Traefik & CRD & Let's Encrypt

带有用于Kubernetes的IngressRoute自定义资源定义的Traefik,以及通过Let's Encrypt进行的TLS.

本文档旨在作为一个完整的示例,演示如何在Kubernetes中设置Traefik ,其中的动态配置来自IngressRoute定制资源 ,以及使用Let's Encrypt进行 TLS设置. 但是,为简单起见,我们在Kubernetes集群设置中使用了k3s docker镜像.

请注意,对于此设置,鉴于我们将使用ACME的TLS-ALPN-01挑战,将要在其上运行的主机必须能够在端口443上接收来自外部的连接.当然,它的Internet面向IP地址必须与您打算使用的域名匹配.

在以下内容中,可以通过两种不同的方式将YAML配置文件中定义的Kubernetes资源应用于设置:

  • 第一种,通常的方法是简单地使用kubectl apply命令.
  • 第二个可用于本教程的方法是将文件直接放置在k3s docker映像用于此类输入的目录中( /var/lib/rancher/k3s/server/manifests ).

Kubectl版本

对于本指南中使用的rancher/k3s版本( 0.8.0 ),kubectl版本必须> = 1.11 .

k3s Docker-compose Configuration

我们的起点是docker-compose配置文件,用于启动k3s集群. 您可以从以下内容开始:

docker-compose -f k3s.yml up
server:
  image: rancher/k3s:v0.8.0
  command: server --disable-agent --no-deploy traefik
  environment:
    - K3S_CLUSTER_SECRET=somethingtotallyrandom
    - K3S_KUBECONFIG_OUTPUT=/output/kubeconfig.yaml
    - K3S_KUBECONFIG_MODE=666
  volumes:
    # k3s will generate a kubeconfig.yaml in this directory. This volume is mounted
    # on your host, so you can then 'export KUBECONFIG=/somewhere/on/your/host/out/kubeconfig.yaml',
    # in order for your kubectl commands to work.
    - /somewhere/on/your/host/out:/output
    # This directory is where you put all the (yaml) configuration files of
    # the Kubernetes resources.
    - /somewhere/on/your/host/in:/var/lib/rancher/k3s/server/manifests
  ports:
    - 6443:6443

node:
  image: rancher/k3s:v0.8.0
  privileged: true
  links:
    - server
  environment:
    - K3S_URL=https://server:6443
    - K3S_CLUSTER_SECRET=somethingtotallyrandom
  volumes:
    # this is where you would place a alternative traefik image (saved as a .tar file with
    # 'docker save'), if you want to use it, instead of the traefik:v2.0 image.
    - /sowewhere/on/your/host/custom-image:/var/lib/rancher/k3s/agent/images

Cluster Resources

现在,让我们看一下(如果使用kubectl apply ,应按应应用的顺序排列)完整安装所需的所有资源.

IngressRoute Definition

首先,定义IngressRouteMiddleware种类. 另请注意RBAC授权资源; 稍后将通过部署的serviceAccountName引用它们.

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutes.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRoute
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutetcps.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRouteTCP
    plural: ingressroutetcps
    singular: ingressroutetcp
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: middlewares.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: Middleware
    plural: middlewares
    singular: middleware
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tlsoptions.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TLSOption
    plural: tlsoptions
    singular: tlsoption
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: traefikservices.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TraefikService
    plural: traefikservices
    singular: traefikservice
  scope: Namespaced

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.containo.us
    resources:
      - middlewares
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutetcps
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - tlsoptions
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - traefikservices
    verbs:
      - get
      - list
      - watch

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default

Services

然后,服务. 一个用于Traefik本身,另一个用于其路由的应用程序,即在本例中为我们的演示HTTP服务器: whoami .

apiVersion: v1
kind: Service
metadata:
  name: traefik

spec:
  ports:
    - protocol: TCP
      name: web
      port: 8000
    - protocol: TCP
      name: admin
      port: 8080
    - protocol: TCP
      name: websecure
      port: 4443
  selector:
    app: traefik

---
apiVersion: v1
kind: Service
metadata:
  name: whoami

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami

Deployments

接下来,进行部署,即服务背后的实际容器. 同样,一个是Traefik的吊舱,另一个是whoami应用程序的吊舱.

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v2.0
          args:
            - --api.insecure
            - --accesslog
            - --entrypoints.web.Address=:8000
            - --entrypoints.websecure.Address=:4443
            - --providers.kubernetescrd
            - --certificatesresolvers.default.acme.tlschallenge
            - [email protected]
            - --certificatesresolvers.default.acme.storage=acme.json
            # Please note that this is the staging Let's Encrypt server.
            # Once you get things working, you should remove that whole line altogether.
            - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
          ports:
            - name: web
              containerPort: 8000
            - name: websecure
              containerPort: 4443
            - name: admin
              containerPort: 8080

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami
  labels:
    app: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: containous/whoami
          ports:
            - name: web
              containerPort: 80

Port Forwarding

现在,作为上述内容的例外,请注意,您不应让下面的ingressRoute资源自动应用于您的集群. 原因是,一旦Traefik的ACME提供者检测到我们拥有TLS路由器,它将尝试为相应域生成证书. 这是行不通的,因为就这样,我们的Traefik吊舱无法从外部到达,这将使ACME TLS挑战失败. 因此,为了使整个工作正常进行,我们必须延迟应用ingressRoute资源,直到我们正确设置了端口转发为止,这是下一步.

kubectl port-forward --address 0.0.0.0 service/traefik 8000:8000 8080:8080 443:4443 -n default

另外,如果在本指南中,该内容不在本文档的讨论范围之内,请注意,由于Linux上的特权端口限制,上述命令可能无法在端口443上进行侦听.在这种情况下,您可以使用一些技巧,例如使用以下命令提升kubectl上限setcaps ,或使用authbind ,或在主机和WAN之间设置NAT. 查一下

Traefik Routers

现在,我们终于可以应用实际的ingressRoutes了:

kubectl apply -f 04-ingressroutes.yml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: simpleingressroute
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`your.domain.com`) && PathPrefix(`/notls`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutetls
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`your.domain.com`) && PathPrefix(`/tls`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    certResolver: default

给它几秒钟以完成ACME TLS挑战,然后您应该可以从外部访问您的whoami pod(通过Traefik路由). 没有TLS的或都(只是为了好玩,请勿在生产中使用):

curl [-k] https://your.domain.com/tls
curl [-k] http://your.domain.com:8000/notls

请注意,只要使用的是Let's Encrypt登台服务器,就必须使用-k ,因为它不是尚未手动添加的系统上的授权证书颁发机构.