k8s集群Ingress+Traefik的实用类型实现
·
这次来写一篇ingress的一些用法
环境用的是Ubuntu22.04搭建的k8集群
链接：https://blog.csdn.net/weixin_45049740/article/details/156514328?spm=1001.2014.3001.5502
文章总分为二块
第一块是原生Ingress的方法
第二块是traefik ingressRoute的代理方法
下面是一些介绍可以跳过
traefik介绍
传统反向代理（如 Nginx）依赖静态配置，面对服务频繁上下线、弹性伸缩时，需手动改配置或依赖模板 / 脚本，易出错且效率低。Traefik 从设计上解决这些痛点：
1 自动发现后端服务（如 Docker 容器、K8s Service），实时生成路由，无需手动维护路由表；
2 内置 ACME 客户端，自动申请 / 续期 Let’s Encrypt 证书，简化 HTTPS 配置；
3 以 “中间件” 封装常用流量治理能力（如重定向、限流、认证），配置灵活可复用；
4 提供可视化 Dashboard，快速排查路由与服务问题，降低运维门槛。
Ingress 介绍
Ingress 是Kubernetes 原生的 HTTP/HTTPS 流量入口资源，核心作用是为集群内的 Service 提供统一的外部访问入口和七层（应用层）路由规则管理，解决了 NodePort/LoadBalancer 端口零散、无域名 / 路径路由、HTTPS 配置繁琐等问题，是 K8s 集群暴露七层服务的标准方案。
简单说：K8s 里的 Service 负责集群内服务发现和四层负载均衡，而 Ingress 负责集群外的七层流量调度，把外部基于域名、URL 路径的请求，精准转发到对应的后端 Service，同时可统一管理 HTTPS 证书、限流、重定向等七层策略。
IngressRoute 介绍
IngressRoute 是 Traefik 针对 K8s 设计的自定义资源（CRD），本质是「Traefik 专属的 Ingress 规则定义方式」—— 它比 K8s 原生 Ingress 功能更强、配置更灵活，是 Traefik 接管 K8s 七层流量的核心配置入口。
简单说：
K8s 原生 Ingress 是「通用版七层路由规则」，功能有限；
Traefik IngressRoute 是「Traefik 定制版七层路由规则」，完美适配 Traefik 的所有特性（中间件、TLS、权重路由等）。
一. Ingress
1.1 http代理模式
1.1.1 镜像配置
链接:https://pan.baidu.com/s/1k4yZHQoCawwvsUkKRbtBKw?pwd=v2kf
[root@master01 game]# cat deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: game-static-v1
labels:
app: game-static
spec:
replicas: 2
selector:
matchLabels:
app: game-static-v1
template:
metadata:
labels:
app: game-static-v1
spec:
containers:
- name: c1
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
ports:
- containerPort: 8090
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: game-static-svc-v1
spec:
selector:
app: game-static-v1
type: NodePort
ports:
- port: 8091
targetPort: 8090
nodePort: 30891
1.1.2 运行
kubectl apply -f deployment.yaml ingress-deployment.yaml
#添加hosts解析
[root@master01 game]# cat /etc/hosts
...
...
10.0.250.6 worker01 v1.xinyouzhumeng.com v2.xinyouzhumeng.com
...
...
#检查下
[root@master01 ~]# kubectl get ing
NAME CLASS HOSTS ADDRESS PORTS AGE
ingress-game traefik-server v1.xinyouzhumeng.com 80 10h
kubectl describe ingress ingress-game
Name: ingress-game
Labels: <none>
Namespace: default
Address:
Ingress Class: traefik-server
Default backend: <default>
Rules:
Host Path Backends
---- ---- --------
v1.xinyouzhumeng.com
/ game-static-svc-v1:8091 (10.100.30.110:8090,10.100.5.52:8090)
v2.xinyouzhumeng.com
Annotations: <none>
Events: <none>
[root@master01 game]# cat ingress-deployment.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-game
namespace: default
spec:
ingressClassName: traefik-server
rules:
- host: v1.xinyouzhumeng.com
http:
paths:
- pathType: Prefix
path: /
backend:
service:
name: game-static-svc-v1
port:
number: 8091
检查测试
root@master01 game]# kubectl get svc -A |grep traefik-server
traefik traefik-server NodePort 10.200.182.166 <none> 80:26286/TCP,443:30700/TCP 7d12h
[root@master01 game]# curl v1.xinyouzhumeng.com:26286
<!DOCTYPE html>
<html lang="zh-CN">
<head>
.....
