Skip to content

Commit 5a321b6

Browse files
ivankatliarchukmloiseleur
ivankatliarchuk
and
mloiseleur
authored
docs(traefik): public and private routing (#5559)
* docs: added treafik public and private routing Signed-off-by: ivan katliarchuk <[email protected]> docs: added treafik public and private routing Signed-off-by: ivan katliarchuk <[email protected]> docs: added treafik public and private routing Signed-off-by: ivan katliarchuk <[email protected]> docs: added treafik public and private routing Signed-off-by: ivan katliarchuk <[email protected]> docs: added treafik public and private routing Signed-off-by: ivan katliarchuk <[email protected]> docs: added treafik public and private routing Signed-off-by: ivan katliarchuk <[email protected]> docs: added treafik public and private routing Signed-off-by: ivan katliarchuk <[email protected]> docs: added treafik public and private routing Co-authored-by: Michel Loiseleur <[email protected]> docs(traefik): public and private routing Signed-off-by: ivan katliarchuk <[email protected]> * docs(traefik): public and private routing Signed-off-by: ivan katliarchuk <[email protected]> * docs(traefik): public and private routing Co-authored-by: Michel Loiseleur <[email protected]> * docs(traefik): public and private routing Signed-off-by: ivan katliarchuk <[email protected]> * docs(traefik): public and private routing Co-authored-by: Michel Loiseleur <[email protected]> --------- Signed-off-by: ivan katliarchuk <[email protected]> Co-authored-by: Michel Loiseleur <[email protected]>
1 parent 9f16d83 commit 5a321b6

File tree

10 files changed

+337
-239
lines changed

10 files changed

+337
-239
lines changed

‎docs/flags.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
| `--[no-]ignore-ingress-rules-spec` | Ignore the spec.rules section in Ingress resources (default: false) |
3939
| `--[no-]ignore-ingress-tls-spec` | Ignore the spec.tls section in Ingress resources (default: false) |
4040
| `--[no-]ignore-non-host-network-pods` | Ignore pods not running on host network when using pod source (default: false) |
41-
| `--ingress-class=INGRESS-CLASS` | Require an Ingress to have this class name (defaults to any class; specify multiple times to allow more than one class) |
41+
| `--ingress-class=INGRESS-CLASS` | Require an Ingress to have this class name; specify multiple times to allow more than one class (optional; defaults to any class) |
4242
| `--label-filter=""` | Filter resources queried for endpoints by label selector; currently supported by source types crd, gateway-httproute, gateway-grpcroute, gateway-tlsroute, gateway-tcproute, gateway-udproute, ingress, node, openshift-route, service and ambassador-host |
4343
| `--managed-record-types=A...` | Record types to manage; specify multiple times to include many; (default: A,AAAA,CNAME) (supported records: A, AAAA, CNAME, NS, SRV, TXT) |
4444
| `--namespace=""` | Limit resources queried for endpoints to a specific namespace (default: all namespaces) |

‎docs/snippets/traefik-proxy/ingress-route-default.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: traefik.io/v1alpha1
2+
kind: IngressRoute
3+
metadata:
4+
name: traefik-ingress
5+
annotations:
6+
external-dns.alpha.kubernetes.io/target: traefik.example.com
7+
kubernetes.io/ingress.class: traefik
8+
spec:
9+
entryPoints:
10+
- web
11+
- websecure
12+
routes:
13+
- match: Host(`application.example.com`)
14+
kind: Rule
15+
services:
16+
- name: service
17+
namespace: namespace
18+
port: port

‎docs/snippets/traefik-proxy/ingress-route-public-private.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
apiVersion: traefik.io/v1
3+
kind: IngressRoute
4+
metadata:
5+
name: traefik-public-abc
6+
annotations:
7+
kubernetes.io/ingress.class: traefik-public
8+
spec:
9+
entryPoints:
10+
- web
11+
- websecure
12+
routes:
13+
- match: Host(`application.public.example.com`)
14+
kind: Rule
15+
services:
16+
- name: service
17+
namespace: namespace
18+
port: port
19+
tls:
20+
secretName: traefik-tls-cert-public
21+
---
22+
apiVersion: traefik.io/v1
23+
kind: IngressRoute
24+
metadata:
25+
name: traefik-private-abc
26+
annotations:
27+
kubernetes.io/ingress.class: traefik-private
28+
spec:
29+
entryPoints:
30+
- web
31+
- websecure
32+
routes:
33+
- match: Host(`application.private.tlc`)
34+
kind: Rule
35+
services:
36+
- name: service
37+
namespace: namespace
38+
port: port
39+
tls:
40+
secretName: traefik-tls-cert-private

