使用traefik作爲ingress對外訪問服務http

1、準備traefik相關yaml

ingress 服務器ip 192.168.30.35

1.1 創建traefik-rbac

vi traefik-rbac.yaml
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik
  namespace: kube-system
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
    - extensions
    resources:
    - ingresses/status
    verbs:
    - update
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik
subjects:
- kind: ServiceAccount
  name: traefik
  namespace: kube-system

1.2 創建traefik-deployment

vi traefik-deployment.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik
  namespace: kube-system
---
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: traefik
  namespace: kube-system
  labels:
    k8s-app: traefik
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: traefik
  template:
    metadata:
      labels:
        k8s-app: traefik
        name: traefik
    spec:
      serviceAccountName: traefik
      terminationGracePeriodSeconds: 60
      containers:
      - image: traefik
        name: traefik
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        - name: admin
          containerPort: 8080
        args:
        - --api
        - --kubernetes
        - --web
        - --logLevel=INFO
        - --web.metrics
        - --metrics.prometheus
        - --web.metrics.prometheus
      nodeSelector:
        ingress: "yes"
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/ingress
        operator: Equal
---
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: traefik
  name: traefik
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik
  clusterIP: None
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 8080
      name: admin
  type: ClusterIP

1.3 創建traefik-dashboard

vi traefik-dashboard.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-dashboard
  namespace: kube-system
spec:
  rules:
  - host: traefik.mddgame.com
    http:
      paths:
        - path: /
          backend:
            serviceName: traefik
            servicePort: 8080

1.4 創建prometheus-serviceMonitortraefik

vi prometheus-serviceMonitortraefik.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  labels:
    k8s-app: traefik
  name: traefik
  namespace: monitoring
spec:
  endpoints:
  - honorLabels: true
    interval: 15s
    port: admin
  jobLabel: k8s-app
  namespaceSelector:
    matchNames:
    - kube-system
  selector:
    matchLabels:
      k8s-app: traefik

2 創建traefik 服務

## 指定traefik 在ingress 節點運行
kubectl label nodes ingress  ingress=yes 
## 創建traefik
kubectl apply -f .

3、驗證 traefik 部署是否正常

kubectl get all -A | grep traefik
root@Qist:/mnt/e/work/k8s/traefik# kubectl get all -A | grep traefik
kube-system      pod/traefik-76f6ccc479-f7prx                  1/1     Running   0          26m

kube-system   service/traefik                   ClusterIP   None            <none>        80/TCP,8080/TCP          26m

kube-system      deployment.apps/traefik                  1/1     1            1           26m

kube-system      replicaset.apps/traefik-76f6ccc479                  1         1         1       26m
登錄 ingress 服務器查看iptables nat 規則是否創建如果

這裏使用的是hostPort 所以只是ingress 部署的服務端口對外暴露
還有一種hostNetwork: true 模式對外暴露端口這樣需要容器特權模式安全性有所降低，網絡性能是最好的

4、查看創建的ingress 服務是否能正常對外提供服務

root@Qist:/mnt/e/work/k8s/traefik# kubectl get ingress -n kube-system
NAME                HOSTS                 ADDRESS   PORTS   AGE
traefik-dashboard   traefik.mddgame.com             80      35m
綁定host 
192.168.30.35 traefik.mddgame.com
http://traefik.mddgame.com/dashboard/

5、grafana，prometheus 創建ingress

vi traefik-grafana.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: grafana-dashboard
  namespace: monitoring

spec:
  rules:
  - host: grafana.mddgame.com
    http:
      paths:
      - path: /
        backend:
          serviceName: grafana
          servicePort: 3000

vi prometheus-traefik.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: prometheus
  namespace: monitoring

spec:
  rules:
  - host: prometheus.mddgame.com
    http:
      paths:
      - path: /
        backend:
          serviceName: prometheus-k8s
          servicePort: 9090

創建 Ingress
kubectl apply -f  traefik-grafana.yaml
kubectl apply -f  prometheus-traefik.yaml
root@Qist:/mnt/e/work/k8s/traefik# kubectl get ingress -n monitoring
NAME                HOSTS                    ADDRESS   PORTS   AGE
grafana-dashboard   grafana.mddgame.com                80      3d1h
prometheus          prometheus.mddgame.com             80      5h4m
綁定host 查看使用域名能否正常訪問如果能正常部署正常

traefik prometheus 監控json 下載

https://grafana.com/dashboards?dataSource=prometheus&search=traefik
導入 grafana