.....
</body>
</html>
1.2 url多路径匹配
[root@master01 ~]# mkdir /root/test
[root@master01 ~]# cd test/
[root@master01 test]# cat deplourl.yam
apiVersion: apps/v1
kind: Deployment
metadata:
name: game-static-v3
labels:
app: game-static
spec:
replicas: 2
selector:
matchLabels:
app: game-static-v3
template:
metadata:
labels:
app: game-static-v3
spec:
volumes:
- name: data
emptyDir: {}
- name: dt
hostPath:
path: /etc/localtime
initContainers:
- name: i1
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
command:
- /bin/sh
- -c
- echo ${pod_name} =========== ${pod_ip} >> /data/code/index.html
env:
- name: pod_name
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: pod_ip
valueFrom:
fieldRef:
fieldPath: status.podIP
volumeMounts:
- name: data
mountPath: /data/code
- name: dt
mountPath: /etc/localtime
containers:
- name: c3
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
ports:
- containerPort: 8090
protocol: TCP
volumeMounts:
- name: data
mountPath: /data/code/
- name: dt
mountPath: /etc/localtime
---
apiVersion: v1
kind: Service
metadata:
name: game-static-svc-v3
spec:
selector:
app: game-static-v3
type: NodePort
ports:
- port: 8093
targetPort: 8090
nodePort: 30893
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: game-static-v4
labels:
app: game-static
spec:
replicas: 2
selector:
matchLabels:
app: game-static-v4
template:
metadata:
labels:
app: game-static-v4
spec:
volumes:
- name: data
emptyDir: {}
- name: dt
hostPath:
path: /etc/localtime
initContainers:
- name: i1
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
command:
- /bin/sh
- -c
- echo ${pod_name} =========== ${pod_ip} >> /data/code/index.html
env:
- name: pod_name
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: pod_ip
valueFrom:
fieldRef:
fieldPath: status.podIP
volumeMounts:
- name: data
mountPath: /data/code
- name: dt
mountPath: /etc/localtime
containers:
- name: c4
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
ports:
- containerPort: 8090
protocol: TCP
volumeMounts:
- name: data
mountPath: /data/code/
- name: dt
mountPath: /etc/localtime
---
apiVersion: v1
kind: Service
metadata:
name: game-static-svc-v4
spec:
selector:
app: game-static-v4
type: NodePort
ports:
- port: 8094
targetPort: 8090
nodePort: 30894
1.2.1 启动
kubectl apply -f deplourl.yam
[root@master01 test]# kubectl get pods,svc -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod/cj-backup-etcd-29499420-nhvz2 0/1 Completed 0 6d14h 10.0.250.6 worker01 <none> <none>
pod/cj-backup-etcd-29505180-kxcnf 0/1 Completed 1 45h 10.0.250.6 worker01 <none> <none>
pod/cj-backup-etcd-29506620-wjggc 0/1 Completed 0 38h 10.0.250.6 worker01 <none> <none>
pod/cj-backup-etcd-29508060-dv45n 0/1 Completed 0 14h 10.0.250.6 worker01 <none> <none>
pod/game-static-v1-b9bf9899c-lnwjk 1/1 Running 0 14h 10.100.30.110 worker02 <none> <none>
pod/game-static-v1-b9bf9899c-mdxgk 1/1 Running 0 14h 10.100.5.52 worker01 <none> <none>
pod/game-static-v2-67665d5b95-9qk8k 1/1 Running 0 14h 10.100.30.111 worker02 <none> <none>
pod/game-static-v2-67665d5b95-hw8rs 1/1 Running 0 14h 10.100.5.53 worker01 <none> <none>
pod/game-static-v3-89bcff66d-k5gk4 1/1 Running 0 32m 10.100.5.54 worker01 <none> <none>
pod/game-static-v3-89bcff66d-q92hc 1/1 Running 0 32m 10.100.30.112 worker02 <none> <none>
pod/game-static-v4-7b499d74bb-8w5nv 1/1 Running 0 32m 10.100.30.113 worker02 <none> <none>
pod/game-static-v4-7b499d74bb-cfrvl 1/1 Running 0 32m 10.100.5.55 worker01 <none> <none>
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/game-static-svc-v1 NodePort 10.200.148.10 <none> 8091:30891/TCP 14h app=game-static-v1
service/game-static-svc-v2 NodePort 10.200.224.128 <none> 8092:30892/TCP 14h app=game-static-v2
service/game-static-svc-v3 NodePort 10.200.108.3 <none> 8093:30893/TCP 32m app=game-static-v3
