adrien/ansible-role-k8s-traefik
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Compare commits

base: adrien:master
Branches Tags
adrien:master
..
compare: adrien:WIP
Branches Tags
adrien:master

No commits in common. "master" and "WIP" have entirely different histories.
master ... WIP

62 changed files with 1621 additions and 2509 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.drone.yml
View file

@ -1,7 +1,7 @@
--- ---
kind: pipeline kind: pipeline
type: kubernetes type: kubernetes
# type: docker #type: docker
name: default name: default
steps: steps:

36
defaults/main.yml
View file

@ -1,29 +1,19 @@
my_context: kubernetes my_context: kubernetes
traefik_version: "3.3.6" traefik_version: "2.3"
traefik_helm_chart_version: "35.0.1" traefik_domain: "local"
traefikcrds_helm_chart_version: "1.6.0"
cluster_domain: "local"
traefik_namespace: "traefik" traefik_namespace: "traefik"
traefik_service_type: LoadBalancer #ingress_whitelist:
# ingress_whitelist: # - 10.96.0.0/12
# - 10.96.0.0/12 # - 10.244.0.0/16
# - 10.244.0.0/16 # - 192.168.0.0/24
# - 192.168.0.0/24 #traefik_node_selector:
# traefik_node_selector: # - localhost
# - localhost
traefik_cpu_limit: 500m traefik_cpu_limit: 500m
traefik_memory_limit: 300Mi traefik_memory_limit: 300Mi
traefik_entrypoints: [] traefik_entrypoints:
# - { name: "http", port: 8000, proto: "TCP", hostport: 80 middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] } - { name: "http", port: 8000, proto: "TCP", hostport: 80 }
# - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] } - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true }
# - { name: "traefik", port: 8080, proto: "TCP" } - { name: "traefik", port: 8080, proto: "TCP" }
# traefik_external_ips: []
# - 1.2.3.4
basic_auth: false basic_auth: false
# traefik_dashboard_certificate: wildcard-cluster #traefik_dashboard_certificate: wildcard-cluster
crowdsec_namespace: "crowdsec"
crowdsec_traefik_bouncer_chart_version: "0.1.3"
traefik_sabblier_version: "1.9.0"

1523
files/grafana-dashboard.yml
View file

File diff suppressed because it is too large Load diff

8
meta/main.yml
View file

@ -5,9 +5,7 @@ galaxy_info:
min_ansible_version: 2.6 min_ansible_version: 2.6
galaxy_tags: [] galaxy_tags: []
license: GPL2 license: GPL2
collections:
- kubernetes.core
platforms: platforms:
- name: kubernetes - name: kubernetes
version: version:
- all - all

