Create a Traefik Ingress Service

An Ingress is a collection of rules for authorizing access to Services in a cluster. You can configure forwarding rules to redirect different URLs to different Services in the cluster. This implements the business routing mechanism at the HTTP layer.

Prerequisites

To ensure proper running of an Ingress, an Ingress Controller must be deployed within a cluster to provide a unified portal for all backend Services. This example uses Traefik as the Ingress Controller in the cluster. The YAML file for deploying Traefik is as follows:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: kube-system
---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
---

kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: traefik-ingress-controller
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
      name: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      nodeSelector:
        kubernetes.io/role: "node"
      tolerations:
      - operator: Exists
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      containers:
      - image: hub.kce.ksyun.com/ksyun/traefik:v1.6.5-mp
        name: traefik-ingress-lb
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        args:
        - --api
        - --kubernetes
        - --logLevel=INFO
        - --entryPoints=Name:https Address::443 TLS
        - --entryPoints=Name:http Address::80
        - --defaultentrypoints=https,http
---

kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  type: LoadBalancer
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 443
      name: tls
    - protocol: TCP
      port: 8080
      name: admin

To allow the Traefik Service to be accessed outside the cluster, you need to change the access type of the Service corresponding to the Traefik Ingress Controller to LoadBalancer.

Check the deployment of Traefik.

[root@vm10-0-33-13 ~]# kubectl get ds -n kube-system | grep traefik
traefik-ingress-controller       2         2         2       2            2           kubernetes.io/role=node   3m16s

Check the corresponding Service.

[root@vm10-0-33-13 ~]# kubectl get svc -n kube-system | grep traefik
traefik-ingress-service   LoadBalancer   10.254.67.8     120.92.123.155   80:32676/TCP,443:31720/TCP,8080:31840/TCP   105m

The Traefik Ingress Controller is exposed to the Internet through Kingsoft Cloud SLB. Ports 80, 8080, and 443 are enabled. Ports 80 and 443 are service ports, and port 8080 is a UI port. You can access the UI of Traefik by using the IP address and port 8080 of SLB.

Create test applications

Two applications are created for testing.

The hello-world.yaml file is as follows:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: hello-world
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: hello-world
    spec:
      containers:
      - name: hello-world
        image: hub.kce.ksyun.com/kingsoft/hello-world:latest
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: hello-world
  name: hello-world-svc
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: hello-world
  type: ClusterIP

The hello-k8s.yaml file is as follows:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: hello-k8s
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: hello-k8s
    spec:
      containers:
      - name: hello-k8s
        image: hub.kce.ksyun.com/kingsoft/hello-k8s:latest
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: hello-k8s
  name: hello-k8s-svc
spec:
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app: hello-k8s
  type: ClusterIP

Create the corresponding Deployment and Service.

[root@vm10-0-33-13 hello]# kubectl create -f hello-k8s.yaml 
deployment.extensions/hello-k8s created
service/hello-k8s-svc created

[root@vm10-0-33-13 hello]# kubectl create -f hello-world.yaml 
deployment.extensions/hello-world created
service/hello-world-svc created

[root@vm10-0-33-13 hello]# kubectl get deploy
NAME          DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
hello-k8s     1         1         1            1           5m2s
hello-world   1         1         1            1           4m50s

[root@vm10-0-33-13 hello]# kubectl get svc
NAME              TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
hello-k8s-svc     ClusterIP   10.254.131.29   <none>        8080/TCP   5m31s
hello-world-svc   ClusterIP   10.254.244.96   <none>        80/TCP     5m19s
kubernetes        ClusterIP   10.254.0.1      <none>        443/TCP    52d

Ingress configuration policy

An Ingress policy can be configured based on different distribution methods to achieve flexible distribution. The following section describes common Ingress forwarding policies.

Redirect different URLs of the same domain to different Services

Typically, this configuration is used when a website uses different URLs to provide different Services.

Access configuration:

• Access to http://my.k8s.traefik/hello-k8s is routed to the backend Service named "hello-k8s-svc".
• Access to http://my.k8s.traefik/hello-world is routed to the backend Service named "hello-world-svc".

The ingress.yaml file is as follows:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-k8s-traefik
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.frontend.rule.type: PathPrefixStrip
spec:
  rules:
  - host: my.k8s.traefik
    http:
      paths:
      - path: /hello-world
        backend:
          serviceName: hello-world-svc
          servicePort: 80
      - path: /hello-k8s
        backend:
          serviceName: hello-k8s-svc
          servicePort: 8080

Create an Ingress policy.

[root@vm10-0-33-13 hello]# kubectl create -f ingres.yaml 
ingress.extensions/my-k8s-traefik created

[root@vm10-0-33-13 hello]# kubectl get ingress
NAME             HOSTS            ADDRESS   PORTS   AGE
my-k8s-traefik   my.k8s.traefik             80      73s

Notes:

• The domain name my.k8s.traefik is resolved to the IP address of SLB.
• To enable traffic forwarding by URL, specify the rule as PathPrefixStrip: traefik.frontend.rule.type: PathPrefixStrip.

The following figures show access verification in a browser.

Redirect different domains to different Services

Typically, this configuration is used when a website uses different domains or virtual hosts to provide different Services.

Access configuration:

• Access to http://traefik.hello.k8s is routed to the backend Service named "hello-k8s-svc".
• Access to http://traefik.hello.world is routed to the backend Service named "hello-world-svc".

The ingress2.yaml file is as follows:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-k8s-traefik-1
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: traefik.hello.k8s
    http:
      paths:
      - path: /  
        backend:
          serviceName: hello-k8s-svc
          servicePort: 8080
  - host: traefik.hello.world
    http:
      paths:
      - path: /  
        backend:
          serviceName: hello-world-svc
          servicePort: 80

[root@vm10-0-33-13 hello]# kubectl create -f ingress2.yaml 
ingress.extensions/my-k8s-traefik-1 created

[root@vm10-0-33-13 hello]# kubectl get ingress
NAME               HOSTS                                   ADDRESS   PORTS   AGE
my-k8s-traefik-1   traefik.hello.k8s,traefik.hello.world             80      21s

The following figures show access verification in a browser.

You can check the configured Ingress policy on the UI of Traefik.

For more information about Traefik, see Kubernetes Ingress Controller.