adrien/ansible-role-k8s-traefik
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Compare commits

base: adrien:master
Branches Tags
adrien:master
..
compare: adrien:WIP2
Branches Tags
adrien:master

No commits in common. "master" and "WIP2" have entirely different histories.
master ... WIP2

18 changed files with 202 additions and 2419 deletions
Download patch file Download diff file Expand all files Collapse all files

22
defaults/main.yml
View file

@ -1,10 +1,7 @@
my_context: kubernetes
traefik_version: "3.3.6"
traefik_helm_chart_version: "35.0.1"
traefikcrds_helm_chart_version: "1.6.0"
cluster_domain: "local"
traefik_version: "2.3"
traefik_domain: "local"
traefik_namespace: "traefik"
traefik_service_type: LoadBalancer
#ingress_whitelist:
# - 10.96.0.0/12
# - 10.244.0.0/16
@ -13,17 +10,10 @@ traefik_service_type: LoadBalancer
# - localhost
traefik_cpu_limit: 500m
traefik_memory_limit: 300Mi
traefik_entrypoints: []
# - { name: "http", port: 8000, proto: "TCP", hostport: 80 middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
# - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
# - { name: "traefik", port: 8080, proto: "TCP" }
# traefik_external_ips: []
# - 1.2.3.4
traefik_entrypoints:
- { name: "http", port: 8000, proto: "TCP", hostport: 80 }
- { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true }
- { name: "traefik", port: 8080, proto: "TCP" }
basic_auth: false
#traefik_dashboard_certificate: wildcard-cluster
crowdsec_namespace: "crowdsec"
crowdsec_traefik_bouncer_chart_version: "0.1.3"
traefik_sabblier_version: "1.9.0"

1523
files/grafana-dashboard.yml
View file

File diff suppressed because it is too large Load diff

2
meta/main.yml
View file

@ -6,7 +6,7 @@ galaxy_info:
galaxy_tags: []
license: GPL2
collections:
- kubernetes.core
- community.kubernetes
platforms:
- name: kubernetes
version:

217
tasks/main.yml
View file

@ -1,20 +1,7 @@
- name: traefik setup
block:
# - name: Deploy Traefik CRDs
# kubernetes.core.k8s:
# state: present
# context: "{{ my_context }}"
# apply: true
# definition: "{{ lookup('url', item , split_lines=False) | from_yaml_all }}"
# with_items:
## - "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml"
# - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
## - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml"
## ansible.builtin.command: >
## kubectl --context "{{ my_context }}" apply --server-side --force-conflicts -k
## https://github.com/traefik/traefik-helm-chart/tree/v{{ traefik_helm_chart_version }}/traefik/crds/
- name: namespace
kubernetes.core.k8s:
k8s:
state: present
context: "{{ my_context }}"
merge_type: merge
@ -22,20 +9,20 @@
api_version: v1
kind: Namespace
metadata:
name: '{{ traefik_namespace }}'
name: traefik
labels:
namespace: '{{ traefik_namespace }}'
- name: Create a Secret object for basic authentification
kubernetes.core.k8s:
k8s:
state: present
context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}'
definition:
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
namespace: '{{ traefik_namespace }}'
type: Opaque
data:
basic_auth: "{{ basic_auth_data | b64encode }}"
@ -43,7 +30,7 @@
- basic_auth|bool
- name: Add host label for traefik deployment
kubernetes.core.k8s:
k8s:
state: present
context: "{{ my_context }}"
definition:
@ -58,36 +45,8 @@
when:
- traefik_node_selector is defined
- name: Deploy latest version of CrowdSec Traefik bouncer
kubernetes.core.helm:
context: "{{ my_context }}"
name: crowdsec-traefik-bouncer
release_namespace: "{{ traefik_namespace }}"
create_namespace: true
chart_ref: crowdsec/crowdsec-traefik-bouncer
chart_version: "{{ crowdsec_traefik_bouncer_chart_version }}"
values:
image:
tag: "0.5.0"
bouncer:
crowdsec_bouncer_api_key: "{{ traefik_crowdsec_bouncer_apikey }}"
crowdsec_agent_host: "crowdsec-service.{{ crowdsec_namespace }}.svc.cluster.local:8080"
crowdsec_bouncer_gin_mode: "release"
replicaCount: 1
podSecurityContext:
fsGroup: 2000
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
when:
- traefik_crowdsec_bouncer_apikey is defined
# - name: Get Deployment information object
# kubernetes.core.k8s_info:
# k8s_info:
# context: "{{ my_context }}"
# api_version: v1
# kind: DaemonSet
@ -98,11 +57,11 @@
# register: traefik_actual_resources
#
# - name: Retreive actual traefik version
# ansible.builtin.shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
# shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
# register: traefik_actual_version
#
# - name: Remove old traefik version {{ traefik_actual_version.stdout }}
# kubernetes.core.k8s:
# k8s:
# state: "absent"
# context: "{{ my_context }}"
# resource_definition: "{{ lookup('template', item) | from_yaml }}"
@ -114,144 +73,62 @@
# - not traefik_version == traefik_actual_version.stdout
# - traefik_actual_version.stdout is version(traefik_version, '>')
# https://github.com/traefik/traefik-helm-chart
- name: Defined traefik repository
kubernetes.core.helm_repository:
community.kubernetes.helm_repository:
name: traefik
repo_url: "https://helm.traefik.io/traefik"
- name: Deploy Traefik CRDs
kubernetes.core.helm:
context: "{{ my_context }}"
name: traefik-crds
chart_ref: traefik/traefik-crds
chart_version: "{{ traefikcrds_helm_chart_version }}"
release_namespace: "{{ traefik_namespace }}"
create_namespace: true
# - name: show templating results
# ansible.builtin.debug:
# msg: "{{ lookup('ansible.builtin.template', 'traefik-helm-value.yaml.j2') }}"
tags: traefik
- name: Deploy latest version of Traefik
kubernetes.core.helm:
context: "{{ my_context }}"
community.kubernetes.helm:
name: traefik
chart_ref: traefik/traefik
chart_version: "{{ traefik_helm_chart_version }}"
release_namespace: "{{ traefik_namespace }}"
create_namespace: true
skip_crds: true
values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
release_namespace: traefik
values:
image:
tag: "{{ traefik_version_2_3 }}"
additionalArguments:
- --configFile=/etc/traefik/traefik.yaml
podSecurityPolicy:
enabled: true
service:
enabled: false
ingressRoute:
dashboard:
enabled: false
ingressClass:
enabled: true
isDefaultClass: true
ports:
web:
redirectTo: websecure
hostPort: 80
websecure:
hostPort: 443
volumes:
- mountPath: /etc/traefik
name: traefik-conf
type: configMap
- mountPath: /etc/traefik/file
name: traefik-files
type: configMap
- mountPath: /etc/traefik/basic-auth
name: basic-auth
type: secret
- name: Install traefik configuration
kubernetes.core.k8s:
k8s:
state: "present"
context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}'
# merge_type: merge
apply: true
resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
apply: yes
resource_definition: "{{ lookup('template', item) | from_yaml }}"
with_items:
- default-network-dns-policy.yaml.j2
# - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}"
- traefik-certificate.yml.j2
- traefik-cm.yml.j2
- traefik-files.yml.j2
# - traefik-sa.yml.j2
- traefik-ingressroute.yml.j2
# - traefik-svc.yml.j2
# - traefik-defaultbackend.yml.j2
- name: Install traefik plugin's
kubernetes.core.k8s:
state: "present"
context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}'
# merge_type: merge
apply: true
resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
with_items:
- traefik-ondemand-plugin.yml.j2
when:
- traefik_ondemand is defined
- name: ReInstall traefik-hub certificate if already know
kubernetes.core.k8s:
state: "present"
context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}'
# merge_type: merge
# apply: true
resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
with_items:
- traefik-hub-certificate.yml.j2
when:
- traefik_hub_tlscrt is defined
- traefik_hub_tlskey is defined
- name: Defined traefik-hub repository
kubernetes.core.helm_repository:
name: traefik-hub
repo_url: "https://helm.traefik.io/hub"
when:
- traefik_hub_token is defined
- name: Deploy latest version of Traefik-hub
kubernetes.core.helm:
context: "{{ my_context }}"
name: hub-agent
chart_ref: traefik-hub/hub-agent
release_namespace: "{{ traefik_namespace }}"
values:
token: "{{ traefik_hub_token }}"
when:
- traefik_hub_token is defined
# echo 'apiVersion: v1
# kind: Service
# metadata:
# annotations:
# # external-dns.alpha.kubernetes.io/endpoints-type: HostIP
# external-dns.alpha.kubernetes.io/hostname: traefik.ibm.reslinger.net
# external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
# # external-dns.alpha.kubernetes.io/target: "1.2.3.4"
# name: traefik-dns
# namespace: traefik
# spec:
# clusterIP: None
# ports:
# - name: web
# port: 80
# protocol: TCP
# targetPort: web
# - name: websecure
# port: 443
# protocol: TCP
# targetPort: websecure
# selector:
# app.kubernetes.io/instance: traefik-traefik
# app.kubernetes.io/name: traefik' | kubectl --context kubeibm -n traefik apply -f -
# - name: Deploy latest version of Switchboard
# kubernetes.core.helm:
# context: "{{ my_context }}"
# name: switchboard
# chart_ref: oci://ghcr.io/borchero/charts/switchboard
# release_namespace: "{{ traefik_namespace }}"
# # values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
# values:
# integrations:
# # certManager:
# # enabled: true
# # issuer: "letsencrypt-prod"
# externalDNS:
# enabled: true
# targetIPs: [10.144.217.172]
- name: Install traefik grafana dashboard
kubernetes.core.k8s:
state: "present"
context: "{{ my_context }}"
namespace: 'traefik'
apply: yes
resource_definition: "{{ lookup('file', item) | from_yaml_all }}"
with_items:
- grafana-dashboard.yml
- traefik-svc.yml.j2
tags: traefik

