Skip to content

Instantly share code, notes, and snippets.

@XciD
Last active March 4, 2019 13:43
Show Gist options
  • Save XciD/5ff1606ea692f2e841252113217c13a8 to your computer and use it in GitHub Desktop.
Save XciD/5ff1606ea692f2e841252113217c13a8 to your computer and use it in GitHub Desktop.
Traefik
### Basic config with storage of the ssl certs
apiVersion: v1
kind: ConfigMap
metadata:
name: traefik-config
namespace: traefik
data:
traefik.toml: |
# traefik.toml
defaultEntryPoints = ["http", "https"]
[kubernetes]
ingressClass = "traefik"
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[acme]
email = "adrien@xcid.fr" # Change me
onHostRule = true
storage = "/ssl/acme.json"
entryPoint = "https"
[acme.tlsChallenge]
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: traefik-pv
namespace: traefik
spec:
volumeMode: Filesystem
storageClassName: cinder-high-speed
cinder:
volumeID: your-volume-id
capacity:
storage: 1Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
namespace: traefik
name: traefik-pv-claim
spec:
storageClassName: cinder-high-speed
volumeName: traefik-pv
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
name: traefik-ingress-controller
namespace: traefik
spec:
selector:
matchLabels:
name: traefik-ingress-controller
template:
metadata:
labels:
name: traefik-ingress-controller
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
nodeSelector:
ingress: "true"
volumes:
- name: config
configMap:
name: traefik-config
- name: traefik-persistent-storage
persistentVolumeClaim:
claimName: traefik-pv-claim
containers:
- image: traefik:1.7.7
name: traefik-ingress-lb
volumeMounts:
- mountPath: /config
name: config
- name: traefik-persistent-storage
mountPath: /ssl
ports:
- name: http
containerPort: 80
hostPort: 80
- name: https
containerPort: 443
hostPort: 443
- name: admin
containerPort: 8080
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
args:
- --api
- --logLevel=INFO
- --configfile=/config/traefik.toml
apiVersion: v1
kind: Service
metadata:
name: traefik-web-ui
namespace: traefik
spec:
selector:
name: traefik-ingress-controller
ports:
- name: http
port: 80
targetPort: 8080
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: traefik-web-ui
namespace: traefik
annotations:
kubernetes.io/ingress.class: traefik
ingress.kubernetes.io/auth-type: basic
ingress.kubernetes.io/auth-secret: basic-auth
spec:
rules:
- host: lb.your-domain
http:
paths:
- backend:
serviceName: traefik-web-ui
servicePort: http
### Basic role for the endpoint discovery
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: traefik
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-ingress-controller
namespace: traefik
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment