Deploy traefik and achieve http and https access

I. Background 1. Applications such as rancher and kubernetes-dashboard need to be accessed via https, so this deployment will enable traefik support for https.

2. Based on previous rancher HA deployment under the cattle-system namespace, so this time will also deploy traefik under the cattle-system namespace, and use the same tls certificate.

ii. traefik deployment 1. Create RBAC policy to authorize service account

The RBAC manifest file traefik-rbac.yaml is as follows:

---apiVersion: v1kind: ServiceAccountmetadata: name: traefik-ingress-controller namespace: cattle-system---kind: ClusterRoleapiVersion: rbac.authorization.k8s.io/v1metadata: name: traefik-ingress-controllerrules: - apiGroups: - "" resources: - services - endpoints - secrets verbs: - get - list - watch - apiGroups: - extensions resources: - ingresses verbs: - get - list - watch---kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1metadata: name: traefik-ingress-controllerroleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controllersubjects:- kind: ServiceAccount name: traefik-ingress-controller namespace: cattle-system

application manifest file

[root@k8s-master03 traefik]# kubectl apply -f traefik-rbac.yamlserviceaccount/traefik-ingress-controller createdclusterrole.rbac.authorization.k8s.io/traefik-ingress-controller createdclusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created2. Deploying traefik using DamonSet controller

The damonset manifest file traefik-ds.yaml is as follows:

---kind: ConfigMapapiVersion: v1metadata: name: traefik-conf namespace: cattle-systemdata: traefik.toml: | insecureSkipVerify = true defaultEntryPoints = ["http","https"] [entryPoints] [entryPoints.http] address = ":80" [entryPoints.https] address = ":443" [entryPoints.https.tls] [[entryPoints.https.tls.certificates]] CertFile = "/ssl/tls.crt" KeyFile = "/ssl/tls.key"---kind: DaemonSetapiVersion: extensions/v1beta1metadata: name: traefik-ingress-controller namespace: cattle-system labels: k8s-app: traefik-ingress-lbspec: template: metadata: labels: k8s-app: traefik-ingress-lb name: traefik-ingress-lb spec: serviceAccountName: traefik-ingress-controller terminationGracePeriodSeconds: 60 hostNetwork: true volumes: - name: ssl secret: secretName: tls-rancher-ingress - name: config configMap: name: traefik-conf containers: - image: traefik name: traefik-ingress-lb ports: - name: http containerPort: 80 hostPort: 80 - name: admin containerPort: 8080 securityContext: privileged: true args: - --configfile=/config/traefik.toml - -d - --web - --kubernetes volumeMounts: - mountPath: "/ssl" name: "ssl" - mountPath: "/config" name: "config"---kind: ServiceapiVersion: v1metadata: name: traefik-ingress-service namespace: cattle-systemspec: selector: k8s-app: traefik-ingress-lb ports: - protocol: TCP port: 80 name: web - protocol: TCP port: 8080 name: admin - protocol: TCP port: 443 name: https #type: NodePort

application manifest file

[root@k8s-master03 traefik]# kubectl apply -f traefik-ds.yamlconfigmap/traefik-conf createddaemonset.extensions/traefik-ingress-controller createdservice/traefik-ingress-service created3. Configure forwarding for traefik UI

The ingress manifest file traefik-ui.yaml is as follows:

apiVersion: v1kind: Servicemetadata: name: traefik-web-ui namespace: cattle-systemspec: selector: k8s-app: traefik-ingress-lb ports: - name: web port: 80 targetPort: 8080---apiVersion: extensions/v1beta1kind: Ingressmetadata: name: traefik-web-ui namespace: cattle-systemspec: rules: - host: traefik-ui.sumapay.com http: paths: - path: / backend: serviceName: traefik-web-ui servicePort: web

application manifest file

[root@k8s-master03 traefik]# kubectl apply -f traefik-ui.yamlservice/traefik-web-ui createdingress.extensions/traefik-web-ui created4. Check [root@k8s-master01 ~]# kubectl get pods -n cattle-systemNAME READY STATUS RESTARTS AGEcattle-cluster-agent-594b8f79bb-pgmdt 1/1 Running 5 11dcattle-node-agent-lg44f 1/1 Running 0 11dcattle-node-agent-zgdms 1/1 Running 5 11drancher2-9774897c-622sc 1/1 Running 0 9drancher2-9774897c-czxxx 1/1 Running 0 9drancher2-9774897c-sm2n5 1/1 Running 1 9dtraefik-ingress-controller-hj9nc 1/1 Running 0 142mtraefik-ingress-controller-vxcgt 1/1 Running 0 142m [root@k8s-master01 ~]# kubectl get svc -n cattle-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGErancher2 ClusterIP 10.111.16.80 80/TCP 9dtraefik-ingress-service ClusterIP 10.111.121.27 80/TCP,8080/TCP,443/TCP 143mtraefik-web-ui ClusterIP 10.103.112.22 80/TCP 136m [root@k8s-master01 ~]# kubectl get ingress -n cattle-system NAME HOSTS ADDRESS PORTS AGErancher2 rancher.sumapay.com 80, 443 9dtraefik-web-ui traefik-ui.sumapay.com 80 137m

After mapping the domain name to the external Load Balancer IP, traefik UI and rancher HA services are accessible through the domain name.