Traefik Ingress Controller 完整部署指南

# 常见入口点配置
entryPoints:
  web:        # HTTP 入口（端口 80）
  websecure:  # HTTPS 入口（端口 443）
  traefik:    # 管理界面（端口 8080）

# 复合路由规则
match: Host(`api.example.com`) && PathPrefix(`/v1`) && Method(`GET`)

# 下载 Helm 安装脚本
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# 验证安装
helm version

# Bash 用户
helm completion bash >> ~/.bashrc
source ~/.bashrc

# Zsh 用户
helm completion zsh >> ~/.zshrc
source ~/.zshrc

# Fish 用户
helm completion fish > ~/.config/fish/completions/helm.fish

# 检查集群状态
kubectl cluster-info

# 检查节点状态
kubectl get nodes

# 检查 Helm 是否能正常工作
helm list

# 克隆官方 Helm Chart 仓库
git clone https://github.com/traefik/traefik-helm-chart

# 进入 Chart 目录
cd traefik-helm-chart

# 查看默认配置（可选）
helm show values ./traefik/

cat > prod-values.yaml << 'EOF'
# 禁用默认的 Dashboard IngressRoute，我们将手动创建
ingressRoute:
  dashboard:
    enabled: false

# 配置端口映射
ports:
  web:
    port: 8000
    hostPort: 80      # 直接绑定到主机的 80 端口
  websecure:
    port: 8443
    hostPort: 443     # 直接绑定到主机的 443 端口

# 禁用 Service（使用 hostPort 模式时不需要）
service:
  enabled: false

# 配置日志级别
logs:
  general:
    level: ERROR      # 生产环境建议使用 ERROR 级别

# 容忍主节点污点，允许在 master 节点运行
tolerations:
- key: "node-role.kubernetes.io/master"
  operator: "Equal"
  effect: "NoSchedule"

# 固定部署到 master01 节点
nodeSelector:
  kubernetes.io/hostname: "master01"
EOF

# 创建命名空间
kubectl create namespace traefik

# 使用 Helm 部署 Traefik
helm upgrade --install traefik \
  --namespace traefik \
  --values ./prod-values.yaml \
  ./traefik/

# 等待 Pod 启动完成
watch kubectl get pods -n traefik

NAME                      READY   STATUS    RESTARTS   AGE
traefik-84879ffbd-6kwv5   1/1     Running   0          68s

# 查看 Pod 详细信息
kubectl get pods -n traefik -o wide

# 查看 Pod 日志
kubectl logs -n traefik deployment/traefik

# 测试 HTTP 端口（应该返回 404，这是正常的）
curl -I http://192.168.8.70

# 预期输出
HTTP/1.1 404 Not Found
Date: Sun, 17 Jan 2021 03:09:37 GMT
Content-Length: 19
Content-Type: text/plain; charset=utf-8

# CentOS/RHEL
yum install httpd-tools -y

# Ubuntu/Debian
apt-get install apache2-utils -y

# 生成用户名和密码（用户名：admin，密码：123456）
htpasswd -nb admin 123456

# 输出示例
admin:$apr1$aUlPDYOb$tDDau3d3zv0op6NrMo6C1

# 转换为 base64 编码（Kubernetes Secret 需要）
htpasswd -nb admin 123456 | base64
# 输出：YWRtaW46JGFwcjEkYVVsUERZT2IkdEREYXUzZDN6dnowb3A2TnJNbzZDMQoK

cat > dashboard-config.yaml << 'EOF'
# 创建存储认证信息的 Secret
apiVersion: v1
kind: Secret
metadata:
  name: dashboard-auth-secret
  namespace: traefik
type: Opaque
data:
  users: YWRtaW46JGFwcjEkYVVsUERZT2IkdEREYXUzZDN6dnowb3A2TnJNbzZDMQoK

---
# 创建 BasicAuth 中间件
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: dashboard-auth
  namespace: traefik
spec:
  basicAuth:
    secret: dashboard-auth-secret
    removeHeader: true    # 移除认证头，避免传递给后端

---
# 创建 Dashboard 路由
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
  namespace: traefik
spec:
  entryPoints:
  - web                   # 使用 HTTP 入口点
  routes:
  - match: Host(`traefik.coderyzun.cyou`)
    kind: Rule
    services:
    - name: api@internal  # Traefik 内置的 API 服务
      kind: TraefikService
    middlewares:
    - name: dashboard-auth
EOF

