Posted at 2026-04-19 云原生

一、认识traefik

1.1 traefik简介

参考链接：https://traefik.cn/
是一个为了让部署微服务更加便捷而诞生的现代HTTP反向代理、负载均衡工具
它支持多种后台(Docker，Swarm，Kubernetes，Marathon，Mesos,Consul,Etcd,Zookeeper,BoltDB,Rest API,file…)来自动化、动态的应用它的配置文件设置。

1.2 traefix 特性

非常快
无需安装依赖，通过Go语言编写的单一可执行文件
支持Rest API
多种后台支持：Docker，Swarm，Kubernets，Marathon，Mesos，Consul，Etcd 并且还会更多
后台监控，可以监听后台变化进而自动化应用新的配置文件设置
配置文件热更新，无需重启进程
正常结束http连接
后端断路器
轮询，rebalancer负载均衡
Rest Metrics
支持最小化docker 镜像
前后台支持SSL
清爽的AngularJS 前端页面
支持websocket
支持HTTP/2
网络错误重试
支持Let’s Encrypt (自动更新HTTPS证书)
高可用集群模式

1.3 traefik 与 nginx ingress对比

对比项	APISIX ingress	Kubernetes Ingress	NGINX Ingress	Kong Ingress	Traefik	HAproxy	Istio Ingress	Ambassador
协议	http/https, http2, grpc, tcp/udp, tcp+tls, Dubbo	http/https, http2, grpc	http/https, http2, grpc, tcp/udp	http/https, http2, grpc	http/https, http2, grpc, tcp, tcp+tls	http/https, http2, grpc, tcp, tcp+tls	http/https, http2, grpc, tcp, tcp+tls, mongo, mysql, redis	http/https, http2, grpc, tcp, tcp+tls
基础平台	openresty/tengine	nginx/openresty	nginx/nginx plus	openresty	traefik	haproxy	envoy	envoy
路由匹配	path, method, host, header, nginx 变量，args 变量，自定义函数	host, path	host, path	path, method, host, header	host, path, headers, query, path prefix, method	host, path	host, path, method, headers	host, path, method, headers
命名空间支持	-	共用或指定命名空间	-	指定命名空间	共用或指定命名空间	共用或指定命名空间	共用或指定命名空间	共用或指定命名空间
部署策略	ab 部署、灰度发布、金丝雀部署	金丝雀部署，ab 部署	-	金丝雀部署、蓝绿部署	金丝雀部署、蓝绿部署	蓝绿部署	金丝雀部署、蓝绿部署、灰度部署、根据 header 白名单	金丝雀部署、蓝绿部署、灰度部署、根据 header 白名单
upstream 探测	重试、超时、心跳探测、熔断	重试、超时	重试、超时、心跳探测	心跳探测、熔断	重试、超时、心跳探测、熔断	探测 url、ip、port	重试、超时、心跳探测、熔断	重试、超时、心跳探测、熔断
负载均衡算法	一致性 hash, WRR	RR, 会话保持，最小连接，一致性 hash, EWMA	RR, 会话保持，最小连接，最短时间，一致性 hash	WRR, 会话保持	WRR, 动态 RR, 会话保持	RR, static-RR, 最小连接，源 ip, uri, uri param, uri header, 会话保持	RR, 会话保持，一致性 hash, maglev 负载均衡	RR, 会话保持，一致性 hash, maglev 负载均衡
鉴权方式	key-auth, OpenID Connect	basic-auth, oauth	-	basic, Key, HMAC, LDAP, Oauth 2.0, PASETO, OpenID Connect	basic, auth-url, external auth	basic-auth, Oauth, Auth TLS	basic, external auth, Oauth, OpenID	basic, external auth, Oauth, OpenID
JWT	✅	-	✅	✅	✅	✅	✅	✅
DDOS 防护能力	limit-conn, limit-count, limit-req, ip-writelist	limit-conn, limit-count, limit-req, ip-writelist	rate-limit	limit-conn, limit-count, limit-req, ip-writelist, response limit	limit-conn, limit-req, ip-writelist	limit-conn, limit-req, ip-writelist	limit-req, ip-writelist	limit-req, ip-writelist
全链路跟踪	✅	✅	-	✅	✅	✅	✅	✅
协议转换	grpc, Dubbo	-	-	-	grpc	-	grpc, mongo, mysql, redis	grpc, mongo, mysql, redis

1.4 traefik核心概念及能力

Traefik 是一个边缘路由器，它会拦截外部请求并根据逻辑规则选择不同的操作方式，这些规则决定着这些请求到底该如何处理。Traefik提供自动发现能力，会实时检测服务，并自动更新路由。

请求首先会连接到entrypoints，然后分析这些请求是否与定义的rules匹配，如果匹配，则会通过一系列middlewares，再到对应的services上。

