Kubernetes Ingress 不适用于 Traefik 和 TLS答案

【问题标题】：Kubernetes Ingress not working with Traefik and TLSKubernetes Ingress 不适用于 Traefik 和 TLS
【发布时间】：2021-08-07 18:24:43
【问题描述】：

我正在尝试让一些东西在 K8s（裸机上的 Ubuntu 20.04 上的 1.21.0）上运行，并且可能缺少一些简单的东西。我已经使用他们的 helm chart (9.19.1) 和以下值文件安装了 Traefik (2.4.8)：

deployment:
  kind: DaemonSet

dashboard:
  enabled: true

hostNetwork: true
ports:
  web:
    port: 80
  websecure:
    port: 443

securityContext:
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  readOnlyRootFilesystem: true
  runAsGroup: 0
  runAsNonRoot: false
  runAsUser: 0

additionalArguments:
  - "--log.level=DEBUG"

我可以通过 ssh 隧道进入并查看 Traefik 仪表板。我安装了 httpbin 来测试一些东西：

kind: Service
metadata:
  name: httpbin
  namespace: default
spec:
  selector:
    app: httpbin
  ports:
    - port: 8080
      protocol: TCP
      targetPort: 80
---
apiVersion: v1
kind: Pod
metadata:
  name: httpbin
  namespace: default
  labels:
    app: httpbin
spec:
  containers:
    - image: kennethreitz/httpbin:latest
      name: httpbin
      ports:
        - containerPort: 80
          protocol: TCP

我用我的证书（一个真正的 *.brandseye.com 证书）和一个 Ingress 创建了一个秘密：

kind: Ingress
metadata:
  name: test-ingress
  namespace: default
spec:
  tls:
    - hosts:
        - aragorn.brandseye.com
      secretName: brandseye-com-cert
  rules:
    - host: aragorn.brandseye.com
      http:
        paths:
          - path: /get
            pathType: Exact
            backend:
              service:
                name: httpbin
                port:
                  number: 8080

现在我可以访问：http://aragorn.brandseye.com/get，它可以工作了。但是 https://aragorn.brandseye.com/get 给出了 404。使用了正确的证书。

Traefik 看起来不错：

time="2021-05-18T13:35:38Z" level=debug msg="Configuration received from provider kubernetes: {\"http\":{\"routers\":{\"test-ingress-default-aragorn-brandseye-com-get\":{\"service\":\"default-httpbin-8080\",\"rule\":\"Host(`aragorn.brandseye.com`) \\u0026\\u0026 Path(`/get`)\"}},\"services\":{\"default-httpbin-8080\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://172.20.1.9:80\"}],\"passHostHeader\":true}}}},\"tcp\":{},\"tls\":{}}" providerName=kubernetes
time="2021-05-18T13:35:38Z" level=debug msg="No entryPoint defined for this router, using the default one(s) instead: [web websecure]" routerName=test-ingress-default-aragorn-brandseye-com-get
time="2021-05-18T13:35:38Z" level=debug msg="No store is defined to add the certificate MIIGkDCCBXigAwIBAgIQCYfAPbF1vuf5b72JgcBPEDANBgkqhk, it will be added to the default store."
time="2021-05-18T13:35:38Z" level=debug msg="Adding certificate for domain(s) *.brandseye.com,brandseye.com"
time="2021-05-18T13:35:38Z" level=debug msg="No default certificate, generating one"
time="2021-05-18T13:35:38Z" level=debug msg="Added outgoing tracing middleware ping@internal" middlewareType=TracingForwarder entryPointName=traefik routerName=ping@internal middlewareName=tracing
time="2021-05-18T13:35:38Z" level=debug msg="Added outgoing tracing middleware api@internal" routerName=kube-system-traefik-dashboard-d012b7f875133eeab4e5@kubernetescrd entryPointName=traefik middlewareName=tracing middlewareType=TracingForwarder
time="2021-05-18T13:35:38Z" level=debug msg="Added outgoing tracing middleware api@internal" middlewareType=TracingForwarder entryPointName=traefik routerName=traefik-traefik-dashboard-d012b7f875133eeab4e5@kubernetescrd middlewareName=tracing
time="2021-05-18T13:35:38Z" level=debug msg="Creating middleware" entryPointName=traefik middlewareName=traefik-internal-recovery middlewareType=Recovery
time="2021-05-18T13:35:38Z" level=debug msg="Creating middleware" serviceName=default-httpbin-8080 middlewareName=pipelining middlewareType=Pipelining entryPointName=web routerName=test-ingress-default-aragorn-brandseye-com-get@kubernetes
time="2021-05-18T13:35:38Z" level=debug msg="Creating load-balancer" routerName=test-ingress-default-aragorn-brandseye-com-get@kubernetes serviceName=default-httpbin-8080 entryPointName=web
time="2021-05-18T13:35:38Z" level=debug msg="Creating server 0 http://172.20.1.9:80" serviceName=default-httpbin-8080 serverName=0 entryPointName=web routerName=test-ingress-default-aragorn-brandseye-com-get@kubernetes
time="2021-05-18T13:35:38Z" level=debug msg="Added outgoing tracing middleware default-httpbin-8080" middlewareType=TracingForwarder entryPointName=web routerName=test-ingress-default-aragorn-brandseye-com-get@kubernetes middlewareName=tracing
time="2021-05-18T13:35:38Z" level=debug msg="Creating middleware" entryPointName=web middlewareName=traefik-internal-recovery middlewareType=Recovery
time="2021-05-18T13:35:38Z" level=debug msg="Creating middleware" entryPointName=websecure middlewareName=traefik-internal-recovery middlewareType=Recovery
time="2021-05-18T13:35:38Z" level=debug msg="No default certificate, generating one"

有什么想法吗？发送。

如果我查看 Traefik Dashboard 上的路由器详细信息，TLS 块中没有任何内容似乎不正确：

【问题讨论】：

好吧，我很容易使用 ingress-nginx，所以 Traefik 被抛弃了

标签： ssl kubernetes kubernetes-ingress traefik traefik-ingress

【解决方案1】：

我不知道这是否会帮助你。但是我的配置像这样运行良好。

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: laznp-www-ingress-route
  namespace: wordpress
spec:
  entryPoints:
    - websecure
routes:
  - match: Host(`laznp.id`)
    kind: Rule
    services:
      - name: laznp-www-svc
        port: 80
tls: {}

我使用来自 Traefik CRD 的 IngressRoute 类型，希望对您有所帮助。

【讨论】：