![](/img/trans.png)
[英]Traefik ignores IngressRoute and Ingress resources in k8s
[英]Unable to Access Traefik Dashboard or K8s Services on DigitalOcean K8s using Traefik's IngressRoute CRD
我正在使用 DigitalOcean 的托管服務上的 K8s,並且只是嘗試設置非常基礎的內容以使其正常工作。
據我所知,我可以確認事情正在設置中,因為我在以下配置聲明中擁有它們,但是在訪問 Traefik 用於測試功能甚至訪問 Traefik 的示例“whoami”pod 的服務時遇到問題儀表板。
使用kubectl proxy
時,我使用http://localhost:8001/api/v1/namespaces/default/services/http:traefik:8080/proxy/dashboard/#/
嘗試訪問 Traefik Dashboard,它“響應”,但只給出一個空白頁。
在 Traefik pod 的日志中,只有以下內容:
time="2019-11-04T00:44:49Z" level=info msg="Configuration loaded from flags."
time="2019-11-04T00:44:58Z" level=error msg="Unable to obtain ACME certificate for domains \"<myDomain>\": unable to generate a certificate for the domains [<myDomain>]: acme: Error -> One or more domains had a problem:\n[<myDomain>] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Connection refused, url: \n" rule="Host(`<myDomain>`) && PathPrefix(`/tls`)" routerName=default-ingressroutetls-2c388d38f54b2bf1bbe2 providerName=default.acme
稍后我將研究 Let's Encrypt 問題,因為現在我專注於在基本層面上實現此功能。
嘗試訪問 WhoAmI 服務時,在http://<myDomain>/notls
,我得到ERR_CONNECTION_REFUSED
(Brave/Chrome)
traefik.yaml
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutes.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRoute
plural: ingressroutes
singular: ingressroute
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutetcps.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteTCP
plural: ingressroutetcps
singular: ingressroutetcp
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: middlewares.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: Middleware
plural: middlewares
singular: middleware
scope: Namespaced
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsoptions.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSOption
plural: tlsoptions
singular: tlsoption
scope: Namespaced
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.containo.us
resources:
- middlewares
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- ingressroutes
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- ingressroutetcps
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- tlsoptions
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: default
---
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: default
name: traefik-ingress-controller
---
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
namespace: default
name: traefik
labels:
app: traefik
spec:
replicas: 1
selector:
matchLabels:
app: traefik
template:
metadata:
labels:
app: traefik
spec:
serviceAccountName: traefik-ingress-controller
containers:
- name: traefik
image: traefik:v2.0
imagePullPolicy: Always
args:
- --api.insecure
- --accesslog
- --entrypoints.web.Address=:80
- --entrypoints.websecure.Address=:443
- --providers.kubernetescrd
- --certificatesresolvers.default.acme.tlschallenge
- --certificatesresolvers.default.acme.email=<myEmail>
- --certificatesresolvers.default.acme.storage=acme.json
ports:
- name: web
containerPort: 80
- name: websecure
containerPort: 443
- name: admin
containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
name: traefik
spec:
ports:
- protocol: TCP
name: web
port: 8000
- protocol: TCP
name: admin
port: 8080
- protocol: TCP
name: websecure
port: 4443
selector:
app: traefik
whoami.yaml
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
namespace: default
name: whoami
labels:
app: whoami
spec:
replicas: 2
selector:
matchLabels:
app: whoami
template:
metadata:
labels:
app: whoami
spec:
containers:
- name: whoami
image: containous/whoami
ports:
- name: web
containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: whoami
spec:
ports:
- protocol: TCP
name: web
port: 80
selector:
app: whoami
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: simpleingressroute
spec:
entryPoints:
- web
routes:
- match: Host(`<myDomain>`) && PathPrefix(`/notls`)
kind: Rule
services:
- name: whoami
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ingressroutetls
spec:
entryPoints:
- websecure
routes:
- match: Host(`<myDomain>`) && PathPrefix(`/tls`)
kind: Rule
services:
- name: whoami
port: 80
tls:
certResolver: default
任何幫助將不勝感激,在此先感謝您!!
我可以猜到幾件事可以幫助你...
我將首先擺脫您正在使用的浮動 IP,然后通過將服務創建為“LoadBalancer”類型來為 Traefik 服務分配一個外部 IP,如下所示:
apiVersion: v1
kind: Service
metadata:
name: traefik
spec:
ports:
- protocol: TCP
name: web
port: 80
- protocol: TCP
name: websecure
port: 443
selector:
app: traefik
type: LoadBalancer
status:
loadBalancer: {}
該服務需要幾秒鍾才能獲得外部 ip 地址。 使用“kubectl get all”查看“EXTERNAL-IP”列下的狀態。 最后,這就是你想要做的,不是嗎? 將 Treafik 配置為負載均衡器? 所以所有指向和通過服務本身的外部流量都是有意義的,不是嗎?
您看到的錯誤應該可以通過將以下參數更改/添加到 Traefik 部署來解決:
- --certificatesresolvers.default.acme.tlschallenge=true
- --certificatesresolvers.default.acme.httpChallenge.entryPoint=web
- --api.dashboard=true (needed for the API route to work)
然后,創建到 Traefik API 的路由。 指向 API 的路由看起來像這樣(至少我是這樣做的):
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard
spec:
entryPoints:
- web
routes:
- match: Host(`traefik.domain.com`)
kind: Rule
services:
- name: api@internal
kind: TraefikService
我會說先試試這些,然后把 TLS 證書留到以后。
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.