参考github项目地址https://github.com/containous/traefik
文档地址: https://docs.traefik.io/
以下配置文件均可在https://github.com/containous/traefik/tree/master/examples/k8s找到
traefik 有两种部署方式,一种是通过deamonset形式,一种是通过deployment的形式。两个形式各有优势。
使用deployment,可伸缩性可以更好
使用deamonset,Single-Pod-per-Node。当节点加入群集时,DaemonSet会自动扩展到新节点。DaemonSet可以使用NET_BIND_SERVICE功能运行,这将允许它绑定到每个主机上的端口80/443 / etc。这将允许绕过kube-proxy,并减少流量跳跃。
首先创建rbac文件
##traefik-rbac.yaml
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: kube-system
##traefik-ds.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: kube-system
---
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
name: traefik-ingress-controller
namespace: kube-system
labels:
k8s-app: traefik-ingress-lb
spec:
template:
metadata:
labels:
k8s-app: traefik-ingress-lb
name: traefik-ingress-lb
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
containers:
- image: traefik
name: traefik-ingress-lb
ports:
- name: http
containerPort: 80
hostPort: 80
- name: admin
containerPort: 8080
hostPort: 8580
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
args:
- --api
- --kubernetes
- --logLevel=INFO
---
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- protocol: TCP
port: 80
name: web
- protocol: TCP
port: 8080
name: admin
deamonset的方式在配置文件中直接暴露机器的端口,由hostPort实现。访问时未使用的kube-proxy.
##traefik-deployment.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: kube-system
---
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
name: traefik-ingress-controller
namespace: kube-system
labels:
k8s-app: traefik-ingress-lb
spec:
replicas: 1
selector:
matchLabels:
k8s-app: traefik-ingress-lb
template:
metadata:
labels:
k8s-app: traefik-ingress-lb
name: traefik-ingress-lb
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
containers:
- image: traefik
name: traefik-ingress-lb
ports:
- name: http
containerPort: 80
- name: admin
containerPort: 8080
args:
- --api
- --kubernetes
- --logLevel=INFO
---
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- protocol: TCP
port: 80
name: web
- protocol: TCP
port: 8080
name: admin
type: NodePort
deployment 的形式通过nodePort的形式暴露访问的端口。
创建
#创建rbac
kubectl create -f traefik-rbac.yaml
#创建服务
kubectl create -f traefik-ds.yaml
或者:
kubectl create -f traefik-deployment.yaml
创建到服务的Ingress
example:traefik web界面的访问
###traefik-ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-web-ui
namespace: kube-system
spec:
tls:
- secretName: traefik-cert
rules:
- host: traefik-ui.k8s
http:
paths:
- path: /
backend:
serviceName: traefik-ingress-service
servicePort: 8080
注: 此处的servicePort,可以是8080,也可以用name表示,如下:
###traefik-ingress2.yaml
---
apiVersion: v1
kind: Service
metadata:
name: traefik-web-ui
namespace: kube-system
spec:
type: NodePort
selector:
k8s-app: traefik-ingress-lb
ports:
- name: web
port: 80
targetPort: 8080
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-web-ui
namespace: kube-system
spec:
rules:
- host: traefik-ui.k8s
http:
paths:
- path: /
backend:
serviceName: traefik-web-ui
servicePort: web
将Ingress中的host 添加到本地的hosts文件中,形式: [节点IP host]
添加完成后即可通过浏览器访问。
example:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: cheeses
annotations:
traefik.frontend.rule.type: PathPrefixStrip
spec:
rules:
- host: cheeses.minikube
http:
paths:
- path: /stilton
backend:
serviceName: stilton
servicePort: http
- path: /cheddar
backend:
serviceName: cheddar
servicePort: http
- path: /wensleydale
backend:
serviceName: wensleydale
servicePort: http
traefik.frontend.rule.type: PathPrefixStrip 必须放在ingress的annotations中,才可以生效。
对于后台有多个副本的服务,默认的调度是:轮询调度。
可以在service的annotations中,配置traefik.ingress.kubernetes.io/load-balancer-method: drr
调度算法更改为动态轮询,根据每次调度到的服务动态调整权重。