353
tasks/main.yml
View file

@ -1,257 +1,120 @@
- name: traefik setup - name: traefik setup
block: block:
# - name: Deploy Traefik CRDs - name: namespace
# kubernetes.core.k8s: k8s:
# state: present state: present
# context: "{{ my_context }}" context: "{{ my_context }}"
# apply: true merge_type: merge
# definition: "{{ lookup('url', item , split_lines=False) | from_yaml_all }}" definition:
# with_items: api_version: v1
## - "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml" kind: Namespace
# - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml" metadata:
## - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml" name: traefik
## ansible.builtin.command: > labels:
## kubectl --context "{{ my_context }}" apply --server-side --force-conflicts -k namespace: '{{ traefik_namespace }}'
## https://github.com/traefik/traefik-helm-chart/tree/v{{ traefik_helm_chart_version }}/traefik/crds/
- name: namespace
kubernetes.core.k8s:
state: present
context: "{{ my_context }}"
merge_type: merge
definition:
api_version: v1
kind: Namespace
metadata:
name: '{{ traefik_namespace }}'
labels:
namespace: '{{ traefik_namespace }}'
- name: Create a Secret object for basic authentification - name: Create a Secret object for basic authentification
kubernetes.core.k8s: k8s:
state: present state: present
context: "{{ my_context }}" context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}' definition:
definition: apiVersion: v1
apiVersion: v1 kind: Secret
kind: Secret metadata:
metadata: name: basic-auth
name: basic-auth namespace: '{{ traefik_namespace }}'
type: Opaque type: Opaque
data: data:
basic_auth: "{{ basic_auth_data | b64encode }}" basic_auth: "{{ basic_auth_data | b64encode }}"
when: when:
- basic_auth|bool - basic_auth|bool
- name: Add host label for traefik deployment - name: Add host label for traefik deployment
kubernetes.core.k8s: k8s:
state: present state: present
context: "{{ my_context }}" context: "{{ my_context }}"
definition: definition:
apiVersion: v1 apiVersion: v1
kind: Node kind: Node
metadata: metadata:
name: "{{ item }}" name: "{{ item }}"
labels: labels:
entrypoint: traefik entrypoint: traefik
with_items: with_items:
- '{{ traefik_node_selector }}' - '{{ traefik_node_selector }}'
when: when:
- traefik_node_selector is defined - traefik_node_selector is defined
- name: Deploy latest version of CrowdSec Traefik bouncer - name: Get Deployment information object
kubernetes.core.helm: k8s_info:
context: "{{ my_context }}" context: "{{ my_context }}"
name: crowdsec-traefik-bouncer api_version: v1
release_namespace: "{{ traefik_namespace }}" kind: DaemonSet
create_namespace: true name: traefik
chart_ref: crowdsec/crowdsec-traefik-bouncer namespace: '{{ traefik_namespace }}'
chart_version: "{{ crowdsec_traefik_bouncer_chart_version }}" field_selectors:
values: - spec.template.spec.containers.image
image: register: traefik_actual_resources
tag: "0.5.0"
bouncer:
crowdsec_bouncer_api_key: "{{ traefik_crowdsec_bouncer_apikey }}"
crowdsec_agent_host: "crowdsec-service.{{ crowdsec_namespace }}.svc.cluster.local:8080"
crowdsec_bouncer_gin_mode: "release"
replicaCount: 1
podSecurityContext:
fsGroup: 2000
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
when:
- traefik_crowdsec_bouncer_apikey is defined
# - name: Get Deployment information object - name: Retreive actual traefik version
# kubernetes.core.k8s_info: shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
# context: "{{ my_context }}" register: traefik_actual_version
# api_version: v1
# kind: DaemonSet
# name: traefik
# namespace: '{{ traefik_namespace }}'
# field_selectors:
# - spec.template.spec.containers.image
# register: traefik_actual_resources
#
# - name: Retreive actual traefik version
# ansible.builtin.shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
# register: traefik_actual_version
#
# - name: Remove old traefik version {{ traefik_actual_version.stdout }}
# kubernetes.core.k8s:
# state: "absent"
# context: "{{ my_context }}"
# resource_definition: "{{ lookup('template', item) | from_yaml }}"
# with_items:
# - "{{ lookup('vars', 'traefik_' + traefik_actual_version.stdout | regex_replace('[.]','_') + '_list') | reverse | list }}"
## - hostvars[inventory_hostname]['traefik_' + traefik_actual_version.stdout + '_list'] | reverse
# when:
# - not traefik_actual_version.stdout == "[]"
# - not traefik_version == traefik_actual_version.stdout
# - traefik_actual_version.stdout is version(traefik_version, '>')
# https://github.com/traefik/traefik-helm-chart - name: Remove old traefik version {{ traefik_actual_version.stdout }}
- name: Defined traefik repository k8s:
kubernetes.core.helm_repository: state: "absent"
name: traefik context: "{{ my_context }}"
repo_url: "https://helm.traefik.io/traefik" resource_definition: "{{ lookup('template', item) | from_yaml }}"
- name: Deploy Traefik CRDs with_items:
kubernetes.core.helm: - "{{ lookup('vars', 'traefik_' + traefik_actual_version.stdout | regex_replace('[.]','_') + '_list') | reverse | list }}"
context: "{{ my_context }}" # - hostvars[inventory_hostname]['traefik_' + traefik_actual_version.stdout + '_list'] | reverse
