Traefik & CRD & Let’s Encrypt

Traefik with an IngressRoute Custom Resource Definition for Kubernetes, and TLS Through Let’s Encrypt.

This document is intended to be a fully working example demonstrating how to set up Traefik in Kubernetes, with the dynamic configuration coming from the IngressRoute Custom Resource, and TLS setup with Let’s Encrypt. However, for the sake of simplicity, we’re using k3s docker image for the Kubernetes cluster setup.

Please note that for this setup, given that we’re going to use ACME’s TLS-ALPN-01 challenge, the host you’ll be running it on must be able to receive connections from the outside on port 443. And of course its internet facing IP address must match the domain name you intend to use.

In the following, the Kubernetes resources defined in YAML configuration files can be applied to the setup in two different ways:

  • the first, and usual way, is simply with the kubectl apply command.
  • the second, which can be used for this tutorial, is to directly place the files in the directory used by the k3s docker image for such inputs (/var/lib/rancher/k3s/server/manifests).

Kubectl Version

With the rancher/k3s version used in this guide (0.8.0), the kubectl version needs to be >= 1.11.

k3s Docker-compose Configuration

Our starting point is the docker-compose configuration file, to start the k3s cluster. You can start it with:

  1. docker-compose -f k3s.yml up
  1. server:
  2. image: rancher/k3s:v1.17.2-k3s1
  3. command: server --disable-agent --no-deploy traefik
  4. environment:
  5. - K3S_CLUSTER_SECRET=somethingtotallyrandom
  6. - K3S_KUBECONFIG_OUTPUT=/output/kubeconfig.yaml
  7. - K3S_KUBECONFIG_MODE=666
  8. volumes:
  9. # k3s will generate a kubeconfig.yaml in this directory. This volume is mounted
  10. # on your host, so you can then 'export KUBECONFIG=/somewhere/on/your/host/out/kubeconfig.yaml',
  11. # in order for your kubectl commands to work.
  12. - /somewhere/on/your/host/out:/output
  13. # This directory is where you put all the (yaml) configuration files of
  14. # the Kubernetes resources.
  15. - /somewhere/on/your/host/in:/var/lib/rancher/k3s/server/manifests
  16. ports:
  17. - 6443:6443
  18. node:
  19. image: rancher/k3s:v1.17.2-k3s1
  20. privileged: true
  21. links:
  22. - server
  23. environment:
  24. - K3S_URL=https://server:6443
  25. - K3S_CLUSTER_SECRET=somethingtotallyrandom
  26. volumes:
  27. # this is where you would place a alternative traefik image (saved as a .tar file with
  28. # 'docker save'), if you want to use it, instead of the traefik:v2.7 image.
  29. - /somewhere/on/your/host/custom-image:/var/lib/rancher/k3s/agent/images

Cluster Resources

Let’s now have a look (in the order they should be applied, if using kubectl apply) at all the required resources for the full setup.

IngressRoute Definition

First, the definition of the IngressRoute and the Middleware kinds. Also note the RBAC authorization resources; they’ll be referenced through the serviceAccountName of the deployment, later on.

