Traefik云原生网关从入门到生产实践

嘻哈baby

403人浏览 · 2025-12-21 15:41:54

嘻哈baby · 2025-12-21 15:41:54 发布

前言

Traefik是一款现代化的云原生边缘路由器，原生支持Docker和Kubernetes。与Nginx不同，Traefik可以自动发现服务并动态更新配置，非常适合微服务架构。

一、Traefik vs Nginx

特性	Traefik	Nginx
服务发现	✅ 自动	❌ 需手动配置
动态配置	✅ 热更新	❌ 需reload
Let’s Encrypt	✅ 自动	❌ 需certbot
Dashboard	✅ 内置	❌ 需第三方
学习曲线	中等	较低
性能	高	极高
适用场景	云原生/容器	传统/静态

二、Docker快速开始

2.1 基础部署

# docker-compose.yml
version: '3.8'

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik:/etc/traefik
    networks:
      - traefik-net
    labels:
      # Dashboard
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xxx"

networks:
  traefik-net:
    external: true

2.2 配置文件

# traefik/traefik.yml
api:
  dashboard: true
  insecure: false

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik-net
  file:
    directory: /etc/traefik/dynamic
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@example.com
      storage: /etc/traefik/acme.json
      httpChallenge:
        entryPoint: web

三、服务代理配置

3.1 Docker Labels方式

# 应用服务
services:
  webapp:
    image: nginx:alpine
    labels:
      - "traefik.enable=true"
      # 路由规则
      - "traefik.http.routers.webapp.rule=Host(`app.example.com`)"
      - "traefik.http.routers.webapp.entrypoints=websecure"
      - "traefik.http.routers.webapp.tls.certresolver=letsencrypt"
      # 服务配置
      - "traefik.http.services.webapp.loadbalancer.server.port=80"
    networks:
      - traefik-net

  api:
    image: my-api:latest
    labels:
      - "traefik.enable=true"
      # 路径前缀路由
      - "traefik.http.routers.api.rule=Host(`app.example.com`) && PathPrefix(`/api`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
      # 去除路径前缀
      - "traefik.http.routers.api.middlewares=strip-api"
      - "traefik.http.middlewares.strip-api.stripprefix.prefixes=/api"
      - "traefik.http.services.api.loadbalancer.server.port=8080"
    networks:
      - traefik-net

3.2 文件配置方式

# traefik/dynamic/services.yml
http:
  routers:
    external-service:
      rule: "Host(`external.example.com`)"
      entryPoints:
        - websecure
      service: external-service
      tls:
        certResolver: letsencrypt

  services:
    external-service:
      loadBalancer:
        servers:
          - url: "http://192.168.1.100:8080"
          - url: "http://192.168.1.101:8080"
        healthCheck:
          path: /health
          interval: 10s

四、中间件配置

4.1 常用中间件

# traefik/dynamic/middlewares.yml
http:
  middlewares:
    # Basic认证
    auth-basic:
      basicAuth:
        users:
          - "admin:$apr1$xxx"
    
    # 速率限制
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
    
    # 请求头
    secure-headers:
      headers:
        frameDeny: true
        sslRedirect: true
        browserXssFilter: true
        contentTypeNosniff: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
    
    # IP白名单
    ip-whitelist:
      ipWhiteList:
        sourceRange:
          - "10.0.0.0/8"
          - "192.168.0.0/16"
    
    # 重试
    retry:
      retry:
        attempts: 3
        initialInterval: 100ms
    
    # 压缩
    compress:
      compress: {}
    
    # 熔断
    circuit-breaker:
      circuitBreaker:
        expression: "NetworkErrorRatio() > 0.5 || ResponseCodeRatio(500, 600, 0, 600) > 0.5"

4.2 应用中间件

# Docker Labels
labels:
  - "traefik.http.routers.myapp.middlewares=rate-limit,secure-headers,compress"

# 文件配置
http:
  routers:
    myapp:
      middlewares:
        - rate-limit
        - secure-headers
        - compress

五、负载均衡

5.1 轮询策略

http:
  services:
    my-service:
      loadBalancer:
        servers:
          - url: "http://server1:80"
          - url: "http://server2:80"
          - url: "http://server3:80"

5.2 加权轮询

http:
  services:
    my-service:
      weighted:
        services:
          - name: server1
            weight: 3
          - name: server2
            weight: 1

5.3 会话保持

http:
  services:
    my-service:
      loadBalancer:
        sticky:
          cookie:
            name: server_id
            secure: true
            httpOnly: true

六、Kubernetes集成

6.1 Helm安装

helm repo add traefik https://traefik.github.io/charts
helm repo update
helm install traefik traefik/traefik -n traefik --create-namespace