这就是涉及到以下几个核心的组件：

providers

providers是基础组件，Traefik的配置发现是通过它来实现的，它可以是协调器，容器引擎，云提供商或者键值存储
Entrypoints

Entrypoints 是 Traefik的网络入口，它定义接收请求的接口，以及是否监听TCP或者UDP。
Routers

Routers主要用于分析请求，并将这些请求连接到对应的服务上去，在这个过程中，Routers还可以使用MiddleWares来更新请求，比如在把请求发到服务之前添加一些Headers。
Services

Services 负责配置如何到达最终将处理传入请求的实际服务。
MiddleWares

Middlewares用来修改请求或者根据请求来做出一些判断(authentication，rate limiting，headers，……)，中间件被附件到路由上，是一种在请求发送到你的服务之前(或者在服务的响应发送到客户端之前)调试请求的一种方法。

二、traefik 部署

2.1 获取traefik 部署前置资源清单文件

2.1.1 创建CRD资源（官方建议使用Helm安装）

yaml资源

# Install Traefik Resource Definitions:

kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml

# Install RBAC for Traefik:

kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml

**kubernetes-crd-definition-v1.yml ** 官方默认
**kubernetes-crd-rbac.yml ** 修改namespace

[root@master1 ~]# cat kubernetes-crd-rbac.yml
#1. 增加ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: traefik
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - secrets
      - nodes
      - configmaps
    verbs:
      - get
      - list
      - watch
  # The pods right is needed to inject k8s.pod.uid and k8s.pod.name OTel attributes.
  # When OTel tracing/logs/metrics are not enabled, this rule is not needed.
  - apiGroups:
      - ""
    resources:
       - pods
    verbs:
        - get
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.io
    resources:
      - middlewares
      - middlewaretcps
      - ingressroutes
      - traefikservices
      - ingressroutetcps
      - ingressrouteudps
      - tlsoptions
      - tlsstores
      - serverstransports
      - serverstransporttcps
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: traefik

traefik.config

apiVersion: v1
kind: ConfigMap
metadata:
  name: traefik
  namespace: traefik  # 建议改为 traefik 专用命名空间
data:
  traefik.yaml: |-
    serversTransport:
      insecureSkipVerify: true ## 忽略验证代理服务器的TSL证书
    api:
      insecure: true        #允许HTTP方式访问API 生产环境建议设为 false，使用 basic auth 或 forward auth
      dashboard: true    # 启用dashboard
      debuF: true        # 启用debug调试模式
    metrics:
      prometheus: {}     # 配置promethus 监控指标，并使用默认配置
    entryPoints:
      web:
        address: ":80"    # 配置80端口并设置入口为web
      websecure:
        address: ":443"   # 配置443端口，并设置入口为websecure
      metrics:
        address: ":8082"  # 配置8082端口，并设置入口名称为metrics
      tcpep:
        address: ":8083"  # 配置8083端口并设置入口名称为 tcpep 作为tcp入口
      udpep:
        address: ":8084/udp" ##配置8084端口并设置入口名称为udpep 作为udp入口
      traefik:
        address: ":8080"     ##配置8080端口设置入口名称为traefik 为traefik dashboard端口
    providers: 
      kubernetesCRD: {}     # v3 中不需要空字符串，直接空对象即可  启用k8s  CRD 方式来配置路由规则
      kubernetesIngress: {} # 启用K8s  Ingress 方式来配置路由
      kubernetesGateway: {} # 启用 K8s gateway api
    loF:
      level: ERROR    # 设置日志级别  filePath 为空输出到控制台
      format: json    # 错误日志格式
    accessLoF:
      format: json
      bufferingSize: 0

deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik
  namespace: traefik  # 与 ConfigMap 保持一致
spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller  # 确保已创建 RBAC
      containers:
        - name: traefik
          image: registry.cn-hangzhou.aliyuncs.com/hemingkang/traefik:v3.6.0
          # 关键：指定静态配置文件路径
          args:
            - --configFile=/config/traefik.yaml
          ports:
            - name: web
              containerPort: 80
            - name: websecure
              containerPort: 443
            - name: traefik
              containerPort: 8080  # Dashboard/API 端口
            - name: metrics
              containerPort: 8082
            - name: tcpep
              containerPort: 8083
            - name: udpep
              containerPort: 8084
              protocol: UDP
          volumeMounts:
            # 挂载 ConfigMap 到 /etc/traefik
            - name: config
              mountPath: /config
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: traefik  # 引用你的 ConfigMap