# 应用配置
kubectl apply -f dashboard-config.yaml

# 验证资源创建
kubectl get secret,middleware,ingressroute -n traefik

cat <<EOF | kubectl apply -f -
# 创建测试应用的 Service
apiVersion: v1
kind: Service
metadata:
  name: whoami-v1
  namespace: default
spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami-v1

---
# 创建测试应用的 Deployment
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami-v1
  namespace: default
  labels:
    app: whoami-v1
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami-v1
  template:
    metadata:
      labels:
        app: whoami-v1
    spec:
      containers:
        - name: whoami
          image: containous/whoami
          ports:
            - name: web
              containerPort: 80
EOF

# 检查 Pod 状态
kubectl get pods -l app=whoami-v1

# 检查 Service
kubectl get svc whoami-v1

cat <<EOF | kubectl apply -f -
# 添加请求头和响应头的中间件
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: add-headers
  namespace: default
spec:
  headers:
    customRequestHeaders:
      X-Script-Name: "traefik-demo"      # 添加自定义请求头
      X-Forwarded-Proto: "http"         # 添加协议信息
    customResponseHeaders:
      X-Custom-Response-Header: "Traefik-Powered"  # 添加自定义响应头
      X-Frame-Options: "DENY"           # 安全头：防止页面被嵌入框架

---
# 移除请求头的中间件
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: remove-headers
  namespace: default
spec:
  headers:
    customRequestHeaders:
      X-Script-Name: ""                 # 移除请求头（设置为空字符串）
    customResponseHeaders:
      X-Custom-Response-Header: ""      # 移除响应头
EOF

cat <<EOF | kubectl apply -f -
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: headers-demo
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  # 添加头信息的路由
  - match: Host(`traefik.coderyzun.cyou`) && PathPrefix(`/headers/add`)
    kind: Rule
    services:
    - name: whoami-v1
      port: 80
    middlewares:
    - name: add-headers

  # 移除头信息的路由
  - match: Host(`traefik.coderyzun.cyou`) && PathPrefix(`/headers/remove`)
    kind: Rule
    services:
    - name: whoami-v1
      port: 80
    middlewares:
    - name: remove-headers
EOF

# 测试添加头信息
curl -H "X-Script-Name: original" http://traefik.coderyzun.cyou/headers/add

# 测试移除头信息
curl -H "X-Script-Name: will-be-removed" http://traefik.coderyzun.cyou/headers/remove

cat << EOF | kubectl apply -f -
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: ipwhitelist
spec:
  ipWhiteList:
    sourceRange:
      - 192.168.8.153
EOF

cat <<EOF | kubectl apply -f -
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: apps-ipwhitelist
spec:
  entryPoints:
    - web
  routes:
  - match: Host(\`traefik.coderyzun.cyou\`) && PathPrefix(\`/ipwhitelist\`)
    kind: Rule
    services:
    - name: v1
      port: 80
    middlewares:
    - name: ipwhitelist 
EOF

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: v2
spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: v2

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: v2
  labels:
    app: v2
spec:
  selector:
    matchLabels:
      app: v2
  template:
    metadata:
      labels:
        app: v2
    spec:
      containers:
        - name: v2
          image: containous/whoami
          ports:
            - name: web
              containerPort: 80
EOF

cat <<EOF | kubectl apply -f -
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: redirectregex
spec:
  redirectRegex:
    regex: ^http://traefik.coderyzun.cyou/redirectregex/v1/(.*)
    replacement: http://traefik.coderyzun.cyou/redirectregex/v2/\${1}
    permanent: true   # open permanent redirection 
EOF

cat <<EOF | kubectl apply -f -
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: redirectregex-appv1
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - match: Host(\`traefik.coderyzun.cyou\`) && PathPrefix(\`/redirectregex/v1\`)
    kind: Rule
    services:
    - name: v1
      port: 80
    middlewares:
    - name: redirectregex
  - match: Host(\`traefik.coderyzun.cyou\`) && PathPrefix(\`/redirectregex/v2\`)
    kind: Rule
    services:
    - name: v2
      port: 80
EOF

curl -I http://traefik.coderyzun.cyou/redirectregex/v1/1