Traefik & CRD & Let's Encrypt¶
Traefik 在 Kubernetes 中通过自定义资源对象(CRD)实现 IngressRoute, 通过 Let's Encrypt 实现 TLS。
本文档旨在作为一个完整的示例,演示如何在 Kubernetes 使用 IngressRoute Custom Resource 实现动态配置并使用 Let's Encrypt 设置 TLS 。 但是,为了简单起见,我们在 Kubernetes 集群设置中使用了 k3s docker 镜像。
请注意,对于此设置,鉴于我们将使用 ACME 的 TLS-ALPN-01 挑战,将在其上运行的主机必须能够在端口443上接收来自外部的连接。当然主机对应的 IP 地址必须和你打算使用的域名匹配。
接下来,可以通过两种不同的方式将 YAML 配置文件中定义的 Kubernetes 资源应用于设置:
- 第一种方式,通常情况下直接简单的使用
kubectl apply
命令。 - 第二种方式, 在本教程中可以使用,直接将文件放在 k3s 镜像中 (
/var/lib/rancher/k3s/server/manifests
) 的目录中.
Kubectl 版本
本教程使用的 rancher/k3s
版本是 (0.8.0
), kubectl 版本必须大于等于 1.11
。
k3s Docker-compose 配置¶
我们的起点是 docker-compose 的配置文件,启动 k3s 集群,你可以执行下面命令:
docker-compose -f k3s.yml up
server:
image: rancher/k3s:v0.8.0
command: server --disable-agent --no-deploy traefik
environment:
- K3S_CLUSTER_SECRET=somethingtotallyrandom
- K3S_KUBECONFIG_OUTPUT=/output/kubeconfig.yaml
- K3S_KUBECONFIG_MODE=666
volumes:
# k3s will generate a kubeconfig.yaml in this directory. This volume is mounted
# on your host, so you can then 'export KUBECONFIG=/somewhere/on/your/host/out/kubeconfig.yaml',
# in order for your kubectl commands to work.
- /somewhere/on/your/host/out:/output
# This directory is where you put all the (yaml) configuration files of
# the Kubernetes resources.
- /somewhere/on/your/host/in:/var/lib/rancher/k3s/server/manifests
ports:
- 6443:6443
node:
image: rancher/k3s:v0.8.0
privileged: true
links:
- server
environment:
- K3S_URL=https://server:6443
- K3S_CLUSTER_SECRET=somethingtotallyrandom
volumes:
# this is where you would place a alternative traefik image (saved as a .tar file with
# 'docker save'), if you want to use it, instead of the traefik:v2.0 image.
- /sowewhere/on/your/host/custom-image:/var/lib/rancher/k3s/agent/images
集群资源¶
现在让我们看一下(如果使用 kubectl apply
,则应按照应用的顺序)完整安装过程中所有的必需资源。
IngressRoute 定义¶
首先,定义 IngressRoute
和 Middleware
资源类型。
同时注意 RBAC 授权资源;后面将通过部署 serviceAccountName
引用它们。
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutes.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRoute
plural: ingressroutes
singular: ingressroute
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutetcps.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteTCP
plural: ingressroutetcps
singular: ingressroutetcp
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: middlewares.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: Middleware
plural: middlewares
singular: middleware
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsoptions.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSOption
plural: tlsoptions
singular: tlsoption
scope: Namespaced
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.containo.us
resources:
- middlewares
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- ingressroutes
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- ingressroutetcps
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- tlsoptions
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: default
Services¶
其次是服务。一个是 Traefik 本身,另一个是其路由的应用程序,例如,我们演示的 HTTP 服务器:whoami。
apiVersion: v1
kind: Service
metadata:
name: traefik
spec:
ports:
- protocol: TCP
name: web
port: 8000
- protocol: TCP
name: admin
port: 8080
- protocol: TCP
name: websecure
port: 4443
selector:
app: traefik
---
apiVersion: v1
kind: Service
metadata:
name: whoami
spec:
ports:
- protocol: TCP
name: web
port: 80
selector:
app: whoami
Deployments¶
下一个是部署,例如,服务后端真实的 pods。 同样,一个是 Traefik 的 pod, 另一个是 whoami 应用程序的 pod。
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: default
name: traefik-ingress-controller
---
kind: Deployment
apiVersion: apps/v1
metadata:
namespace: default
name: traefik
labels:
app: traefik
spec:
replicas: 1
selector:
matchLabels:
app: traefik
template:
metadata:
labels:
app: traefik
spec:
serviceAccountName: traefik-ingress-controller
containers:
- name: traefik
image: traefik:v2.0
args:
- --api.insecure
- --accesslog
- --entrypoints.web.Address=:8000
- --entrypoints.websecure.Address=:4443
- --providers.kubernetescrd
- --certificatesresolvers.default.acme.tlschallenge
- --certificatesresolvers.default.acme.email=foo@you.com
- --certificatesresolvers.default.acme.storage=acme.json
# Please note that this is the staging Let's Encrypt server.
# Once you get things working, you should remove that whole line altogether.
- --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
ports:
- name: web
containerPort: 8000
- name: websecure
containerPort: 4443
- name: admin
containerPort: 8080
---
kind: Deployment
apiVersion: apps/v1
metadata:
namespace: default
name: whoami
labels:
app: whoami
spec:
replicas: 2
selector:
matchLabels:
app: whoami
template:
metadata:
labels:
app: whoami
spec:
containers:
- name: whoami
image: containous/whoami
ports:
- name: web
containerPort: 80
端口转发¶
现在,作为上述内容的例外,请注意,您不应让下面的 ingressRoute 资源自动应用于您的集群。原因是,一旦 Traefik 的 ACME 提供者检测到我们有 TLS 路由,它将尝试为域名生成对应的证书。这样是不能成功的,因为我们的 Traefik pod 无法从集群外部访问,这样会导致 ACME TLS 挑战失败。因此,为了整个工作正常进行,我们必须延迟部署 ingressRoute 资源,直到我们正确设置了下一步中的端口转发为止。
kubectl port-forward --address 0.0.0.0 service/traefik 8000:8000 8080:8080 443:4443 -n default
另外,请注意,由于 Linux 上的特权端口的限制,上述命令可能无法监听在端口443上,这已经超出了本文档的范围。在这种情况下,你可以使用一些技巧,例如使用 setcaps
提升 kubectl
的上限,或使用 authbind
,或在主机和 WAN 之间建立NAT。请自寻解决。
Traefik 路由¶
现在,我们终于可以应用的 ingressRoutes,使用如下命令:
kubectl apply -f 04-ingressroutes.yml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: simpleingressroute
namespace: default
spec:
entryPoints:
- web
routes:
- match: Host(`your.domain.com`) && PathPrefix(`/notls`)
kind: Rule
services:
- name: whoami
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ingressroutetls
namespace: default
spec:
entryPoints:
- websecure
routes:
- match: Host(`your.domain.com`) && PathPrefix(`/tls`)
kind: Rule
services:
- name: whoami
port: 80
tls:
certResolver: default
给它几秒钟的时间来完成 ACME TLS 挑战,然后你应该可以从外部访问你的 whoami pod (通过 Traefik 路由)。 使用 TLS 或者不使用 TLS 都可以访问(只是为了好玩,请勿在生产中使用):
curl [-k] https://your.domain.com/tls
curl [-k] http://your.domain.com:8000/notls
注意,只要你使用 Let's Encrypt 的 staging 服务器,你就必须使用 -k
参数,因为它不在跟 DNS 服务器中。
本节翻译作者:@罗立志