  1. ---
  2. apiVersion: apiextensions.k8s.io/v1
  3. kind: CustomResourceDefinition
  4. metadata:
  5. annotations:
  6. controller-gen.kubebuilder.io/version: v0.6.2
  7. creationTimestamp: null
  8. name: ingressroutes.traefik.containo.us
  9. spec:
  10. group: traefik.containo.us
  11. names:
  12. kind: IngressRoute
  13. listKind: IngressRouteList
  14. plural: ingressroutes
  15. singular: ingressroute
  16. scope: Namespaced
  17. versions:
  18. - name: v1alpha1
  19. schema:
  20. openAPIV3Schema:
  21. description: IngressRoute is an Ingress CRD specification.
  22. properties:
  23. apiVersion:
  24. description: 'APIVersion defines the versioned schema of this representation
  25. of an object. Servers should convert recognized schemas to the latest
  26. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  27. type: string
  28. kind:
  29. description: 'Kind is a string value representing the REST resource this
  30. object represents. Servers may infer this from the endpoint the client
  31. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  32. type: string
  33. metadata:
  34. type: object
  35. spec:
  36. description: IngressRouteSpec is a specification for a IngressRouteSpec
  37. resource.
  38. properties:
  39. entryPoints:
  40. items:
  41. type: string
  42. type: array
  43. routes:
  44. items:
  45. description: Route contains the set of routes.
  46. properties:
  47. kind:
  48. enum:
  49. - Rule
  50. type: string
  51. match:
  52. type: string
  53. middlewares:
  54. items:
  55. description: MiddlewareRef is a ref to the Middleware resources.
  56. properties:
  57. name:
  58. type: string
  59. namespace:
  60. type: string
  61. required:
  62. - name
  63. type: object
  64. type: array
  65. priority:
  66. type: integer
  67. services:
  68. items:
  69. description: Service defines an upstream to proxy traffic.
  70. properties:
  71. kind:
  72. enum:
  73. - Service
  74. - TraefikService
  75. type: string
  76. name:
  77. description: Name is a reference to a Kubernetes Service
  78. object (for a load-balancer of servers), or to a TraefikService
  79. object (service load-balancer, mirroring, etc). The
  80. differentiation between the two is specified in the
  81. Kind field.
  82. type: string
  83. namespace:
  84. type: string
  85. passHostHeader:
  86. type: boolean
  87. port:
  88. anyOf:
  89. - type: integer
  90. - type: string
  91. x-kubernetes-int-or-string: true
  92. responseForwarding:
  93. description: ResponseForwarding holds configuration for
  94. the forward of the response.
  95. properties:
  96. flushInterval:
  97. type: string
  98. type: object
  99. scheme:
  100. type: string
  101. serversTransport:
  102. type: string
  103. sticky:
  104. description: Sticky holds the sticky configuration.
  105. properties:
  106. cookie:
  107. description: Cookie holds the sticky configuration
  108. based on cookie.
  109. properties:
  110. httpOnly:
  111. type: boolean
  112. name:
  113. type: string
  114. sameSite:
  115. type: string
  116. secure:
  117. type: boolean
  118. type: object
  119. type: object
  120. strategy:
  121. type: string
  122. weight:
  123. description: Weight should only be specified when Name
  124. references a TraefikService object (and to be precise,
  125. one that embeds a Weighted Round Robin).
  126. type: integer
  127. required:
  128. - name
  129. type: object
  130. type: array
  131. required:
  132. - kind
  133. - match
  134. type: object
  135. type: array
  136. tls:
  137. description: "TLS contains the TLS certificates configuration of the
  138. routes. To enable Let's Encrypt, use an empty TLS struct, e.g. in
  139. YAML: \n \t tls: {} # inline format \n \t tls: \t secretName:
  140. # block format"
  141. properties:
  142. certResolver:
  143. type: string
  144. domains:
  145. items:
  146. description: Domain holds a domain name with SANs.
  147. properties:
  148. main:
  149. type: string
  150. sans:
  151. items:
  152. type: string
  153. type: array
  154. type: object
  155. type: array
  156. options:
  157. description: Options is a reference to a TLSOption, that specifies
  158. the parameters of the TLS connection.
  159. properties:
  160. name:
  161. type: string
  162. namespace:
  163. type: string
  164. required:
  165. - name
  166. type: object
  167. secretName:
  168. description: SecretName is the name of the referenced Kubernetes
  169. Secret to specify the certificate details.
  170. type: string
  171. store:
  172. description: Store is a reference to a TLSStore, that specifies
  173. the parameters of the TLS store.
  174. properties:
  175. name:
  176. type: string
  177. namespace:
  178. type: string
  179. required:
  180. - name
  181. type: object
  182. type: object
  183. required:
  184. - routes
  185. type: object
  186. required:
  187. - metadata
  188. - spec
  189. type: object
  190. served: true
  191. storage: true
  192. status:
  193. acceptedNames:
  194. kind: ""
  195. plural: ""
  196. conditions: []
  197. storedVersions: []
  198. ---
  199. apiVersion: apiextensions.k8s.io/v1
  200. kind: CustomResourceDefinition
  201. metadata:
  202. annotations:
  203. controller-gen.kubebuilder.io/version: v0.6.2
  204. creationTimestamp: null
  205. name: ingressroutetcps.traefik.containo.us
  206. spec:
  207. group: traefik.containo.us
  208. names:
  209. kind: IngressRouteTCP
  210. listKind: IngressRouteTCPList
  211. plural: ingressroutetcps
  212. singular: ingressroutetcp
  213. scope: Namespaced
  214. versions:
  215. - name: v1alpha1
  216. schema:
  217. openAPIV3Schema:
  218. description: IngressRouteTCP is an Ingress CRD specification.
  219. properties:
  220. apiVersion:
  221. description: 'APIVersion defines the versioned schema of this representation
  222. of an object. Servers should convert recognized schemas to the latest
  223. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  224. type: string
  225. kind:
  226. description: 'Kind is a string value representing the REST resource this
  227. object represents. Servers may infer this from the endpoint the client
  228. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  229. type: string
  230. metadata:
  231. type: object
  232. spec:
  233. description: IngressRouteTCPSpec is a specification for a IngressRouteTCPSpec
  234. resource.
  235. properties:
  236. entryPoints:
  237. items:
  238. type: string
  239. type: array
  240. routes:
  241. items:
  242. description: RouteTCP contains the set of routes.
  243. properties:
  244. match:
  245. type: string
  246. middlewares:
  247. description: Middlewares contains references to MiddlewareTCP
  248. resources.
  249. items:
  250. description: ObjectReference is a generic reference to a Traefik
  251. resource.
  252. properties:
  253. name:
  254. type: string
  255. namespace:
  256. type: string
  257. required:
  258. - name
  259. type: object
  260. type: array
  261. priority:
  262. type: integer
  263. services:
  264. items:
  265. description: ServiceTCP defines an upstream to proxy traffic.
  266. properties:
  267. name:
  268. type: string
  269. namespace:
  270. type: string
  271. port:
  272. anyOf:
  273. - type: integer
  274. - type: string
  275. x-kubernetes-int-or-string: true
  276. proxyProtocol:
  277. description: ProxyProtocol holds the ProxyProtocol configuration.
  278. properties:
  279. version:
  280. type: integer
  281. type: object
  282. terminationDelay:
  283. type: integer
  284. weight:
  285. type: integer
  286. required:
  287. - name
  288. - port
  289. type: object
  290. type: array
  291. required:
  292. - match
  293. type: object
  294. type: array
  295. tls:
  296. description: "TLSTCP contains the TLS certificates configuration of
  297. the routes. To enable Let's Encrypt, use an empty TLS struct, e.g.
  298. in YAML: \n \t tls: {} # inline format \n \t tls: \t secretName:
