【问题标题】：LoadBalancer Healthy Fails when run Traefik in Google Cloud Kubernetes在 Google Cloud Kubernetes 中运行 Traefik 时 LoadBalancer Healthy 失败
【发布时间】：2019-07-08 18:55:48
【问题描述】：

我正在尝试在 Google Cloud Kubernetes 中配置 Traefik，我正在创建一个集群，并使用以下文件配置该集群。

我的代码来自这里：

run.sh

#!/usr/bin/env bash

PROJECT="my-beautiful-project" # Replace This
CLUSTER_NAME="cluster-traefik-x"

# Create Cluster
gcloud container clusters create $CLUSTER_NAME --zone europe-west4-c

# Connect to Cluster:
gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT

# Reserve IPs
gcloud compute addresses create my-web-static-ip-rui --global
gcloud compute addresses create my-web-static-ip-rui-dashboard --global

# Setup Traefik
kubectl apply -f 10-traefik-service-acc.yaml
kubectl apply -f 20-traefik-cr.yaml
kubectl apply -f 30-traefik-crb.yaml

kubectl apply -f 40-traefik-deployment.yaml
kubectl apply -f 50-traefik-svc.yaml

# gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT && kubectl port-forward --namespace kube-system $(kubectl get pod --namespace kube-system --selector="k8s-app=traefik-ingress-lb" --output jsonpath='{.items[0].metadata.name}') 8080:8080 # DASHBOARD
# gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT && kubectl port-forward --namespace kube-system $(kubectl get pod --namespace kube-system --selector="k8s-app=traefik-ingress-lb" --output jsonpath='{.items[0].metadata.name}') 8081:80 # HTTP

kubectl apply -f 60-traefik-webui-svc.yaml
# gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT && kubectl port-forward --namespace kube-system $(kubectl get pod --namespace kube-system --selector="k8s-app=traefik-ingress-lb" --output jsonpath='{.items[0].metadata.name}') 8082:8080 # DASHBOARD

kubectl apply -f 70-traefik-ingress.yaml
kubectl apply -f 75-traefik-ingress-lb-rui.yaml
kubectl apply -f 210-ws-rui-deployment.yaml
kubectl apply -f 220-ws-rui-svc.yaml
kubectl apply -f 230-ws-rui-ingress.yaml

# curl http://127.0.0.1:8081/hello # Should fail
# curl -H host:api.my-domain.com http://127.0.0.1:8081/hello # Returns ok

10-traefik-service-acc.yaml：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress
  namespace: kube-system

20-traefik-cr.yaml

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch

30-traefik-crb.yaml

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress
subjects:
- kind: ServiceAccount
  name: traefik-ingress
  namespace: kube-system

40-traefik-deployment.yaml

kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: traefik-ingress
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress
      terminationGracePeriodSeconds: 60
      containers:
      - image: traefik
        name: traefik-ingress-lb
        ports:
        - name: http
          containerPort: 80 # LOADBALANCER
        - name: admin
          containerPort: 8080 # DASHBOARD
        args:
        - --api
        - --kubernetes
        - --logLevel=DEBUG # INFO | DEBUG

50-traefik-svc.yaml

kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web # LOADBALANCER
    - protocol: TCP
      port: 8080
      name: admin # DASHBOARD
  type: NodePort # -> https://docs.traefik.io/user-guide/kubernetes/
# I read in internet some examples with NodePort and some with LoadBalancer. 
# I think that the most correct is NodePort
#  type: LoadBalancer
#  loadBalancerIP: 130.211.20.21 # Use when type is LoadBalancer # THIS DOES NOT WORK WITH RESERVED IPs

60-traefik-webui-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: traefik-web-ui
  namespace: kube-system
spec:
  type: NodePort
#  type: ClusterIP # ClusterIP is the default ServiceType. The examples that I saw don't have anything, then is ClusterIP by default, but Kubernetes Ingress says: `error while evaluating the ingress spec: service "kube-system/traefik-web-ui" is type "ClusterIP", expected "NodePort" or "LoadBalancer"` then, I choose NodePort
  selector:
    k8s-app: traefik-ingress-lb
  ports:
  - name: web
    port: 80
    targetPort: 8080 # DASHBOARD

70-traefik-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-web-ui
  namespace: kube-system
  annotations:
#    kubernetes.io/ingress.class: traefik # SHOULD I USE THIS HERE?
    kubernetes.io/ingress.global-static-ip-name: "my-web-static-ip-rui-dashboard"
spec:
  rules:
    - host: dashboard.api.my-domain.com
      http:
        paths:
        - path: /
          backend:
            serviceName: traefik-web-ui
            servicePort: web

