Merge branch 'traefik' into 'master'

部署traefik 1.7

See merge request QA/tke-eos!45

yamls/traefik/readme.md

+## 部署traefik 1.7
+
+## 创建必要的帐号
+
+kubectl apply -f traefik-rbac.yaml
+
+### 创建secret保存证书
+
+kubectl create secret generic traefik-cert --from-file=tls.crt --from-file=tls.key -n kube-system
+
+### 创建configmap保存traefik配置
+
+kubectl create configmap traefik-conf --from-file=traefik.toml -n kube-system
+
+### 部署traefik deamonset
+
+kubectl apply -f traefik-ds.yaml
+

yamls/traefik/tls.crt

+-----BEGIN CERTIFICATE-----
+MIIFnDCCBISgAwIBAgIQBjaqYWkT60UXF0gA1jtPMTANBgkqhkiG9w0BAQsFADBy
+MQswCQYDVQQGEwJDTjElMCMGA1UEChMcVHJ1c3RBc2lhIFRlY2hub2xvZ2llcywg
+SW5jLjEdMBsGA1UECxMURG9tYWluIFZhbGlkYXRlZCBTU0wxHTAbBgNVBAMTFFRy
+dXN0QXNpYSBUTFMgUlNBIENBMB4XDTE5MDQyNDAwMDAwMFoXDTIwMDQyMzEyMDAw
+MFowHDEaMBgGA1UEAwwRKi5saWFuZ2tlYmFuZy5uZXQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCoxfyjFmBOoxMzs5c3orTHUK8KoBFOxjDnerOkahtI
+DUkA9zVhKkbOgaL8RhmvFLssvcOFb+ptRDWn+8SVwuG3YO6IJHROLK0/nNnSKLxT
+fY1pRr+bv4h03lk7Fs+af4rqo+nHR/BzSB7KvGl88S+wBQztObZGPdDYm86ixL36
+Rpb5u5R4R3mm8JBHqO8s1NwCk4rhnnCH0ggSh4N46h6uXl/i3/e8KN38AXB1eUYY
+kf+w+b0r7LL6sVvtvb9NmFLhDglNraqW2W1tFYfgbVV1Ach/ZphPH/CB/nZWjQWG
+kb+ty94vAYGIZ2IgWKgb7cDNTPRyo0LK1FiT+2cCrPLXAgMBAAGjggKCMIICfjAf
+BgNVHSMEGDAWgBR/05nzoEcOMQBWViKOt8ye3coBijAdBgNVHQ4EFgQUbgtj2Bt1
+oO/dXEYZ+mf+nZ09l0EwLQYDVR0RBCYwJIIRKi5saWFuZ2tlYmFuZy5uZXSCD2xp
+YW5na2ViYW5nLm5ldDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUH
+AwEGCCsGAQUFBwMCMEwGA1UdIARFMEMwNwYJYIZIAYb9bAECMCowKAYIKwYBBQUH
+AgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQIBMH0GCCsG
+AQUFBwEBBHEwbzAhBggrBgEFBQcwAYYVaHR0cDovL29jc3AuZGNvY3NwLmNuMEoG
+CCsGAQUFBzAChj5odHRwOi8vY2FjZXJ0cy5kaWdpdGFsY2VydHZhbGlkYXRpb24u
+Y29tL1RydXN0QXNpYVRMU1JTQUNBLmNydDAJBgNVHRMEAjAAMIIBBAYKKwYBBAHW
+eQIEAgSB9QSB8gDwAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUA
+AAFqTn0yTgAABAMARzBFAiEAz/f9DKjaq9/9h+EOToWSLKb++wTmp7i6R5WqzK6z
+qPcCIC4Ck7tP3AvNRY0KhiUhUzzFRKmekM/AfouCCUtrU4DdAHYAh3W/51l8+IxD
+mV+9827/Vo1HVjb/SrVgwbTq/16ggw8AAAFqTn0zZgAABAMARzBFAiAF9e5hAiZZ
+Aw59BWhUt2U80q4SwZFCAqI/8rivsnUiZQIhAPuFNkGbck+LYbTMCK8H6A+1wbnl
+ICYP5UTkPLm/NYhFMA0GCSqGSIb3DQEBCwUAA4IBAQADEZdu3wSRZgokPH0Hl2FO
+coGeYLVR2TPM/hQLLqnh1e1A4TepeK6R9qMmHsO8MuzlDK/4ZiD5TaV71BSL1+OK
+Ke2At+/RxDclLIrenURnD1S1iEGTTDJ2Itpliyrm+taastxjMLSFl99uVSPadH1c
+r7L32PIEHIxpyGSZRfOfFOUsh8w5bHgta8n3rM5azDsYaB52CjPSyLJpZ2dE17/v
+5uZoX5Kc9e+sNCy3RocXIkmvyIgKDYa/RZ14tNm4R0fwDRofJhxEMb4kO9ky6hzu
+kuAEPNdzn2ji7ZfalvzCiBy/ayzwBemXZQe5+Hg8PsNk3WPNpvM8rKGGjnitbvKb
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIErjCCA5agAwIBAgIQBYAmfwbylVM0jhwYWl7uLjANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0xNzEyMDgxMjI4MjZaFw0yNzEyMDgxMjI4MjZaMHIxCzAJBgNVBAYTAkNO
+MSUwIwYDVQQKExxUcnVzdEFzaWEgVGVjaG5vbG9naWVzLCBJbmMuMR0wGwYDVQQL
+ExREb21haW4gVmFsaWRhdGVkIFNTTDEdMBsGA1UEAxMUVHJ1c3RBc2lhIFRMUyBS
+U0EgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCgWa9X+ph+wAm8
+Yh1Fk1MjKbQ5QwBOOKVaZR/OfCh+F6f93u7vZHGcUU/lvVGgUQnbzJhR1UV2epJa
+e+m7cxnXIKdD0/VS9btAgwJszGFvwoqXeaCqFoP71wPmXjjUwLT70+qvX4hdyYfO
+JcjeTz5QKtg8zQwxaK9x4JT9CoOmoVdVhEBAiD3DwR5fFgOHDwwGxdJWVBvktnoA
+zjdTLXDdbSVC5jZ0u8oq9BiTDv7jAlsB5F8aZgvSZDOQeFrwaOTbKWSEInEhnchK
+ZTD1dz6aBlk1xGEI5PZWAnVAba/ofH33ktymaTDsE6xRDnW97pDkimCRak6CEbfe
+3dXw6OV5AgMBAAGjggFPMIIBSzAdBgNVHQ4EFgQUf9OZ86BHDjEAVlYijrfMnt3K
+AYowHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDgYDVR0PAQH/BAQD
+AgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAG
+AQH/AgEAMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Au
+ZGlnaWNlcnQuY29tMEIGA1UdHwQ7MDkwN6A1oDOGMWh0dHA6Ly9jcmwzLmRpZ2lj
+ZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwTAYDVR0gBEUwQzA3Bglg
+hkgBhv1sAQIwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29t
+L0NQUzAIBgZngQwBAgEwDQYJKoZIhvcNAQELBQADggEBAK3dVOj5dlv4MzK2i233
+lDYvyJ3slFY2X2HKTYGte8nbK6i5/fsDImMYihAkp6VaNY/en8WZ5qcrQPVLuJrJ
+DSXT04NnMeZOQDUoj/NHAmdfCBB/h1bZ5OGK6Sf1h5Yx/5wR4f3TUoPgGlnU7EuP
+ISLNdMRiDrXntcImDAiRvkh5GJuH4YCVE6XEntqaNIgGkRwxKSgnU3Id3iuFbW9F
+UQ9Qqtb1GX91AJ7i4153TikGgYCdwYkBURD8gSVe8OAco6IfZOYt/TEwii1Ivi1C
+qnuUlWpsF1LdQNIdfbW3TSe0BhQa7ifbVIfvPWHYOu3rkg1ZeMo6XRU9B4n5VyJY
+RmE=
+-----END CERTIFICATE-----