service
1. **localbalancer service ** 之前安装过loadbalancer L2 ip_pool

apiVersion: v1
kind: Service
metadata:
  name: traefik
  namespace: traefik
spec:
  type: LoadBalancer  # 或 NodePort/ClusterIP，根据环境选择
  selector:
    app: traefik
  ports:
    - name: web
      port: 80
      targetPort: 80
    - name: websecure
      port: 443
      targetPort: 443
    - name: traefik
      port: 8080
      targetPort: 8080
    - name: metrics
      port: 8082
      targetPort: 8082

http://192.168.11.20:8080/dashboard/#/

DaemonSet 部署

[root@master1 traefik]# kubectl label nodes --all traefik=true
node/master1 labeled
node/master2 labeled
node/node1 labeled
node/node2 labeled
node/node3 labeled

daemonset.yaml

[root@master1 traefik]# cat daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: traefik
  namespace: traefik  # 与 ConfigMap 保持一致
spec:
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller  # 确保已创建 RBAC
      containers:
        - name: traefik
          image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/traefik:v3.6.7
          # 关键：指定静态配置文件路径
          args:
            - --configFile=/config/traefik.yaml
          ports:
            - name: web
              containerPort: 80
              hostPort: 80  # 将容器端口绑定在服务器的80端口
            - name: websecure
              containerPort: 443
              hostPort: 443
            - name: traefik
              containerPort: 8080  # Dashboard/API 端口
            - name: metrics
              containerPort: 8082
            - name: tcpep
              containerPort: 8083
              hostPort: 8083
            - name: udpep
              containerPort: 8084
              protocol: UDP
              hostPort: 8084
          volumeMounts:
            # 挂载 ConfigMap 到 /etc/traefik
            - name: config
              mountPath: /config
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: traefik
      tolerations:
      - operator: "Exists"  # 设置容忍所有污点，防止节点被设置污点  或者通过标签选择  nodeSelector:

外部流量: 用户 → 节点IP:80/443（hostPort） → Traefik Pod
内部流量: Pod → Service(ClusterIP) → Traefik Pod

客户端请求
	浏览器 / 客户端访问：https://whoami.hmk.cn
	DNS 解析 → 宿主机（Node）IP
	目标端口：443（HTTPS 默认）
宿主机 hostPort 接收
	在 Traefik DaemonSet 里配置了：
	ports:
	- name: websecure
  	containerPort: 443
  	hostPort: 443  # 关键：直接绑定宿主机 443
	流量直接进入当前 Node 上的 Traefik Pod，不经过 Traefik Service
Traefik 处理
	入口点：websecure（443）
	执行 TLS 解密（用 who-tls 证书）
	匹配 IngressRoute 规则：
	match: Host(`whoami.hmk.cn`) && PathPrefix(`/`)
	找到目标：services: name: whoami port: 80
转发到业务 Service
	Traefik 把流量发给 whoami Service（ClusterIP）
	Service 做负载均衡，选一个后端 Pod
	流量到达 whoami 业务 Pod:80

cluster svc

[root@master1 traefik]# kubectl get svc -n traefik
NAME      TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                             AGE
traefik   ClusterIP   10.68.104.32   <none>        80/TCP,8080/TCP,8083/TCP,8084/UDP   114m
[root@master1 traefik]# cat traefik-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: traefik
  namespace: traefik
spec:
  ports:
  - protocol: TCP
    name: web
    port: 80
  - protocol: TCP
    name: traefik
    port: 8080
  - protocol: TCP
    name: tcpep
    port: 8083
  - protocol: UDP
    name: udpep
    port: 8084
  selector:
    app: traefik

2.2 配置访问traefik Dashboard 路由规则

Traefik应用已经部署完成，但是想让外部访问Kubernetes内部服务，还需要配置路由规则，上面部署Traefik时开启了TraefikDashboard，这是Traefik提供的视图看板，所以，首先配置基于HTTP的Traefik Dashboard 路由规则，使外部能够访问TraefikDashboard。这里使用 IngressRoute方式进行演示。

2.2.1 traefik 创建路由规则方法

原生ingress
CRD Ingress Route
GateWay API

2.2.1.1 traefik dashboard访问原生ingress方式

必路由规则须和对应的service 在一个命名空间

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: trafik-dashboard
  namespace: traefik
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  rules:
  - host: tfni.hmk.cn
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: traefik
            port:
              number: 8080

[root@master1 traefik]# kubectl apply -f traefik-dashboard-native-ingress.yaml
WarninF: annotation "kubernetes.io/ingress.class" is deprecated, please use 'spec.ingressClassName' instead
ingress.networking.k8s.io/trafik-dashboard created

测试 nginx

 kubectl run hmknginx --image=registry.cn-hangzhou.aliyuncs.com/hemingkang/nginx:1.20.0 --port=80
kubectl create svc clusterip nginx --tcp=81:80
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: trafik-nginx
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik 
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  rules:
  - host: nginx.hmk.cn
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: nginx
            port:
              number: 81

