k3s 基础 —— 配置 traefik dashboard & k8s dashboard 域名访问

配置 k8s dashboard 域名访问

安装略

① kubectl 代理（只支持localhost 或 http）：

kubectl proxy --address='0.0.0.0' --accept-hosts='^*$'

② 若 k8s 在虚拟机中部署，局域网中临时访问，可使用端口转发:

kubectl port-forward -n kubernetes-dashboard service/kubernetes-dashboard 10443:443 --address 0.0.0.0

③ traefik 配置域名访问

apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
  name: k8s-dashboard-transport
  namespace: kubernetes-dashboard
spec:
  serverName: "k8s-dashboard.domain.com"
  insecureSkipVerify: true
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: k8s-dashboard-web
  namespace: kubernetes-dashboard
spec:
  entryPoints:
    - websecure
  routes:
    - match: "Host(`k8s-dashboard.domain.com`)"
      kind: Rule
      services:
      - name: kubernetes-dashboard
        namespace: kubernetes-dashboard
        port: 443
        serversTransport: k8s-dashboard-transport
  tls:
    secretName: my-tls

配置 traefik dashboard 域名访问

① 端口转发

# 访问地址 http://192.168.0.201:9000/dashboard/#/
kubectl -n kube-system port-forward $(kubectl -n kube-system get pods --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000 --address 0.0.0.0

② 域名访问

# 访问地址 https://traefik.domain.com/dashboard/#/
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard-web
  namespace: kube-system
spec:
  entryPoints:
    - web
  routes:
    - kind: Rule
      match: Host(`traefik.domain.com`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
      services:
        - kind: TraefikService
          name: api@internal

---

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard-web-tls
  namespace: kube-system
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`traefik.domain.com`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
      services:
        - kind: TraefikService
          name: api@internal
  tls:
    secretName: my-tls

注：secret 的生成

kubectl create secret tls my-tls \
  --key /etc/letsencrypt/live/domain.com/privkey.pem \
  --cert /etc/letsencrypt/live/domain.com/fullchain.pem