service/game-static-svc-v4 NodePort 10.200.36.188 <none> 8094:30894/TCP 32m app=game-static-v4
service/kubernetes ClusterIP 10.200.0.1 <none> 443/TCP 30d <none>
[root@master01 test]#
#可以看到轮询正常
[root@master01 test]# curl 10.200.36.188:8094
game-static-v4-7b499d74bb-8w5nv =========== 10.100.30.113
[root@master01 test]# curl 10.200.36.188:8094
game-static-v4-7b499d74bb-cfrvl =========== 10.100.5.55
[root@master01 test]# curl 10.200.36.188:8094
game-static-v4-7b499d74bb-8w5nv =========== 10.100.30.113
[root@master01 test]# curl 10.200.36.188:8094
game-static-v4-7b499d74bb-cfrvl =========== 10.100.5.55
[root@master01 test]#
1.2.2 ingress实现uri代理分发配置
[root@master01 test]# cat ingurl.yam
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-uri
spec:
ingressClassName: traefik-server
rules:
- host: url.xinyouzhumeng.com
http:
paths:
- pathType: Prefix
path: /v1
backend:
service:
name: game-static-svc-v3
port:
number: 8093
- pathType: Prefix
path: /v2
backend:
service:
name: game-static-svc-v4
port:
number: 8094
记得配置hosts
[root@master01 test]# cat /etc/hosts
...
10.0.250.6 worker01 v1.xinyouzhumeng.com v2.xinyouzhumeng.com url.xinyouzhumeng.com
10.0.250.7 worker02 v1.xinyouzhumeng.com v2.xinyouzhumeng.com url.xinyouzhumeng.com
[root@master01 test]#
[root@master01 test]# kubectl get ing
NAME CLASS HOSTS ADDRESS PORTS AGE
ingress-game traefik-server v1.xinyouzhumeng.com,v2.xinyouzhumeng.com 80 13h
ingress-uri traefik-server url.xinyouzhumeng.com 80 4m41s
[root@master01 test]# kubectl describe ing ingress-uri
Name: ingress-uri
Labels: <none>
Namespace: default
Address:
Ingress Class: traefik-server
Default backend: <default>
Rules:
Host Path Backends
---- ---- --------
url.xinyouzhumeng.com
/v1 game-static-svc-v3:8093 (10.100.30.114:8090,10.100.5.56:8090)
/v2 game-static-svc-v4:8094 (10.100.30.115:8090,10.100.5.57:8090)
Annotations: <none>
Events: <none>
#看端口
error: unknown command "traefik-server" for "kubectl"
[root@master01 test]# kubectl get svc -A | grep -i traefik
traefik traefik-server NodePort 10.200.182.166 <none> 80:26286/TCP,443:30700/TCP 7d15h
1.2.3 访问测试
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v1
game-static-v3-89bcff66d-2gh5j =========== 10.100.30.114
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v1
game-static-v3-89bcff66d-4blw9 =========== 10.100.5.56
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v1
game-static-v3-89bcff66d-2gh5j =========== 10.100.30.114
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v1
game-static-v3-89bcff66d-4blw9 =========== 10.100.5.56
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v2
game-static-v4-7b499d74bb-6b7fn =========== 10.100.5.57
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v2
game-static-v4-7b499d74bb-4brth =========== 10.100.30.115
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v2
game-static-v4-7b499d74bb-6b7fn =========== 10.100.5.57
[root@master01 test]# curl url.xinyouzhumeng.com:26286/v2
game-static-v4-7b499d74bb-4brth =========== 10.100.30.115
1.3 映射https
1.3.1创建个证书
[root@master01 test]# openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=gam.xinyouzhumeng.com"
..........+...+.....+......+.+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+...+............+...+...+.................+..........+..+.........+....+......+.........+.....+......+.......+.....+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
