Traefik & Kubernetes

    Configuring Kubernetes Gateway provider and Deploying/Exposing Services

    Gateway API

    Whoami Service

    1. ---
    2. apiVersion: apps/v1
    3. kind: Deployment
    4. metadata:
    5.   name: whoami
    7. spec:
    8.   replicas: 2
    9.   selector:
    10.     matchLabels:
    11.       app: whoami
    13.   template:
    14.     metadata:
    15.       labels:
    16.         app: whoami
    18.     spec:
    19.       containers:
    20.         - name: whoami
    21.           image: traefik/whoami
    23. ---
    24. apiVersion: v1
    25. kind: Service
    26. metadata:
    27.   name: whoami
    29. spec:
    30.   selector:
    31.     app: whoami
    33.   ports:
    34.     - protocol: TCP
    35.       port: 80

    Traefik Service

    1. ---
    2. apiVersion: v1
    3. kind: ServiceAccount
    4. metadata:
    5.   name: traefik-controller
    7. ---
    8. apiVersion: apps/v1
    9. kind: Deployment
    10. metadata:
    11.   name: traefik
    13. spec:
    14.   replicas: 1
    15.   selector:
    16.     matchLabels:
    17.       app: traefik-lb
    19.   template:
    20.     metadata:
    21.       labels:
    22.         app: traefik-lb
    24.     spec:
    25.       serviceAccountName: traefik-controller
    26.       containers:
    27.         - name: traefik
    28.           image: traefik:v2.9
    29.           args:
    30.             - --entrypoints.web.address=:80
    31.             - --entrypoints.websecure.address=:443
    32.             - --experimental.kubernetesgateway
    33.             - --providers.kubernetesgateway
    35.           ports:
    36.             - name: web
    37.               containerPort: 80
    39.             - name: websecure
    40.               containerPort: 443
    42. ---
    43. apiVersion: v1
    44. kind: Service
    45. metadata:
    46.   name: traefik
    48. spec:
    49.   type: LoadBalancer
    50.   selector:
    51.     app: traefik-lb
    53.   ports:
    54.       port: 80
    55.       targetPort: web
    56.       name: web
    58.     - protocol: TCP
    59.       port: 443
    60.       targetPort: websecure
    61.       name: websecure

    RBAC

    1. ---
    2. apiVersion: rbac.authorization.k8s.io/v1
    3. kind: ClusterRole
    4. metadata:
    5.   name: gateway-role
    6. rules:
    7.   - apiGroups:
    8.       - ""
    9.     resources:
    10.       - namespaces
    11.     verbs:
    12.       - list
    13.       - watch
    14.   - apiGroups:
    15.       - ""
    16.     resources:
    17.       - services
    18.       - endpoints
    19.       - secrets
    20.     verbs:
    21.       - get
    22.       - list
    23.       - watch
    24.   - apiGroups:
    25.       - gateway.networking.k8s.io
    26.     resources:
    27.       - gatewayclasses
    29.       - httproutes
    30.       - tcproutes
    31.       - tlsroutes
    32.     verbs:
    33.       - get
    34.       - list
    35.       - watch
    36.   - apiGroups:
    37.       - gateway.networking.k8s.io
    38.     resources:
    39.       - gatewayclasses/status
    40.       - gateways/status
    41.       - httproutes/status
    42.       - tcproutes/status
    43.       - tlsroutes/status
    44.     verbs:
    45.       - update
    47. ---
    48. apiVersion: rbac.authorization.k8s.io/v1
    49. kind: ClusterRoleBinding
    50. metadata:
    51.   name: gateway-controller
    52. roleRef:
    53.   apiGroup: rbac.authorization.k8s.io
    54.   kind: ClusterRole
    55.   name: gateway-role
    56. subjects:
    57.   - kind: ServiceAccount
    58.     name: traefik-controller
    59.     namespace: default

    Routing Configuration

    • You can find an exhaustive list, of the custom resources and their attributes in or in the Kubernetes Sigs Gateway API repository.
    • Validate that are fulfilled before using the Traefik Kubernetes Gateway Provider.

    You can find an excerpt of the supported Kubernetes Gateway API resources in the table below:

    Kind: GatewayClass

    GatewayClass is cluster-scoped resource defined by the infrastructure provider. This resource represents a class of Gateways that can be instantiated. More details on the GatewayClass .