  299. # block format"
  300. properties:
  301. certResolver:
  302. type: string
  303. domains:
  304. items:
  305. description: Domain holds a domain name with SANs.
  306. properties:
  307. main:
  308. type: string
  309. sans:
  310. items:
  311. type: string
  312. type: array
  313. type: object
  314. type: array
  315. options:
  316. description: Options is a reference to a TLSOption, that specifies
  317. the parameters of the TLS connection.
  318. properties:
  319. name:
  320. type: string
  321. namespace:
  322. type: string
  323. required:
  324. - name
  325. type: object
  326. passthrough:
  327. type: boolean
  328. secretName:
  329. description: SecretName is the name of the referenced Kubernetes
  330. Secret to specify the certificate details.
  331. type: string
  332. store:
  333. description: Store is a reference to a TLSStore, that specifies
  334. the parameters of the TLS store.
  335. properties:
  336. name:
  337. type: string
  338. namespace:
  339. type: string
  340. required:
  341. - name
  342. type: object
  343. type: object
  344. required:
  345. - routes
  346. type: object
  347. required:
  348. - metadata
  349. - spec
  350. type: object
  351. served: true
  352. storage: true
  353. status:
  354. acceptedNames:
  355. kind: ""
  356. plural: ""
  357. conditions: []
  358. storedVersions: []
  359. ---
  360. apiVersion: apiextensions.k8s.io/v1
  361. kind: CustomResourceDefinition
  362. metadata:
  363. annotations:
  364. controller-gen.kubebuilder.io/version: v0.6.2
  365. creationTimestamp: null
  366. name: ingressrouteudps.traefik.containo.us
  367. spec:
  368. group: traefik.containo.us
  369. names:
  370. kind: IngressRouteUDP
  371. listKind: IngressRouteUDPList
  372. plural: ingressrouteudps
  373. singular: ingressrouteudp
  374. scope: Namespaced
  375. versions:
  376. - name: v1alpha1
  377. schema:
  378. openAPIV3Schema:
  379. description: IngressRouteUDP is an Ingress CRD specification.
  380. properties:
  381. apiVersion:
  382. description: 'APIVersion defines the versioned schema of this representation
  383. of an object. Servers should convert recognized schemas to the latest
  384. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  385. type: string
  386. kind:
  387. description: 'Kind is a string value representing the REST resource this
  388. object represents. Servers may infer this from the endpoint the client
  389. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  390. type: string
  391. metadata:
  392. type: object
  393. spec:
  394. description: IngressRouteUDPSpec is a specification for a IngressRouteUDPSpec
  395. resource.
  396. properties:
  397. entryPoints:
  398. items:
  399. type: string
  400. type: array
  401. routes:
  402. items:
  403. description: RouteUDP contains the set of routes.
  404. properties:
  405. services:
  406. items:
  407. description: ServiceUDP defines an upstream to proxy traffic.
  408. properties:
  409. name:
  410. type: string
  411. namespace:
  412. type: string
  413. port:
  414. anyOf:
  415. - type: integer
  416. - type: string
  417. x-kubernetes-int-or-string: true
  418. weight:
  419. type: integer
  420. required:
  421. - name
  422. - port
  423. type: object
  424. type: array
  425. type: object
  426. type: array
  427. required:
  428. - routes
  429. type: object
  430. required:
  431. - metadata
  432. - spec
  433. type: object
  434. served: true
  435. storage: true
  436. status:
  437. acceptedNames:
  438. kind: ""
  439. plural: ""
  440. conditions: []
  441. storedVersions: []
  442. ---
  443. apiVersion: apiextensions.k8s.io/v1
  444. kind: CustomResourceDefinition
  445. metadata:
  446. annotations:
  447. controller-gen.kubebuilder.io/version: v0.6.2
  448. creationTimestamp: null
  449. name: middlewares.traefik.containo.us
  450. spec:
  451. group: traefik.containo.us
  452. names:
  453. kind: Middleware
  454. listKind: MiddlewareList
  455. plural: middlewares
  456. singular: middleware
  457. scope: Namespaced
  458. versions:
  459. - name: v1alpha1
  460. schema:
  461. openAPIV3Schema:
  462. description: Middleware is a specification for a Middleware resource.
  463. properties:
  464. apiVersion:
  465. description: 'APIVersion defines the versioned schema of this representation
  466. of an object. Servers should convert recognized schemas to the latest
  467. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  468. type: string
  469. kind:
  470. description: 'Kind is a string value representing the REST resource this
  471. object represents. Servers may infer this from the endpoint the client
  472. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  473. type: string
  474. metadata:
  475. type: object
  476. spec:
  477. description: MiddlewareSpec holds the Middleware configuration.
  478. properties:
  479. addPrefix:
  480. description: AddPrefix holds the AddPrefix configuration.
  481. properties:
  482. prefix:
  483. type: string
  484. type: object
  485. basicAuth:
  486. description: BasicAuth holds the HTTP basic authentication configuration.
  487. properties:
  488. headerField:
  489. type: string
  490. realm:
  491. type: string
  492. removeHeader:
  493. type: boolean
  494. secret:
  495. type: string
  496. type: object
  497. buffering:
  498. description: Buffering holds the request/response buffering configuration.
  499. properties:
  500. maxRequestBodyBytes:
  501. format: int64
  502. type: integer
  503. maxResponseBodyBytes:
  504. format: int64
  505. type: integer
  506. memRequestBodyBytes:
  507. format: int64
  508. type: integer
  509. memResponseBodyBytes:
  510. format: int64
  511. type: integer
  512. retryExpression:
  513. type: string
  514. type: object
  515. chain:
  516. description: Chain holds a chain of middlewares.
  517. properties:
  518. middlewares:
  519. items:
  520. description: MiddlewareRef is a ref to the Middleware resources.
  521. properties:
  522. name:
  523. type: string
  524. namespace:
  525. type: string
  526. required:
  527. - name
  528. type: object
  529. type: array
  530. type: object
  531. circuitBreaker:
  532. description: CircuitBreaker holds the circuit breaker configuration.
  533. properties:
  534. expression:
  535. type: string
  536. type: object
  537. compress:
  538. description: Compress holds the compress configuration.
  539. properties:
  540. excludedContentTypes:
  541. items:
  542. type: string
  543. type: array
  544. minResponseBodyBytes:
  545. type: integer
  546. type: object
  547. contentType:
  548. description: ContentType middleware - or rather its unique `autoDetect`
  549. option - specifies whether to let the `Content-Type` header, if
  550. it has not been set by the backend, be automatically set to a value
  551. derived from the contents of the response. As a proxy, the default
  552. behavior should be to leave the header alone, regardless of what
  553. the backend did with it. However, the historic default was to always
  554. auto-detect and set the header if it was nil, and it is going to
  555. be kept that way in order to support users currently relying on
  556. it. This middleware exists to enable the correct behavior until
  557. at least the default one can be changed in a future version.
  558. properties:
  559. autoDetect:
  560. type: boolean
  561. type: object
  562. digestAuth:
  563. description: DigestAuth holds the Digest HTTP authentication configuration.
  564. properties:
  565. headerField:
  566. type: string
  567. realm:
  568. type: string
  569. removeHeader:
  570. type: boolean
  571. secret:
  572. type: string
  573. type: object
  574. errors:
  575. description: ErrorPage holds the custom error page configuration.
  576. properties:
  577. query:
  578. type: string
  579. service:
  580. description: Service defines an upstream to proxy traffic.