‎docs/snippets/traefik-proxy/traefik-public-private-config.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
type: public
3+
providers:
4+
kubernetesCRD:
5+
ingressClass: traefik-public
6+
7+
kubernetesIngress:
8+
ingressClass: traefik-public
9+
---
10+
type: private
11+
providers:
12+
kubernetesCRD:
13+
ingressClass: traefik-private
14+
15+
kubernetesIngress:
16+
ingressClass: traefik-private

‎docs/snippets/traefik-proxy/with-cluster-rbac.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: external-dns
6+
---
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRole
9+
metadata:
10+
name: external-dns
11+
rules:
12+
- apiGroups: [""]
13+
resources: ["services","endpoints","pods"]
14+
verbs: ["get","watch","list"]
15+
- apiGroups: [""]
16+
resources: ["nodes"]
17+
verbs: ["list","watch"]
18+
- apiGroups: ["traefik.containo.us","traefik.io"]
19+
resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps"]
20+
verbs: ["get","watch","list"]
21+
---
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
kind: ClusterRoleBinding
24+
metadata:
25+
name: external-dns-viewer
26+
roleRef:
27+
apiGroup: rbac.authorization.k8s.io
28+
kind: ClusterRole
29+
name: external-dns
30+
subjects:
31+
- kind: ServiceAccount
32+
name: external-dns
33+
namespace: default
34+
---
35+
apiVersion: apps/v1
36+
kind: Deployment
37+
metadata:
38+
name: external-dns
39+
spec:
40+
strategy:
41+
type: Recreate
42+
selector:
43+
matchLabels:
44+
app: external-dns
45+
template:
46+
metadata:
47+
labels:
48+
app: external-dns
49+
spec:
50+
serviceAccountName: external-dns
51+
containers:
52+
- name: external-dns
53+
# update this to the desired external-dns version
54+
image: registry.k8s.io/external-dns/external-dns:v0.17.0
55+
args:
56+
- --source=traefik-proxy
57+
- --provider=aws
58+
- --registry=txt
59+
- --txt-owner-id=my-identifier

‎docs/snippets/traefik-proxy/without-rbac.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: external-dns
5+
spec:
6+
strategy:
7+
type: Recreate
8+
selector:
9+
matchLabels:
10+
app: external-dns
11+
template:
12+
metadata:
13+
labels:
14+
app: external-dns
15+
spec:
16+
containers:
17+
- name: external-dns
18+
# update this to the desired external-dns version
19+
image: registry.k8s.io/external-dns/external-dns:v0.17.0
20+
args:
21+
- --source=traefik-proxy
22+
- --provider=aws
23+
- --registry=txt
24+
- --txt-owner-id=my-identifier

‎docs/sources/traefik-proxy.md‎

Lines changed: 44 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -1,123 +1,29 @@
11
# Traefik Proxy Source
22

3+
- [Traefik Documentation](https://doc.traefik.io/traefik/)
4+
- [Traefik Helm Chart](https://github.com/traefik/traefik-helm-chart)
5+
36
This tutorial describes how to configure ExternalDNS to use the Traefik Proxy source.
47
It is meant to supplement the other provider-specific setup tutorials.
58

69
## Manifest (for clusters without RBAC enabled)
710

811
```yaml
9-
apiVersion: apps/v1
10-
kind: Deployment
11-
metadata:
12-
name: external-dns
13-
spec:
14-
strategy:
15-
type: Recreate
16-
selector:
17-
matchLabels:
18-
app: external-dns
19-
template:
20-
metadata:
21-
labels:
22-
app: external-dns
23-
spec:
24-
containers:
25-
- name: external-dns
26-
# update this to the desired external-dns version
27-
image: registry.k8s.io/external-dns/external-dns:v0.17.0
28-
args:
29-
- --source=traefik-proxy
30-
- --provider=aws
31-
- --registry=txt
32-
- --txt-owner-id=my-identifier
12+
[[% include 'traefik-proxy/without-rbac.yaml' %]]
3313
```
3414