name: traefik-crds when:
chart_ref: traefik/traefik-crds - not traefik_actual_version.stdout == "[]"
chart_version: "{{ traefikcrds_helm_chart_version }}" - not traefik_version == traefik_actual_version.stdout
release_namespace: "{{ traefik_namespace }}" - traefik_actual_version.stdout is version(traefik_version, '>')
create_namespace: true
# - name: show templating results
# ansible.builtin.debug:
# msg: "{{ lookup('ansible.builtin.template', 'traefik-helm-value.yaml.j2') }}"
- name: Deploy latest version of Traefik
kubernetes.core.helm:
context: "{{ my_context }}"
name: traefik
chart_ref: traefik/traefik
chart_version: "{{ traefik_helm_chart_version }}"
release_namespace: "{{ traefik_namespace }}"
create_namespace: true
skip_crds: true
values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
- name: Install traefik configuration - name: Install traefik version {{ traefik_version }}
kubernetes.core.k8s: k8s:
state: "present" state: "present"
context: "{{ my_context }}" context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}' namespace: '{{ traefik_namespace }}'
# merge_type: merge merge_type: merge
apply: true resource_definition: "{{ lookup('template', item) | from_yaml }}"
resource_definition: "{{ lookup('template', item) | from_yaml_all }}" with_items:
with_items: - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}"
- default-network-dns-policy.yaml.j2 - traefik-psp.yml.j2
# - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}" - traefik-cm.yml.j2
- traefik-certificate.yml.j2 - traefik-sa.yml.j2
- traefik-cm.yml.j2 - traefik-dp.yml.j2
- traefik-files.yml.j2 # - traefik-svc.yml.j2
# - traefik-sa.yml.j2 # - traefik-dashboard-svc.yml.j2
- traefik-ingressroute.yml.j2 - traefik-middleware-httpsredirect.yml.j2
# - traefik-svc.yml.j2 - traefik-middleware-basicauth.yml.j2
# - traefik-defaultbackend.yml.j2 - traefik-middleware-headers.yml.j2
- traefik-tls-options.yml.j2
- traefik-ingressroute.yml.j2
- traefik-dashboard-insecure.yml.j2
# - traefik-ping.yml.j2
- name: Install traefik plugin's
kubernetes.core.k8s:
state: "present"
context: "{{ my_context }}"
namespace: '{{ traefik_namespace }}'
# merge_type: merge
apply: true
resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
with_items:
- traefik-ondemand-plugin.yml.j2
when:
- traefik_ondemand is defined
- name: ReInstall traefik-hub certificate if already know - name: Define state of ipwhitelist middleware to present
kubernetes.core.k8s: set_fact:
state: "present" traefik_ipwhitelist_state: present
context: "{{ my_context }}" when:
namespace: '{{ traefik_namespace }}' - traefik_version | regex_search('(^2.)')
# merge_type: merge - ingress_whitelist is defined
# apply: true - name: Define state of ipwhitelist middleware to absent
resource_definition: "{{ lookup('template', item) | from_yaml_all }}" set_fact:
with_items: traefik_ipwhitelist_state: absent
- traefik-hub-certificate.yml.j2 when:
when: - not ingress_whitelist is defined or traefik_ipwhitelist_state is not defined
- traefik_hub_tlscrt is defined - name: IP white list need to be {{ traefik_ipwhitelist_state }}
- traefik_hub_tlskey is defined k8s:
- name: Defined traefik-hub repository state: "{{ traefik_ipwhitelist_state }}"
kubernetes.core.helm_repository: context: "{{ my_context }}"
name: traefik-hub merge_type: merge
repo_url: "https://helm.traefik.io/hub" resource_definition: "{{ lookup('template', item) | from_yaml }}"
when: with_items:
- traefik_hub_token is defined - traefik-middleware-ipwhitelist.yml.j2
- name: Deploy latest version of Traefik-hub
kubernetes.core.helm:
context: "{{ my_context }}"
name: hub-agent
chart_ref: traefik-hub/hub-agent
release_namespace: "{{ traefik_namespace }}"
values:
token: "{{ traefik_hub_token }}"
when:
- traefik_hub_token is defined
# echo 'apiVersion: v1
# kind: Service
# metadata:
# annotations:
# # external-dns.alpha.kubernetes.io/endpoints-type: HostIP
# external-dns.alpha.kubernetes.io/hostname: traefik.ibm.reslinger.net
# external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
# # external-dns.alpha.kubernetes.io/target: "1.2.3.4"
# name: traefik-dns
# namespace: traefik
# spec:
# clusterIP: None
# ports:
# - name: web
# port: 80
# protocol: TCP
# targetPort: web
# - name: websecure
# port: 443
# protocol: TCP
# targetPort: websecure
# selector:
# app.kubernetes.io/instance: traefik-traefik
# app.kubernetes.io/name: traefik' | kubectl --context kubeibm -n traefik apply -f -
# - name: Deploy latest version of Switchboard
# kubernetes.core.helm:
# context: "{{ my_context }}"
# name: switchboard
# chart_ref: oci://ghcr.io/borchero/charts/switchboard
# release_namespace: "{{ traefik_namespace }}"
# # values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
# values:
# integrations:
# # certManager:
# # enabled: true
# # issuer: "letsencrypt-prod"
# externalDNS:
# enabled: true
# targetIPs: [10.144.217.172]
- name: Install traefik grafana dashboard
kubernetes.core.k8s:
state: "present"
context: "{{ my_context }}"
namespace: 'traefik'
apply: yes
resource_definition: "{{ lookup('file', item) | from_yaml_all }}"
with_items:
- grafana-dashboard.yml
tags: traefik tags: traefik