注解方式deprecated

[root@master1 traefik]# kubectl apply -f traefik-dashboard.yaml
WarninF: annotation “kubernetes.io/ingress.class” is deprecated, please use ‘spec.ingressClassName’ instead
ingress.networking.k8s.io/trafik-dashboard created

修改config 使用edit 或者直接删除（建议edit）

kubernetesIngress:
  # 👇 必须加这两行，才能支持 ingressClassName
  ingressClass: traefik           # 与 IngressClass 名字一致

# traefik-ingressclass.yaml
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: traefik
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"  # 可选，设为默认
spec:
  controller: traefik.io/ingress-controller  # 👈 固定写法


[root@master1 traefik]# cat traefik-ingressclass.yaml
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: traefik
spec:
  controller: traefik.io/ingress-controller

重建traefik

kubectl rollout restart daemonset traefik -n traefik

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: trafik-dashboard
  namespace: traefik
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  ingressClassName: traefik
  rules:
  - host: tfni.hmk.cn
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: traefik
            port:
              number: 8080

2.2.1.2 traefik dashboard访问 crd ingressroute方式

[root@master1 traefik]# cat traefik-dashboard-crdingressroute.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: traefik
  namespace: traefik
spec:
 entryPoints:
 - web
 routes:
 - match: Host(`dashboard.hmk.cn`) && PathPrefix(`/`)
   kind: Rule
   services:
   - name: traefik
     port: 8080

hosts 解析

1 2	192.168.11.5 tfni.hmk.cn 192.168.11.7 dashboard.hmk.cn

三、traefik基础应用

客户端 → 宿主机 IP:hostPort → Traefik Pod（直接）→ IngressRoute → 业务 Service → 业务 Pod

3.1 配置HTTP路由规则

3.1.1 创建应用及服务资源清单文件并应用

[root@master1 traefik-whoami]# cat whoami.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
  labels:
    app: traefiklabs
    name: whoami
spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoami
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoami
    spec:
      containers:
      - name: whoami
        image: traefik/whoami
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  ports:
  - name: http
    port: 80
  selector:
    app: traefiklabs
    task: whoami
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoamitcp
  labels:
    app: traefiklabs
    name: whoamitcp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamitcp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamitcp
    spec:
      containers:
      - name: whoamitcp
        image: traefik/whoamitcp
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: whoamitcp
spec:
  ports:
  - protocol: TCP
    port: 8080
  selector:
    app: traefiklabs
    task: whoamitcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoamiudp
  labels:
    app: traefiklabs
    name: whoamiudp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamiudp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamiudp
    spec:
      containers:
      - name: whoamiudp
        image: traefik/whoamiudp:latest
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
spec:
  ports:
  - protocol: UDP
    port: 8080
  selector:
    app: traefiklabs
    task: whoamiudp

3.1.2 创建whoami应用ingress route 资源清单文件并应用

[root@master1 traefik-whoami]# cat whoami-ingressroute.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: httpingressroute
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`whoami.hmk.cn`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: whoami
      port: 80

3.2 配置HTTPS路由规则

HTTPS 来访问应用，需要监听websecure 这个入口，通过443端口来访问，需要证书

3.2.1 自签名证书

1	openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout tsl.key -out tls.crt -subj "/CN=whoami.hmk.cn"

3.2.2 创建secret

1	kubectl create secret tls who-tls --cert=tls.crt --key=tls.key

3.2.3 创建https 应用路由规则

[root@master1 traefik-whoami]# cat  whoamissl-ingress.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: httpsingressroute
spec:
  entryPoints:
  - websecure
  routes:
  - match: Host(`whoami.hmk.cn`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    secretName: who-tls

3.3 配置TCP路由规则

SNI为服务名称标识，是TSL协议的扩展。因此，只有TLS路由才能使用该规则指定域名。但是，非TLS路由必须使用带有*的规则（每个域）来声明每个非TLS请求都将由路由进行处理。

[root@master1 traefik-whoami]#
[root@master1 traefik-whoami]#
[root@master1 traefik-whoami]# cat whoamiingressroutetcp.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcp
spec:
  entryPoints:
  - tcpep
  routes:
  - match: HostSNI(`*`)
    services:
    - name: whoamitcp
      port: 8080
     
[root@master1 traefik-whoami]# kubectl apply -f whoamiingressroutetcp.yaml
ingressroutetcp.traefik.io/ingressroutetcp created

3.3.1 配置MySQL部署 traefik代理

3.3.1.1 修改traefik configmap 增加入口

cat configmap.yaml     
      mysql:
        address: ":3312"
cat daemonset.yaml      
            - name: mysql
              containerPort: 3312
              hostPort: 3312
              
