Установка и Настройка Ingress Traefik

You can customize the install with a values file. There are some [[EXAMPLES>>url:https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md]] provided. Complete documentation on all available parameters is in the [[default file>>url:https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml]].

51

52

Example:

53

54

{{{helm upgrade --install traefik \

55

--namespace traefik \

56

--set dashboard.enabled=true \

57

--set rbac.enabled=true \

58

--set nodeSelector.node-type=master \

59

--set="additionalArguments={--api.dashboard=true,--log.level=INFO,--providers.kubernetesingress.ingressclass=traefik-internal,--serversTransport.insecureSkipVerify=true}" \

60

traefik/traefik \

61

--version <version>}}}

62

63

Verify the installation by checking all resources in the namespace.

64

65

{{{$ kubectl get all -n traefik

66

NAME READY STATUS RESTARTS AGE

67

pod/traefik-6c77767cfd-pjkt7 1/1 Running 0 5m6s

68

69

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

70

service/traefik LoadBalancer 10.233.26.243 192.168.1.34 80:32715/TCP,443:30295/TCP 5m7s

71

72

NAME READY UP-TO-DATE AVAILABLE AGE

73

deployment.apps/traefik 1/1 1 1 5m7s

74

75

NAME DESIRED CURRENT READY AGE

76

replicaset.apps/traefik-6c77767cfd 1 1 1 5m7s}}}

77

78

From the above output, we have a **LoadBalancer** service with a //pending// external IP Address. This will be configured later in the guide.

79

80

View the Traefik CRDs with the command;

81

82

{{{$ kubectl get crd -n traefik | grep traefik

83

ingressroutes.traefik.containo.us 2023-03-08T14:32:55Z

84

ingressroutetcps.traefik.containo.us 2023-03-08T14:32:55Z

85

ingressrouteudps.traefik.containo.us 2023-03-08T14:32:55Z

86

middlewares.traefik.containo.us 2023-03-08T14:32:55Z

87

middlewaretcps.traefik.containo.us 2023-03-08T14:32:55Z

88

serverstransports.traefik.containo.us 2023-03-08T14:32:55Z

89

tlsoptions.traefik.containo.us 2023-03-08T14:32:55Z

90

tlsstores.traefik.containo.us 2023-03-08T14:32:55Z

91

traefikservices.traefik.containo.us 2023-03-08T14:32:55Z}}}

92

93

== Step 2 – Expose Traefik Dashboard ==

94

95

Check Traefik service to check its Load balancer IP address.

96

97

{{{$ kubectl get svc -l app.kubernetes.io/name=traefik -n traefik

98

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

99

traefik LoadBalancer 10.233.26.243 192.168.1.34 80:32715/TCP,443:30295/TCP 3h43m}}}

100

101

We can confirm our load balancer IP address is 192.168.1.34. You can map this in your /etc/hosts file.

102

103

{{{$ sudo vim /etc/hosts

104

traefik.computingforgeeks.com 192.168.1.34}}}

105

106

Confirm you can ping the IP address using domain name.

107

108

{{{$ ping -c 2 traefik.home.cloudlabske.io

109

PING traefik.home.cloudlabske.io (192.168.1.34): 56 data bytes

110

64 bytes from 192.168.1.34: icmp_seq=0 ttl=64 time=8.333 ms

111

64 bytes from 192.168.1.34: icmp_seq=1 ttl=64 time=3.596 ms

112

113

--- traefik.home.cloudlabske.io ping statistics ---

114

2 packets transmitted, 2 packets received, 0.0% packet loss

115

round-trip min/avg/max/stddev = 3.596/5.965/8.333/2.369 ms}}}

116

117

This HelmChart does not expose the Traefik dashboard by default, for security concerns. Thus, there are multiple ways to expose the dashboard. For instance, the dashboard access could be achieved through a port-forward, Nodeport or via Ingress.

118

119

=== Expose using Port forwarding (Recommended way) ===

120

121

You can gain access to the dashboard through **//port-forward//. **To achieve this run the following commands in your workstation where kubectl is configured.

122

123

{{{kubectl port-forward $(kubectl get pods --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000}}}

124

125

You can then access the dashboard on **//http:~/~/127.0.0.1:9000/dashboard///**

126

127

=== Expose using Load balancer port ===

128

129

Create a new file with ports exposed for Traefik service.

130

131

{{{vim traefik-dashboard-service.yml}}}

132

133

This will be used to patch the service. Here we’re adding new entry for port **9000**

{{{spec:

ports:

- name: web

port: 80

protocol: TCP

targetPort: web

- name: websecure

port: 443

protocol: TCP

targetPort: websecure

- name: traefik

port: 9000

protocol: TCP

targetPort: traefik}}}

149

150

Apply the manifest with ~-~-patch option while providing the file path.

151

152

{{{$ kubectl -n traefik patch svc/traefik --patch "$(cat traefik-dashboard-service.yml)"

153

service/traefik patched}}}

154

155

Confirm the service is updated with new port **9000 **where the dashboard will be exposed. You can choose any other port as you prefer.

156

157

{{{$ kubectl get svc traefik

158

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

159

traefik LoadBalancer 10.233.26.243 192.168.1.34 80:32715/TCP,443:30295/TCP,9000:30811/TCP 4h3m}}}

160

161

From the output we can confirm our Load Balancer IP address to be **//192.168.1.34//**. You can access Traefik web dashboard on this IP directly or via domain name mapped to the IP address in your /etc/hosts file or actual DNS server.