62
templates/2.0/traefik-clusterrole.yml.j2 Normal file
View file

@ -0,0 +1,62 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.containo.us
resources:
- middlewares
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- ingressroutes
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- ingressroutetcps
verbs:
- get
- list
- watch
- apiGroups:
- traefik.containo.us
resources:
- tlsoptions
verbs:
- get
- list
- watch

13
templates/2.0/traefik-clusterrolebinding.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: traefik

16
templates/2.0/traefik-crd-ingressroute.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutes.traefik.containo.us
namespace: traefik
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRoute
plural: ingressroutes
singular: ingressroute
scope: Namespaced

16
templates/2.0/traefik-crd-ingressroutetcp.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutetcps.traefik.containo.us
namespace: traefik
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteTCP
plural: ingressroutetcps
singular: ingressroutetcp
scope: Namespaced

16
templates/2.0/traefik-crd-middleware.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: middlewares.traefik.containo.us
namespace: traefik
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: Middleware
plural: middlewares
singular: middleware
scope: Namespaced

13
templates/2.0/traefik-crd-tlsoption.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsoptions.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSOption
plural: tlsoptions
singular: tlsoption
scope: Namespaced

157
templates/2.1/Ressources-exemple.yml Normal file
View file

@ -0,0 +1,157 @@
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: wrr2
namespace: {{ traefik_namespace }}
spec:
weighted:
services:
- name: s1
weight: 1
port: 80
# Optional, as it is the default value
kind: Service
- name: s3
weight: 1
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: wrr1
namespace: {{ traefik_namespace }}
spec:
weighted:
services:
- name: wrr2
kind: TraefikService
weight: 1
- name: s3
weight: 1
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: mirror1
namespace: {{ traefik_namespace }}
spec:
mirroring:
name: s1
port: 80
mirrors:
- name: s3
percent: 20
port: 80
- name: mirror2
kind: TraefikService
percent: 20
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: mirror2
namespace: {{ traefik_namespace }}
spec:
mirroring:
name: wrr2
kind: TraefikService
mirrors:
- name: s2
# Optional, as it is the default value
kind: Service
percent: 20
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ingressroute
spec:
entryPoints:
- web
- websecure
routes:
- match: Host(`foo.com`) && PathPrefix(`/bar`)
kind: Rule
priority: 12
# defining several services is possible and allowed, but for now the servers of
# all the services (for a given route) get merged altogether under the same
# load-balancing strategy.
services:
- name: s1
port: 80
healthCheck:
path: /health
host: baz.com
intervalSeconds: 7
timeoutSeconds: 60
# strategy defines the load balancing strategy between the servers. It defaults
# to Round Robin, and for now only Round Robin is supported anyway.
strategy: RoundRobin
- name: s2
port: 433
healthCheck:
path: /health
host: baz.com
intervalSeconds: 7
timeoutSeconds: 60
- match: PathPrefix(`/misc`)
services:
- name: s3
port: 80
middlewares:
- name: stripprefix
- name: addprefix
- match: PathPrefix(`/misc`)
services:
- name: s3
# Optional, as it is the default value
kind: Service
port: 8443
# scheme allow to override the scheme for the service. (ex: https or h2c)
scheme: https
- match: PathPrefix(`/lb`)
services:
- name: wrr1
kind: TraefikService
- match: PathPrefix(`/mirrored`)
services:
- name: mirror1
kind: TraefikService
# use an empty tls object for TLS with Let's Encrypt
tls:
secretName: supersecret
options:
name: myTLSOption
namespace: default
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
name: ingressroutetcp.crd
namespace: default
spec:
entryPoints:
- footcp
routes:
- match: HostSNI(`bar.com`)
services:
- name: whoamitcp
port: 8080
tls:
secretName: foosecret
passthrough: false
options:
name: myTLSOption
namespace: default

42
templates/2.1/traefik-clusterrole.yml.j2 Normal file
View file

@ -0,0 +1,42 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.containo.us
resources:
- middlewares
- ingressroutes
- traefikservices
- ingressroutetcps
- tlsoptions
verbs:
- get
- list
- watch

13
templates/2.1/traefik-clusterrolebinding.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: {{ traefik_namespace }}

16
templates/2.1/traefik-crd-ingressroute.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutes.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRoute
plural: ingressroutes
singular: ingressroute
scope: Namespaced

16
templates/2.1/traefik-crd-ingressroutetcp.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutetcps.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteTCP
plural: ingressroutetcps
singular: ingressroutetcp
scope: Namespaced

16
templates/2.1/traefik-crd-middleware.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: middlewares.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: Middleware
plural: middlewares
singular: middleware
scope: Namespaced

16
templates/2.1/traefik-crd-tlsoption.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsoptions.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSOption
plural: tlsoptions
singular: tlsoption
scope: Namespaced

16
templates/2.1/traefik-crd-traefikservice.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: traefikservices.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TraefikService
plural: traefikservices
singular: traefikservice
scope: Namespaced