  581. properties:
  582. kind:
  583. enum:
  584. - Service
  585. - TraefikService
  586. type: string
  587. name:
  588. description: Name is a reference to a Kubernetes Service object
  589. (for a load-balancer of servers), or to a TraefikService
  590. object (service load-balancer, mirroring, etc). The differentiation
  591. between the two is specified in the Kind field.
  592. type: string
  593. namespace:
  594. type: string
  595. passHostHeader:
  596. type: boolean
  597. port:
  598. anyOf:
  599. - type: integer
  600. - type: string
  601. x-kubernetes-int-or-string: true
  602. responseForwarding:
  603. description: ResponseForwarding holds configuration for the
  604. forward of the response.
  605. properties:
  606. flushInterval:
  607. type: string
  608. type: object
  609. scheme:
  610. type: string
  611. serversTransport:
  612. type: string
  613. sticky:
  614. description: Sticky holds the sticky configuration.
  615. properties:
  616. cookie:
  617. description: Cookie holds the sticky configuration based
  618. on cookie.
  619. properties:
  620. httpOnly:
  621. type: boolean
  622. name:
  623. type: string
  624. sameSite:
  625. type: string
  626. secure:
  627. type: boolean
  628. type: object
  629. type: object
  630. strategy:
  631. type: string
  632. weight:
  633. description: Weight should only be specified when Name references
  634. a TraefikService object (and to be precise, one that embeds
  635. a Weighted Round Robin).
  636. type: integer
  637. required:
  638. - name
  639. type: object
  640. status:
  641. items:
  642. type: string
  643. type: array
  644. type: object
  645. forwardAuth:
  646. description: ForwardAuth holds the http forward authentication configuration.
  647. properties:
  648. address:
  649. type: string
  650. authRequestHeaders:
  651. items:
  652. type: string
  653. type: array
  654. authResponseHeaders:
  655. items:
  656. type: string
  657. type: array
  658. authResponseHeadersRegex:
  659. type: string
  660. tls:
  661. description: ClientTLS holds TLS specific configurations as client.
  662. properties:
  663. caOptional:
  664. type: boolean
  665. caSecret:
  666. type: string
  667. certSecret:
  668. type: string
  669. insecureSkipVerify:
  670. type: boolean
  671. type: object
  672. trustForwardHeader:
  673. type: boolean
  674. type: object
  675. headers:
  676. description: Headers holds the custom header configuration.
  677. properties:
  678. accessControlAllowCredentials:
  679. description: AccessControlAllowCredentials is only valid if true.
  680. false is ignored.
  681. type: boolean
  682. accessControlAllowHeaders:
  683. description: AccessControlAllowHeaders must be used in response
  684. to a preflight request with Access-Control-Request-Headers set.
  685. items:
  686. type: string
  687. type: array
  688. accessControlAllowMethods:
  689. description: AccessControlAllowMethods must be used in response
  690. to a preflight request with Access-Control-Request-Method set.
  691. items:
  692. type: string
  693. type: array
  694. accessControlAllowOriginList:
  695. description: AccessControlAllowOriginList is a list of allowable
  696. origins. Can also be a wildcard origin "*".
  697. items:
  698. type: string
  699. type: array
  700. accessControlAllowOriginListRegex:
  701. description: AccessControlAllowOriginListRegex is a list of allowable
  702. origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  703. items:
  704. type: string
  705. type: array
  706. accessControlExposeHeaders:
  707. description: AccessControlExposeHeaders sets valid headers for
  708. the response.
  709. items:
  710. type: string
  711. type: array
  712. accessControlMaxAge:
  713. description: AccessControlMaxAge sets the time that a preflight
  714. request may be cached.
  715. format: int64
  716. type: integer
  717. addVaryHeader:
  718. description: AddVaryHeader controls if the Vary header is automatically
  719. added/updated when the AccessControlAllowOriginList is set.
  720. type: boolean
  721. allowedHosts:
  722. items:
  723. type: string
  724. type: array
  725. browserXssFilter:
  726. type: boolean
  727. contentSecurityPolicy:
  728. type: string
  729. contentTypeNosniff:
  730. type: boolean
  731. customBrowserXSSValue:
  732. type: string
  733. customFrameOptionsValue:
  734. type: string
  735. customRequestHeaders:
  736. additionalProperties:
  737. type: string
  738. type: object
  739. customResponseHeaders:
  740. additionalProperties:
  741. type: string
  742. type: object
  743. featurePolicy:
  744. description: 'Deprecated: use PermissionsPolicy instead.'
  745. type: string
  746. forceSTSHeader:
  747. type: boolean
  748. frameDeny:
  749. type: boolean
  750. hostsProxyHeaders:
  751. items:
  752. type: string
  753. type: array
  754. isDevelopment:
  755. type: boolean
  756. permissionsPolicy:
  757. type: string
  758. publicKey:
  759. type: string
  760. referrerPolicy:
  761. type: string
  762. sslForceHost:
  763. description: 'Deprecated: use RedirectRegex instead.'
  764. type: boolean
  765. sslHost:
  766. description: 'Deprecated: use RedirectRegex instead.'
  767. type: string
  768. sslProxyHeaders:
  769. additionalProperties:
  770. type: string
  771. type: object
  772. sslRedirect:
  773. description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  774. instead.'
  775. type: boolean
  776. sslTemporaryRedirect:
  777. description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  778. instead.'
  779. type: boolean
  780. stsIncludeSubdomains:
  781. type: boolean
  782. stsPreload:
  783. type: boolean
  784. stsSeconds:
  785. format: int64
  786. type: integer
  787. type: object
  788. inFlightReq:
  789. description: InFlightReq limits the number of requests being processed
  790. and served concurrently.
  791. properties:
  792. amount:
  793. format: int64
  794. type: integer
  795. sourceCriterion:
  796. description: SourceCriterion defines what criterion is used to
  797. group requests as originating from a common source. If none
  798. are set, the default is to use the request's remote address
  799. field. All fields are mutually exclusive.
  800. properties:
  801. ipStrategy:
  802. description: IPStrategy holds the ip strategy configuration.
  803. properties:
  804. depth:
  805. type: integer
  806. excludedIPs:
  807. items:
  808. type: string
  809. type: array
  810. type: object
  811. requestHeaderName:
  812. type: string
  813. requestHost:
  814. type: boolean
  815. type: object
  816. type: object
  817. ipWhiteList:
  818. description: IPWhiteList holds the ip white list configuration.
  819. properties:
  820. ipStrategy:
  821. description: IPStrategy holds the ip strategy configuration.
  822. properties:
  823. depth:
  824. type: integer
  825. excludedIPs:
  826. items:
  827. type: string
  828. type: array
  829. type: object
  830. sourceRange:
  831. items:
  832. type: string
  833. type: array
  834. type: object
  835. passTLSClientCert:
  836. description: PassTLSClientCert holds the TLS client cert headers configuration.
  837. properties:
  838. info:
  839. description: TLSClientCertificateInfo holds the client TLS certificate
  840. info configuration.
  841. properties:
  842. issuer:
  843. description: TLSClientCertificateIssuerDNInfo holds the client
  844. TLS certificate distinguished name info configuration. cf
  845. https://tools.ietf.org/html/rfc3739
  846. properties:
  847. commonName:
  848. type: boolean
  849. country:
  850. type: boolean
  851. domainComponent:
  852. type: boolean
  853. locality:
  854. type: boolean
  855. organization:
  856. type: boolean
  857. province:
  858. type: boolean
  859. serialNumber:
  860. type: boolean
  861. type: object
  862. notAfter:
  863. type: boolean
  864. notBefore:
  865. type: boolean
  866. sans:
  867. type: boolean
  868. serialNumber:
  869. type: boolean
  870. subject:
  871. description: TLSClientCertificateSubjectDNInfo holds the client
  872. TLS certificate distinguished name info configuration. cf
  873. https://tools.ietf.org/html/rfc3739
  874. properties:
  875. commonName:
  876. type: boolean
  877. country:
  878. type: boolean
  879. domainComponent:
  880. type: boolean
  881. locality:
  882. type: boolean
  883. organization:
  884. type: boolean
  885. organizationalUnit:
  886. type: boolean
  887. province:
  888. type: boolean
  889. serialNumber:
  890. type: boolean
  891. type: object
  892. type: object
  893. pem:
  894. type: boolean
  895. type: object
  896. plugin:
  897. additionalProperties:
  898. x-kubernetes-preserve-unknown-fields: true
  899. type: object
  900. rateLimit:
  901. description: RateLimit holds the rate limiting configuration for a
  902. given router.
  903. properties:
  904. average:
  905. format: int64
  906. type: integer
  907. burst:
  908. format: int64
  909. type: integer
  910. period:
  911. anyOf:
  912. - type: integer
  913. - type: string
  914. x-kubernetes-int-or-string: true
  915. sourceCriterion:
  916. description: SourceCriterion defines what criterion is used to
  917. group requests as originating from a common source. If none
  918. are set, the default is to use the request's remote address
  919. field. All fields are mutually exclusive.
  920. properties:
  921. ipStrategy:
  922. description: IPStrategy holds the ip strategy configuration.
  923. properties:
  924. depth:
  925. type: integer
  926. excludedIPs:
  927. items:
  928. type: string
  929. type: array
  930. type: object
  931. requestHeaderName:
  932. type: string
  933. requestHost:
  934. type: boolean
  935. type: object
  936. type: object
  937. redirectRegex:
  938. description: RedirectRegex holds the redirection configuration.
  939. properties:
  940. permanent:
  941. type: boolean
  942. regex:
  943. type: string
  944. replacement:
  945. type: string
  946. type: object
  947. redirectScheme:
  948. description: RedirectScheme holds the scheme redirection configuration.
  949. properties:
  950. permanent:
  951. type: boolean
  952. port:
  953. type: string
  954. scheme:
  955. type: string
  956. type: object
  957. replacePath:
  958. description: ReplacePath holds the ReplacePath configuration.
  959. properties:
  960. path:
  961. type: string
  962. type: object
  963. replacePathRegex:
  964. description: ReplacePathRegex holds the ReplacePathRegex configuration.
  965. properties:
  966. regex:
  967. type: string
  968. replacement:
  969. type: string
  970. type: object
  971. retry:
  972. description: Retry holds the retry configuration.
  973. properties:
  974. attempts:
  975. type: integer
  976. initialInterval:
  977. anyOf:
  978. - type: integer
  979. - type: string
  980. x-kubernetes-int-or-string: true
  981. type: object
  982. stripPrefix:
  983. description: StripPrefix holds the StripPrefix configuration.
  984. properties:
  985. forceSlash:
  986. type: boolean
  987. prefixes:
  988. items:
  989. type: string
  990. type: array
  991. type: object
  992. stripPrefixRegex:
  993. description: StripPrefixRegex holds the StripPrefixRegex configuration.
  994. properties:
  995. regex:
  996. items:
  997. type: string
  998. type: array
  999. type: object
  1000. type: object
  1001. required:
  1002. - metadata
  1003. - spec
  1004. type: object
  1005. served: true
  1006. storage: true
  1007. status:
  1008. acceptedNames:
  1009. kind: ""
  1010. plural: ""
  1011. conditions: []
  1012. storedVersions: []
  1013. ---
  1014. apiVersion: apiextensions.k8s.io/v1
  1015. kind: CustomResourceDefinition
  1016. metadata:
  1017. annotations:
  1018. controller-gen.kubebuilder.io/version: v0.6.2
  1019. creationTimestamp: null
  1020. name: middlewaretcps.traefik.containo.us
  1021. spec:
  1022. group: traefik.containo.us
  1023. names:
  1024. kind: MiddlewareTCP
  1025. listKind: MiddlewareTCPList
  1026. plural: middlewaretcps
  1027. singular: middlewaretcp
  1028. scope: Namespaced
  1029. versions:
  1030. - name: v1alpha1
  1031. schema:
  1032. openAPIV3Schema:
  1033. description: MiddlewareTCP is a specification for a MiddlewareTCP resource.
  1034. properties:
  1035. apiVersion:
  1036. description: 'APIVersion defines the versioned schema of this representation
  1037. of an object. Servers should convert recognized schemas to the latest
  1038. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1039. type: string
  1040. kind:
  1041. description: 'Kind is a string value representing the REST resource this
  1042. object represents. Servers may infer this from the endpoint the client
  1043. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1044. type: string
  1045. metadata:
  1046. type: object
  1047. spec:
  1048. description: MiddlewareTCPSpec holds the MiddlewareTCP configuration.
  1049. properties:
  1050. inFlightConn:
  1051. description: TCPInFlightConn holds the TCP in flight connection configuration.
  1052. properties:
  1053. amount:
  1054. format: int64
  1055. type: integer
  1056. type: object
  1057. ipWhiteList:
  1058. description: TCPIPWhiteList holds the TCP ip white list configuration.
  1059. properties:
  1060. sourceRange:
  1061. items:
  1062. type: string
  1063. type: array
  1064. type: object
  1065. type: object
  1066. required:
  1067. - metadata
  1068. - spec
  1069. type: object
  1070. served: true
  1071. storage: true
  1072. status:
  1073. acceptedNames:
  1074. kind: ""
  1075. plural: ""
  1076. conditions: []
  1077. storedVersions: []
  1078. ---
  1079. apiVersion: apiextensions.k8s.io/v1
  1080. kind: CustomResourceDefinition
  1081. metadata:
  1082. annotations:
  1083. controller-gen.kubebuilder.io/version: v0.6.2
  1084. creationTimestamp: null
  1085. name: serverstransports.traefik.containo.us
  1086. spec:
  1087. group: traefik.containo.us
  1088. names:
  1089. kind: ServersTransport
  1090. listKind: ServersTransportList
  1091. plural: serverstransports
  1092. singular: serverstransport
  1093. scope: Namespaced
  1094. versions:
  1095. - name: v1alpha1
  1096. schema:
  1097. openAPIV3Schema:
  1098. description: ServersTransport is a specification for a ServersTransport resource.
  1099. properties:
  1100. apiVersion:
  1101. description: 'APIVersion defines the versioned schema of this representation
  1102. of an object. Servers should convert recognized schemas to the latest
  1103. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1104. type: string
  1105. kind:
  1106. description: 'Kind is a string value representing the REST resource this
  1107. object represents. Servers may infer this from the endpoint the client
  1108. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1109. type: string
  1110. metadata:
  1111. type: object
  1112. spec:
  1113. description: ServersTransportSpec options to configure communication between
  1114. Traefik and the servers.
  1115. properties:
  1116. certificatesSecrets:
  1117. description: Certificates for mTLS.
  1118. items:
  1119. type: string
  1120. type: array
  1121. disableHTTP2:
  1122. description: Disable HTTP/2 for connections with backend servers.
  1123. type: boolean
  1124. forwardingTimeouts:
  1125. description: Timeouts for requests forwarded to the backend servers.
  1126. properties:
  1127. dialTimeout:
  1128. anyOf:
  1129. - type: integer
  1130. - type: string
  1131. description: DialTimeout is the amount of time to wait until a
  1132. connection to a backend server can be established. If zero,
  1133. no timeout exists.
  1134. x-kubernetes-int-or-string: true
  1135. idleConnTimeout:
  1136. anyOf:
  1137. - type: integer
  1138. - type: string
  1139. description: IdleConnTimeout is the maximum period for which an
  1140. idle HTTP keep-alive connection will remain open before closing
