1. 部署traefik

1.1 相关版本介绍

• k8s：v1.23.17

• traefik：v2.9.10

链接地址：

• GitHub：https://github.com/traefik/traefik

• Dockerhub：https://hub.docker.com/_/traefik

• 官网：https://doc.traefik.io/traefik

• gateway-api：https://github.com/kubernetes-sigs/gateway-api

1.2 创建crd资源

官网文档：https://doc.traefik.io/traefik/providers/kubernetes-crd

# Install Traefik Resource Definitions:
kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.9/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml

# Install RBAC for Traefik:
kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.9/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
done

GitHub文件地址：kubernetes-crd-definition-v1.yml kubernetes-crd-rbac.yml

CRD资源：https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#definitions

1.3 权限和访问

部署演示：https://doc.traefik.io/traefik/getting-started/quick-start-with-kubernetes

第一步是创建角色。 群集角色资源：

mkdir -p /root/traefik ; cd /root/traefik
cat > 00-role.yml <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: traefik-role

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
EOF

参考文件：https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#rbac

第二步创建一个专有服务账户：

mkdir -p /root/traefik ; cd /root/traefik
cat > 00-account.yml <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-account
EOF

绑定帐户上的角色以对后者应用权限和规则

mkdir -p /root/traefik ; cd /root/traefik
cat > 01-role-binding.yml <<EOF
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: traefik-role-binding

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-role
subjects:
  - kind: ServiceAccount
    name: traefik-account
    namespace: default # Using "default" because we did not specify a namespace when creating the ClusterAccount.
EOF

部署容器：

mkdir -p /root/traefik ; cd /root/traefik
cat > 02-traefik.yml <<EOF
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik-deployment
  labels:
    app: traefik
spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-account
      containers:
        - name: traefik
          image: traefik:v2.9
          args:
            - --api.insecure
            - --providers.kubernetesingress
          ports:
            - name: web
              containerPort: 80
            - name: dashboard
              containerPort: 8080
EOF

启动配置：https://doc.traefik.io/traefik/reference/static-configuration/cli

部署servers：

mkdir -p /root/traefik ; cd /root/traefik
cat > 02-traefik-services.yml <<EOF
apiVersion: v1
kind: Service
metadata:
  name: traefik-dashboard-service

spec:
  type: NodePort # 这里先用nodeport展示：默认LoadBalancer
  ports:
    - port: 8080
      targetPort: dashboard
  selector:
    app: traefik
---
apiVersion: v1
kind: Service
metadata:
  name: traefik-web-service

spec:
  type: NodePort
  ports:
    - targetPort: web
      port: 80
  selector:
    app: traefik
EOF

启动traefik：

kubectl apply -f 00-role.yml \
              -f 00-account.yml \
              -f 01-role-binding.yml \
              -f 02-traefik.yml \
              -f 02-traefik-services.yml
kubectl get svc
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
kubernetes                  ClusterIP   10.96.0.1        <none>        443/TCP          36d
myapp                       ClusterIP   10.110.23.33     <none>        80/TCP           22h
traefik-dashboard-service   NodePort    10.107.137.221   <none>        8080:32584/TCP   41m #访问界面
traefik-web-service         NodePort    10.101.176.161   <none>        80:30511/TCP     41m

博客参考：http://www.mydlq.club/article/107