......+.+..+.+...........+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+.........+.+.....+....+.....+....+.........+..+...+............+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+...........+..........+..+...+....+...+..+......+...............+.........+...............+.+...............+..+....+.....+...+.+...........+.+...+......+...+..+..........+......+............+.....+............+......+.......+...........+....+...........+.........+......+......+..........+.....+.+...+..+............+.+...........+...+...+...+....+.....+...+....+......+...+........................+...............+........+.......+.....+.......+........+.+.................+.........+.+..+......................+........+......+....+....................+...+.............+......+...........+...+....+...........+.......+...+.....+.+........+...+...+......+.....................+.......+......+..+..........+..+......+.+...+.....+......+.+......+...+..+...............+..................+..........+.........+.....+.+.....+.......+...+.....+......+..................+......+.+...+..+......+.......+..............................+.....+.......+......+..+..........+............+......+........+......+.+........+.+...+...+...+..+.........+.+...+......+...+......+..+....+...+........+...+.+.....+....+............+........+.+......+..+...+...+....+..+......+...+......+....+......+.....+...+......+.......+...+.........+...+........+.+......+...+......+...+........+.............+..+.........+....+..+....+...+........+........................+.+..+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
[root@master01 test]# ls
deplourl.yam ingurl.yam tls.crt tls.key
1.3.2 将证书文件以secrets形式存储
kubectl create secret tls ca-secret --cert=tls.crt --key=tls.key
secret/ca-secret created
[root@master01 test]# kubectl get secrets ca-secret
NAME TYPE DATA AGE
ca-secret kubernetes.io/tls 2 6s
[root@master01 test]# kubectl delete -f ingurl.yam
ingress.networking.k8s.io "ingress-uri" deleted
[root@master01 test]#
#配置
[root@master01 test]# cat deplourl.yam
apiVersion: apps/v1
kind: Deployment
metadata:
name: game-static-v3
labels:
app: game-static
spec:
replicas: 2
selector:
matchLabels:
app: game-static-v3
template:
metadata:
labels:
app: game-static-v3
spec:
volumes:
- name: data
emptyDir: {}
- name: dt
hostPath:
path: /etc/localtime
initContainers:
- name: i1
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
command:
- /bin/sh
- -c
- echo ${pod_name} =========== ${pod_ip} >> /data/code/index.html
env:
- name: pod_name
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: pod_ip
valueFrom:
fieldRef:
fieldPath: status.podIP
volumeMounts:
- name: data
mountPath: /data/code
- name: dt
mountPath: /etc/localtime
containers:
- name: c3
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
command:
- /bin/sh
- -c
- |
sed -i 's/listen 8090;/listen 0.0.0.0:8090;/g' /etc/nginx/nginx.conf
sed -i 's/server_name localhost;/server_name _;/g' /etc/nginx/nginx.conf
nginx -g "daemon off;"
ports:
- containerPort: 8090
protocol: TCP
volumeMounts:
- name: data
mountPath: /data/code/
- name: dt
mountPath: /etc/localtime
---
apiVersion: v1
kind: Service
metadata:
name: game-static-svc-v3
spec:
selector:
app: game-static-v3
type: NodePort
ports:
- port: 8093
targetPort: 8090
nodePort: 30893
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: game-static-v4
labels:
app: game-static
spec:
replicas: 2
selector:
matchLabels:
app: game-static-v4
template:
metadata:
labels:
app: game-static-v4
spec:
volumes:
- name: data
emptyDir: {}
- name: dt
hostPath:
path: /etc/localtime
initContainers:
- name: i1
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
command:
- /bin/sh
- -c
- echo ${pod_name} =========== ${pod_ip} >> /data/code/index.html
env:
- name: pod_name
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: pod_ip
valueFrom:
fieldRef:
fieldPath: status.podIP
volumeMounts:
- name: data
mountPath: /data/code
- name: dt
mountPath: /etc/localtime
containers:
- name: c4
image: hb.aixxw.xin:8444/gamehtml/testgame:v0.1
