前言
上一次对kubernetes配置了 traefik ，如果需要traefik代理https的应用，就需要配置https,下面就针对traefik 的https做配置
准备工作：
下面的操作在deploy节点操作，此节点同时又被定义为了我的master节点。
- 证书：自己生成，或使用机构颁发的证书, 私签证书命令，需要有安装OpenSSL：
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=泛域名，如*.abc.com"
我这里使用了LetsEncrypt的证书，我的tls.crt tls.key存放在了/etc/kubernetes/ssl/,注意名字是tls,不然会报错，“找不到tls.crt证书文件”
cd /etc/kubernetes/ssl/
kubectl create secret generic traefik-cert --from-file=tls.crt --from-file=tls.key -n kube-system
检查一下：
[root@master conf]# kubectl get secrets -n kube-system | grep traefik
traefik-cert Opaque 2 42m
traefik-ingress-controller-token-78tll kubernetes.io/service-account-token 3 1h
- traefik.toml
cd /etc/k8s/conf
# vim traefik.toml
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[[entryPoints.https.tls.certificates]]
certFile = "/ssl/tls.crt"
keyFile = "/ssl/tls.key"
- configmap：
kubectl create configmap traefik-conf --from-file=traefik.toml -n kube-system
检查一下：
[root@master conf]# kubectl get cm -n kube-system | grep traefik
traefik-conf 1 38m
当然也可以查看详细的描述信息,命令后输出的内容比较丰富，这里省略输出：
[root@master conf]# kubectl describe cm traefik-conf -n kube-system
把上述的文件放到node上面对应的目录,可以使用下面的脚本快速同步一下
#!/bin/bash
for i in `seq 11 15`
do
rsync -av /etc/kubernetes/ssl/tls* 192.168.2.$i:/etc/kubernetes/ssl/
rsync -av /etc/k8s/ 192.168.2.$i:/etc/k8s/
done
关键配置文件
[root@master conf]# tree ./
./
├── traefik-depoyment.yaml
├── traefik-rbac.yaml
├── traefik.toml
└── ui.yaml
- traefik-rbac.yaml
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: kube-system
应用配置：
kubectl apply -f traefik-rbac.yaml
- traefik-depoyment.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: kube-system
---
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
name: traefik-ingress-controller
namespace: kube-system
labels:
k8s-app: traefik-ingress-lb
spec:
selector:
matchLabels:
k8s-app: traefik-ingress-lb
template:
metadata:
labels:
k8s-app: traefik-ingress-lb
name: traefik-ingress-lb
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
hostNetwork: true
volumes:
- name: ssl
secret:
secretName: traefik-cert
- name: config
configMap:
name: traefik-conf
containers:
- image: traefik
name: traefik-ingress-lb
volumeMounts:
- mountPath: "/etc/kubernetes/ssl/" #ssl路径
name: "ssl"
- mountPath: "/etc/k8s/conf/" #conf路径
name: "config"
ports:
- name: http
containerPort: 80
- name: https
containerPort: 443
- name: admin
containerPort: 8080
args:
- --api
- --kubernetes
- --configfile=/etc/k8s/conf/traefik.toml
nodeSelector:
edgenode: "traefik-proxy" #这里限制了部署节点，应用了上次的label
---
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- protocol: TCP
port: 80
name: web
- protocol: TCP
port: 443
name: https
- protocol: TCP
port: 8080
name: admin
type: NodePort
应用配置：
kubectl apply -f traefik-depoyment.yaml
- ui.yaml
---
apiVersion: v1
kind: Service
metadata:
name: traefik-web-ui
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- name: web
port: 80
targetPort: 8080
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-web-ui
namespace: kube-system
annotations:
kubernetes.io/ingress.class: traefik
spec:
tls:
- secretName: traefik-cert #引用证书
rules:
- host: tf.abcgogo.com #自己的域名
http:
paths:
- path: /
backend:
serviceName: traefik-web-ui
servicePort: web
应用配置：
kubectl apply -f ui.yaml
检查配置输出
[root@master conf]# kubectl get svc,deployment,pod -o wide -n kube-system | grep traefik
service/traefik-ingress-service NodePort 10.68.210.65 <none> 80:34297/TCP,443:22151/TCP,8080:28570/TCP 1h k8s-app=traefik-ingress-lb
service/traefik-web-ui ClusterIP 10.68.138.157 <none> 80/TCP 1h k8s-app=traefik-ingress-lb
pod/traefik-ingress-controller-fx5g6 1/1 Running 0 1h 192.168.2.11 192.168.2.11 <none>
pod/traefik-ingress-controller-nkhmk 1/1 Running 0 1h 192.168.2.12 192.168.2.12 <none>
pod/traefik-ingress-controller-r8hlr 1/1 Running 0 1h 192.168.2.13 192.168.2.13 <none>
配置好dns,就可以看到ui了