157
templates/2.2/Ressources-exemple.yml Normal file
View file

@ -0,0 +1,157 @@
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: wrr2
namespace: {{ traefik_namespace }}
spec:
weighted:
services:
- name: s1
weight: 1
port: 80
# Optional, as it is the default value
kind: Service
- name: s3
weight: 1
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: wrr1
namespace: {{ traefik_namespace }}
spec:
weighted:
services:
- name: wrr2
kind: TraefikService
weight: 1
- name: s3
weight: 1
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: mirror1
namespace: {{ traefik_namespace }}
spec:
mirroring:
name: s1
port: 80
mirrors:
- name: s3
percent: 20
port: 80
- name: mirror2
kind: TraefikService
percent: 20
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: mirror2
namespace: {{ traefik_namespace }}
spec:
mirroring:
name: wrr2
kind: TraefikService
mirrors:
- name: s2
# Optional, as it is the default value
kind: Service
percent: 20
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ingressroute
spec:
entryPoints:
- web
- websecure
routes:
- match: Host(`foo.com`) && PathPrefix(`/bar`)
kind: Rule
priority: 12
# defining several services is possible and allowed, but for now the servers of
# all the services (for a given route) get merged altogether under the same
# load-balancing strategy.
services:
- name: s1
port: 80
healthCheck:
path: /health
host: baz.com
intervalSeconds: 7
timeoutSeconds: 60
# strategy defines the load balancing strategy between the servers. It defaults
# to Round Robin, and for now only Round Robin is supported anyway.
strategy: RoundRobin
- name: s2
port: 433
healthCheck:
path: /health
host: baz.com
intervalSeconds: 7
timeoutSeconds: 60
- match: PathPrefix(`/misc`)
services:
- name: s3
port: 80
middlewares:
- name: stripprefix
- name: addprefix
- match: PathPrefix(`/misc`)
services:
- name: s3
# Optional, as it is the default value
kind: Service
port: 8443
# scheme allow to override the scheme for the service. (ex: https or h2c)
scheme: https
- match: PathPrefix(`/lb`)
services:
- name: wrr1
kind: TraefikService
- match: PathPrefix(`/mirrored`)
services:
- name: mirror1
kind: TraefikService
# use an empty tls object for TLS with Let's Encrypt
tls:
secretName: supersecret
options:
name: myTLSOption
namespace: default
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
name: ingressroutetcp.crd
namespace: default
spec:
entryPoints:
- footcp
routes:
- match: HostSNI(`bar.com`)
services:
- name: whoamitcp
port: 8080
tls:
secretName: foosecret
passthrough: false
options:
name: myTLSOption
namespace: default

48
templates/2.2/traefik-clusterrole.yml.j2 Normal file
View file

@ -0,0 +1,48 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['traefik-ingress-controller']
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.containo.us
resources:
- middlewares
- ingressroutes
- traefikservices
- ingressroutetcps
- ingressrouteudps
- tlsoptions
- tlsstores
verbs:
- get
- list
- watch

13
templates/2.2/traefik-clusterrolebinding.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: {{ traefik_namespace }}

16
templates/2.2/traefik-crd-ingressroutes.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutes.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRoute
plural: ingressroutes
singular: ingressroute
scope: Namespaced

16
templates/2.2/traefik-crd-ingressroutetcps.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutetcps.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteTCP
plural: ingressroutetcps
singular: ingressroutetcp
scope: Namespaced

16
templates/2.2/traefik-crd-ingressrouteudps.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressrouteudps.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteUDP
plural: ingressrouteudps
singular: ingressrouteudp
scope: Namespaced

16
templates/2.2/traefik-crd-middlewares.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: middlewares.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: Middleware
plural: middlewares
singular: middleware
scope: Namespaced

16
templates/2.2/traefik-crd-tlsoptions.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsoptions.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSOption
plural: tlsoptions
singular: tlsoption
scope: Namespaced

16
templates/2.2/traefik-crd-tlsstores.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsstores.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSStore
plural: tlsstores
singular: tlsstore
scope: Namespaced

16
templates/2.2/traefik-crd-traefikservices.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: traefikservices.traefik.containo.us
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TraefikService
plural: traefikservices
singular: traefikservice
scope: Namespaced

157
templates/2.3/Ressources-exemple.yml Normal file
View file

@ -0,0 +1,157 @@
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: wrr2
namespace: {{ traefik_namespace }}
spec:
weighted:
services:
- name: s1
weight: 1
port: 80
# Optional, as it is the default value
kind: Service
- name: s3
weight: 1
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: wrr1
namespace: {{ traefik_namespace }}
spec:
weighted:
services:
- name: wrr2
kind: TraefikService
weight: 1
- name: s3
weight: 1
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: mirror1
namespace: {{ traefik_namespace }}
spec:
mirroring:
name: s1
port: 80
mirrors:
- name: s3
percent: 20
port: 80
- name: mirror2
kind: TraefikService
percent: 20
---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
name: mirror2
namespace: {{ traefik_namespace }}
spec:
mirroring:
name: wrr2
kind: TraefikService
mirrors:
- name: s2
# Optional, as it is the default value
kind: Service
percent: 20
port: 80
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ingressroute
spec:
entryPoints:
- web
- websecure
routes:
- match: Host(`foo.com`) && PathPrefix(`/bar`)
kind: Rule
priority: 12
# defining several services is possible and allowed, but for now the servers of
# all the services (for a given route) get merged altogether under the same
# load-balancing strategy.
services:
- name: s1
port: 80
healthCheck:
path: /health
host: baz.com
intervalSeconds: 7
timeoutSeconds: 60
# strategy defines the load balancing strategy between the servers. It defaults
# to Round Robin, and for now only Round Robin is supported anyway.
strategy: RoundRobin
- name: s2
port: 433
healthCheck:
path: /health
host: baz.com
intervalSeconds: 7
timeoutSeconds: 60
- match: PathPrefix(`/misc`)
services:
- name: s3
port: 80
middlewares:
- name: stripprefix
- name: addprefix
- match: PathPrefix(`/misc`)
services:
- name: s3
# Optional, as it is the default value
kind: Service
port: 8443
# scheme allow to override the scheme for the service. (ex: https or h2c)
scheme: https
- match: PathPrefix(`/lb`)
services:
- name: wrr1
kind: TraefikService
- match: PathPrefix(`/mirrored`)
services:
- name: mirror1
kind: TraefikService
# use an empty tls object for TLS with Let's Encrypt
tls:
secretName: supersecret
options:
name: myTLSOption
namespace: default
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
name: ingressroutetcp.crd
namespace: default
spec:
entryPoints:
- footcp
routes:
- match: HostSNI(`bar.com`)
services:
- name: whoamitcp
port: 8080
tls:
secretName: foosecret
passthrough: false
options:
name: myTLSOption
namespace: default

