阿里云的ACK默認只提供了3個Ingress Controller組件的自動安裝，分別是ALB Ingress Controller、MSE Ingress Controller和Nginx Ingress Controller。
當我們想使用Traefik Ingress Controller時，只能自己手動部署。
Traefik 官方文檔也提供了安裝方法，通過Helm Chart方式部署到Kubernetes集群，安裝步驟：
要求
Kubernetes 1.16+
安裝了Helm 版本 3.9+
將 Traefik Labs 圖表存儲庫添加到 Helm：
helm repo add traefik https://traefik.github.io/charts
您可以通過運行以下命令來更新圖表存儲庫：
helm repo update
helm并使用命令行安裝它：
helm install traefik traefik/traefik
當然實際安裝的時候，還需要根據自己的需求設置參數。
這種方式是比較簡單的，但是對于我們需要更深入的了解Traefik Ingress Controller的人來說，可能這種方式太過簡單。
所以我這里采用CRD的方式安裝配置Traefik Ingress Controller
Traefik的路由方式有兩種，一種是傳統的Ingress一種是IngressRoute，這里部署讓兩種方式都支持。
1、部署crd，由于文件比較大，這里直接使用GitHub的文件連接
kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.9/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
2、部署rbac
kubectl apply -f rbac.yaml
rbac.yaml：
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: traefik-ingress-controller rules: - apiGroups: - "" resources: - services - endpoints - secrets verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses - ingressclasses verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses/status verbs: - update - apiGroups: - traefik.containo.us resources: - middlewares - middlewaretcps - ingressroutes - traefikservices - ingressroutetcps - ingressrouteudps - tlsoptions - tlsstores - serverstransports verbs: - get - list - watch --- # 為 Traefik 創建一個專用服務帳戶 apiVersion: v1 kind: ServiceAccount metadata: namespace: default name: traefik-account --- # 將角色綁定到帳戶上 將權限和規則應用到帳戶上 apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: traefik-ingress-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controller subjects: - kind: ServiceAccount name: traefik-account namespace: default
3、部署IngressClass（可選）
kubectl apply -f ingressClass.yaml
ingressClass.yaml:
apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: name: traefik-lb spec: controller: traefik.io/ingress-controller
4、部署traefik，這里采用DaemonSet，也可以采用Deployment
kubectl apply -f traefik-daemonset.yaml
traefik-daemonset.yaml:
--- apiVersion: v1 kind: Service metadata: name: traefik-ingress-lb labels: app: traefik annotations: service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: lb-xxxxx # 阿里云slb id，需要提前創建一個 service.beta.kubernetes.io/alicloud-loadbalancer-force-override-listeners: 'true' #創建監聽 spec: # type: NodePort type: LoadBalancer ports: - name: http protocol: TCP port: 80 targetPort: 80 # nodePort: 30080 #NodePort方式時，建議固定端口 - name: https port: 443 targetPort: 443 # nodePort: 30433 protocol: TCP selector: app: traefik --- kind: DaemonSet apiVersion: apps/v1 metadata: namespace: default name: traefik-ingress-controller labels: app: traefik spec: selector: matchLabels: app: traefik template: metadata: labels: app: traefik spec: serviceAccountName: traefik-account containers: - name: traefik image: traefik:v2.9 args: - --api.insecure - --accesslog - --entrypoints.web.Address=:80 - --entrypoints.websecure.Address=:443 - --providers.kubernetescrd=true - --providers.kubernetesingress=true - --providers.kubernetesingress.ingressclass=traefik-lb - --providers.kubernetesingress.ingressendpoint.ip=xx.xx.xx.xx # - --providers.kubernetesingress.ingressendpoint.hostname=alb-xxxx.cn-chengdu.alb.aliyuncs.com - --certificatesresolvers.default.acme.tlschallenge - --certificatesresolvers.default.acme.email=foo@you.com - --certificatesresolvers.default.acme.storage=acme.json - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory ports: - name: web containerPort: 80 - name: websecure containerPort: 443 - name: admin containerPort: 8080 resources: limits: cpu: 1000m memory: 512Mi requests: cpu: 50m memory: 128Mi readinessProbe: initialDelaySeconds: 5 periodSeconds: 10 timeoutSeconds: 1 failureThreshold: 5 tcpSocket: port: 80 livenessProbe: initialDelaySeconds: 120 periodSeconds: 5 timeoutSeconds: 2 failureThreshold: 3 tcpSocket: port: 80
5、公開traefik dashboard，實際使用中，建議加上登錄認證。
kubectl apply -f traefik-admin.yaml
traefik-admin.yaml:
--- apiVersion: v1 kind: Service metadata: name: traefik-admin spec: ports: - protocol: TCP name: admin port: 80 targetPort: 8080 selector: app: traefik --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: admin-ingress annotations: traefik.ingress.kubernetes.io/router.entrypoints: web spec: ingressClassName: traefik-lb rules: - host: dashboard.amd5.cn http: paths: - path: / pathType: Prefix backend: service: name: traefik-admin port: number: 80
6、部署官方的whoami服務，驗證IngressRoute路由。
kubectl apply -f whoami.yaml
whoami.yaml:
kind: Deployment apiVersion: apps/v1 metadata: name: whoami labels: app: whoami spec: replicas: 2 selector: matchLabels: app: whoami template: metadata: labels: app: whoami spec: containers: - name: whoami image: traefik/whoami ports: - name: web containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: whoami spec: selector: app: whoami ports: - name: web port: 80 targetPort: 80 --- apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: whoami spec: entryPoints: - web routes: - match: Host(`whoami.amd5.cn`) && PathPrefix(`/`) kind: Rule services: - name: whoami port: 80
7、部署兩個nginx服務，驗證Ingress路由。
kubectl apply -f nginx.yaml
nginx.yaml:
apiVersion: apps/v1 kind: Deployment metadata: name: coffee spec: replicas: 2 selector: matchLabels: app: coffee template: metadata: labels: app: coffee spec: containers: - name: coffee image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: coffee-svc spec: ports: - port: 80 targetPort: 80 protocol: TCP selector: app: coffee --- apiVersion: apps/v1 kind: Deployment metadata: name: tea spec: replicas: 1 selector: matchLabels: app: tea template: metadata: labels: app: tea spec: containers: - name: tea image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: tea-svc spec: ports: - port: 80 targetPort: 80 protocol: TCP selector: app: tea --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: coffee-ingress annotations: traefik.ingress.kubernetes.io/router.entrypoints: web spec: ingressClassName: "traefik-lb" rules: - host: coffee.amd5.cn http: paths: - path: / pathType: Prefix backend: service: name: coffee-svc port: number: 80 --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: tea-ingress annotations: traefik.ingress.kubernetes.io/router.entrypoints: web spec: ingressClassName: "traefik-lb" rules: - host: tea.amd5.cn http: paths: - path: / pathType: Prefix backend: service: name: tea-svc port: number: 80
查看部署結果：
測試訪問dashboard:
測試訪問whoami:
測試訪問nginx：
