一、基础知识
Traefik 是一款优秀的反向代理工具,与 Nginx 相比,Traefik 具有以下优势
1.1、原生支持动态配置。例如,Kubernetes 的 Ingress 资源或 IngressRoute 等 CRD 资源(Nginx 每次需重新加载完整配置,部分情况下可能会影响连接)。
1.2、原生支持服务发现。使用 Ingress 或 IngressRoute 等动态配置后,会自动 watch 后端 endpoint,同步更新到负载均衡的后端列表中。
1.3、提供美观的 Dashboard 管理页面。
1.4、原生支持 Metrics,与 Prometheus 和 Kubernetes 无缝集成。
1.5、拥有更丰富的高级功能。例如,多版本的灰度发布、流量复制、自动生成 HTTPS 免费证书、中间件等。
二、部署 Traefik
2.1、 traefik-rbac.yaml
[root@VM-0-41-centos ~/traefik]# cat traefik-rbac.yaml
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses/status
verbs:
- update
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: kube-system
2.2、部署traefik主服务
2.2.1、方法1:deployment方式部署
[root@VM-0-41-centos ~/traefik]# cat traefik-deployment.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: kube-system
---
kind: Deployment
apiVersion: apps/v1
metadata:
name: traefik-ingress-controller
namespace: kube-system
labels:
k8s-app: traefik-ingress-lb
spec:
replicas: 1
selector:
matchLabels:
k8s-app: traefik-ingress-lb
template:
metadata:
labels:
k8s-app: traefik-ingress-lb
name: traefik-ingress-lb
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
containers:
- image: traefik:v1.7
name: traefik-ingress-lb
ports:
- name: http
containerPort: 80
- name: admin
containerPort: 8080
args:
- --api
- --kubernetes
- --logLevel=INFO
---
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- protocol: TCP
port: 80
name: web
- protocol: TCP
port: 8080
name: admin
type: NodePort
2.2.2、方式2:DaemonSet方式部署
[root@VM-0-41-centos ~/traefik]# cat traefik-ds.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: kube-system
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
name: traefik-ingress-controller
namespace: kube-system
labels:
k8s-app: traefik-ingress-lb
spec:
selector:
matchLabels:
k8s-app: traefik-ingress-lb
name: traefik-ingress-lb
template:
metadata:
labels:
k8s-app: traefik-ingress-lb
name: traefik-ingress-lb
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
containers:
- image: traefik:v1.7
name: traefik-ingress-lb
ports:
- name: http
containerPort: 80
hostPort: 80
- name: admin
containerPort: 8080
hostPort: 8080
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
args:
- --api
- --kubernetes
- --logLevel=INFO
---
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- protocol: TCP
port: 80
name: web
- protocol: TCP
port: 8080
name: admin
3、部署ui svc服务
[root@VM-0-41-centos ~/traefik]# cat ui.yaml
---
apiVersion: v1
kind: Service
metadata:
name: traefik-web-ui
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- name: web
port: 80
targetPort: 8080
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-web-ui
namespace: kube-system
spec:
rules:
- host: traefik-ui.minikube
http:
paths:
- path: /
backend:
serviceName: traefik-web-ui
servicePort: web
四、应用以上yaml文件
kubectl apply -f traefik-rbac.yaml
kubectl apply -f traefik-deployment.yaml
kubectl apply -f ui.yaml
五、查看服务是否正常
[root@VM-0-41-centos ~/traefik]# kubectl get pod -n kube-system |grep traefik
traefik-ingress-controller-78b4959fdf-4r6kf 1/1 Running 0 7h45m
[root@VM-0-41-centos ~/traefik]# kubectl get svc -n kube-system |grep traefik
traefik-ingress-service NodePort 10.3.252.102 <none> 80:30521/TCP,8080:31381/TCP 7h46m
traefik-web-ui ClusterIP 10.3.255.184 <none> 80/TCP 7h46m
traefik-web-ui1 ClusterIP 10.3.252.93 <none> 80/TCP 7h13m
六、浏览器访问