8080
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /ping
              port: 8080
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
      volumes:
        - name: config
          configMap:
            name: traefik-config
      tolerations:              ## 设置容忍所有污点，防止节点被设置污点
        - operator: "Exists"
      nodeSelector:             ## 设置node筛选器，在特定label的节点上启动
        IngressProxy: "true"

traefik-dashboard-route.yaml 

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard-route
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`traefik.dashboard.com`)
      kind: Rule
      services:
        - name: traefik
          port: 8080

---

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard-route-tls
  namespace: traefik
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`traefik.dashboard.com`)
      kind: Rule
      services:
        - name: traefik
          port: 8080
  tls:
    secretName: traefik-dashboard-tls

所有文件都创建好之后，全部apply即可：

kubectl apply -f . -n traefik

三、暴露Traefik Dashboard

默认情况下，为了安全，Traefik没有暴露Dashboard，我们可以使用Traefik自定义的IngressRoute资源，暴露Traefik Dashboard。