针对kubernetes的Traefik ipwhitelist中间件示例

Question

我在我的kubernetes（1.14）集群中使用Traefik的IPWhitelist中间件时遇到了麻烦。

我从这里使用DaemonSet配置：

https://docs.traefik.io/user-guide/kubernetes/

我想将此白名单应用于群集中的所有流量。

• 如何适用于所有流量？
• 我可以使用注释而不是IngressRoute吗？
• 我错过了一个例子或文件吗？

谢谢！

这是我到目前为止所拥有的：

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: middlewares.traefik.containo.us
spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: Middleware
    plural: middlewares
    singular: middleware
  scope: Namespaced
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: cloudflare-whitelist
spec:
  ipWhiteList:
    sourceRange:
    - 2400:cb00::/32
    ...
    - 131.0.72.0/22
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: allup
  annotations:
    traefik.frontend.rule.type: PathPrefixStrip
spec:
  tls:
    - secretName: cloudflare-tls-cert
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            backend:
              serviceName: app-www-service
              servicePort: http
    - host: stuff.example.com
      http:
        paths:
          - path: /
            backend:
              serviceName: app-stuff-service
              servicePort: http
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: cloudflare-whitelist
  namespace: ingress
spec:
  entryPoints:
    - web  # <- what is this for?
  routes:
    - match: Host(`example.com`)  # <- Howto apply to all ingress?
      kind: Rule
      middlewares:
        - name: cloudflare-whitelist
    - match: Host(`stuff.example.com`)
      kind: Rule
      middlewares:
        - name: cloudflare-whitelist

• 如何适用于所有流量？
• 我可以使用注释而不是IngressRoute吗？
• 我错过了一个例子或文件吗？

谢谢！

Answer 1

好的，这是我发现的，来自Traefik Slack的有用窥视。 上面的代码适用于仍在Alpha中的Traefik v2.0。

对于Traefik 1.7（当我写这篇文章时， Kubernetes指南中引用的当前版本 ）

对于1.7，使用常规注释

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: allup
  annotations:
    traefik.ingress.kubernetes.io/whitelist-source-range: "2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32, 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32, 173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/15, 104.16.0.0/12, 172.64.0.0/13, 131.0.72.0/22"
spec:
  tls:
    - secretName: cloudflare-tls-cert
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            backend:
              serviceName: app-www-service
              servicePort: http