yamls/traefik/tls.key

+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAqMX8oxZgTqMTM7OXN6K0x1CvCqARTsYw53qzpGobSA1JAPc1
+YSpGzoGi/EYZrxS7LL3DhW/qbUQ1p/vElcLht2DuiCR0TiytP5zZ0ii8U32NaUa/
+m7+IdN5ZOxbPmn+K6qPpx0fwc0geyrxpfPEvsAUM7Tm2Rj3Q2JvOosS9+kaW+buU
+eEd5pvCQR6jvLNTcApOK4Z5wh9IIEoeDeOoerl5f4t/3vCjd/AFwdXlGGJH/sPm9
+K+yy+rFb7b2/TZhS4Q4JTa2qltltbRWH4G1VdQHIf2aYTx/wgf52Vo0FhpG/rcve
+LwGBiGdiIFioG+3AzUz0cqNCytRYk/tnAqzy1wIDAQABAoIBAAHTFh6bPNJM0AXU
+kLNwxlyLQkEuptE/skKmYG/MF9xpDFt+0KxqvRY5b44jod5zLmzW5li4c4PX426b
++a2WzELjwOBm6Hz53auc4fv0JckPR+qV8bdY1DxTNQq+/eKRM2rC9+GIJRDR/Ec7
+zzYjE11nSJL99zr+KxZUZOD8mIMuoKuX1pxFgEomSEQ6/r31MvLBP7TvT+MwTH7g
+xRLGzvwLur9fJuvvNYu3l8TrPMTDxsMkmIym+FW0K3NHMgngq5eiCDyN1l9SM8hx
+r8eDLbctEO8tnPAY2NC0EkUIjSq7nZ4qvAo0fxV12uzOEG1gL4PitUqD8Er+0+Cp
+EpbPNhkCgYEA4huSzx66bTvy40qfoT1X7kfDLzPnivhTVVYyRiLEJg584su4rpiy
+P9SZ33WLtJwyW4CFZFbGD+5jQeiADyrh2EDarKV7R7ToxbC2BRxZ0pU3lmBn37bS
+x+V3CcBCpT4SUVsatElFKzwd4iQHNX//BqNj8/O+RRCAGcBWDNQhbX8CgYEAvxX7
+K5DLLLPFs06aBpcqN//Bjr1s45Kt9ySpFcEkyvgl2qM0L/69zmrsLaFwTQN+WCi8
+uTea/SLi6Z8dDd+ceW6nZR32br/EiSadN4m8td+wI/Doo2GjXeOSF9FunfejnhjA
+oED1JEUVJiNYaOAAeLzjsukKo2uEKscEeMGtVqkCgYA0IzePGv7SAWjYkHSOsZ59
+C38ue0GBAhH1M5MUKSAhxmV1xpQnbn5ryZJRvMEiPIJAJzqbEIdLVST+Jaah2LmL
+LClAdkgfGNA0BbNzKj5sGIxg2IobRAUGoxr33KWBhPakW+WkfOC+P3aEltoys/kS
+hsqdji7prgxb48Xz31Z18QKBgQCxFO/FOdPvw1HNj2QSA3iumKeJXmZQp5fsVt8T
+OACe0ERUT7aHW+4OIuxohRmLZVdq36W1h6BsQi5DDp9gQf/CURd0D8ZWcAT0jQJZ
+e52Udo3HYPRWpJ8+3SyAQife4KWSV6H7YPdM+3BT/aFq31vQiEwDew/Ozk6XTgQI
+3IOEsQKBgQDGJesnVnOSzU59xvoV5NGd+5b0t/J5bCuAT65dWXpPeVv6+o25GYH/
+Kyg+iWttsLs+cDAYPOm057wkU4JveOy8YooibzxGT48iytbYwjZgPKT+X7a3jGFO
+GLBl71zKl5ZQFuVLbweL3gaQnMoY5uXhi0rMR0y/Ub/QemdCdIQ61w==
+-----END RSA PRIVATE KEY-----
\ No newline at end of file