46
templates/default-network-dns-policy.yaml.j2
View file

@ -1,46 +0,0 @@
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: intra-namespace
spec:
podSelector: {}
ingress:
- from:
- namespaceSelector:
matchLabels:
name: {{ traefik_namespace }}
#---
#apiVersion: networking.k8s.io/v1
#kind: NetworkPolicy
#metadata:
# name: allow-dns-access
#spec:
# podSelector:
# matchLabels: {}
# policyTypes:
# - Egress
# egress:
# - to:
# - namespaceSelector:
# matchLabels:
# kubernetes.io/metadata.name: kube-system
# podSelector:
# matchLabels:
# k8s-app: kube-dns
# ports:
# - protocol: UDP
# port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-traefik-v121-ingress
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
ingress:
- {}
policyTypes:
- Ingress

12
templates/traefik-certificate.yml.j2
View file

@ -1,12 +0,0 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: traefik.{{ cluster_domain }}
spec:
dnsNames:
- traefik.{{ cluster_domain }}
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
secretName: traefik.{{ cluster_domain }}

92
templates/traefik-cm.yml.j2
View file

@ -15,111 +15,49 @@ data:
web:
address: ":8000/tcp"
http:
# middlewares:
# - auth@file
# - secure_headers@file
# - crowdsec-bouncer@file
# - {{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd
redirections:
entryPoint:
to: websecure
scheme: https
permanent: true
websecure:
address: ":8443"
address: ":8443/tcp"
http:
tls:
options: default
# middlewares:
# - auth@file
# - secure_headers@file
# - crowdsec-bouncer@file
http3:
advertisedPort: 443
traefik:
address: ":8080/tcp"
metrics:
address: ":9100/tcp"
{% if traefik_hub_token is defined %}
traefikhub-api:
address: ":9900"
traefikhub-tunl:
address: ":9901/tcp"
{% endif%}
address: ":9000/tcp"
{% for traefik_entrypoint in traefik_entrypoints %}
{{ traefik_entrypoint.name }}:
{% if traefik_entrypoint.proto is defined %}
address: ":{{ traefik_entrypoint.port }}/{{ traefik_entrypoint.proto | lower }}"
{% else %}
address: ":{{ traefik_entrypoint.port }}"
{% endif %}
{% if traefik_entrypoint.tls is defined or traefik_entrypoint.middlewares is defined %}
http:
{% if traefik_entrypoint.middlewares is defined %}
middlewares:
{% for middleware in traefik_entrypoint.middlewares %}
- {{ middleware }}
{% endfor %}
{% endif %}
address: :{{ traefik_entrypoint.port }}
{% if traefik_entrypoint.tls is defined and traefik_entrypoint.tls|bool %}
http:
tls: {}
{% endif %}
{% endif %}
{% endfor %}
providers:
kubernetesCRD:
# ingressClass: "traefik"
throttleDuration: 2s
{% if traefik_ondemand is defined %}
allowEmptyServices: true
{% endif%}
kubernetesIngress:
ingressClass: "traefik"
{% if traefik_hub_token is defined %}
allowExternalNameServices: true
{% endif%}
{% if traefik_ondemand is defined %}
allowEmptyServices: true
{% endif%}
kubernetesGateway: {}
file:
directory: /etc/traefik/file/
watch: true
metrics:
prometheus:
entryPoint: metrics
addRoutersLabels: true
entryPoint: traefik
ping:
entryPoint: traefik
api:
dashboard: true
{% if traefik_hub_token is defined %}
hub: {}
{% endif %}
log:
level: ERROR
# format: json
accessLog: {}
#accessLog:
# filePath: "/var/log/traefik/access.log"
# bufferingSize: 50
## format: json
## fields:
## names:
## BackendAddr: keep
## BackendName: keep
## BackendURL: keep
## FrontendName: keep
{% if traefik_hub_token is defined or traefik_ondemand is defined %}
experimental:
# kubernetesGateway: true
{% if traefik_hub_token is defined %}
hub: true
{% endif %}
{% if traefik_ondemand is defined %}
plugins:
sablier:
moduleName: github.com/sablierapp/sablier
version: v{{ traefik_sabblier_version }}
{% endif %}
{% endif %}
level: WARN
format: json
accessLog:
format: json
fields:
names:
BackendAddr: keep
BackendName: keep
BackendURL: keep
FrontendName: keep