  1141. itself.
  1142. x-kubernetes-int-or-string: true
  1143. pingTimeout:
  1144. anyOf:
  1145. - type: integer
  1146. - type: string
  1147. description: PingTimeout is the timeout after which the HTTP/2
  1148. connection will be closed if a response to ping is not received.
  1149. x-kubernetes-int-or-string: true
  1150. readIdleTimeout:
  1151. anyOf:
  1152. - type: integer
  1153. - type: string
  1154. description: ReadIdleTimeout is the timeout after which a health
  1155. check using ping frame will be carried out if no frame is received
  1156. on the HTTP/2 connection. If zero, no health check is performed.
  1157. x-kubernetes-int-or-string: true
  1158. responseHeaderTimeout:
  1159. anyOf:
  1160. - type: integer
  1161. - type: string
  1162. description: ResponseHeaderTimeout is the amount of time to wait
  1163. for a server's response headers after fully writing the request
  1164. (including its body, if any). If zero, no timeout exists.
  1165. x-kubernetes-int-or-string: true
  1166. type: object
  1167. insecureSkipVerify:
  1168. description: Disable SSL certificate verification.
  1169. type: boolean
  1170. maxIdleConnsPerHost:
  1171. description: If non-zero, controls the maximum idle (keep-alive) to
  1172. keep per-host. If zero, DefaultMaxIdleConnsPerHost is used.
  1173. type: integer
  1174. peerCertURI:
  1175. description: URI used to match against SAN URI during the peer certificate
  1176. verification.
  1177. type: string
  1178. rootCAsSecrets:
  1179. description: Add cert file for self-signed certificate.
  1180. items:
  1181. type: string
  1182. type: array
  1183. serverName:
  1184. description: ServerName used to contact the server.
  1185. type: string
  1186. type: object
  1187. required:
  1188. - metadata
  1189. - spec
  1190. type: object
  1191. served: true
  1192. storage: true
  1193. status:
  1194. acceptedNames:
  1195. kind: ""
  1196. plural: ""
  1197. conditions: []
  1198. storedVersions: []
  1199. ---
  1200. apiVersion: apiextensions.k8s.io/v1
  1201. kind: CustomResourceDefinition
  1202. metadata:
  1203. annotations:
  1204. controller-gen.kubebuilder.io/version: v0.6.2
  1205. creationTimestamp: null
  1206. name: tlsoptions.traefik.containo.us
  1207. spec:
  1208. group: traefik.containo.us
  1209. names:
  1210. kind: TLSOption
  1211. listKind: TLSOptionList
  1212. plural: tlsoptions
  1213. singular: tlsoption
  1214. scope: Namespaced
  1215. versions:
  1216. - name: v1alpha1
  1217. schema:
  1218. openAPIV3Schema:
  1219. description: TLSOption is a specification for a TLSOption resource.
  1220. properties:
  1221. apiVersion:
  1222. description: 'APIVersion defines the versioned schema of this representation
  1223. of an object. Servers should convert recognized schemas to the latest
  1224. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1225. type: string
  1226. kind:
  1227. description: 'Kind is a string value representing the REST resource this
  1228. object represents. Servers may infer this from the endpoint the client
  1229. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1230. type: string
  1231. metadata:
  1232. type: object
  1233. spec:
  1234. description: TLSOptionSpec configures TLS for an entry point.
  1235. properties:
  1236. alpnProtocols:
  1237. items:
  1238. type: string
  1239. type: array
  1240. cipherSuites:
  1241. items:
  1242. type: string
  1243. type: array
  1244. clientAuth:
  1245. description: ClientAuth defines the parameters of the client authentication
  1246. part of the TLS connection, if any.
  1247. properties:
  1248. clientAuthType:
  1249. description: ClientAuthType defines the client authentication
  1250. type to apply.
  1251. enum:
  1252. - NoClientCert
  1253. - RequestClientCert
  1254. - RequireAnyClientCert
  1255. - VerifyClientCertIfGiven
  1256. - RequireAndVerifyClientCert
  1257. type: string
  1258. secretNames:
  1259. description: SecretName is the name of the referenced Kubernetes
  1260. Secret to specify the certificate details.
  1261. items:
  1262. type: string
  1263. type: array
  1264. type: object
  1265. curvePreferences:
  1266. items:
  1267. type: string
  1268. type: array
  1269. maxVersion:
  1270. type: string
  1271. minVersion:
  1272. type: string
  1273. preferServerCipherSuites:
  1274. type: boolean
  1275. sniStrict:
  1276. type: boolean
  1277. type: object
  1278. required:
  1279. - metadata
  1280. - spec
  1281. type: object
  1282. served: true
  1283. storage: true
  1284. status:
  1285. acceptedNames:
  1286. kind: ""
  1287. plural: ""
  1288. conditions: []
  1289. storedVersions: []
  1290. ---
  1291. apiVersion: apiextensions.k8s.io/v1
  1292. kind: CustomResourceDefinition
  1293. metadata:
  1294. annotations:
  1295. controller-gen.kubebuilder.io/version: v0.6.2
  1296. creationTimestamp: null
  1297. name: tlsstores.traefik.containo.us
  1298. spec:
  1299. group: traefik.containo.us
  1300. names:
  1301. kind: TLSStore
  1302. listKind: TLSStoreList
  1303. plural: tlsstores
  1304. singular: tlsstore
  1305. scope: Namespaced
  1306. versions:
  1307. - name: v1alpha1
  1308. schema:
  1309. openAPIV3Schema:
  1310. description: TLSStore is a specification for a TLSStore resource.
  1311. properties:
  1312. apiVersion:
  1313. description: 'APIVersion defines the versioned schema of this representation
  1314. of an object. Servers should convert recognized schemas to the latest
  1315. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1316. type: string
  1317. kind:
  1318. description: 'Kind is a string value representing the REST resource this
  1319. object represents. Servers may infer this from the endpoint the client
  1320. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1321. type: string
  1322. metadata:
  1323. type: object
  1324. spec:
  1325. description: TLSStoreSpec configures a TLSStore resource.
  1326. properties:
  1327. defaultCertificate:
  1328. description: DefaultCertificate holds a secret name for the TLSOption
  1329. resource.
  1330. properties:
  1331. secretName:
  1332. description: SecretName is the name of the referenced Kubernetes
  1333. Secret to specify the certificate details.
  1334. type: string
  1335. required:
  1336. - secretName
  1337. type: object
  1338. required:
  1339. - defaultCertificate
  1340. type: object
  1341. required:
  1342. - metadata
  1343. - spec
  1344. type: object
  1345. served: true
  1346. storage: true
  1347. status:
  1348. acceptedNames:
  1349. kind: ""
  1350. plural: ""
  1351. conditions: []
  1352. storedVersions: []
  1353. ---
  1354. apiVersion: apiextensions.k8s.io/v1
  1355. kind: CustomResourceDefinition
  1356. metadata:
  1357. annotations:
  1358. controller-gen.kubebuilder.io/version: v0.6.2
  1359. creationTimestamp: null
  1360. name: traefikservices.traefik.containo.us
  1361. spec:
  1362. group: traefik.containo.us
  1363. names:
  1364. kind: TraefikService
  1365. listKind: TraefikServiceList
  1366. plural: traefikservices
  1367. singular: traefikservice
  1368. scope: Namespaced
  1369. versions:
  1370. - name: v1alpha1
  1371. schema:
  1372. openAPIV3Schema:
  1373. description: TraefikService is the specification for a service (that an IngressRoute
  1374. refers to) that is usually not a terminal service (i.e. not a pod of servers),
  1375. as opposed to a Kubernetes Service. That is to say, it usually refers to
  1376. other (children) services, which themselves can be TraefikServices or Services.
  1377. properties:
  1378. apiVersion:
  1379. description: 'APIVersion defines the versioned schema of this representation
  1380. of an object. Servers should convert recognized schemas to the latest
  1381. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1382. type: string
  1383. kind:
  1384. description: 'Kind is a string value representing the REST resource this