3515
## Manifest (for clusters with RBAC enabled)
3616

3717
```yaml
38-
apiVersion: v1
39-
kind: ServiceAccount
40-
metadata:
41-
name: external-dns
42-
---
43-
apiVersion: rbac.authorization.k8s.io/v1
44-
kind: ClusterRole
45-
metadata:
46-
name: external-dns
47-
rules:
48-
- apiGroups: [""]
49-
resources: ["services","endpoints","pods"]
50-
verbs: ["get","watch","list"]
51-
- apiGroups: [""]
52-
resources: ["nodes"]
53-
verbs: ["list","watch"]
54-
- apiGroups: ["traefik.containo.us","traefik.io"]
55-
resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps"]
56-
verbs: ["get","watch","list"]
57-
---
58-
apiVersion: rbac.authorization.k8s.io/v1
59-
kind: ClusterRoleBinding
60-
metadata:
61-
name: external-dns-viewer
62-
roleRef:
63-
apiGroup: rbac.authorization.k8s.io
64-
kind: ClusterRole
65-
name: external-dns
66-
subjects:
67-
- kind: ServiceAccount
68-
name: external-dns
69-
namespace: default
70-
---
71-
apiVersion: apps/v1
72-
kind: Deployment
73-
metadata:
74-
name: external-dns
75-
spec:
76-
strategy:
77-
type: Recreate
78-
selector:
79-
matchLabels:
80-
app: external-dns
81-
template:
82-
metadata:
83-
labels:
84-
app: external-dns
85-
spec:
86-
serviceAccountName: external-dns
87-
containers:
88-
- name: external-dns
89-
# update this to the desired external-dns version
90-
image: registry.k8s.io/external-dns/external-dns:v0.17.0
91-
args:
92-
- --source=traefik-proxy
93-
- --provider=aws
94-
- --registry=txt
95-
- --txt-owner-id=my-identifier
18+
[[% include 'traefik-proxy/with-cluster-rbac.yaml' %]]
9619
```
9720

9821
## Deploying a Traefik IngressRoute
9922

100-
Create a IngressRoute file called 'traefik-ingress.yaml' with the following contents:
23+
Create an IngressRoute file called 'ingress-route-default' with the following contents:
10124

10225
```yaml
103-
apiVersion: traefik.io/v1alpha1
104-
kind: IngressRoute
105-
metadata:
106-
name: traefik-ingress
107-
annotations:
108-
external-dns.alpha.kubernetes.io/target: traefik.example.com
109-
kubernetes.io/ingress.class: traefik
110-
spec:
111-
entryPoints:
112-
- web
113-
- websecure
114-
routes:
115-
- match: Host(`application.example.com`)
116-
kind: Rule
117-
services:
118-
- name: service
119-
namespace: namespace
120-
port: port
26+
[[% include 'traefik-proxy/ingress-route-default.yaml' %]]
12127
```
12228

12329
Note the annotation on the IngressRoute (`external-dns.alpha.kubernetes.io/target`); use the same hostname as the traefik DNS.
@@ -127,30 +33,61 @@ ExternalDNS uses this annotation to determine what services should be registered
12733
Create the IngressRoute:
12834

12935
```sh
130-
kubectl create -f traefik-ingress.yaml
36+
kubectl create -f docs/snippets/traefik-proxy/ingress-route-default.yaml
13137
```
13238

13339
Depending where you run your IngressRoute it can take a little while for ExternalDNS synchronize the DNS record.
13440