16
templates/traefik-defaultbackend.yml.j2
View file

@ -1,16 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: cheese
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.priority: "1"
traefik.ingress.kubernetes.io/router.middlewares: security_headers@file,compress@file
spec:
defaultBackend:
service:
name: stilton
port:
number: 80

93
templates/traefik-files.yml.j2
View file

@ -7,21 +7,6 @@ data:
traefik-middlewares.yaml: |
http:
middlewares:
min_security:
chain:
middlewares:
- security_headers
{% if ingress_whitelist is defined %}
- traefik-ipwhitelist
{% endif %}
- rate-limit
- compress
{% if false %}
{% if basic_auth|bool %}
- basic-auth
{% endif %}
- authelia
{% endif %}
compress:
compress:
excludedContentTypes: ["text/event-stream"]
@ -32,7 +17,7 @@ data:
security_headers:
headers:
accessControlAllowMethods: ["GET", "OPTIONS", "PUT"]
# accessControlAllowOrigin: "origin-list-or-null"
accessControlAllowOrigin: "origin-list-or-null"
accessControlMaxAge: 100
addVaryHeader: true
browserXssFilter: true
@ -43,15 +28,13 @@ data:
stsPreload: true
customFrameOptionsValue: "SAMEORIGIN"
referrerPolicy: "same-origin"
# permissionsPolicy: "vibrate 'self'"
permissionsPolicy: "camera 'none'; microphone 'none'; geolocation 'none'; payment 'none';"
featurePolicy: "vibrate 'self'"
stsSeconds: 315360000
# contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
sslRedirect: true
contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
# customResponseHeaders:
# X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex,"
# server: ""
hostsProxyHeaders:
- "X-Forwarded-Host"
{% if ingress_whitelist is defined %}
traefik-ipwhitelist:
ipWhiteList:
@ -60,19 +43,6 @@ data:
- {{ acl_whitelist }}
{% endfor %}
{% endif %}
{% if traefik_ondemand is defined %}
ondemand:
plugin:
sablier:
#group: default
dynamic:
displayName: Application is starting
refreshFrequency: 5s
showDetails: "true"
theme: hacker-terminal
sablierUrl: http://sablier:10000
sessionDuration: 1m
{% endif %}
{% if basic_auth|bool %}
basic-auth:
basicAuth:
@ -85,30 +55,7 @@ data:
forwardAuth:
address: "http://authelia:9091/api/verify?rd=https://login.example.com/"
trustForwardHeader: true
authResponseHeaders:
- "Remote-User"
- "Remote-Groups"
- "Remote-Name"
- "Remote-Email"
authelia-basic:
forwardAuth:
address: "http://authelia:9091/api/verify?auth=basic"
trustForwardHeader: true
authResponseHeaders:
- "Remote-User"
- "Remote-Groups"
- "Remote-Name"
- "Remote-Email"
crowdsec-bouncer:
forwardAuth:
address: "http://crowdsec-traefik-bouncer-service/api/v1/forwardAuth"
trustForwardHeader: true
traefik-servers-transport.yaml: |
http:
serversTransports:
skip-verify-https-backend:
insecureSkipVerify: true
authReponseHeaders: ["Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email"]
traefik-tls-defaults-options.yaml: |
tls:
@ -123,33 +70,3 @@ data:
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
alpnProtocols:
- h2
- http/1.1
{% if false %}
stores:
default:
defaultCertificate:
certFile: path/to/wildcardcert.crt
keyFile: path/to/wildcardcert.key
certificates:
- certFile: /path/to/domain.cert
keyFile: /path/to/domain.key
- certFile: /path/to/other-domain.cert
keyFile: /path/to/other-domain.key
{% endif %}
# dashboard.yaml: |
# http:
# routers:
# traefik:
# rule: "Host(`traefik.{{ domain | lower }}`)"
# entryPoints:
# - "websecure"
# middlewares:
# - "min_security@file"
#{% if basic_auth|bool %}
# - "basic-auth@file"
#{% endif %}
# service: "api@internal"

