jakubhajek

We use Logstash to transform specific business logs that don't contain any unique value which could be used to calculate fingerprint in order to avoid duplicates. That's why we calculate fingerprints with the entire document/log. 

That approach works correctly for the same document which has been sent once again to Logstash we received the same fingerprints which are expecting behavior. 

Please see the below steps to replicate that issue.
I attached logstash.conf which is a simple pipeline calculating fingerprint and saving the output in a file. 

1. Run Logstash instance:

docker run -p 41311:41311 -v ${PWD}/pipeline/:/usr/share/logstash/pipeline  logstash:6.8.4

jakubhajek

# docker stack deploy -c stack-tr-main.yml traefik --prune

version: "3.7"
services:
  main:
    image: traefik:v2.1.2
    healthcheck:
      test: wget --quiet --tries=1 --spider https://traefik.labs.cometari.eu/ping || exit 1
      interval: 3s
      timeout: 1s

jakubhajek

# docker stack deploy -c stack-app.yml app --with-registry-auth --prune
version: "3.7"

services:
  backend:
    image: jakubhajek/nodejs-backend:latest
    healthcheck:
      test: wget --quiet --tries=1 --spider http://localhost:3000/ || exit 1
      interval: 3s
      timeout: 1s

jakubhajek

http:
  services:
    canary:
      weighted:
        services:
          # Load balancing between Traefik services
          - name: app1_svc@docker
            weight: 1
          - name: app2_svc@docker
            weight: 5

jakubhajek

[http]
    [http.middlewares]
         [http.middlewares.https-redirect.redirectscheme]
              scheme = "https"
              permanent = true
         [http.middlewares.security-headers.headers]
              # CORS
              AccessControlAllowMethods = ["GET", "OPTIONS", "PUT"]
              AccessControlAllowOrigin = "origin-list-or-null"

jakubhajek

apiVersion: v1
data:
  dav.conf: |
    location /upload {
      alias     upload/data;
      client_body_temp_path  upload/client_tmp;

      dav_methods  PUT DELETE MKCOL COPY MOVE;

      client_max_body_size 1500m;

jakubhajek

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: harbor-portal
  namespace: harbor
spec:
  entryPoints:
    - webs-int
  routes:

jakubhajek

log:
  level: info
  format: json

accessLog:
  format: json
  bufferingSize: 5

providers:
  docker:

jakubhajek

Advanced Load Balancing with Traefik 2.5

Traefik Workshop #2, Q&A. September 30, 2021

In the case of Canary or Mirroring, what if the two apps were in different clusters instead?

Progressive deployment that might be also called Canary deployment can be achieved between two separate clusters. I would recommend using that with Weighted Round Robin Load Balancing with Nested Health Checks. Please note that it is available as a dynamic configuration provided via File provider.

---

Is the Traefik Proxy running inside or outside k8s? And how can you scale this if needed (for a huge amount of incoming traffic for instance)?

jakubhajek

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096