50
templates/2.3/traefik-clusterrole.yml.j2 Normal file
View file

@ -0,0 +1,50 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: traefik-ingress-controller
rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['traefik-ingress-controller']
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.containo.us
resources:
- middlewares
- ingressroutes
- traefikservices
- ingressroutetcps
- ingressrouteudps
- tlsoptions
- tlsstores
verbs:
- get
- list
- watch

13
templates/2.3/traefik-clusterrolebinding.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: traefik-ingress-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
name: traefik-ingress-controller
namespace: {{ traefik_namespace }}

13
templates/2.3/traefik-crd-ingressroutes.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutes.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRoute
plural: ingressroutes
singular: ingressroute
scope: Namespaced

13
templates/2.3/traefik-crd-ingressroutetcps.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressroutetcps.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteTCP
plural: ingressroutetcps
singular: ingressroutetcp
scope: Namespaced

13
templates/2.3/traefik-crd-ingressrouteudps.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: ingressrouteudps.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: IngressRouteUDP
plural: ingressrouteudps
singular: ingressrouteudp
scope: Namespaced

13
templates/2.3/traefik-crd-middlewares.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: middlewares.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: Middleware
plural: middlewares
singular: middleware
scope: Namespaced

13
templates/2.3/traefik-crd-tlsoptions.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsoptions.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSOption
plural: tlsoptions
singular: tlsoption
scope: Namespaced

13
templates/2.3/traefik-crd-tlsstores.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tlsstores.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TLSStore
plural: tlsstores
singular: tlsstore
scope: Namespaced

13
templates/2.3/traefik-crd-traefikservices.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: traefikservices.traefik.containo.us
spec:
group: traefik.containo.us
version: v1alpha1
names:
kind: TraefikService
plural: traefikservices
singular: traefikservice
scope: Namespaced

46
templates/default-network-dns-policy.yaml.j2
View file

@ -1,46 +0,0 @@
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: intra-namespace
spec:
podSelector: {}
ingress:
- from:
- namespaceSelector:
matchLabels:
name: {{ traefik_namespace }}
#---
#apiVersion: networking.k8s.io/v1
#kind: NetworkPolicy
#metadata:
# name: allow-dns-access
#spec:
# podSelector:
# matchLabels: {}
# policyTypes:
# - Egress
# egress:
# - to:
# - namespaceSelector:
# matchLabels:
# kubernetes.io/metadata.name: kube-system
# podSelector:
# matchLabels:
# k8s-app: kube-dns
# ports:
# - protocol: UDP
# port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-traefik-v121-ingress
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
ingress:
- {}
policyTypes:
- Ingress

12
templates/traefik-certificate.yml.j2
View file

@ -1,12 +0,0 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: traefik.{{ cluster_domain }}
spec:
dnsNames:
- traefik.{{ cluster_domain }}
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
secretName: traefik.{{ cluster_domain }}

