一、POD服务暴露Ingress Traefik的理解
二、Ingress 数据流向
三、Ingress Traefik安装
在运维主机上运行
[root@test-operator traefik]# cd /data/k8s-yaml/
k8s-yaml]# mkdir traefik
k8s-yaml]# cd traefik/
traefik]# docker pull traefik:v1.7.2-alpine
traefik]# docker images|grep traefik
traefik]# docker tag add5fac61ae5 traefik]# harbor.od.com/public/traefik:v1.7.2
traefik]# docker push test-harbor.cedarhd.com/public/traefik:v1.7.2
#创建四个资源配置清单
traefik]# vi rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: kube-system
------------------------------------------------------------------------------------------
traefik]# vi ds.yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: traefik-ingress
namespace: kube-system
labels:
k8s-app: traefik-ingress
spec:
template:
metadata:
labels:
k8s-app: traefik-ingress
name: traefik-ingress
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
containers:
- image: test-harbor.cedarhd.com/public/traefik:v1.7.2
name: traefik-ingress
ports:
- name: controller
containerPort: 80
hostPort: 81
- name: admin-web
containerPort: 8080
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
args:
- --api
- --kubernetes
- --logLevel=INFO
- --insecureskipverify=true
- --kubernetes.endpoint=https://10.3.153.240:7443
- --accesslog
- --accesslog.filepath=/var/log/traefik_access.log
- --traefiklog
- --traefiklog.filepath=/var/log/traefik.log
- --metrics.prometheus
------------------------------------------------------------------------------------------
traefik]# vi svc.yaml
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress
ports:
- protocol: TCP
port: 80
name: controller
- protocol: TCP
port: 8080
name: admin-web
------------------------------------------------------------------------------------------
traefik]# vi ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-web-ui
namespace: kube-system
annotations:
kubernetes.io/ingress.class: traefik
spec:
rules:
- host: test-traefik.cedarhd.com
http:
paths:
- path: /
backend:
serviceName: traefik-ingress-service
servicePort: 8080
在任意运算节点主机上运行
[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/rbac.yaml
serviceaccount/traefik-ingress-controller created
clusterrole.rbac.authorization.k8s.io/traefik-ingress-controller created
clusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created
[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/ds.yaml
daemonset.extensions/traefik-ingress created
[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/svc.yaml
service/traefik-ingress-service created
[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/ingress.yaml
ingress.extensions/traefik-web-ui created
[root@test-nodes1 ~]# systemctl restart docker.service #重启两台运算节点的docker
[root@test-nodes2 ~]# kubectl get pods -n kube-system #检查运行情况
NAME READY STATUS RESTARTS AGE
coredns-6c69fbcc6c-6vqgr 1/1 Running 0 18h
traefik-ingress-44ptk 1/1 Running 0 22m
traefik-ingress-vrvr4 1/1 Running 0 22m
四、分别在master/standby proxy做域名解释跳转
[root@test-master ~]# vi /etc/nginx/conf.d/cedarhd.com.conf
upstream default_backend_traefik {
server 10.3.153.221:81 max_fails=3 fail_timeout=10s;
server 10.3.153.222:81 max_fails=3 fail_timeout=10s;
}
server {
server_name *.cedarhd.com;
location / {
proxy_pass http://default_backend_traefik;
proxy_set_header Host $http_host;
proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
}
}
[root@test-master ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@test-master ~]# nginx -s reload
#备注,在DNS主机上把test-traefik.cedarhd.com的域名解释到VIP地址(10.3.153.240)上。
原创文章,作者:kepupublish,如若转载,请注明出处:https://blog.ytso.com/183545.html