# kubectl rollout  restart daemonset traefik -n traefik
[root@master1 traefik]# cat traefik-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: traefik
  namespace: traefik
spec:
  ports:
  - protocol: TCP
    name: web
    port: 80
  - protocol: TCP
    name: websecure
    port: 443
  - protocol: TCP
    name: traefik
    port: 8080
  - protocol: TCP
    name: tcpep
    port: 8083
  - protocol: TCP
    name: mysql
    port: 3312

3.3.1.2 部署mysql应用测试使用deploy

[root@master1 mysql]# cat mysql-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: mysql
  name: mysql
spec:
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/mysql:5.7.35
        imagePullPolicy: IfNotPresent
        env:
        - name: MYSQL_ROOT_PASSWORD
          value: abc123
        ports:
        - containerPort: 3306
[root@master1 mysql]# cat mysql-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: mysql
spec:
  selector:
    app: mysql
  ports:
  - port: 3306
    protocol: TCP
    targetPort: 3306

3.3.1.3 为mysql应用创建ingressroute

[root@master1 mysql]# cat mysql-ingresstcp.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mysql
spec:
  entryPoints:
  - mysql
  routes:
  - match: HOSTSNI(`*`)
    services:
    - name: mysql
      port: 3306

[root@master1 mysql]# kubectl apply -f mysql-ingresstcp.yaml
ingressroutetcp.traefik.io/mysql created

3.3.2 配置redis 部署traefik代理

核心规则

配置项	必须一致？	说明
静态配置 `entryPoints`	必须 = containerPort	Traefik 进程监听的端口
containerPort	必须 = entryPoints	Pod 内容器暴露的端口
hostPort	可以 ≠ containerPort	宿主机映射端口，自定义

静态配置 entryPoints:6379 ──┐
                            ├──► 必须一致 ◄──┐
DaemonSet containerPort:6379 ─┘              │
                                             │
DaemonSet hostPort:6379 ─────────────────────┘ 或 hostPort:16379 也可以

configmap.yaml
	redis:
        address: ":6066"


daemonset.yaml
            - name: redis
              containerPort: 6066
              hostPort: 16066
traefik-svc 可不增加，如果集群内使用可以增加

3.4 配置UDP 路由规则

[root@master1 traefik]# kubectl  get pods
NAME                                      READY   STATUS    RESTARTS       AGE
nfs-client-provisioner-5b9864cf4f-dw9rr   1/1     Running   13 (72m ago)   8d
redis-865c965b9c-pzw5d                    1/1     Running   0              43m
whoamiudp-7cbf479778-fzcpm                1/1     Running   0              22s
whoamiudp-7cbf479778-tnp6p                1/1     Running   0              22s
[root@master1 traefik]# kubectl get svc
NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
kubernetes   ClusterIP   10.68.0.1      <none>        443/TCP    71d
redis        ClusterIP   10.68.19.141   <none>        6379/TCP   43m
whoamiudp    ClusterIP   10.68.204.66   <none>        8080/UDP   24s

[root@master1 traefik]# cat traefik-ingresswhoamitcp.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: whoamiudp
spec:
  entryPoints:
  - udpep
  routes:
  - services:
    - name: whoamiudp
      port: 8080

[root@master1 traefik]# echo "WHO" | socat - udp4-datagram:192.168.11.8:8084
Hostname: whoamiudp-7cbf479778-tnp6p
IP: 127.0.0.1
IP: ::1
IP: 172.20.135.30
IP: fe80::28b3:daff:fe37:b989
[root@master1 traefik]# echo "othermessage" | socat - udp4-datagram:192.168.11.8:8084
Received: othermessage

四、traefik中间件 MiddleWare

4.1 traefik中间件介绍MiddleWare

中间件是Traefik2.0中一个非常有特色的功能，我们可以根据自己的各种需求去选择不用的中间件来满足服务，Traefik官方已经内置了许多不同功能的中间件，其中包括修改请求头信息；重定向；身份验证等等，而且中间件还可以通过链式组合的方式来适用各种情况。例如：强制跳转https，去除访问前缀，访问白名单等。

4.2 traefik 中间件应用案例 ipWhiteList

在一些环境中，对某些URL并不希望对外暴露，比如promethus、grafana等，我们就可以通过白名单ip来达到要求。可以使用traefik中的ipwhitelist中间件来完成。

