K8S配置traefik ingressroutes支持TLS

最终效果

参考traefik文档ingressroutes部分，刚读时非常令人费解。

https://docs.traefik.io/https/tls/#certificates-stores

In Traefik, certificates are grouped together in certificates stores.

Any store definition other than the default one (named default) will be ignored, and there is thefore only one globally available TLS store.

这两个描述，直接坑杀了我2天时间。

一直以为traefik的tls模型是:

ingressroutes --引用--> tlsstore --引用--> [k8s tls secret]

其实，ingressroutes里，我知道的部分，service和tls都可以直接引用k8s的标准资源。

• service
• tls

假设，我们有如下资源：

• k8s tls secret
• k8s service
  • k8s deployment

我们需要提供如下域名的https接入访问：

• https://www.abc.com
• https://api.ddd.com

apiVersion: v1
data:
  tls.crt: .....
  tls.key: .....
kind: Secret
metadata:
  name: tls-abc.com
  namespace: default
type: kubernetes.io/tls

---

apiVersion: v1
data:
  tls.crt: .....
  tls.key: .....
kind: Secret
metadata:
  name: tls-def.com
  namespace: default
type: kubernetes.io/tls

deployment and service

apiVersion: v1
kind: Service
metadata:
  name: whoami
  labels:
    app: whoami
spec:
  ports:
  - port: 80
    targetPort: 80
  selector:
    app: whoami

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
spec:
  selector:
    matchLabels:
      app: whoami
  replicas: 1
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
      - name: whoami
        image: containous/whoami
        ports:
        - containerPort: 80

IngressRoutes www.abc.com

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ir-www.abc.com-https  ## https 单独定义一个，和http分离部署
  namespace: default

spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`www.abc.com`) && PathPrefix(`/`)
      services:
        - kind: Service
          name: whoami
          port: 80
      tls: {}
  tls:
    secretName: tls-abc.com  ## 此处引用k8s secret
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ir-www.abc.com-http ## http 单独定义一个，和https分离部署
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - kind: Rule
      match: Host(`www.abc.com`) && PathPrefix(`/`)
      services:
        - kind: Service
          name: whoami
          port: 80

IngressRoutes www.def.com

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ir-www.def.com-https  ## https 单独定义一个，和http分离部署
  namespace: default

spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`www.def.com`) && PathPrefix(`/api`)
      services:
        - kind: Service
          name: whoami
          port: 80
      tls: {}
  tls:
    secretName: tls-def.com  ## 此处引用k8s secret
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ir-www.def.com-http ## http 单独定义一个，和https分离部署
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - kind: Rule
      match: Host(`www.def.com`) && PathPrefix(`/api`)
      services:
        - kind: Service
          name: whoami
          port: 80