command:
- /bin/sh
- -c
- |
sed -i 's/listen 8090;/listen 0.0.0.0:8090;/g' /etc/nginx/nginx.conf
sed -i 's/server_name localhost;/server_name _;/g' /etc/nginx/nginx.conf
nginx -g "daemon off;"
ports:
- containerPort: 8090
protocol: TCP
volumeMounts:
- name: data
mountPath: /data/code/
- name: dt
mountPath: /etc/localtime
---
apiVersion: v1
kind: Service
metadata:
name: game-static-svc-v4
spec:
selector:
app: game-static-v4
type: NodePort
ports:
- port: 8094
targetPort: 8090
nodePort: 30894
[root@master01 test]# cat httpsingurl.yam
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-https
labels:
app: game-static
env: test
version: v1
annotations:
traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.tls.minVersion: "VersionTLS12"
traefik.ingress.kubernetes.io/router.tls.sessionTimeout: "86400s"
traefik.ingress.kubernetes.io/service.timeout: "30s"
traefik.ingress.kubernetes.io/service.idleTimeout: "60s"
kubernetes.io/description:
spec:
ingressClassName: traefik-server
rules:
- host: www.xinyouzhumeng.com
http:
paths:
- path: /v1
pathType: Prefix
backend:
service:
name: game-static-svc-v3
port:
number: 8093
- path: /v2
pathType: Prefix
backend:
service:
name: game-static-svc-v4
port:
number: 8094
tls:
- hosts:
- www.xinyouzhumeng.com
secretName: ca-secret
启动
[root@master01 test]# kubectl apply -f httpsingurl.yam
ingress.networking.k8s.io/ingress-https created
#记得添加hosts解析
www.xinyouzhumeng.com
#查看
[root@master01 test]# kubectl get ingress ingress-https
NAME CLASS HOSTS ADDRESS PORTS AGE
ingress-https traefik-server www.xinyouzhumeng.com 80, 443 7m38s
#测试http
[root@master01 test]# curl www.xinyouzhumeng.com:26286/v1
game-static-v3-5fdbfdff99-rmt9w =========== 10.100.5.60
# 测试https
[root@master01 test]# curl -k https://www.xinyouzhumeng.com:30700/v1 --header "Host: www.xinyouzhumeng.com"
game-static-v3-5fdbfdff99-269ch =========== 10.100.30.119
1.4 Dashboard界面配置
1.4.1 修改配置
[root@master01 helm-charts]# cd /opt/k8s/add-ons/helm-charts
[root@master01 helm-charts]# ls
traefik whelm-linux
[root@master01 helm-charts]# vim traefik/values.yaml -n 210
..............
..............
# @default -- See _values.yaml_
ingressRoute:
dashboard:
# -- Create an IngressRoute for the dashboard
# enabled: false
enabled: true
insecure: true
............
............
1.4.2 heml重新生成
helm -n traefik uninstall traefik-server
helm -n traefik install traefik-server traefik
[root@master01 test]# kubectl get pods -A -o wide | grep traefik
traefik traefik-server-69497fcd6f-q7jlg 1/1 Running 0 37m 10.100.5.63 worker01 <none> <none>
[root@master01 test]# kubectl get pods,svc -A -o wide | grep traefik
traefik pod/traefik-server-69497fcd6f-q7jlg 1/1 Running 0 37m 10.100.5.63 worker01 <none> <none>
traefik service/traefik-server NodePort 10.200.247.42 <none> 80:31889/TCP,443:20902/TCP 37m app.kubernetes.io/instance=traefik-server-traefik,app.kubernetes.io/name=traefik
[root@master01 test]#
1.4.3 配置ingress
[root@master01 test]# cat traefik-dashboard.yam
apiVersion: v1
kind: Service
metadata:
name: svc-traefik-server
namespace: traefik
spec:
selector:
app.kubernetes.io/instance: traefik-server-traefik
type: NodePort
ports:
- port: 8080
targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-traefik-server
namespace: traefik
spec:
ingressClassName: traefik-server
rules:
- host: traefik.dashboard.com
http:
paths:
- pathType: Prefix
path: /dashboard
backend:
service:
name: svc-traefik-server
port:
number: 8080
- pathType: Prefix
path: /api
backend:
service:
name: svc-traefik-server
port:
number: 8080
1.4.4 启动测试
[root@master01 test]# kubectl apply -f traefik-dashboard.yam
service/svc-traefik-server created
ingress.networking.k8s.io/ingress-traefik-server created
[root@master01 test]# kubectl get svc,ingress -n traefik | grep traefik-server