41+
## Support private and public routing
42+
43+
To create a more robust and manageable Kubernetes environment, leverage separate Ingress classes to finely control public and private routing's security, performance, and operational policies. Similar approach could work in multi-tenant environments.
44+
45+
For this we are going to need two instances of `traefik` (public and private) as well as two instances of `external-dns`.
46+
47+
The `traefik` configuration should contain (for more detailed configured validate with the vendor)
48+
49+
```yaml
50+
[[% include 'traefik-proxy/traefik-public-private-config.yaml' %]]
51+
```
52+
53+
Create a IngressRoutes files with the following contents:
54+
55+
```yaml
56+
[[% include 'traefik-proxy/ingress-route-public-private.yaml' %]]
57+
```
58+
59+
And the arguments for `external-dns` instances should looks like
60+
61+
```yaml
62+
---
63+
args:
64+
- --source=traefik-proxy
65+
- --annotation-filter="kubernetes.io/ingress.class=traefik-public"
66+
---
67+
args:
68+
- --source=traefik-proxy
69+
- --annotation-filter="kubernetes.io/ingress.class=traefik-private"
70+
```
71+
13572
## Cleanup
13673
13774
Now that we have verified that ExternalDNS will automatically manage Traefik DNS records, we can delete the tutorial's example:
13875
13976
```sh
140-
kubectl delete -f traefik-ingress.yaml
77+
kubectl delete -f docs/snippets/traefik-proxy/ingress-route-default.yaml
14178
kubectl delete -f externaldns.yaml
14279
```
14380

14481
## Additional Flags
14582

146-
| Flag | Description |
147-
| --- | --- |
83+
| Flag | Description |
84+
|--------------------------|----------------------------------------------------------|
14885
| --traefik-disable-legacy | Disable listeners on Resources under traefik.containo.us |
149-
| --traefik-disable-new | Disable listeners on Resources under traefik.io |
86+
| --traefik-disable-new | Disable listeners on Resources under traefik.io |
15087

15188
### Disabling Resource Listeners
15289

153-
Traefik has deprecated the legacy API group, traefik.containo.us, in favor of traefik.io. By default the traefik-proxy source will listen for resources under both API groups; however, this may cause timeouts with the following message
90+
Traefik has deprecated the legacy API group, `traefik.containo.us`, in favor of `traefik.io`. By default the `traefik-proxy` source will listen for resources under both API groups; however, this may cause timeouts with the following message
15491

15592
```sh
15693
FATA[0060] failed to sync traefik.io/v1alpha1, Resource=ingressroutes: context deadline exceeded

‎pkg/apis/externaldns/types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ func App(cfg *Config) *kingpin.Application {
473473
app.Flag("ignore-ingress-rules-spec", "Ignore the spec.rules section in Ingress resources (default: false)").BoolVar(&cfg.IgnoreIngressRulesSpec)
474474
app.Flag("ignore-ingress-tls-spec", "Ignore the spec.tls section in Ingress resources (default: false)").BoolVar(&cfg.IgnoreIngressTLSSpec)
475475
app.Flag("ignore-non-host-network-pods", "Ignore pods not running on host network when using pod source (default: false)").BoolVar(&cfg.IgnoreNonHostNetworkPods)
476-
app.Flag("ingress-class", "Require an Ingress to have this class name (defaults to any class; specify multiple times to allow more than one class)").StringsVar(&cfg.IngressClassNames)
476+
app.Flag("ingress-class", "Require an Ingress to have this class name; specify multiple times to allow more than one class (optional; defaults to any class)").StringsVar(&cfg.IngressClassNames)
477477
app.Flag("label-filter", "Filter resources queried for endpoints by label selector; currently supported by source types crd, gateway-httproute, gateway-grpcroute, gateway-tlsroute, gateway-tcproute, gateway-udproute, ingress, node, openshift-route, service and ambassador-host").Default(defaultConfig.LabelFilter).StringVar(&cfg.LabelFilter)
478478
managedRecordTypesHelp := fmt.Sprintf("Record types to manage; specify multiple times to include many; (default: %s) (supported records: A, AAAA, CNAME, NS, SRV, TXT)", strings.Join(defaultConfig.ManagedDNSRecordTypes, ","))
479479
app.Flag("managed-record-types", managedRecordTypesHelp).Default(defaultConfig.ManagedDNSRecordTypes...).StringsVar(&cfg.ManagedDNSRecordTypes)

0 commit comments

Comments
 (0)