184
templates/traefik-helm-value.yaml.j2
View file

@ -1,184 +0,0 @@
# https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml
{% if traefik_version is defined %}
image:
tag: "{{ traefik_version }}"
{% endif %}
#fullnameOverride: "{{ my_context }}"
additionalArguments:
- --configFile=/etc/traefik/traefik.yaml
#podSecurityPolicy:
# enabled: true
service:
type: {{ traefik_service_type }}
{% if traefik_external_ips is defined %}
externalIPs:
{% for external_ip in traefik_external_ips %}
- {{ external_ip }}
{% endfor %}
{% endif %}
{% if traefik_service_type == "LoadBalancer" %}
annotations:
external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
{% endif %}
ingressRoute:
dashboard:
enabled: false
podDisruptionBudget:
enabled: true
minAvailable: 1
ingressClass:
enabled: true
isDefaultClass: true
{% if false %}
autoscaling:
enabled: true
minReplicas: 1
maxReplicas: 10
metrics:
- type: Resource
resource:
name: cpu
targetAverageUtilization: 60
- type: Resource
resource:
name: memory
targetAverageUtilization: 60
{% endif %}
{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) or traefik_hub_token is defined %}
ports:
{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) %}
web:
# redirectTo: websecure
{% if traefik_hostport is defined and traefik_hostport == true %}
hostPort: 80
{% endif %}
{% if traefik_service_type == "NodePort" %}
nodePort: 80
{% endif %}
websecure:
{% if traefik_hostport is defined and traefik_hostport == true %}
hostPort: 443
{% endif %}
{% if traefik_service_type == "NodePort" %}
nodePort: 443
{% endif %}
http3:
enabled: true
advertisedPort: 443
# tls:
# enabled: true
# options: default
{% endif %}
{% if traefik_hub_token is defined %}
traefikhub-tunl:
port: 9901
expose: true
exposedPort: 9901
protocol: "TCP"
{% endif %}
{% endif %}
volumes:
- mountPath: /etc/traefik
name: traefik-conf
type: configMap
- mountPath: /etc/traefik/file
name: traefik-files
type: configMap
- mountPath: /etc/traefik/basic-auth
name: basic-auth
type: secret
deployment:
{% if traefik_hostport is defined and traefik_hostport == true %}
kind: DaemonSet
{% else %}
replicas: 1
{% endif %}
revisionHistoryLimit: 3
# podAnnotations:
# prometheus.io/port: '9100'
# prometheus.io/scrape: 'true'
# prometheus.io/path: "/metrics"
{% if traefik_hostport is defined and traefik_hostport == true %}
updateStrategy:
type: OnDelete
{% endif %}
metrics:
prometheus:
service:
enabled: true
serviceMonitor:
metricRelabelings: []
# # - sourceLabels: [__name__]
# # separator: ;
# # regex: ^fluentd_output_status_buffer_(oldest|newest)_.+
# # replacement: $1
# # action: drop
relabelings: []
# # - sourceLabels: [__meta_kubernetes_pod_node_name]
# # separator: ;
# # regex: ^(.*)$
# # targetLabel: nodename
# # replacement: $1
# # action: replace
# jobLabel: traefik
# interval: 30s
# honorLabels: true
# # (Optional)
# # scrapeTimeout: 5s
# # honorTimestamps: true
# # enableHttp2: true
# # followRedirects: true
# # additionalLabels:
# # foo: bar
# # namespace: "another-namespace"
# # namespaceSelector: {}
# prometheusRule:
# enabled: true
# additionalLabels: {}
# namespace: "{{ traefik_namespace }}"
# rules:
# - alert: TraefikDown
# expr: up{job="traefik"} == 0
# for: 5m
# labels:
# context: traefik
# severity: warning
# annotations:
# summary: "Traefik Down"
# description: "{% raw %}{{ $labels.pod }} on {{ $labels.nodename }} is down{% endraw %}"
experimental:
{% if traefik_ondemand is defined %}
plugins:
sablier:
moduleName: "github.com/sablierapp/sablier"
version: "v1.8.1"
{% endif %}
{% if traefik_hub_token is defined %}
hub:
enabled: true
{% endif %}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
readOnlyRootFilesystem: true
seccompProfile:
type: RuntimeDefault
{% if false %}
{% raw %}
extraObjects:
- apiVersion: v1
kind: ConfigMap
metadata:
name: "extra"
data:
something: "extra"
- |
apiVersion: v1
kind: ConfigMap
metadata:
name: "templated"
data:
something: {{ printf "templated" }}
{% endraw %}
{% endif %}

