[TOC] # 二進制安裝 ## 下載traefik包 ```shell curl -L -o /usr/local/src/traefik_v2.10.4_linux_amd64.tar.gz https://github.com/traefik/traefik/releases/download/v2.10.4/traefik_v2.10.4_linux_amd64.tar.gz ``` ## 解壓traefik ```shell mkdir -p /app/traefik/{config/{dynamic,k8s-crd-rbac},pki,logs} tar xvf /usr/local/src/traefik_v2.10.4_linux_amd64.tar.gz -C /app/traefik/ ``` ## 可選：k8s創建crd及rbac資源 >[info] 說明: `traefik` 自動發現(providers) `kubernetesIngress` 和 `Kubernetes IngressRoute(kubernetesCRD)` 有配置才需要執行以下步驟 ```bash cd /app/traefik/config/k8s-crd-rbac curl -O https://raw.githubusercontent.com/traefik/traefik/v2.10/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml curl -O https://raw.githubusercontent.com/traefik/traefik/v2.10/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml kubectl apply -f ./kubernetes-crd-definition-v1.yml kubectl apply -f ./kubernetes-crd-rbac.yml kubectl create sa traefik-ingress-controller kubectl describe secret `kubectl describe sa traefik-ingress-controller | awk '/Tokens/ {print $2}'` ``` ## traefik 配置文件 ```yaml # 全局配置 global: checkNewVersion: true sendAnonymousUsage: true # Entrypoints 配置 # web，webSecurity 是Entrypoints名稱，可以自定義名稱。推薦使用 web，webSecurity # 注意：traefik, metrics 是內建Entrypoints名稱。 entryPoints: web: address: ":80" webSecurity: address: ":443" traefik: address: ":9000" metrics: address: ":9100" # traefik日志設置 # https://doc.traefik.io/traefik/observability/logs/ log: filePath: "/app/traefik/logs/traefik.log" format: json level: DEBUG # 業務訪問日志設置 # https://doc.traefik.io/traefik/observability/access-logs/ accessLog: filePath: "/app/traefik/logs/access.log" # 異步寫入日志，Traefik 在將日志行寫入所選輸出之前將保留在內存中的數量 bufferingSize: 100 format: json fields: defaultMode: keep names: StartUTC: drop # ClientAddr: drop # traefik動態發現的提供商 # https://doc.traefik.io/traefik/providers/overview/ providers: file: directory: "/app/traefik/config/dynamic" watch: true kubernetesIngress: endpoint: "https://192.168.32.182:6443" certAuthFilePath: "/app/traefik/pki/ca.crt" # 使用 kubernetes 根證書 token: "" # 上面創建的sa對應的token值 kubernetesCRD: endpoint: "https://192.168.32.182:6443" certAuthFilePath: "/app/traefik/pki/ca.crt" # 使用 kubernetes 根證書 token: "" # 上面創建的sa對應的token值 api: # 啟動dashboard頁面 dashboard: true # 非安全訪問 dashboard 頁面，生產環境不建議開啟 # insecure: true # 健康檢查 ping: true # traefik metrics數據 metrics: prometheus: entryPoint: metrics ``` ## 創建 systemd 服務文件 ```shell cat <<'EOF' | sudo tee /usr/lib/systemd/system/traefik.service >> /dev/null [Unit] Description=traefik Server Documentation=https://doc.traefik.io/traefik/ Wants=network.service After=network.service [Service] Type=simple ExecStart=/app/traefik/traefik --configfile /app/traefik/config/traefik.yml Restart=on-failure [Install] WantedBy=multi-user.target EOF ``` ## 啟動traefik服務 ```shell systemctl daemon-reload systemctl start traefik.service ``` ## 訪問 dashboard 頁面 ### 非安全訪問 1. 在 traefik 配置文件中，`api` 字段下添加一對 `insecure: true` 的配置。 2. 重啟 traefik 服務。 3. 使用 http://{traefik ip}:{traefik port} 訪問，{traefik port} 默認是 `8080` 端口  ### 安全訪問 1. 在 k8s 集群添加 `IngressRoute` 資源 ```yaml cat <<- 'EOF' | kubectl apply -f - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: dashboard spec: entryPoints: - web routes: - match: PathPrefix(`/dashboard`) || PathPrefix(`/api`) kind: Rule services: - name: api@internal kind: TraefikService EOF ``` 2. 訪問 `http://{traefik web}:{traefik web port}/dashboard/` 地址 >[danger] 注意：path路徑必須是 `/dashboard/` , 否則拋出 `404 page not found` 異常  # helm 安裝