120
templates/traefik-cm.yml.j2
View file

@ -1,9 +1,4 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: traefik
name: traefik-conf
data: data:
traefik.yaml: | traefik.yaml: |
global: global:
@ -12,114 +7,51 @@ data:
serversTransport: serversTransport:
insecureSkipVerify: true insecureSkipVerify: true
entryPoints: entryPoints:
web:
address: ":8000/tcp"
http:
# middlewares:
# - auth@file
# - secure_headers@file
# - crowdsec-bouncer@file
# - {{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd
redirections:
entryPoint:
to: websecure
scheme: https
permanent: true
websecure:
address: ":8443"
http:
tls:
options: default
# middlewares:
# - auth@file
# - secure_headers@file
# - crowdsec-bouncer@file
http3:
advertisedPort: 443
traefik:
address: ":8080/tcp"
metrics:
address: ":9100/tcp"
{% if traefik_hub_token is defined %}
traefikhub-api:
address: ":9900"
traefikhub-tunl:
address: ":9901/tcp"
{% endif%}
{% for traefik_entrypoint in traefik_entrypoints %} {% for traefik_entrypoint in traefik_entrypoints %}
{{ traefik_entrypoint.name }}: {{ traefik_entrypoint.name }}:
{% if traefik_entrypoint.proto is defined %} address: :{{ traefik_entrypoint.port }}
address: ":{{ traefik_entrypoint.port }}/{{ traefik_entrypoint.proto | lower }}"
{% else %}
address: ":{{ traefik_entrypoint.port }}"
{% endif %}
{% if traefik_entrypoint.tls is defined or traefik_entrypoint.middlewares is defined %}
http:
{% if traefik_entrypoint.middlewares is defined %}
middlewares:
{% for middleware in traefik_entrypoint.middlewares %}
- {{ middleware }}
{% endfor %}
{% endif %}
{% if traefik_entrypoint.tls is defined and traefik_entrypoint.tls|bool %} {% if traefik_entrypoint.tls is defined and traefik_entrypoint.tls|bool %}
http:
tls: {} tls: {}
{% endif %} {% endif %}
{% endif %}
{% endfor %} {% endfor %}
providers: providers:
kubernetesCRD: kubernetesCRD:
# ingressClass: "traefik" # ingressClass: "traefik"
throttleDuration: 2s throttleDuration: 2s
{% if traefik_ondemand is defined %}
allowEmptyServices: true
{% endif%}
kubernetesIngress: kubernetesIngress:
ingressClass: "traefik" ingressClass: "traefik"
{% if traefik_hub_token is defined %}
allowExternalNameServices: true
{% endif%}
{% if traefik_ondemand is defined %}
allowEmptyServices: true
{% endif%}
kubernetesGateway: {}
file: file:
directory: /etc/traefik/file/ directory: /etc/traefik/file/
watch: true watch: true
metrics: metrics:
prometheus: prometheus:
entryPoint: metrics buckets:
addRoutersLabels: true - 0.1
- 0.3
- 1.2
- 5
entryPoint: traefik
ping: ping:
entryPoint: traefik entryPoint: traefik
api: api:
insecure: true
dashboard: true dashboard: true
{% if traefik_hub_token is defined %} debug: true
hub: {}
{% endif %}
log: log:
level: ERROR level: WARN
# format: json format: json
accessLog: {} accessLog:
#accessLog: format: json
# filePath: "/var/log/traefik/access.log" fields:
# bufferingSize: 50 names:
## format: json BackendAddr: keep
## fields: BackendName: keep
## names: BackendURL: keep
## BackendAddr: keep FrontendName: keep
## BackendName: keep kind: ConfigMap
## BackendURL: keep metadata:
## FrontendName: keep labels:
{% if traefik_hub_token is defined or traefik_ondemand is defined %} app: traefik
experimental: name: traefik
# kubernetesGateway: true namespace: {{ traefik_namespace }}
{% if traefik_hub_token is defined %}
hub: true
{% endif %}
{% if traefik_ondemand is defined %}
plugins:
sablier:
moduleName: github.com/sablierapp/sablier
version: v{{ traefik_sabblier_version }}
{% endif %}
{% endif %}

40
templates/traefik-dashboard-insecure.yml.j2 Normal file
View file

@ -0,0 +1,40 @@
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard-insecure
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
entryPoints:
- http
routes:
# Match is the rule corresponding to an underlying router.
# Later on, match could be the simple form of a path prefix, e.g. just "/bar",
# but for now we only support a traefik style matching rule.
- match: Host(`traefik.{{ traefik_domain }}`)
# kind could eventually be one of "Rule", "Path", "Host", "Method", "Header",
# "Parameter", etc, to support simpler forms of rule matching, but for now we
# only support "Rule".
kind: Rule
# (optional) Priority disambiguates rules of the same length, for route matching.
middlewares:
{% if ingress_whitelist is defined %}
- name: traefik-ipwhitelist
{% endif %}
- name: https-only
services:
- name: api@internal
kind: TraefikService
# - name: traefik-dashboard
# port: 8080
# # (default 1) A weight used by the weighted round-robin strategy (WRR).
# weight: 1
# # (default true) PassHostHeader controls whether to leave the request's Host
# # Header as it was before it reached the proxy, or whether to let the proxy set it
# # to the destination (backend) host.
# passHostHeader: true
# responseForwarding:
# # (default 100ms) Interval between flushes of the buffered response body to the client.
# flushInterval: 100ms

24
templates/traefik-dashboard-svc.yml.j2 Normal file
View file

@ -0,0 +1,24 @@
apiVersion: v1
kind: Service
metadata:
labels:
app: traefik
name: traefik-dashboard
namespace: {{ traefik_namespace }}
spec:
ports:
- name: http
port: 80
protocol: TCP
targetPort: 80
# - name: traefik
# port: 8080
# protocol: TCP
- protocol: TCP
port: 443
name: https
targetPort: 443
type: ClusterIP
selector:
app: traefik

