K8S 之 服务暴露Ingress Traefik 安装

一、POD服务暴露Ingress Traefik的理解

二、Ingress 数据流向

三、Ingress Traefik安装

在运维主机上运行

[root@test-operator traefik]# cd /data/k8s-yaml/k8s-yaml]# mkdir traefikk8s-yaml]# cd traefik/traefik]# docker pull traefik:v1.7.2-alpinetraefik]# docker images|grep traefiktraefik]# docker tag add5fac61ae5 traefik]# harbor.od.com/public/traefik:v1.7.2traefik]# docker push test-harbor.cedarhd.com/public/traefik:v1.7.2#创建四个资源配置清单traefik]# vi rbac.yamlapiVersion: v1kind: ServiceAccountmetadata:  name: traefik-ingress-controller  namespace: kube-system---apiVersion: rbac.authorization.k8s.io/v1beta1kind: ClusterRolemetadata:  name: traefik-ingress-controllerrules:  - apiGroups:      - ""    resources:      - services      - endpoints      - secrets    verbs:      - get      - list      - watch  - apiGroups:      - extensions    resources:      - ingresses    verbs:      - get      - list      - watch---kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1beta1metadata:  name: traefik-ingress-controllerroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: traefik-ingress-controllersubjects:- kind: ServiceAccount  name: traefik-ingress-controller  namespace: kube-system------------------------------------------------------------------------------------------traefik]# vi ds.yamlapiVersion: extensions/v1beta1kind: DaemonSetmetadata:  name: traefik-ingress  namespace: kube-system  labels:    k8s-app: traefik-ingressspec:  template:    metadata:      labels:        k8s-app: traefik-ingress        name: traefik-ingress    spec:      serviceAccountName: traefik-ingress-controller      terminationGracePeriodSeconds: 60      containers:      - image: test-harbor.cedarhd.com/public/traefik:v1.7.2        name: traefik-ingress        ports:        - name: controller          containerPort: 80          hostPort: 81        - name: admin-web          containerPort: 8080        securityContext:          capabilities:            drop:            - ALL            add:            - NET_BIND_SERVICE        args:        - --api        - --kubernetes        - --logLevel=INFO        - --insecureskipverify=true        - --kubernetes.endpoint=https://10.3.153.240:7443        - --accesslog        - --accesslog.filepath=/var/log/traefik_access.log        - --traefiklog        - --traefiklog.filepath=/var/log/traefik.log        - --metrics.prometheus------------------------------------------------------------------------------------------traefik]# vi svc.yamlkind: ServiceapiVersion: v1metadata:  name: traefik-ingress-service  namespace: kube-systemspec:  selector:    k8s-app: traefik-ingress  ports:    - protocol: TCP      port: 80      name: controller    - protocol: TCP      port: 8080      name: admin-web------------------------------------------------------------------------------------------traefik]# vi ingress.yamlapiVersion: extensions/v1beta1kind: Ingressmetadata:  name: traefik-web-ui  namespace: kube-system  annotations:    kubernetes.io/ingress.class: traefikspec:  rules:  - host: test-traefik.cedarhd.com    http:      paths:      - path: /        backend:          serviceName: traefik-ingress-service          servicePort: 8080

在任意运算节点主机上运行

[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/rbac.yamlserviceaccount/traefik-ingress-controller createdclusterrole.rbac.authorization.k8s.io/traefik-ingress-controller createdclusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/ds.yamldaemonset.extensions/traefik-ingress created[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/svc.yamlservice/traefik-ingress-service created[root@test-nodes1 ~]# kubectl apply -f http://k8s-yaml.cedarhd.com/traefik/ingress.yamlingress.extensions/traefik-web-ui created[root@test-nodes1 ~]# systemctl restart docker.service      #重启两台运算节点的docker[root@test-nodes2 ~]# kubectl get pods -n kube-system     #检查运行情况NAME                       READY   STATUS    RESTARTS   AGEcoredns-6c69fbcc6c-6vqgr   1/1     Running   0          18htraefik-ingress-44ptk      1/1     Running   0          22mtraefik-ingress-vrvr4      1/1     Running   0          22m

四、分别在master/standby proxy做域名解释跳转

[root@test-master ~]# vi /etc/nginx/conf.d/cedarhd.com.confupstream default_backend_traefik {    server 10.3.153.221:81    max_fails=3 fail_timeout=10s;    server 10.3.153.222:81    max_fails=3 fail_timeout=10s;}server {    server_name *.cedarhd.com;    location / {        proxy_pass http://default_backend_traefik;        proxy_set_header Host       $http_host;        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;    }}[root@test-master ~]# nginx -tnginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful[root@test-master ~]# nginx -s reload#备注，在DNS主机上把test-traefik.cedarhd.com的域名解释到VIP地址(10.3.153.240)上。