6.2 IngressRoute配置

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: webapp
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`app.example.com`)
      kind: Rule
      services:
        - name: webapp
          port: 80
      middlewares:
        - name: rate-limit
  tls:
    certResolver: letsencrypt
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
spec:
  rateLimit:
    average: 100
    burst: 50

七、多站点代理

7.1 跨网络服务代理

当需要代理不同网络中的服务时，传统方式需要公网IP或VPN。使用组网软件（如星空组网）可以将多个站点组成虚拟局域网：

# traefik/dynamic/multi-site.yml
http:
  routers:
    beijing-api:
      rule: "Host(`api.example.com`) && PathPrefix(`/beijing`)"
      service: beijing-api
      
    shanghai-api:
      rule: "Host(`api.example.com`) && PathPrefix(`/shanghai`)"
      service: shanghai-api

  services:
    # 北京站点服务（通过虚拟内网访问）
    beijing-api:
      loadBalancer:
        servers:
          - url: "http://10.26.0.10:8080"
    
    # 上海站点服务（通过虚拟内网访问）
    shanghai-api:
      loadBalancer:
        servers:
          - url: "http://10.26.0.20:8080"

八、监控与日志

8.1 Prometheus指标

# traefik.yml
metrics:
  prometheus:
    addEntryPointsLabels: true
    addServicesLabels: true
    buckets:
      - 0.1
      - 0.3
      - 1.2
      - 5.0

8.2 访问日志

accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
  filters:
    statusCodes:
      - "400-499"
      - "500-599"
    retryAttempts: true
    minDuration: "10ms"

8.3 Grafana Dashboard

导入Dashboard ID: 17346（Traefik官方Dashboard）

九、生产配置示例

# docker-compose-production.yml
version: '3.8'

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik:/etc/traefik
      - ./logs:/var/log/traefik
    environment:
      - TZ=Asia/Shanghai
    networks:
      - traefik-net
    healthcheck:
      test: ["CMD", "traefik", "healthcheck"]
      interval: 30s
      timeout: 3s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 512M

networks:
  traefik-net:
    driver: bridge

十、总结

Traefik是云原生时代的优秀网关选择：

特点	优势
自动发现	Docker/K8s服务自动注册
动态配置	无需重启，热更新
Let’s Encrypt	自动申请和续期证书
中间件	认证、限流、熔断开箱即用
Dashboard	可视化管理界面

适用场景：

微服务架构
Docker/Kubernetes环境
需要自动SSL的场景
频繁变更的服务配置

参考资料

Traefik官方文档：https://doc.traefik.io/traefik/
Traefik GitHub：https://github.com/traefik/traefik
Let’s Encrypt配置：https://doc.traefik.io/traefik/https/acme/

本文首发于CSDN，转载请注明出处。

亚马逊云科技技术品牌专区

更多推荐

open-code-review Codex 插件教程：对话式调用评审技能指南

本文是一份面向新手的 **open-code-review Codex 插件教程**，教你在 Codex 中通过对话式方式调用 open-code-review 的 AI 代码评审技能。open-code-review 是阿里巴巴开源的 AI 代码评审工具，采用"确定性流水线 + LLM Agent"混合架构，内置多语言评审规则（NPE、线程安全、XSS、SQL 注入等），可在 Codex 里用一

亚马逊云科技技术品牌专区

OBS Studio 完整指南：免费开源录屏与直播软件从零上手

想做一场像模像样的直播，或者把屏幕内容录成教程视频，但一想到商用软件的订阅费就有些犹豫？其实你不需要花一分钱。OBS Studio 是一款免费开源的直播与录屏软件，支持 Windows、macOS 和 Linux，采集、混音、编码、推流、录制，一条流水线全包了。## 先搞清楚 OBS Studio 是什么OBS Studio 是一个"场景化"的采集合成工具：你把摄像头、窗口、浏览器、图片、

亚马逊云科技技术品牌专区

如何用MediaCrawler爬取小红书抖音数据？7大平台爬虫从安装到实战完整指南

MediaCrawler 是一个支持小红书、抖音、快手、B站、微博、百度贴吧、知乎的开源自媒体数据采集工具。它能按关键词、按帖子、按创作者主页三种方式抓取笔记/视频内容、评论甚至二级评论，并把结果存成 JSON、CSV、Excel 或数据库。适合做市场调研、竞品监控、内容选题的运营人员，以及想要现成爬虫框架而不想从零写 JS 逆向的开发者。## 从一次"手动抄数据"说起想象这个场景：你负责