yamls/traefik/traefik-ds.yaml

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik-ingress-controller
+  namespace: kube-system
+---
+kind: DaemonSet
+apiVersion: extensions/v1beta1
+metadata:
+  name: traefik-ingress-controller
+  namespace: kube-system
+  labels:
+    k8s-app: traefik-ingress-lb
+spec:
+  template:
+    metadata:
+      labels:
+        k8s-app: traefik-ingress-lb
+        name: traefik-ingress-lb
+    spec:
+      serviceAccountName: traefik-ingress-controller
+      terminationGracePeriodSeconds: 60
+      volumes:
+      - name: ssl
+        secret:
+            secretName: traefik-cert
+      - name: config
+        configMap:
+          name: traefik-conf
+      containers:
+      - image: traefik:v1.7
+        name: traefik-ingress-lb
+        volumeMounts:
+        - mountPath: "/ssl"
+          name: "ssl"
+        - mountPath: "/config"
+          name: "config"
+        ports:
+        - name: http
+          containerPort: 80
+          hostPort: 80
+        - name: https
+          containerPort: 443
+          hostPort: 443
+        - name: admin
+          containerPort: 8080
+          hostPort: 8080
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE
+        args:
+        - --api
+        - --kubernetes
+        - --logLevel=INFO
+        - --configfile=/config/traefik.toml
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: traefik-ingress-service
+  namespace: kube-system
+spec:
+  selector:
+    k8s-app: traefik-ingress-lb
+  ports:
+    - protocol: TCP
+      port: 80
+      name: web
+    - protocol: TCP
+      # 管理ui
+      port: 8080
+      name: admin
+    - protocol: TCP
+      port: 443
+      name: https
+
+
+      
\ No newline at end of file

yamls/traefik/traefik-rbac.yaml

+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-ingress-controller
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+    - extensions
+    resources:
+    - ingresses/status
+    verbs:
+    - update
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-ingress-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-ingress-controller
+subjects:
+- kind: ServiceAccount
+  name: traefik-ingress-controller
+  namespace: kube-systems
\ No newline at end of file

yamls/traefik/traefik-ui.yaml

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-web-ui
+  namespace: kube-system
+spec:
+  selector:
+    k8s-app: traefik-ingress-lb
+  ports:
+  - name: web
+    port: 80
+    targetPort: 8080
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: traefik-web-ui
+  namespace: kube-system
+spec:
+  tls:
+  - secretName: traefik-cert
+  rules:
+  - host: traefik-ui.liangkebang.net
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: traefik-web-ui
+          servicePort: web

yamls/traefik/traefik.toml

+logLevel = "INFO"
+defaultEntryPoints = ["http", "https"]
+
+[kubernetes]
+
+
+[entryPoints]
+  [entryPoints.http]
+  address = ":80"
+    #[entryPoints.http.redirect]
+      #entryPoint = "https"
+  [entryPoints.https]
+  address = ":443"
+    [entryPoints.https.tls]
+      [[entryPoints.https.tls.certificates]]
+      certFile = "/ssl/tls.crt"
+      keyFile = "/ssl/tls.key"