  1385. object represents. Servers may infer this from the endpoint the client
  1386. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1387. type: string
  1388. metadata:
  1389. type: object
  1390. spec:
  1391. description: ServiceSpec defines whether a TraefikService is a load-balancer
  1392. of services or a mirroring service.
  1393. properties:
  1394. mirroring:
  1395. description: Mirroring defines a mirroring service, which is composed
  1396. of a main load-balancer, and a list of mirrors.
  1397. properties:
  1398. kind:
  1399. enum:
  1400. - Service
  1401. - TraefikService
  1402. type: string
  1403. maxBodySize:
  1404. format: int64
  1405. type: integer
  1406. mirrors:
  1407. items:
  1408. description: MirrorService defines one of the mirrors of a Mirroring
  1409. service.
  1410. properties:
  1411. kind:
  1412. enum:
  1413. - Service
  1414. - TraefikService
  1415. type: string
  1416. name:
  1417. description: Name is a reference to a Kubernetes Service
  1418. object (for a load-balancer of servers), or to a TraefikService
  1419. object (service load-balancer, mirroring, etc). The differentiation
  1420. between the two is specified in the Kind field.
  1421. type: string
  1422. namespace:
  1423. type: string
  1424. passHostHeader:
  1425. type: boolean
  1426. percent:
  1427. type: integer
  1428. port:
  1429. anyOf:
  1430. - type: integer
  1431. - type: string
  1432. x-kubernetes-int-or-string: true
  1433. responseForwarding:
  1434. description: ResponseForwarding holds configuration for
  1435. the forward of the response.
  1436. properties:
  1437. flushInterval:
  1438. type: string
  1439. type: object
  1440. scheme:
  1441. type: string
  1442. serversTransport:
  1443. type: string
  1444. sticky:
  1445. description: Sticky holds the sticky configuration.
  1446. properties:
  1447. cookie:
  1448. description: Cookie holds the sticky configuration based
  1449. on cookie.
  1450. properties:
  1451. httpOnly:
  1452. type: boolean
  1453. name:
  1454. type: string
  1455. sameSite:
  1456. type: string
  1457. secure:
  1458. type: boolean
  1459. type: object
  1460. type: object
  1461. strategy:
  1462. type: string
  1463. weight:
  1464. description: Weight should only be specified when Name references
  1465. a TraefikService object (and to be precise, one that embeds
  1466. a Weighted Round Robin).
  1467. type: integer
  1468. required:
  1469. - name
  1470. type: object
  1471. type: array
  1472. name:
  1473. description: Name is a reference to a Kubernetes Service object
  1474. (for a load-balancer of servers), or to a TraefikService object
  1475. (service load-balancer, mirroring, etc). The differentiation
  1476. between the two is specified in the Kind field.
  1477. type: string
  1478. namespace:
  1479. type: string
  1480. passHostHeader:
  1481. type: boolean
  1482. port:
  1483. anyOf:
  1484. - type: integer
  1485. - type: string
  1486. x-kubernetes-int-or-string: true
  1487. responseForwarding:
  1488. description: ResponseForwarding holds configuration for the forward
  1489. of the response.
  1490. properties:
  1491. flushInterval:
  1492. type: string
  1493. type: object
  1494. scheme:
  1495. type: string
  1496. serversTransport:
  1497. type: string
  1498. sticky:
  1499. description: Sticky holds the sticky configuration.
  1500. properties:
  1501. cookie:
  1502. description: Cookie holds the sticky configuration based on
  1503. cookie.
  1504. properties:
  1505. httpOnly:
  1506. type: boolean
  1507. name:
  1508. type: string
  1509. sameSite:
  1510. type: string
  1511. secure:
  1512. type: boolean
  1513. type: object
  1514. type: object
  1515. strategy:
  1516. type: string
  1517. weight:
  1518. description: Weight should only be specified when Name references
  1519. a TraefikService object (and to be precise, one that embeds
  1520. a Weighted Round Robin).
  1521. type: integer
  1522. required:
  1523. - name
  1524. type: object
  1525. weighted:
  1526. description: WeightedRoundRobin defines a load-balancer of services.
  1527. properties:
  1528. services:
  1529. items:
  1530. description: Service defines an upstream to proxy traffic.
  1531. properties:
  1532. kind:
  1533. enum:
  1534. - Service
  1535. - TraefikService
  1536. type: string
  1537. name:
  1538. description: Name is a reference to a Kubernetes Service
  1539. object (for a load-balancer of servers), or to a TraefikService
  1540. object (service load-balancer, mirroring, etc). The differentiation
  1541. between the two is specified in the Kind field.
  1542. type: string
  1543. namespace:
  1544. type: string
  1545. passHostHeader:
  1546. type: boolean
  1547. port:
  1548. anyOf:
  1549. - type: integer
  1550. - type: string
  1551. x-kubernetes-int-or-string: true
  1552. responseForwarding:
  1553. description: ResponseForwarding holds configuration for
  1554. the forward of the response.
  1555. properties:
  1556. flushInterval:
  1557. type: string
  1558. type: object
  1559. scheme:
  1560. type: string
  1561. serversTransport:
  1562. type: string
  1563. sticky:
  1564. description: Sticky holds the sticky configuration.
  1565. properties:
  1566. cookie:
  1567. description: Cookie holds the sticky configuration based
  1568. on cookie.
  1569. properties:
  1570. httpOnly:
  1571. type: boolean
  1572. name:
  1573. type: string
  1574. sameSite:
  1575. type: string
  1576. secure:
  1577. type: boolean
  1578. type: object
  1579. type: object
  1580. strategy:
  1581. type: string
  1582. weight:
  1583. description: Weight should only be specified when Name references
  1584. a TraefikService object (and to be precise, one that embeds
  1585. a Weighted Round Robin).
  1586. type: integer
  1587. required:
  1588. - name
  1589. type: object
  1590. type: array
  1591. sticky:
  1592. description: Sticky holds the sticky configuration.
  1593. properties:
  1594. cookie:
  1595. description: Cookie holds the sticky configuration based on
  1596. cookie.
  1597. properties:
  1598. httpOnly:
  1599. type: boolean
  1600. name:
  1601. type: string
  1602. sameSite:
  1603. type: string
  1604. secure:
  1605. type: boolean
  1606. type: object
  1607. type: object
  1608. type: object
  1609. type: object
  1610. required:
  1611. - metadata
  1612. - spec
  1613. type: object
  1614. served: true
  1615. storage: true
  1616. status:
  1617. acceptedNames:
  1618. kind: ""
  1619. plural: ""
  1620. conditions: []
  1621. storedVersions: []
  1622. ---
  1623. apiVersion: rbac.authorization.k8s.io/v1
  1624. kind: ClusterRole
  1625. metadata:
  1626. name: traefik-ingress-controller
  1627. rules:
  1628. - apiGroups:
  1629. - ""
  1630. resources:
  1631. - services
  1632. - endpoints
  1633. - secrets
  1634. verbs:
  1635. - get
  1636. - list
  1637. - watch
  1638. - apiGroups:
  1639. - extensions
  1640. - networking.k8s.io
  1641. resources:
  1642. - ingresses
  1643. - ingressclasses
  1644. verbs:
  1645. - get
  1646. - list
  1647. - watch
  1648. - apiGroups:
  1649. - extensions
  1650. resources:
  1651. - ingresses/status
  1652. verbs:
  1653. - update
  1654. - apiGroups:
  1655. - traefik.containo.us
  1656. resources:
  1657. - middlewares
  1658. - middlewaretcps
  1659. - ingressroutes
  1660. - traefikservices
  1661. - ingressroutetcps
  1662. - ingressrouteudps
  1663. - tlsoptions
  1664. - tlsstores
  1665. - serverstransports
  1666. verbs:
  1667. - get
  1668. - list
  1669. - watch
  1670. ---
  1671. apiVersion: rbac.authorization.k8s.io/v1
  1672. kind: ClusterRoleBinding
  1673. metadata:
  1674. name: traefik-ingress-controller
  1675. roleRef:
  1676. apiGroup: rbac.authorization.k8s.io
  1677. kind: ClusterRole
  1678. name: traefik-ingress-controller
  1679. subjects:
  1680. - kind: ServiceAccount
  1681. name: traefik-ingress-controller
  1682. namespace: default

