traefik goodies

clusters/k3s/ip/ip-deployment.yml

@@ -7,7 +7,7 @@ spec:
   selector:
     matchLabels:
       app: ip
-  replicas: 3
+  replicas: 1
   template:
     metadata:
       labels:

clusters/k3s/ip/ip-ingress-traefik-tls.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ip-ingress
+  namespace: ip
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
+spec:
+  rules:
+    - host: ip.vntx.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ip-service
+                port:
+                  number: 4000
+  tls:
+    - secretName: ip-tls
+      hosts:
+        - ip.vntx.net

clusters/k3s/traefik/dashboard-auth-middleware.yaml

@@ -0,0 +1,7 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: dashboard-basic-auth
+spec:
+  basicAuth:
+    secret: traefik-dashboard-auth-secret

clusters/k3s/traefik/dashboard-auth-secret.yaml

@@ -0,0 +1,23 @@
+# Note: in a kubernetes secret the string (e.g. generated by htpasswd) must be base64-encoded first.
+# To create an encoded user:password pair, the following command can be used:
+# htpasswd -nb user password | openssl base64
+# Or create a new file with the credentials you want and then convert it when your are done
+# htpasswd -c auth username
+# *enter and reenter password*
+# htpasswd auth username2
+# *enter and reenter password*
+# base64 auth
+# copy and paste into below
+# the |2 should stay regardless of how many users. It is yaml syntax.
+# Below are username/passwords test/test and test2/test2
+# https://doc.traefik.io/traefik/middlewares/basicauth/
+apiVersion: v1
+kind: Secret
+metadata:
+  name: traefik-dashboard-auth-secret
+  namespace: default
+data:
+  users: |2
+    Z3JhaGFtOiRhcHIxJGNiajQ2dHRHJEg3OVQ2UDl5QXJoa0t5V01UL0JLUi4K
+
+

clusters/k3s/traefik/letsencrypt-prod.yaml

@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: graham@vntx.net
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+    - http01:
+        ingress:
+          class: traefik
+

clusters/k3s/traefik/traefik-dashboard-ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: traefik-ingress
+  namespace: kube-system
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: default-dashboard-basic-auth@kubernetescrd
+spec:
+  rules:
+    - host: traefik.vntx.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: traefik-dashboard
+                port:
+                  number: 9000
+  tls:
+    - secretName: traefik-tls
+      hosts:
+        - traefik.vntx.net

clusters/k3s/traefik/traefik-dashboard-service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-dashboard
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/instance: traefik
+    app.kubernetes.io/name: traefik-dashboard
+spec:
+  type: ClusterIP
+  ports:
+  - name: traefik
+    port: 9000
+    targetPort: traefik
+    protocol: TCP
+  selector:
+    app.kubernetes.io/instance: traefik-kube-system
+    app.kubernetes.io/name: traefik
+

clusters/k3s/traefik/traefik-https-redirect-middleware.yaml

@@ -0,0 +1,9 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+

clusters/k3s/whoami/whoami-deployment.yaml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: whoami
+spec:
+  selector:
+    matchLabels:
+      app: whoami
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: whoami
+    spec:
+      containers:
+        - name: whoami
+          image: containous/whoami:v1.5.0
+          ports:
+            - containerPort: 80
+

clusters/k3s/whoami/whoami-ingress-tls.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: whoami-tls-ingress
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
+spec:
+  rules:
+    - host: whoami.vntx.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: whoami
+                port:
+                  number: 5678
+  tls:
+    - secretName: whoami-tls
+      hosts:
+        - whoami.vntx.net

clusters/k3s/whoami/whoami-ingress.yaml

@@ -0,0 +1,24 @@
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: whoami
+
+spec:
+  rules:
+    - http:
+        paths:
+          - path: /bar
+            pathType: Prefix
+            backend:
+              service:
+                name: whoami
+                port:
+                  number: 5678
+          - path: /foo
+            pathType: Prefix
+            backend:
+              service:
+                name: whoami
+                port:
+                  number: 5678
+

clusters/k3s/whoami/whoami-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5678
+      targetPort: 80
+  selector:
+    app: whoami
+