# TKE上部署treafik2

腾讯云上有默认的提供的ingress服务，如果你不想用提供的，想用最新的treafik来暴露服务通过域名访问也是可以的,下面我们来部署操作下。

## 创建LB负载到集群中

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fd937fb6ca127e7cc4ee0b73ca3eb73c677f384a1.png?generation=1606373410297758\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F894942e0abf79daa3281ed0b59f4d35302f4ee60.png?generation=1606373410486253\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fdd3ff1ebf25c496ba942c6a1b6b19b03272f9038.png?generation=1606373413506978\&alt=media)

网络类型选择公网，域名需要解析到公网ip

网络选择私有网络，集群所在的vpc

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F43826ab6965ad5104499230a6ef6897edaa19b65.png?generation=1606373411254288\&alt=media)

在你购买的域名中解析到该VIP上，我这边是解析了\*.tx.niewx.ciub

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F3ea1a1cc6a7bf0d1972b48d3c26fba3e5a1044c9.png?generation=1606373412523366\&alt=media)

添加监听器

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F348b2fe7ae93e3e8b5c8dfd954e78a73ff0c6641.png?generation=1606373410764584\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F6af876064ea1778eb0eabc5629ebec3c78ad17d5.png?generation=1606373410886412\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fd4ec408a21330853b1458a8aeda1f4a3ff1871e5.png?generation=1606373413018983\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F577bc06c803dda0024dff8a560565307e8c56ee9.png?generation=1606373412928423\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fe0296037e9d2b3479af70dd6e1ac89213d7ae291.png?generation=1606373411481545\&alt=media)

绑定后端服务器，我们这里绑定的端口为30183,这个端口是k8s集群暴露treafik2的服务端口

## 创建treafik命名空间来部署服务

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F5f01cc17ea69be857254a006aa8485caac5cdbd4.png?generation=1606373411844406\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fccd401d7e516ece0b86a2ada7bd57790d8af8265.png?generation=1606373412428003\&alt=media)

## 部署treafik服务

以下部署，如果在TKE的控制台无法部署yaml，可以通过kubectl来部署对应的yaml文件

### 首先自定义资源类型

```
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutes.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRoute
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutetcps.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRouteTCP
    plural: ingressroutetcps
    singular: ingressroutetcp
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: middlewares.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: Middleware
    plural: middlewares
    singular: middleware
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tlsoptions.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TLSOption
    plural: tlsoptions
    singular: tlsoption
  scope: Namespaced
```

### 配置rbac权限

```
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: treafik
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.containo.us
    resources:
      - middlewares
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutetcps
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - tlsoptions
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: treafik
```

### 部署treafik

```
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: traefik
  namespace: treafik
  labels:
    k8s-app: traefik-ingress-lb
spec:
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
      - image: traefik:v2.0
        name: traefik-ingress-lb
        ports:
        - name: web
          containerPort: 80
          hostPort: 80
        - name: websecure
          containerPort: 443
          hostPort: 443
        - name: admin
          containerPort: 8080
        args:
        - --entrypoints.web.Address=:80
        - --entrypoints.websecure.Address=:443
        - --api.insecure=true
        - --providers.kubernetescrd
        - --api
        - --api.dashboard=true
        - --accesslog

---

kind: Service
apiVersion: v1
metadata:
  name: traefik
  namespace: treafik
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 8080
      name: admin
  type: NodePort
```

### 配置域名规则

```
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-webui
  namespace: treafik
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`traefik2.tx.niewx.club`)
    kind: Rule
    services:
    - name: traefik
      port: 8080

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: prometheus-webui
  namespace: kube-ops
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`prometheus.tx.niewx.club`)
    kind: Rule
    services:
    - name: prometheus
      port: 9090

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: grafana-webui
  namespace: kube-ops
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`grafana.tx.niewx.club`)
    kind: Rule
    services:
    - name: grafana
      port: 3000
```

这里我们暴露我们之前已经部署好的服务。

### 添加treafik服务端口

因为之前的svc只暴露了8080,我们需要暴露treafik的80和443端口，这样lb才能负载到对应的服务上

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fa19dfbefb5f2ca2ea14bd17bc2f98e8a62f832c1.png?generation=1606373411817251\&alt=media)

我们直接在treafik的svc上添加2条映射即可，也可以在最开始的yaml中直接设置好。

## 通过域名访问集群服务

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fd4e02f3321b80e7dae7cc39cfb8a60fca9e4b089.png?generation=1606373413343421\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Faf9a31d4daa357a304f73db988756cbde60ea4c3.png?generation=1606373412379171\&alt=media)

## 设置treafik的basic auth认证

有的时候我们的服务自身没有设置鉴权，任何人可以直接登录界面，这样是不安全的，treafik2提供的中间来解决这个问题，我们一般访问treafik界面是不需要密码的，下面我们给treafik来设置一个访问账号密码

### 采用htpasswd创建文件

```
htpasswd -bc auth admin admin
```

### 创建secret

```
kubectl create secret generic nginx-basic-auth --from-file=auth -n treafik
```

### 定义Basic Auth中间件

```
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: secured
  namespace: treafik
spec:
  chain:
    middlewares:
    - name: auth-users

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: auth-users
  namespace: treafik
spec:
  basicAuth:
    secret: nginx-basic-auth # 兼容 K8S secrets 对象
```

### Ingress中应用中间件

```
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-webui
  namespace: treafik
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`traefik2.tx.niewx.club`)
    kind: Rule
    services:
    - name: traefik
      port: 8080
    middlewares:
      - name: secured
```

### 通过域名访问需要登录才行

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2Fb50c603efcf23f5dddc080e512cda57160079164.png?generation=1606373412629101\&alt=media)

![upload-image](https://1743139827-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMy-ccvHJYp-MpGyagk%2Fsync%2F7564ae5f62b409f2da5007ca396fdd16dea946c2.png?generation=1606373417719930\&alt=media)