162

163

{{{192.168.1.34 traefik.computingforgeeks.com}}}

164

165

Now that your cluster has an IP address/domain name, you can easily access the Traefik Dashboard and web services. But currently, the service is not available since we do not have any Ingress created.

166

167

{{{# curl http://traefik.computingforgeeks.com

168

404 page not found}}}

169

170

Now proceed and access the Traefik Dashboard using the **//http:~/~/LB_IP:9000/dashboard///**

Or the URL [[http:~~/~~/domain_name:9000/dashboard/>>url:https://computingforgeeks.com/]] (do not forget to include the slash at the end of the URL)

== Step 3 – Protect Traefik Dashboard with basic Auth (//Recommended//) ==

179

180

Create the custom middlewares used by the IngressRoute dashboard. We can start by downloading the default **values **file.

181

182

{{{wget https://raw.githubusercontent.com/traefik/traefik-helm-chart/master/traefik/values.yaml -O traefik-values.yaml}}}

183

184

Edit around line **144** and customize. Alternatively create a new custom values file.

185

186

{{{vim custom-traefik-values.yaml}}}

187

188

Add the contents given below while setting your own username and password.

189

190

{{{# Create an IngressRoute for the dashboard

ingressRoute:

dashboard:

enabled: true

# Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)

195

annotations: {}

196

# Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)

197

labels: {}

198

# The router match rule used for the dashboard ingressRoute

199

matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`)

200

# Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure).

201

# By default, it's using traefik entrypoint, which is not exposed.

202

# /!\ Do not expose your dashboard without any protection over the internet /!\

203

entryPoints: ["traefik"]

204

# Additional ingressRoute middlewares (e.g. for authentication)

205

middlewares:

206

- name: traefik-dashboard-auth

207

208

# Create the custom middlewares used by the IngressRoute dashboard (can also be created in another way).

209

# /!\ Yes, you need to replace "changeme" password with a better one. /!\

extraObjects:

- apiVersion: v1

kind: Secret

metadata:

type: kubernetes.io/basic-auth

216

stringData:

217

username: admin

218

password: StrongAdminPassw0rd

219

220

- apiVersion: traefik.io/v1alpha1

kind: Middleware

metadata:

spec:

basicAuth:

secret: traefik-dashboard-auth-secret}}}

227

228

Upgrade Traefik helm deployment.

229

230

{{{$ helm upgrade --values custom-traefik-values.yaml traefik traefik/traefik --namespace traefik

231

Release "traefik" has been upgraded. Happy Helming!

232

NAME: traefik

233

LAST DEPLOYED: Fri June 14 12:10:43 2024

NAMESPACE: traefik

STATUS: deployed

REVISION: 2

TEST SUITE: None

NOTES:

Traefik Proxy v3.0.2 has been deployed successfully

240

on traefik namespace !}}}

241

242

Reload Traefik dashboard to confirm if password authentication is required.

Provide set username and password to gain access.

247

248

== Step 4 – Test Traefik Ingress on Kubernetes ==

249

250

Let’s create a sample application to test the functionality of Traefik Ingress on Kubernetes.

251

252

{{{vim whoami.yaml}}}

253

254

Add the lines below to the file – this defines the deployment of **//whoami//** application

{{{---

apiVersion: apps/v1

kind: Deployment

metadata:

labels:

app: whoami

spec:

replicas: 1

selector:

matchLabels:

app: whoami

template:

metadata:

labels:

app: whoami

spec:

containers:

- image: traefik/whoami:latest

275

276

ports:

277

- containerPort: 80}}}

278

279

Apply the manifest with kubectl command

280

281

{{{kubectl create -f whoami.yaml}}}

282

283

Within few seconds the pod should be running, you can check with the commands below.

284

285

{{{$ kubectl get pods

286

NAME READY STATUS RESTARTS AGE

287

traefik-6c77767cfd-pjkt7 1/1 Running 0 18h

288

whoami-6ff6dcfdc8-q8rcc 1/1 Running 0 11s}}}

289

290

Create a service entry file for **//whoami//** service

291

292

{{{$ vim whoami-service.yaml

---

apiVersion: v1

kind: Service

metadata:

spec:

type: ClusterIP

selector:

app: whoami

ports:

- port: 80}}}

Create the object on Kubernetes by applying the manifest.

306

307

{{{kubectl create -f whoami-service.yaml}}}

308

309

Confirm service creation was successful.

310

311

{{{$ kubectl get svc whoami-svc

312

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

313

whoami-svc ClusterIP 10.233.0.100 <none> 80/TCP 2m11s}}}

314

315

Now, this application is still not accessible until you create an Ingress to expose the service.

316

317

{{{vim whoami-ingress.yaml}}}

318

319

Add the below lines and replace the **host** with the domain name added in** /etc/hosts** for the external IP address:

320

321

{{{apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

annotations:

traefik.ingress.kubernetes.io/router.entrypoints: web

327

spec:

328

rules:

329

- host: traefik.computingforgeeks.com

http:

paths:

- path: /whoami

pathType: Prefix

backend:

service:

port:

number: 80}}}

Create ingress object on kubernetes

341

342

{{{kubectl apply -f app-ingress.yaml}}}

343

344

View the created Ingress:

345

346

{{{$ kubectl get ingress

347

NAME CLASS HOSTS ADDRESS PORTS AGE

348

whoami-http traefik traefik.computingforgeeks.com 80 57s}}}

349

350

Now access the deployment using the URL[[ http:~~/~~/domain_name/whoami>>url:http://domain_name/whoami]]

This confirms Traefik to be working as expected in our Kubernetes cluster.

Wiki source code of Установка и Настройка Ingress Traefik