每个 Kubernetes Traefik 入口路由的 mTLS (clientAuth)

Question

I have multiple services with working ingress routes using traefik 2.6

All ingress routes work as expected using annotations and I get no errors showing when applying the configuration with args regarding file provider to "dynamic.yml" After checking in the pod itself, traefik is running with the correct arguments and that the dynamic.conf file and cert.pem are mounted correctly.

#dynamic.yml
tls:
  options:
    default:
      clientAuth:
        caFiles:
          - /opt/traefik/cert.pem
        clientAuthType: RequireAndVerifyClientCert

The configurations above applies the tls options to all ingress routes.

When applying the following ingress annotations for the service, clients do not get prompted for certs:

Changing the configuration to the following:

#dynamic.yml
tls:
  options:
    mtls:
      clientAuth:
        caFiles:
          - /opt/traefik/cert.pem
        clientAuthType: RequireAndVerifyClientCert

...
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/tls.options: mtls
...

The ingress routes function, however, clients are able to view the site without certificate authentication on the specific ingress route with tls.option "mtls".

Answer 1

在这里找到答案： https ://doc.traefik.io/traefik/routing/providers/kubernetes-ingress/#annotations

traefik.ingress.kubernetes.io/router.tls.options: foobar@file