EKS生产环境部署基于NLB的traefik网关

使用helm部署,并以NLB类型的负载均衡器暴露服务,并开启Gateway API

Helm 安装命令

shell 复制代码
# 添加traefik helm仓库
helm repo add traefik https://traefik.github.io/charts
# 安装
helm install -f values.yaml traefik traefik/traefik -n traefik --create-namespace
# 更新
helm upgrade --install -f values.yaml traefik traefik/traefik -n traefik
# 卸载
helm uninstall traefik -n traefik

values.yaml 文件

yaml 复制代码
image:
  registry: docker.io
  repository: traefik
  tag: v3.5.0
  pullPolicy: IfNotPresent

deployment:
  enabled: true
  # -- Deployment or DaemonSet
  kind: Deployment
  type: LoadBalancer
  # -- Number of pods of the deployment (only applies when kind == Deployment)
  replicas: 2

service:
  annotations:
    # 以NLB方式暴露服务,集群中需要提前部署aws-load-balancer-controller
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*" # 开启NLB代理协议v2,用于后端服务获取真实ip

ports:
  web:
    port: 8000
    expose:
      default: true
    exposedPort: 80
    protocol: TCP
    # 开启代理协议和信任ip网段(由于负载均衡器在vpc内部,此处填写vpc的网段)
    proxyProtocol:
      trustedIPs:
        - "10.1.0.0/16"
  websecure:
    port: 8443
    expose:
      default: true
    exposedPort: 443
    protocol: TCP
    # 开启代理协议和信任ip网段(由于负载均衡器在vpc内部,此处填写vpc的网段)
    proxyProtocol:
      trustedIPs:
        - "10.1.0.0/16"

# 启用 Gateway API provider,关闭 Ingress
providers:
  kubernetesGateway:
    enabled: true
  kubernetesIngress:
    enabled: false

logs:
  general:
    level: INFO
  access:
    enabled: true
    fields:
      headers:
        defaultmode: keep
        names:
          X-Forwarded-For: keep
          X-Real-Ip: keep

验证效果

创建secret资源保存证书

shell 复制代码
kubectl create secret tls example.com \
--cert=/cert/example.com.pem \
--key=/cert/example.com.key \
-n default

创建Gateway资源

yaml 复制代码
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: default-gateway
  namespace: default
spec:
  gatewayClassName: traefik

  listeners:
    - name: web
      protocol: HTTP
      port: 8000
      allowedRoutes:
        namespaces:
          from: All

    - name: websecure
      protocol: HTTPS
      port: 8443
      tls:
        # https终止
        mode: Terminate
        certificateRefs:
          - name: example.com
            namespace: default
      allowedRoutes:
        namespaces:
          from: All

创建HTTPRoute资源

yaml 复制代码
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: test-nginx-http
  namespace: default
spec:
  parentRefs:
    - name: default-gateway
      sectionName: web
      kind: Gateway
  hostnames:
    - demo.example.com
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: test-nginx-https
  namespace: default
spec:
  parentRefs:
    - name: default-gateway
      sectionName: websecure
      kind: Gateway
  hostnames:
    - demo.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        # nginx测试服务需要提前创建好
        - name: nginx-service
          # HTTPRoute资源和后端服务需要在同一个命名空间,否则需要创建ReferenceGrant资源进行授权
          namespace: default
          port: 80
相关推荐
‍。。。2 小时前
ubuntu 安装 vllm
linux·运维·ubuntu
forestqq3 小时前
华为L420国产笔记本(统信UOS桌面专业版1070)安装openEuler2403虚拟机
运维·虚拟化·统信
zzz100663 小时前
Shell 编程基础(续):流程控制与实践
linux·运维·服务器
三坛海会大神5555 小时前
《Shell 大道:筑基篇(下)—— 流控筑根基,数据任驱驰》
linux·运维·服务器·bash
key_Go6 小时前
03.《交换的底层逻辑:从基础到应用》
运维·服务器·网络
武汉格发Gofartlic7 小时前
HFSS许可证状态查询与管理
大数据·运维·人工智能·数据分析·自动化
淮北4948 小时前
linux系统学习(15.启动管理)
运维·服务器·网络·c++·vscode·学习
半梦半醒*9 小时前
playbook剧本
linux·运维·服务器·ssh·ansible·运维开发