14
templates/traefik-hub-certificate.yml.j2
View file

@ -1,14 +0,0 @@
apiVersion: v1
kind: List
items:
- apiVersion: v1
kind: Secret
metadata:
annotations:
app.kubernetes.io/managed-by: traefik-hub
name: hub-certificate
namespace: {{ traefik_namespace }}
type: kubernetes.io/tls
data:
tls.crt: {{ traefik_hub_tlscrt | b64encode }}
tls.key: {{ traefik_hub_tlskey | b64encode }}

35
templates/traefik-ingressroute.yml.j2
View file

@ -1,29 +1,18 @@
apiVersion: traefik.io/v1alpha1
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: traefik
labels:
app: traefik
annotations:
kubernetes.io/ingress.class: traefik
{% if false %}
external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
# external-dns.alpha.kubernetes.io/endpoints-type: HostIP
# external-dns.alpha.kubernetes.io/target: "1.2.3.4"
# external-dns.alpha.kubernetes.io/ttl: "120"
# external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
{% endif %}
spec:
entryPoints:
- websecure
- https
routes:
# Match is the rule corresponding to an underlying router.
# Later on, match could be the simple form of a path prefix, e.g. just "/bar",
# but for now we only support a traefik style matching rule.
- match: Host(`traefik.{{ cluster_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
- match: Host(`traefik.{{ traefik_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
# kind could eventually be one of "Rule", "Path", "Host", "Method", "Header",
# "Parameter", etc, to support simpler forms of rule matching, but for now we
# only support "Rule".
@ -31,31 +20,29 @@ spec:
{% if basic_auth is defined or ingress_whitelist is defined %}
middlewares:
{% if ingress_whitelist is defined %}
- name: traefik-ipwhitelist@file
- name: traefik-ipwhitelist
{% endif %}
{% if basic_auth is defined %}
- name: basic-auth@file
- name: basic-auth
{% endif %}
{% endif %}
services:
- name: api@internal
kind: TraefikService
- match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/ping`)
- match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/ping`)
kind: Rule
services:
- name: ping@internal
kind: TraefikService
# - match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/metrics`)
# kind: Rule
# services:
# - name: prometheus@internal
# kind: TraefikService
- match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/metrics`)
kind: Rule
services:
- name: prometheus@internal
kind: TraefikService
tls:
{% if traefik_dashboard_certificate is defined %}
secretName: {{ traefik_dashboard_certificate }}
{% else %}
secretName: traefik.{{ cluster_domain }}
{% endif %}

12
templates/traefik-middleware-ipwhitelist.yml.j2 Normal file
View file

@ -0,0 +1,12 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: traefik-ipwhitelist
spec:
ipWhiteList:
sourceRange:
{% if ingress_whitelist is defined %}
{% for acl_whitelist in ingress_whitelist %}
- {{ acl_whitelist }}
{% endfor %}
{% endif %}