测试清单

[root@master1 middleware]# cat deploy-service.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-web-middleware
spec:
  replicas: 1
  selector:
    matchLabels:
      app: middleware
  template:
    metadata:
      labels:
        app: middleware
    spec:
      containers:
      - name: nginx-web-c
        image: registry.cn-hangzhou.aliyuncs.com/hemingkang/nginx:1.20.0
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: service-middle
  namespace: default
spec:
  selector:
    app: middleware
  ports:
  - name: http
    port: 80

ipwhitelist

[root@master1 middleware]# cat middleware-ipwhitelist.yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-ipwhitelist
spec:
  ipWhiteList:
    sourceRange:
    - 127.0.0.1
    - 10.68.0.0/16
    - 192.168.11.0/24

ingressroute

[root@master1 middleware]# cat middle-ingressroute.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutemiddle
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`middle.hmk.cn`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: service-middle
      port: 80
    middlewares:
    - name: test-ipwhitelist

删除宿主机网络192.168.11.0/24

五、traefik高级应用

在实际的生产环境，除了线上业务之外，还有更复杂的使用要求。

在开始traefik的高级用法之前，还需要了解一个TraefikService，通过TraefikService 注册到CRD来实现复杂的请求设置

TraefikService  目前能用于以下功能
	server load balancing  负载均衡
	services weighted Round Robin load balancing  权重轮询
	services mirroring  镜像

5.1 负载均衡

5.1.1 创建deployment控制器类型应用

[root@master1 traefik-loadbalancer]# cat loadbalancer-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-web1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: v1
  template:
    metadata:
      labels:
        app: v1
    spec:
      containers:
      - name: nginx-web1
        image: registry.cn-hangzhou.aliyuncs.com/hemingkang/nginx:1.20.0
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh","-c","echo svc1> /usr/share/nginx/html/index.html"]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-web2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: v2
  template:
    metadata:
      labels:
        app: v2
    spec:
      containers:
      - name: nginx-web2
        image: registry.cn-hangzhou.aliyuncs.com/hemingkang/nginx:1.20.0
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh","-c","echo svc1> /usr/share/nginx/html/index.html"]

5.1.2 创建Service

[root@master1 traefik-loadbalancer]# cat nginxservice.yaml
apiVersion: v1
kind: Service
metadata:
  name: svc1
spec:
  ports:
  - name: http
    port: 80
  selector:
    app: v1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
spec:
  ports:
  - name: http
    port: 80
  selector:
    app: v2

5.1.3 创建ingressroute

[root@master1 traefik-loadbalancer]# cat loadbalancer-deploy-service-ingressroute.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressrouteweblb
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`lb.hmk.cn`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: svc1
      port: 80
    - name: svc2
      port: 80

[root@docker ~]# curl lb.hmk.cn
svc2
[root@docker ~]# curl lb.hmk.cn
svc1
[root@docker ~]# curl lb.hmk.cn
svc2
[root@docker ~]# curl lb.hmk.cn
svc1

5.2 灰度发布

基于上述负载均衡案例基础之上实施。

灰度发布也成为金丝雀发布，让一部分即将上线的服务发布到线上，主要通过权重轮询的方式实现。

5.2.1 创建TraefikService

[root@master1 traefik-loadbalancer]# cat traefikservice.yaml
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr
spec:
  weighted:
    services:
    - name: svc1
      port: 80
      weight: 3
    - name: svc2
      port: 80
      weight: 1

5.2.2 创建ingressroute

[root@master1 traefik-loadbalancer]# vim traefik-wrr.yaml
[root@master1 traefik-loadbalancer]# vim traefik-wrr.yaml
[root@master1 traefik-loadbalancer]# cat traefik-wrr.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressrouter
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`lb.hmk.cn`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: wrr
      kind: TraefikService

5.3 流量复制

在负载均衡的基础上实施

所谓的流量复制，也称为镜像服务是指将请求的流量复制一份发送给其他服务，并且会忽略这部分请求的响应，这个功能在做一些压测或者问题复现的时候很有用。

5.3.1 指定流量来自于kubernetes service对象

[root@master1 traefik-loadbalancer]# cat mirror_from_service.yaml
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror-from-service
spec:
  mirroring:
    name: svc1    # 发送100% 的请求到K8s的service "v1"
    port: 80
    mirrors:
    - name: svc2
      port: 80
      percent: 20   # 复制20%的请求到v2

[root@master1 mirror-test]# cat mirror-ingressroute.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
 name: ingressroute-mirror
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`lb.hmk.cn`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: mirror-from-service
      kind: TraefikService

前四次流量web1 第五次web2

5.3.2 通过tarfikservice导入流量

[root@master1 mirror-test]# cat mirror-from-traefikservice.yaml
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror-from-traefikservice
spec:
  mirroring:
    name: mirror-from-service
    kind: TraefikService
    mirrors:
    - name: svc2
      port: 80
      percent: 20
[root@master1 mirror-test]# cat mirror-from-traefikservice-ingressroute.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
 name: ingressroute-mirror-traefikservice
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`lb.hmk.cn`) && PathPrefix(`/`)
    kind: Rule
    services:
    - name: mirror-from-service
      kind: TraefikService