Services

Then, the services. One for Traefik itself, and one for the app it routes for, i.e. in this case our demo HTTP server: whoami.

  1. apiVersion: v1
  2. kind: Service
  3. metadata:
  4. name: traefik
  5. spec:
  6. ports:
  7. - protocol: TCP
  8. name: web
  9. port: 8000
  10. - protocol: TCP
  11. name: admin
  12. port: 8080
  13. - protocol: TCP
  14. name: websecure
  15. port: 4443
  16. selector:
  17. app: traefik
  18. ---
  19. apiVersion: v1
  20. kind: Service
  21. metadata:
  22. name: whoami
  23. spec:
  24. ports:
  25. - protocol: TCP
  26. name: web
  27. port: 80
  28. selector:
  29. app: whoami

Deployments

Next, the deployments, i.e. the actual pods behind the services. Again, one pod for Traefik, and one for the whoami app.

  1. apiVersion: v1
  2. kind: ServiceAccount
  3. metadata:
  4. namespace: default
  5. name: traefik-ingress-controller
  6. ---
  7. kind: Deployment
  8. apiVersion: apps/v1
  9. metadata:
  10. namespace: default
  11. name: traefik
  12. labels:
  13. app: traefik
  14. spec:
  15. replicas: 1
  16. selector:
  17. matchLabels:
  18. app: traefik
  19. template:
  20. metadata:
  21. labels:
  22. app: traefik
  23. spec:
  24. serviceAccountName: traefik-ingress-controller
  25. containers:
  26. - name: traefik
  27. image: traefik:v2.7
  28. args:
  29. - --api.insecure
  30. - --accesslog
  31. - --entrypoints.web.Address=:8000
  32. - --entrypoints.websecure.Address=:4443
  33. - --providers.kubernetescrd
  34. - --certificatesresolvers.myresolver.acme.tlschallenge
  35. - --certificatesresolvers.myresolver.acme.email=foo@you.com
  36. - --certificatesresolvers.myresolver.acme.storage=acme.json
  37. # Please note that this is the staging Let's Encrypt server.
  38. # Once you get things working, you should remove that whole line altogether.
  39. - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
  40. ports:
  41. - name: web
  42. containerPort: 8000
  43. - name: websecure
  44. containerPort: 4443
  45. - name: admin
  46. containerPort: 8080
  47. ---
  48. kind: Deployment
  49. apiVersion: apps/v1
  50. metadata:
  51. namespace: default
  52. name: whoami
  53. labels:
  54. app: whoami
  55. spec:
  56. replicas: 2
  57. selector:
  58. matchLabels:
  59. app: whoami
  60. template:
  61. metadata:
  62. labels:
  63. app: whoami
  64. spec:
  65. containers:
  66. - name: whoami
  67. image: traefik/whoami
  68. ports:
  69. - name: web
  70. containerPort: 80

Port Forwarding

Now, as an exception to what we said above, please note that you should not let the ingressRoute resources below be applied automatically to your cluster. The reason is, as soon as the ACME provider of Traefik detects we have TLS routers, it will try to generate the certificates for the corresponding domains. And this will not work, because as it is, our Traefik pod is not reachable from the outside, which will make the ACME TLS challenge fail. Therefore, for the whole thing to work, we must delay applying the ingressRoute resources until we have port-forwarding set up properly, which is the next step.

  1. kubectl port-forward --address 0.0.0.0 service/traefik 8000:8000 8080:8080 443:4443 -n default

Also, and this is out of the scope if this guide, please note that because of the privileged ports limitation on Linux, the above command might fail to listen on port 443. In which case you can use tricks such as elevating caps of kubectl with setcaps, or using authbind, or setting up a NAT between your host and the WAN. Look it up.

Traefik Routers

We can now finally apply the actual ingressRoutes, with:

  1. kubectl apply -f 04-ingressroutes.yml
  1. apiVersion: traefik.containo.us/v1alpha1
  2. kind: IngressRoute
  3. metadata:
  4. name: simpleingressroute
  5. namespace: default
  6. spec:
  7. entryPoints:
  8. - web
  9. routes:
  10. - match: Host(`your.example.com`) && PathPrefix(`/notls`)
  11. kind: Rule
  12. services:
  13. - name: whoami
  14. port: 80
  15. ---
  16. apiVersion: traefik.containo.us/v1alpha1
  17. kind: IngressRoute
  18. metadata:
  19. name: ingressroutetls
  20. namespace: default
  21. spec:
  22. entryPoints:
  23. - websecure
  24. routes:
  25. - match: Host(`your.example.com`) && PathPrefix(`/tls`)
  26. kind: Rule
  27. services:
  28. - name: whoami
  29. port: 80
  30. tls:
  31. certResolver: myresolver

Give it a few seconds for the ACME TLS challenge to complete, and you should then be able to access your whoami pod (routed through Traefik), from the outside. Both with or (just for fun, do not do that in production) without TLS:

  1. curl [-k] https://your.example.com/tls
  1. curl http://your.example.com:8000/notls

Note that you’ll have to use -k as long as you’re using the staging server of Let’s Encrypt, since it is not an authorized certificate authority on systems where it hasn’t been manually added.