    The GatewayClass should be declared by the infrastructure provider, otherwise please register the GatewayClass definition in the Kubernetes cluster before creating GatewayClass objects.

    A Gateway is 1:1 with the life cycle of the configuration of infrastructure. When a user creates a Gateway, some load balancing infrastructure is provisioned or configured by the GatewayClass controller. More details on the Gateway official documentation.

    Register the Gateway in the Kubernetes cluster before creating Gateway objects.

    Depending on the Listener Protocol, different modes and Route types are supported.

    Listener ProtocolTLS ModeRoute Type Supported
    TCPNot applicableTCPRoute
    TLSPassthrough, TCPRoute
    TLSTerminate, TCPRoute
    HTTPNot applicable
    HTTPSTerminateHTTPRoute

    Declaring Gateway

    HTTP Listener

    1. apiVersion: gateway.networking.k8s.io/v1alpha2
    2. kind: Gateway
    3. metadata:
    4.   name: my-http-gateway
    5.   namespace: default
    6. spec:
    7.   gatewayClassName: my-gateway-class        # [1]
    8.   listeners:                                # [2]
    9.     - name: http                            # [3]
    10.       protocol: HTTP                        # [4]
    11.       port: 80                              # [5]
    12.       allowedRoutes:                        # [9]
    13.         kinds:
    14.           - kind: HTTPRoute                 # [10]
    15.         namespaces:
    16.           from: Selector                    # [11]
    17.           selector:                         # [12]
    18.             matchLabels:
    19.               app: foo

    HTTPS Listener

    1. apiVersion: gateway.networking.k8s.io/v1alpha2
    2. kind: Gateway
    3. metadata:
    4.   name: my-https-gateway
    5.   namespace: default
    6. spec:
    7.   gatewayClassName: my-gateway-class        # [1]
    8.   listeners:                                # [2]
    9.       protocol: HTTPS                       # [4]
    10.       port: 443                             # [5]
    11.       tls:                                  # [7]
    12.         certificateRefs:                    # [8]
    13.           - kind: "Secret"
    14.             name: "mysecret"
    15.       allowedRoutes:                        # [9]
    16.         kinds:
    17.           - kind: HTTPSRoute                # [10]
    18.         namespaces:
    19.           from: Selector                    # [11]
    20.           selector:                         # [12]
    21.             matchLabels:
    22.               app: foo

    TCP Listener

    1. apiVersion: gateway.networking.k8s.io/v1alpha2
    2. kind: Gateway
    3. metadata:
    4.   name: my-tcp-gateway
    5.   namespace: default
    6. spec:
    7.   gatewayClassName: my-gateway-class        # [1]
    8.   listeners:                                # [2]
    9.     - name: tcp                             # [3]
    10.       protocol: TCP                         # [4]
    11.       port: 8000                            # [5]
    12.       allowedRoutes:                        # [9]
    13.         kinds:
    14.           - kind: TCPRoute                  # [10]
    15.         namespaces:
    16.           from: Selector                    # [11]
    17.           selector:                         # [12]
    18.             matchLabels:
    19.               app: footcp

    TLS Listener

    Kind: HTTPRoute

    Register the HTTPRoute definition in the Kubernetes cluster before creating HTTPRoute objects.

