阿里云的ACK默認(rèn)只提供了3個(gè)Ingress Controller組件的自動(dòng)安裝，分別是ALB Ingress Controller、MSE Ingress Controller和Nginx Ingress Controller。

當(dāng)我們想使用Traefik Ingress Controller時(shí)，只能自己手動(dòng)部署。

Traefik 官方文檔也提供了安裝方法，通過(guò)Helm Chart方式部署到Kubernetes集群，安裝步驟：

要求

Kubernetes 1.16+

安裝了Helm 版本 3.9+

將 Traefik Labs 圖表存儲(chǔ)庫(kù)添加到 Helm：

helm repo add traefik https://traefik.github.io/charts

您可以通過(guò)運(yùn)行以下命令來(lái)更新圖表存儲(chǔ)庫(kù)：

helm repo update

helm并使用命令行安裝它：

helm install traefik traefik/traefik

當(dāng)然實(shí)際安裝的時(shí)候，還需要根據(jù)自己的需求設(shè)置參數(shù)。

這種方式是比較簡(jiǎn)單的，但是對(duì)于我們需要更深入的了解Traefik Ingress Controller的人來(lái)說(shuō)，可能這種方式太過(guò)簡(jiǎn)單。

所以我這里采用CRD的方式安裝配置Traefik Ingress Controller

Traefik的路由方式有兩種，一種是傳統(tǒng)的Ingress一種是IngressRoute，這里部署讓兩種方式都支持。

1、部署crd，由于文件比較大，這里直接使用GitHub的文件連接

kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.9/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml

2、部署rbac

kubectl apply -f rbac.yaml

rbac.yaml：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.containo.us
    resources:
      - middlewares
      - middlewaretcps
      - ingressroutes
      - traefikservices
      - ingressroutetcps
      - ingressrouteudps
      - tlsoptions
      - tlsstores
      - serverstransports
    verbs:
      - get
      - list
      - watch
---
# 為 Traefik 創(chuàng)建一個(gè)專用服務(wù)帳戶
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: traefik-account
---
# 將角色綁定到帳戶上 將權(quán)限和規(guī)則應(yīng)用到帳戶上
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-account
    namespace: default

3、部署IngressClass（可選）

kubectl apply -f ingressClass.yaml

ingressClass.yaml:

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: traefik-lb
spec:
  controller: traefik.io/ingress-controller

4、部署traefik，這里采用DaemonSet，也可以采用Deployment

kubectl apply -f traefik-daemonset.yaml

traefik-daemonset.yaml:

---
apiVersion: v1
kind: Service
metadata:
  name: traefik-ingress-lb
  labels:
    app: traefik
  annotations:
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-id: lb-xxxxx   # 阿里云slb id，需要提前創(chuàng)建一個(gè)
    service.beta.kubernetes.io/alicloud-loadbalancer-force-override-listeners: 'true' #創(chuàng)建監(jiān)聽(tīng)
spec:
#  type: NodePort
  type: LoadBalancer
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
#      nodePort: 30080  #NodePort方式時(shí)，建議固定端口
    - name: https
      port: 443
      targetPort: 443
#      nodePort: 30433
      protocol: TCP
  selector:
    app: traefik
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
  namespace: default
  name: traefik-ingress-controller
  labels:
    app: traefik
spec:
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-account
      containers:
        - name: traefik
          image: traefik:v2.9
          args:
            - --api.insecure
            - --accesslog
            - --entrypoints.web.Address=:80
            - --entrypoints.websecure.Address=:443
            - --providers.kubernetescrd=true
            - --providers.kubernetesingress=true
            - --providers.kubernetesingress.ingressclass=traefik-lb
            - --providers.kubernetesingress.ingressendpoint.ip=xx.xx.xx.xx
#            - --providers.kubernetesingress.ingressendpoint.hostname=alb-xxxx.cn-chengdu.alb.aliyuncs.com
            - --certificatesresolvers.default.acme.tlschallenge
            - --certificatesresolvers.default.acme.email=foo@you.com
            - --certificatesresolvers.default.acme.storage=acme.json
            - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
          ports:
            - name: web
              containerPort: 80
            - name: websecure
              containerPort: 443
            - name: admin
              containerPort: 8080
          resources:
            limits:
              cpu: 1000m
              memory: 512Mi
            requests:
              cpu: 50m
              memory: 128Mi
          readinessProbe:
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 1
            failureThreshold: 5
            tcpSocket:
              port: 80
          livenessProbe:
            initialDelaySeconds: 120
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 3
            tcpSocket:
              port: 80

5、公開(kāi)traefik dashboard，實(shí)際使用中，建議加上登錄認(rèn)證。

kubectl apply -f traefik-admin.yaml

traefik-admin.yaml:

---
apiVersion: v1
kind: Service
metadata:
  name: traefik-admin
spec:
  ports:
    - protocol: TCP
      name: admin
      port: 80
      targetPort: 8080
  selector:
    app: traefik
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: admin-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  ingressClassName: traefik-lb
  rules:
  - host: dashboard.amd5.cn
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: traefik-admin
            port:
              number: 80

6、部署官方的whoami服務(wù)，驗(yàn)證IngressRoute路由。

kubectl apply -f whoami.yaml

whoami.yaml:

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  labels:
    app: whoami
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  selector:
    app: whoami
  ports:
    - name: web
      port: 80
      targetPort: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: whoami
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`whoami.amd5.cn`) && PathPrefix(`/`)
      kind: Rule
      services:
        - name: whoami
          port: 80

7、部署兩個(gè)nginx服務(wù)，驗(yàn)證Ingress路由。

kubectl apply -f nginx.yaml

nginx.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coffee
spec:
  replicas: 2
  selector:
    matchLabels:
      app: coffee
  template:
    metadata:
      labels:
        app: coffee
    spec:
      containers:
      - name: coffee
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: coffee-svc
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: coffee
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tea
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tea
  template:
    metadata:
      labels:
        app: tea
    spec:
      containers:
      - name: tea
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: tea-svc
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: tea
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: coffee-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  ingressClassName: "traefik-lb"
  rules:
  - host: coffee.amd5.cn
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: coffee-svc
            port:
              number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tea-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  ingressClassName: "traefik-lb"
  rules:
  - host: tea.amd5.cn
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: tea-svc
            port:
              number: 80

查看部署結(jié)果：

測(cè)試訪問(wèn)dashboard:

測(cè)試訪問(wèn)whoami:

測(cè)試訪問(wèn)nginx：