service/svc-traefik-server NodePort 10.200.176.87 <none> 8080:46572/TCP 4s
service/traefik-server NodePort 10.200.247.42 <none> 80:31889/TCP,443:20902/TCP 27m
ingress.networking.k8s.io/ingress-traefik-server traefik-server traefik.dashboard.com 80 4s
[root@master01 test]# curl http://traefik.dashboard.com:31889/dashboard/
<!DOCTYPE html>
<html lang="en">
<head>
<script>
window.APIUrl = "/api/"
</script>
<meta charset="utf-8" />
<link rel="icon" href="./favicon.ico" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="theme-color" content="#ddee6d" />
<meta
name="description"
content="Traefik Proxy"
/>
<!--
manifest.json provides metadata used when your web app is installed on a
user's mobile device or desktop. See https://developers.google.com/web/fundamentals/web-app-manifest/
-->
<link rel="manifest" href="./manifest.json" />
<title>Traefik Proxy</title>
<script type="module" crossorigin src="./assets/index-Cn5NaOnq.js"></script>
</head>
<body>
<noscript>You need to enable JavaScript to run this app.</noscript>
<div id="root"></div>
</body>
</html>
二. 使用Traefik IngressRoute代理
2.1 基于IngressRoute暴露Traefik的Dashboard
2.1.1 先看下有没运行中相同域名避免解析冲突
[root@master01 ~]# kubectl -n traefik get ingress ingress-traefik-server
NAME CLASS HOSTS ADDRESS PORTS AGE
ingress-traefik-server traefik-server traefik.dashboard.com 80 4d15h
[root@master01 ~]# kubectl -n traefik describe ingress ingress-traefik-server
Name: ingress-traefik-server
Labels: <none>
Namespace: traefik
Address:
Ingress Class: traefik-server
Default backend: <default>
Rules:
Host Path Backends
---- ---- --------
traefik.dashboard.com
/dashboard svc-traefik-server:8080 ()
/api svc-traefik-server:8080 ()
Annotations: <none>
Events: <none>
2.1.2 编写资源清单
[root@master01 routeIngress]# cat ir-traefik-dashboard.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: ingressroute-traefik
namespace: traefik
spec:
entryPoints:
- web
# 配置路由
routes:
- match: Host(`rou.aixxw.xin`) && PathPrefix(`/`)
kind: Rule
services:
- name: svc-traefik-server
port: 8080
[root@master01 routeIngress]#
记得添加hosts解析
...
10.0.250.6 rou.aixxw.xin
10.0.250.7 rou.aixxw.xin
...
kubectl apply -f ir-traefik-dashboard.yaml
[root@master01 routeIngress]# kubectl get ingressroute -n traefik
NAME AGE
ingressroute-traefik 30s
traefik-server-dashboard 4d16h
[root@master01 routeIngress]# kubectl describe ingressroute ingressroute-traefik -n traefik
Name: ingressroute-traefik
Namespace: traefik
Labels: <none>
Annotations: <none>
API Version: traefik.io/v1alpha1
Kind: IngressRoute
Metadata:
Creation Timestamp: 2026-02-13T08:34:58Z
Generation: 1
Resource Version: 8881311
UID: d007ff60-6058-4766-8e8c-a1f5ad77491b
Spec:
Entry Points:
web
Routes:
Kind: Rule
Match: Host(`rou.aixxw.xin`) && PathPrefix(`/`)
Services:
Name: svc-traefik-server
Port: 8080
Events: <none>
oot@master01 routeIngress]# kubectl get svc -A |grep traefik
traefik svc-traefik-server NodePort 10.200.176.87 <none> 8080:46572/TCP 4d16h
traefik traefik-server NodePort 10.200.247.42 <none> 80:31889/TCP,443:20902/TCP 4d16h
2.1.3 测试
[root@master01 routeIngress]# curl rou.aixxw.xin:46572/dashboard/
<!DOCTYPE html>
<html lang="en">
<head>
<script>
window.APIUrl = "/api/"
</script>
<meta charset="utf-8" />
<link rel="icon" href="./favicon.ico" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="theme-color" content="#ddee6d" />
<meta
name="description"
content="Traefik Proxy"
/>
<!--
manifest.json provides metadata used when your web app is installed on a
user's mobile device or desktop. See https://developers.google.com/web/fundamentals/web-app-manifest/
-->
<link rel="manifest" href="./manifest.json" />
<title>Traefik Proxy</title>