134
templates/traefik-ondemand-plugin.yml.j2
View file

@ -1,134 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: sablier
labels:
app.kubernetes.io/name: sablier
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: sablier
template:
metadata:
labels:
app.kubernetes.io/name: sablier
spec:
serviceAccountName: sablier
serviceAccount: sablier
containers:
- name: sablier
image: sablierapp/sablier:{{ traefik_sabblier_version }}
args:
- "start"
- "--provider.name=kubernetes"
- "--server.port=10000"
- "--storage.file=/dev/shm/state.json"
ports:
- containerPort: 10000
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
readOnlyRootFilesystem: true
seccompProfile:
type: RuntimeDefault
securityContext:
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
# --configFile=path/to/myconfigfile.yml
---
apiVersion: v1
kind: Service
metadata:
name: sablier
spec:
selector:
app.kubernetes.io/name: sablier
ports:
- protocol: TCP
port: 10000
targetPort: 10000
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: sablier
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: sablier
# namespace: {{ traefik_namespace }}
rules:
- apiGroups:
- apps
- ""
resources:
- deployments
- statefulsets
verbs:
- get # Retrieve info about specific dep
- list # Events
- watch # Events
- apiGroups:
- apps
- ""
resources:
- deployments/scale
- statefulsets/scale
verbs:
- patch # Scale up and down
- get # Retrieve info about specific dep
- update # Scale up and down
- list # Events
- watch # Events
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: sablier
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: sablier
subjects:
- kind: ServiceAccount
name: sablier
namespace: {{ traefik_namespace }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-traefik-to-sablier
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: sablier
ingress:
- ports:
- port: 10000
from:
- podSelector:
matchLabels:
app.kubernetes.io/name: traefik
policyTypes:
- Ingress
#---
#apiVersion: traefik.io/v1alpha1
#kind: Middleware
#metadata:
# name: ondemand
#spec:
# plugin:
# names: toto # Comma separated names of containers/services/deployments etc.
# group: default # Group name to use to filter by label, ignored if names is set
# dynamic:
# displayName: My Title # (Optional) Defaults to the middleware name
# refreshFrequency: 5s # (Optional) The loading page refresh frequency
# showDetails: "true" # (Optional) Set to true or false to show details specifcally for this middleware, unset to use Sablier server defaults
# theme: hacker-terminal # (Optional) The theme to use
# sablierUrl: http://sablier.{{ traefik_namespace }}:10000 # The sablier URL service, must be reachable from the Traefik instance
# sessionDuration: 1m # The session duration after which containers/services/deployments instances are shutdown

12
templates/traefik-svc.yml.j2
View file

@ -9,23 +9,15 @@ metadata:
spec:
ports:
- name: web
hostPort: 80
port: 80
protocol: TCP
targetPort: web
- name: websecure
hostPort: 443
port: 443
protocol: TCP
targetPort: websecure
- name: websecure-http3
port: 443
protocol: UDP
targetPort: websecure
{% if traefik_external_ips is defined %}
externalIPs:
{% for traefik_external_ip in traefik_external_ips %}
- {{ traefik_external_ip }}
{% endfor %}
{% endif %}
selector:
app.kubernetes.io/instance: traefik
app.kubernetes.io/name: traefik

12
todo.sh
View file

@ -1,12 +0,0 @@
#!/usr/bin/env bash
cat << 'EOF' | kubectl --context my_context apply -f -
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
name: traefik
spec:
controller: traefik.io/ingress-controller
EOF

13
vars/main.yml
View file

@ -1 +1,12 @@
---
traefik_version_2_3: 2.3.7
traefik_2_3_list:
- 2.3/traefik-crd-ingressroutes.yml.j2
- 2.3/traefik-crd-ingressroutetcps.yml.j2
- 2.3/traefik-crd-ingressrouteudps.yml.j2
- 2.3/traefik-crd-middlewares.yml.j2
- 2.3/traefik-crd-tlsoptions.yml.j2
- 2.3/traefik-crd-tlsstores.yml.j2
- 2.3/traefik-crd-traefikservices.yml.j2
- 2.3/traefik-clusterrole.yml.j2
- 2.3/traefik-clusterrolebinding.yml.j2