其实是加了一层还是trafikservice -后端svc

六、Kubernetes Gateway API

6.1 Gateway API介绍

6.1.1 Gateway API 架构

Gateway APIa(之前叫Service API)，是由SIG-NETWORK社区管理的开源项目，项目地址：https://gateway-api.sigs.k8s.io。主要原因是Ingress资源对象不能很好的满足网络需求，很多场景下Ingress控制器都需要通过定义annotations或者crd来进行扩展，这对于使用标准和支持是非常不利的，新推出的Gateway API 旨在通过可扩展的面向对象接口来增强服务网格。

Gateway API 是k8s中一个API资源集合，包括GatewayClass、Gateway、HTTPRoute、TCPRoute、Service等，这些资源共同为各种网络用例构建模型。

6.2kubernetes gateway CRD安装

要在Traefik 中使用Gateway API，首先我们要手动安装Gateway API的CRDs，使用如下命令安装，将安装GatewayClass、Gateway、HTTPRoute、TCPRoute、HTTPRoute、TCPRoute等CRDs：

[root@master1 traefik]# kubectl apply -f "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml"
customresourcedefinition.apiextensions.k8s.io/backendtlspolicies.gateway.networking.k8s.io created
customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io created
customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io created
customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created
customresourcedefinition.apiextensions.k8s.io/httproutes.gateway.networking.k8s.io created
customresourcedefinition.apiextensions.k8s.io/listenersets.gateway.networking.k8s.io created
customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io created
customresourcedefinition.apiextensions.k8s.io/tlsroutes.gateway.networking.k8s.io created
validatingadmissionpolicy.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io created
validatingadmissionpolicybinding.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io created

6.3 为traefik授权(RBAC)

[root@master1 gateway]# cat gateway-rbac-traefik.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gateway-role
rules:
  # Gateway API 核心资源
  - apiGroups: ["gateway.networking.k8s.io"]
    resources:
      - gatewayclasses
      - gateways
      - httproutes
      - tcproutes
      - tlsroutes
      - udproutes
      - grpcroutes
      - referencegrants
      - backendtlspolicies    # v1.5.1 新增
    verbs: ["get", "list", "watch"]

  # 状态更新
  - apiGroups: ["gateway.networking.k8s.io"]
    resources:
      - gatewayclasses/status
      - gateways/status
      - httproutes/status
      - tcproutes/status
      - tlsroutes/status
      - udproutes/status
      - grpcroutes/status
      - backendtlspolicies/status
    verbs: ["update"]

  # 新增：namespaces 权限（Gateway API 控制器需要）
  - apiGroups: [""]
    resources:
      - namespaces
    verbs: ["get", "list", "watch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gateway-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gateway-role
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: traefik    # 你的实际 namespace

可以发现traefik的log 没有gateway的warning信息了

6.4 Traefik 开启Gateway API的 Gateway api支持

providers .kubernetesGateway

启用traefik的时候默认增加了

providers:
  kubernetesCRD: {}     # v3 中不需要空字符串，直接空对象即可
  kubernetesIngress: {}
  kubernetesGateway: {}   # Gateway API 提供者（空对象=启用默认配置）

6.5 创建Gateway API的GatewayClass

[root@master1 gateway]# cat gatewayclass.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: traefik
spec:
  controllerName: traefik.io/gateway-controller

6.6 Gateway API应用案例

6.6.1 通过Gateway API 方式暴露traefik dashboard

6.6.1.1 创建gateway

[root@master1 tarefik-dashboard]# cat traefik-dashboard-gateway.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: hmk
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: http-gateway
  namespace: hmk
spec:
  gatewayClassName: traefik
  listeners:
   - name: web
     protocol: HTTP
     port: 80
     allowedRoutes:
       kinds:
       - kind: HTTPRoute
       namespaces:
         from: All #允许所有命名空间的 HTTPRoute 绑定到这个 Gateway

互斥关系

场景	写法
允许所有命名空间	`from: All`（不能带 selector）
只允许同命名空间	`from: Same`（不能带 selector）
按标签选择命名空间	`from: Selector` + 必须带 selector

如果想用 selector，必须改成

namespaces:
  from: Selector   # ✅ 先改这里
  selector:
    matchLabels:
      gateway-access: "true"  # 然后写选择器