    Declaring HTTPRoute

    1. apiVersion: gateway.networking.k8s.io/v1alpha2
    2. kind: HTTPRoute
    3. metadata:
    4.   name: http-app
    6. spec:
    7.   parentRefs:                               # [1]
    8.     - name: my-tcp-gateway                  # [2]
    9.       namespace: default                    # [3]
    10.       sectionName: tcp                      # [4]
    11.   hostnames:                                # [5]
    12.     - whoami
    13.   rules:                                    # [6]
    14.     - matches:                              # [7]
    15.         - path:                             # [8]
    16.             type: Exact                     # [9]
    17.             value: /bar                     # [10]
    18.         - headers:                          # [11]
    19.             name: foo                       # [12]
    20.             value: bar                      # [13]
    21.     - backendRefs:                          # [14]
    22.         - name: whoamitcp                   # [15]
    23.           weight: 1                         # [16]
    24.           port: 8080                        # [17]
    25.         - name: [email protected]
    26.           group: traefik.containo.us        # [18]
    27.           kind: TraefikService              # [19]
    RefAttributeDescription
    [1]parentRefsReferences the resources (usually Gateways) that a Route wants to be attached to.
    [2]nameName of the referent.
    [3]namespaceNamespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route.
    [4]sectionNameName of a section within the target resource (the Listener name).
    [5]hostnamesA set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request.
    [6]rulesA list of HTTP matchers, filters and actions.
    [7]matchesConditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if any one of the matches is satisfied.
    [8]pathAn HTTP request path matcher. If this field is not specified, a default prefix match on the “/“ path is provided.
    [9]typeType of match against the path Value (supported types: Exact, Prefix).
    [10]valueThe value of the HTTP path to match against.
    [11]headersConditions to select a HTTP route by matching HTTP request headers.
    [12]typeType of match for the HTTP request header match against the values (supported types: Exact).
    [13]valueA map of HTTP Headers to be matched. It MUST contain at least one entry.
    [14]backendRefsDefines the backend(s) where matching requests should be sent.
    [15]nameThe name of the referent service.
    [16]weightThe proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).
    [17]portThe port of the referent service.
    [18]groupGroup is the group of the referent. Only traefik.containo.us and gateway.networking.k8s.io values are supported.
    [19]kindKind is kind of the referent. Only TraefikService and Service values are supported.

    TCPRoute allows mapping TCP requests from a Gateway to Kubernetes Services.

    Register the TCPRoute definition in the Kubernetes cluster before creating TCPRoute objects.

    Declaring TCPRoute

    1. apiVersion: gateway.networking.k8s.io/v1alpha2
    2. kind: TCPRoute
    3. metadata:
    4.   name: tcp-app
    5.   namespace: default
    6. spec:
    7.   parentRefs:                               # [1]
    8.     - name: my-tcp-gateway                  # [2]
    9.       namespace: default                    # [3]
    10.       sectionName: tcp                      # [4]
    11.   rules:                                    # [5]
    12.     - backendRefs:                          # [6]
    13.         - name: whoamitcp                   # [7]
    14.           weight: 1                         # [8]
    15.           port: 8080                        # [9]
    16.         - name: [email protected]
    17.           group: traefik.containo.us        # [10]
    18.           kind: TraefikService              # [11]

    Kind: TLSRoute

    TLSRoute allows mapping TLS requests from a Gateway to Kubernetes Services.

    Register the TLSRoute definition in the Kubernetes cluster before creating TLSRoute objects.

    Declaring TLSRoute

    1. apiVersion: gateway.networking.k8s.io/v1alpha2
    2. kind: TLSRoute
    3. metadata:
    4.   name: tls-app
    5.   namespace: default
    6. spec:
    7.   parentRefs:                               # [1]
    8.     - name: my-tls-gateway                  # [2]
    9.       namespace: default                    # [3]
    10.       sectionName: tcp                      # [4]
    11.   hostnames:                                # [5]
    12.     - whoami
    13.   rules:                                    # [6]
    14.     - backendRefs:                          # [7]
    15.         - name: whoamitcp                   # [8]
    16.           weight: 1                         # [9]
    17.           port: 8080                        # [10]
    18.         - name: [email protected]
    19.           kind: TraefikService              # [12]
    RefAttributeDescription
    [1]parentRefsReferences the resources (usually Gateways) that a Route wants to be attached to.
    [2]nameName of the referent.
    [3]namespaceNamespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route.
    [4]sectionNameName of a section within the target resource (the Listener name).
    [5]hostnamesDefines a set of SNI names that should match against the SNI attribute of TLS ClientHello message in TLS handshake.
    [6]rulesRules are a list of TCP matchers and actions.
    [7]backendRefsDefines the backend(s) where matching requests should be sent.
    [8]nameThe name of the referent service.
    [9]weightThe proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).
    [10]portThe port of the referent service.
    [11]groupGroup is the group of the referent. Only traefik.containo.us and gateway.networking.k8s.io values are supported.
    [12]kindKind is kind of the referent. Only TraefikService and Service values are supported.