K8S 之 服务暴露Ingress Traefik 安装与理解

一、POD服务暴露Ingress Traefik的理解

二、Ingress 数据流向

三、Ingress Traefik安装

在运维主机上运行

[root@test-operator traefik]# cd /data/k8s-yaml/
k8s-yaml]# mkdir traefik
k8s-yaml]# cd traefik/
traefik]# docker pull traefik:v1.7.2-alpine
traefik]# docker images|grep traefik
traefik]# docker tag add5fac61ae5 traefik]# harbor.od.com/public/traefik:v1.7.2
traefik]# docker push test-harbor.cedarhd.com/public/traefik:v1.7.2

#创建四个资源配置清单
traefik]# vi rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: kube-system

------------------------------------------------------------------------------------------

traefik]# vi ds.yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: traefik-ingress
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress
spec:
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress
        name: traefik-ingress
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      containers:
      - image: test-harbor.cedarhd.com/public/traefik:v1.7.2
        name: traefik-ingress
        ports:
        - name: controller
          containerPort: 80
          hostPort: 81
        - name: admin-web
          containerPort: 8080
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        args:
        - --api
        - --kubernetes
        - --logLevel=INFO
        - --insecureskipverify=true
        - --kubernetes.endpoint=https://10.3.153.240:7443
        - --accesslog
        - --accesslog.filepath=/var/log/traefik_access.log
        - --traefiklog
        - --traefiklog.filepath=/var/log/traefik.log
        - --metrics.prometheus

------------------------------------------------------------------------------------------

traefik]# vi svc.yaml
kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress
  ports:
    - protocol: TCP
      port: 80
      name: controller
    - protocol: TCP
      port: 8080
      name: admin-web

------------------------------------------------------------------------------------------
traefik]# vi ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-web-ui
  namespace: kube-system
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: test-traefik.cedarhd.com
    http:
      paths:
      - path: /
        backend:
          serviceName: traefik-ingress-service
          servicePort: 8080

在任意运算节点主机上运行

[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/rbac.yaml
serviceaccount/traefik-ingress-controller created
clusterrole.rbac.authorization.k8s.io/traefik-ingress-controller created
clusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created
[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/ds.yaml
daemonset.extensions/traefik-ingress created
[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/svc.yaml
service/traefik-ingress-service created
[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/ingress.yaml
ingress.extensions/traefik-web-ui created
[root@test-nodes1 ~]# systemctl restart docker.service      #重启两台运算节点的docker
[root@test-nodes2 ~]# kubectl get pods -n kube-system     #检查运行情况
NAME                       READY   STATUS    RESTARTS   AGE
coredns-6c69fbcc6c-6vqgr   1/1     Running   0          18h
traefik-ingress-44ptk      1/1     Running   0          22m
traefik-ingress-vrvr4      1/1     Running   0          22m

四、分别在master/standby proxy做域名解释跳转

[root@test-master ~]# vi /etc/nginx/conf.d/cedarhd.com.conf
upstream default_backend_traefik {
    server 10.3.153.221:81    max_fails=3 fail_timeout=10s;
    server 10.3.153.222:81    max_fails=3 fail_timeout=10s;
}
server {
    server_name *.cedarhd.com;

    location / {
        proxy_pass http://default_backend_traefik;
        proxy_set_header Host       $http_host;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    }
}
[root@test-master ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@test-master ~]# nginx -s reload

#备注，在DNS主机上把test-traefik.cedarhd.com的域名解释到VIP地址(10.3.153.240)上。