<script type="module" crossorigin src="./assets/index-Cn5NaOnq.js"></script>
</head>
<body>
<noscript>You need to enable JavaScript to run this app.</noscript>
<div id="root"></div>
</body>
</html>
[root@master01 routeIngress]#
2.2 IngressRoute暴露whoami
2.2.1先下载whoami镜像
链接:https://pan.baidu.com/s/19NeohIsUTpMPD-QAOAvdLw?pwd=kj3m
先解压dockerwho.tar.gz （其他是二进制文件安装的这里用镜像）
得到三个文件
whoamiudp_v0.2.3.tar
whoami_v1.11.tar
whoamitcp_v0.3.0.tar
再分别
分别导入你的仓库（这边我用的是hb仓库感兴趣的可以去看看）
docker
docker load -i whoamiudp_v0.2.3.tar
docker load -i whoami_v1.11.tar
docker load -i whoamitcp_v0.3.0.tar
4.2.2 编写deploy启动
[root@master01 whoamd64]# cat deploy-svc-whoami.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-whoami
spec:
replicas: 2
selector:
matchLabels:
apps: whoami
template:
metadata:
labels:
apps: whoami
spec:
containers:
- name: whoami
image: hb.aixxw.xin:8444/linux-ingress/whoami:v1.11
imagePullPolicy: IfNotPresent
ports:
- containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-whoamitcp
spec:
replicas: 2
selector:
matchLabels:
apps: whoamitcp
template:
metadata:
labels:
apps: whoamitcp
spec:
containers:
- name: whoamitcp
image: hb.aixxw.xin:8444/linux-ingress/whoamitcp:v0.3.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8080
protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: deploy-whoamiudp
spec:
replicas: 2
selector:
matchLabels:
apps: whoamiudp
template:
metadata:
labels:
apps: whoamiudp
spec:
containers:
- name: whoamiudp
image: hb.aixxw.xin:8444/linux-ingress/whoamiudp:v0.2.3
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8080
protocol: UDP
---
apiVersion: v1
kind: Service
metadata:
name: svc-whoami
spec:
ports:
- name: http
port: 80
selector:
apps: whoami
---
apiVersion: v1
kind: Service
metadata:
name: svc-whoamitcp
spec:
ports:
- name: tcp
port: 8080
selector:
apps: whoamitcp
---
apiVersion: v1
kind: Service
metadata:
name: svc-whoamiudp
spec:
ports:
- name: udp
port: 8080
protocol: UDP
selector:
apps: whoamiudp
启动
kubectl apply -f deploy-svc-whoami.yaml
[root@master01 whoamd64]# kubectl get pods,svc -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod/deploy-whoami-7dd565f974-9682b 1/1 Running 0 2m5s 10.100.5.9 worker01 <none> <none>
pod/deploy-whoami-7dd565f974-9q6cz 1/1 Running 0 2m5s 10.100.30.127 worker02 <none> <none>
pod/deploy-whoamitcp-cf66d64c9-6n78t 1/1 Running 0 2m5s 10.100.5.10 worker01 <none> <none>
pod/deploy-whoamitcp-cf66d64c9-zvmfn 1/1 Running 0 2m5s 10.100.30.126 worker02 <none> <none>
pod/deploy-whoamiudp-78cb657f57-2dbfs 1/1 Running 0 2m5s 10.100.30.67 worker02 <none> <none>
pod/deploy-whoamiudp-78cb657f57-xhgcr 1/1 Running 0 2m5s 10.100.5.1 worker01 <none> <none>
4.2.3 创建IngressRoute代理
#添加ingress解析
#whoami
[root@master01 whoamd64]# cat whoami-ir.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: ingressroute-whoami
namespace: default
spec:
entryPoints:
- web
routes:
- match: Host(`w.aixxw.xin`) && PathPrefix(`/`)
kind: Rule
services:
- name: svc-whoami
port: 80
[root@master01 whoamd64]#
kubectl apply -f whoami-ir.yaml
kubectl get svc traefik-server -n traefik
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
traefik-server NodePort 10.200.247.42 <none> 80:31889/TCP,443:20902/TCP 4d20h
[root@master01 whoamd64]# curl w.aixxw.xin:31889
Hostname: deploy-whoami-7dd565f974-9682b
IP: 127.0.0.1
IP: ::1
IP: 10.100.5.9
IP: fe80::4be:50ff:fe65:ea07
RemoteAddr: 10.100.5.63:48458
GET / HTTP/1.1
Host: w.aixxw.xin:31889
User-Agent: curl/7.81.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 10.0.250.6
X-Forwarded-Host: w.aixxw.xin:31889
X-Forwarded-Port: 31889
X-Forwarded-Proto: http
X-Forwarded-Server: traefik-server-69497fcd6f-q7jlg
X-Real-Ip: 10.0.250.6
[root@master01 whoamd64]# ping w.aixxw.xin -c 2
PING worker01 (10.0.250.6) 56(84) bytes of data.