同时要给 namespace 打标签：

1	kubectl label namespace hmk gateway-access=true

6.6.1.2 创建HTTPRoute

[root@master1 tarefik-dashboard]# cat traefik-dashboard-httproute.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: yangxu
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: traefik-dashboard-gateway-api-route
  namespace: yangxu
spec:
  parentRefs:
  - name: http-gateway
    namespace: hmk
  hostnames:
  - "traefikdashboard.hmk.cn"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: traefik
      namespace: traefik
      port: 8080

3.0+ 以后版本改动较大

6.6.1.3允许授权

[root@master1 tarefik-dashboard]# cat allow-yangxu-to-tracfiksvc.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: ReferenceGrant
metadata:
  name: allow-yangxu-to-traefik-svc
  namespace: traefik  # 后端Service所在命名空间，必须在这里
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    namespace: yangxu  # 允许这个ns的HTTPRoute引用
  to:
  - group: ""
    kind: Service
    name: traefik  # 仅授权引用这个Service，最小权限

Gateway 里的 allowedRoutes

只管：

✅ 哪个命名空间的路由 (HTTPRoute) 可以挂到我这个网关上面
ReferenceGrant

只管：

✅ 哪个命名空间的路由 (HTTPRoute) 可以访问别的命名空间的 Service

一个管「路由能不能挂靠网关」

一个管「路由能不能跨 ns 访问后端服务」

6.6.1.4 在集群之外访问

6.6.2 通过Gateway API 方式暴露web应用

nginx-deploy

[root@master1 deploy-gateway]# cat gatewayapi-web.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-web-gatewayapi
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gatewayweb
  template:
    metadata:
      labels:
        app: gatewayweb
    spec:
      containers:
      - name: nginx-web
        image: registry.cn-hangzhou.aliyuncs.com/hemingkang/nginx:1.20.0
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh","-c","echo gatewayweb > /usr/share/nginx/html/index.html"]
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-web-gatewayapi-svc
spec:
  ports:
  - name: http
    port: 80
  selector:
    app: gatewayweb

gateway

[root@master1 deploy-gateway]# cat gatewayapi-web-gateway.yml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: nginx-web-gateway
spec:
  gatewayClassName: traefik
  listeners:
   - name: web
     protocol: HTTP
     port: 80
     allowedRoutes:
       kinds:
       - kind: HTTPRoute
       namespaces:
         from: Selector
         selector:
           matchLabels:
             app: "nginx"

1	kubectl label ns default app=nginx

httproute

[root@master1 deploy-gateway]# cat nginx-httproute.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: nginx-gateway-api-route
spec:
  parentRefs:
  - name: nginx-web-gateway
  hostnames:
  - "nginx.hmk.cn"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: nginx-web-gatewayapi-svc
      port: 80

同一个命名空间默认default的ns，所以不用授权

ReferenceGrant

6.6.3 金丝雀发布

Gateway APIs规范可以支持的另一个功能是金丝雀发布，假设你想在一个断点上运行两个不同的服务（或统一服务的不同版本），并将一部分请求路由到每个端点，则可以通过修改你的HTTPRoute实现

使用前面的nginx.yaml

[root@master1 mirror-test]# cat nginx.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-web1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: v1
  template:
    metadata:
      labels:
        app: v1
    spec:
      containers:
      - name: nginx-web1
        image: registry.cn-hangzhou.aliyuncs.com/hemingkang/nginx:1.20.0
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh","-c","echo svc1> /usr/share/nginx/html/index.html"]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-web2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: v2
  template:
    metadata:
      labels:
        app: v2
    spec:
      containers:
      - name: nginx-web2
        image: registry.cn-hangzhou.aliyuncs.com/hemingkang/nginx:1.20.0
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh","-c","echo svc1> /usr/share/nginx/html/index.html"]
---
apiVersion: v1
kind: Service
metadata:
  name: svc1
spec:
  ports:
  - name: http
    port: 80
  selector:
    app: v1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
spec:
  ports:
  - name: http
    port: 80
  selector:
    app: v2

gateway：或者使用前面创建的gateway

如果后端service 与httproute不在一个ns，需要允许授权

[root@master1 canary]# cat gateway-cn.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: nginxweb-app
spec:
  gatewayClassName: traefik
  listeners:
   - name: web
     protocol: HTTP
     port: 80
     allowedRoutes:
       kinds:
       - kind: HTTPRoute
       namespaces:
         from: All

httproute：

[root@master1 canary]# cat httproute.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: nginxweb-app
spec:
  parentRefs:
  - name: nginxweb-app
  hostnames:
  - "nginxcn.hmk.cn"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: svc1
      namespace: default
      port: 80
      weight: 3  # 3/4的请求到svc1
    - name: svc2
      namespace: default
      port: 80
      weight: 1  # 1/4的请求到svc2

test:

浏览器访问查看log效果

集群外主机测试：

Next post: Hello World

HMK's blog

保持思考|00后|等待