75-traefik-ingress-lb-rui.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-lb-ingress
  namespace: kube-system
  annotations:
#    kubernetes.io/ingress.class: traefik # SHOULD I USE THIS HERE?
    kubernetes.io/ingress.global-static-ip-name: "my-web-static-ip-rui"

spec:
  rules:
    - host: api.my-domain.com
      http:
        paths:
        - path: /
          backend:
            serviceName: traefik-ingress-service
            servicePort: web

210-ws-rui-deployment.yaml


kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: ws-rui-hello-world
  labels:
    app: animals
    animal: bear
spec:
  replicas: 2
  selector:
    matchLabels:
      app: animals
      task: bear
  template:
    metadata:
      labels:
        app: animals
        task: bear
        version: v0.0.1
    spec:
      containers:
      - name: bear
#        image: supergiantkir/animals:bear
        image: registry.hub.docker.com/ruimartinsptl/python-user-web-service-lixo
        ports:
        - containerPort: 80

220-ws-rui-svc.yaml


apiVersion: v1
kind: Service
metadata:
  name: ws-rui-hello-world
spec:
  type: NodePort
  ports:
  - name: http
    targetPort: 80
    port: 80
  selector:
    app: animals
    task: bear

230-ws-rui-ingress.yaml


apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ws-rui-ingress
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: api.my-domain.com
    http:
      paths:
      # - path: / # SHOULD I USE also `/`?
      #   backend:
      #     serviceName: ws-rui-hello-world
      #     servicePort: http
      - path: /hello
        backend:
          serviceName: ws-rui-hello-world
          servicePort: http

但是，我遇到了一些问题：

我可以在localhost中映射服务端口，然后运行curl -H host:api.my-domain.com http://127.0.0.1:8081/hello或curl -H host:dashboard.api.my-domain.com http://127.0.0.1:8080/dashboard。但我无法从外部访问服务。

这是我的 Kubernetes 集群：

部署部署良好：

IP 制作精良

服务创建良好，但入口在健康检查中失败，并且不是因为域的问题，因为我已经尝试过使用我的域。

这是健康检查：

31398端口存在健康检查问题：

这是自动创建的运行状况检查：

但是如果我从这个端口做一个端口转发到我的本地主机，它的工作：

但是当我尝试访问 realdomain 时，总是收到 404 错误。有人可以帮帮我吗？

有人已经在谷歌云平台配置了 Traefik？

欢迎所有提示 :) ????

更新：解决方案

Traefik 服务应该是LoadBalancer 类型而不是NodePort（文件50-traefik-svc.yaml），那么我不需要为Traefik 创建入口（文件70-traefik-ingress.yaml 可以删除）

我还需要在50-traefik-svc.yaml 中插入loadBalancerIP: xxx.xxx.xxx.xxx，而不是在70-traefik-ingress.yaml 中插入kubernetes.io/ingress.global-static-ip-name: "my-web-static-ip-rui-dashboard"。（这个IP有时需要很长时间才能设置~15分钟）

感谢所有试图帮助我的人:)

【问题讨论】：

感谢您提供有关该问题的非常清晰的详细信息。我有一个猜测，但也许您可以通过编辑 GCP 运行状况检查以查看它使用的主机名来帮助确认？我在想也许健康检查没有通过任何 Host 标头并失败，因为 Ingress 需要它。

标签： kubernetes google-cloud-platform traefik traefik-ingress

【解决方案1】：

显然您知道自己在做什么，但我不知道该工具的具体细节。

但我看到这个问题偶尔会弹出......如果您在某种“托管”环境中运行，安全人员会自动“修复”安全漏洞，这一点尤其重要。

1) 是否有人删除了允许 GCP 运行状况检查器访问您的 IP 的规则？（该规则是自动创建的，但有时“安全人员”会删除它们

2) 是否有人从公开的 API 中删除了 0.0.0.0/0 规则。（因为您的健康检查失败，所以猜测不会）。

检查日志文件是否有任何 PATCH 到防火墙规则。

【讨论】：

【解决方案2】：

当您尝试访问 /hello 时，您的 python 应用程序侦听 /rui 或 /rui/hello 路径，这就是它重定向到默认支持的 404 的原因。

所以有两种选择：

a) 要么使用正确的路径

http://127.0.0.1:8080/rui/hello

b) 或在入口对象中设置 rewrite-target

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ws-rui-ingress
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/rewrite-target: /rui/hello
spec:
  rules:
  - host:
    http:
      paths:
      - path: /hello
        backend:
          serviceName: ws-rui-hello-world
          servicePort: http

【讨论】：

很好的提示 :) 我刚刚更新了这个问题，解决了我的健康检查问题。