64 bytes from worker01 (10.0.250.6): icmp_seq=1 ttl=64 time=1.53 ms
64 bytes from worker01 (10.0.250.6): icmp_seq=2 ttl=64 time=0.913 ms
--- worker01 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 0.913/1.222/1.531/0.309 ms
ok完美执行
2.3 IngressRoute暴露whoami tls证书版本
2.3.1 配置证书
方案一
使用openssl自建证书
openssl req -x509 -nodes -days 365 --newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=w.aixxw.xin"
方案二 (我集群是k8s就使这个了)
k8s生成证书
[root@master01 pki]# pwd
/k8s/certs/pki
cat whoami-csr.json
{
"CN": "w.aixxw.xin",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "Beijing",
"L": "Beijing",
"O": "whoami",
"OU": "whoami-manual"
}
]
}
签发whoami证书
[root@master01 pki]# cfssl gencert \
-ca=/k8s/certs/kubernetes/k8s-ca.pem \
-ca-key=/k8s/certs/kubernetes/k8s-ca-key.pem \
-config=k8s-ca-config.json \
--hostname=w.aixxw.xin,10.0.250.6,10.0.250.7,10.0.250.8,10.0.250.9,10.0.250.2 \
--profile=kubernetes \
whoami-csr.json | cfssljson -bare /k8s/certs/kubernetes/whoami
2026/02/13 21:39:15 [INFO] generate received request
2026/02/13 21:39:15 [INFO] received CSR
2026/02/13 21:39:15 [INFO] generating key: rsa-2048
2026/02/13 21:39:16 [INFO] encoded CSR
2026/02/13 21:39:16 [INFO] signed certificate with serial number 268583251639372085577287054414435225436650305842
cd /k8s/certs/kubernetes/
[root@master01 kubernetes]# ll ./whoami*
-rw------- 1 root root 1675 Feb 13 21:39 ./whoami-key.pem
-rw-r--r-- 1 root root 1110 Feb 13 21:39 ./whoami.csr
-rw-r--r-- 1 root root 1509 Feb 13 21:39 ./whoami.pem
2.3.2 放入secrets资源
[root@master01 kubernetes]# kubectl create secret tls whoami-tls --cert=/k8s/certs/kubernetes/whoami.pem --key=/k8s/certs/kubernetes/whoami-key.pem
secret/whoami-tls created
查看下
[root@master01 kubernetes]# kubectl get secrets whoami-tls
NAME TYPE DATA AGE
whoami-tls kubernetes.io/tls 2 12s
[root@master01 whoamd64]# kubectl apply -f deploy-svc-whoami-https.yaml
ingressroute.traefik.io/ingressroute-whoami-https created
提示：
记得hosts解析
[root@master01 whoamd64]# curl w.aixxw.xin:31889
Hostname: deploy-whoami-7dd565f974-9682b
IP: 127.0.0.1
IP: ::1
IP: 10.100.5.9
IP: fe80::4be:50ff:fe65:ea07
RemoteAddr: 10.100.5.63:48460
GET / HTTP/1.1
Host: w.aixxw.xin:31889
User-Agent: curl/7.81.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 10.0.250.6
X-Forwarded-Host: w.aixxw.xin:31889
X-Forwarded-Port: 31889
X-Forwarded-Proto: http
X-Forwarded-Server: traefik-server-69497fcd6f-q7jlg
X-Real-Ip: 10.0.250.6
okok大家看到这里辛苦大家啦，文章就暂时结束啦
Traefilk就基本使用方式基本都给了详细的实现方式。
想要了解更多进阶功能我们下篇再讲
下篇文章我们讲TCP 和UDP 转发方式
以及 Traefik更多的进阶功能，兄弟们下篇再见啦
更多推荐
20
0- 0
已为社区贡献5条内容
所有评论(0)