16
templates/traefik-defaultbackend.yml.j2
View file

@ -1,16 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: cheese
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.priority: "1"
traefik.ingress.kubernetes.io/router.middlewares: security_headers@file,compress@file
spec:
defaultBackend:
service:
name: stilton
port:
number: 80

93
templates/traefik-dp.yml.j2 Normal file
View file

@ -0,0 +1,93 @@
kind: DaemonSet
apiVersion: apps/v1
metadata:
namespace: {{ traefik_namespace }}
name: traefik
labels:
app: traefik
spec:
# replicas: {% if traefik_node_selector is defined %}{{ traefik_node_selector|length }}{% else %}1{% endif %}
strategy:
type: Recreate
selector:
matchLabels:
app: traefik
template:
metadata:
labels:
app: traefik
spec:
serviceAccountName: traefik-ingress-controller
# securityContext:
# sysctls:
# - name: kernel.net.ipv4.ip_unprivileged_port_start
# value: "80"
containers:
- name: traefik
image: traefik:{{ lookup('vars', 'traefik_version_' + traefik_version | regex_replace('\.','_')) }}
args:
- --configfile=/config/traefik.yaml
# imagePullPolicy: IfNotPresent
ports:
{% for traefik_entrypoint in traefik_entrypoints %}
- name: {{ traefik_entrypoint.name }}
containerPort: {{ traefik_entrypoint.port }}
protocol: {{ traefik_entrypoint.proto }}
{% if traefik_entrypoint.hostport is defined %}
hostPort: {{ traefik_entrypoint.hostport }}
{% endif %}
{% endfor %}
readinessProbe:
httpGet:
path: /ping
port: traefik
failureThreshold: 1
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
livenessProbe:
httpGet:
path: /ping
port: traefik
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
runAsUser: 1000
runAsGroup: 1000
allowPrivilegeEscalation: true
resources:
limits:
cpu: {{ traefik_cpu_limit }}
memory: {{ traefik_memory_limit }}
requests:
cpu: 100m
memory: 20Mi
volumeMounts:
- mountPath: /config
name: config
{% if traefik_node_selector is defined %}
nodeSelector:
reslinger.net/entrypoint: traefik
{% endif %}
dnsPolicy: ClusterFirst
hostNetwork: false
restartPolicy: Always
terminationGracePeriodSeconds: 1
tolerations:
- effect: NoSchedule
operator: Exists
volumes:
- configMap:
defaultMode: 420
name: traefik
name: config

155
templates/traefik-files.yml.j2
View file

@ -1,155 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: traefik-files
data:
traefik-middlewares.yaml: |
http:
middlewares:
min_security:
chain:
middlewares:
- security_headers
{% if ingress_whitelist is defined %}
- traefik-ipwhitelist
{% endif %}
- rate-limit
- compress
{% if false %}
{% if basic_auth|bool %}
- basic-auth
{% endif %}
- authelia
{% endif %}
compress:
compress:
excludedContentTypes: ["text/event-stream"]
rate-limit:
rateLimit:
average: 100
burst: 50
security_headers:
headers:
accessControlAllowMethods: ["GET", "OPTIONS", "PUT"]
# accessControlAllowOrigin: "origin-list-or-null"
accessControlMaxAge: 100
addVaryHeader: true
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
frameDeny: true
stsIncludeSubdomains: true
stsPreload: true
customFrameOptionsValue: "SAMEORIGIN"
referrerPolicy: "same-origin"
# permissionsPolicy: "vibrate 'self'"
permissionsPolicy: "camera 'none'; microphone 'none'; geolocation 'none'; payment 'none';"
stsSeconds: 315360000
# contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
# customResponseHeaders:
# X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex,"
# server: ""
hostsProxyHeaders:
- "X-Forwarded-Host"
{% if ingress_whitelist is defined %}
traefik-ipwhitelist:
ipWhiteList:
sourceRange:
{% for acl_whitelist in ingress_whitelist %}
- {{ acl_whitelist }}
{% endfor %}
{% endif %}
{% if traefik_ondemand is defined %}
ondemand:
plugin:
sablier:
#group: default
dynamic:
displayName: Application is starting
refreshFrequency: 5s
showDetails: "true"
theme: hacker-terminal
sablierUrl: http://sablier:10000
sessionDuration: 1m
{% endif %}
{% if basic_auth|bool %}
basic-auth:
basicAuth:
removeHeader: true
usersFile: "/etc/traefik/basic-auth/basic_auth"
# users:
# - {{ basic_auth_data }}
{% endif %}
authelia:
forwardAuth:
address: "http://authelia:9091/api/verify?rd=https://login.example.com/"
trustForwardHeader: true
authResponseHeaders:
- "Remote-User"
- "Remote-Groups"
- "Remote-Name"
- "Remote-Email"
authelia-basic:
forwardAuth:
address: "http://authelia:9091/api/verify?auth=basic"
trustForwardHeader: true
authResponseHeaders:
- "Remote-User"
- "Remote-Groups"
- "Remote-Name"
- "Remote-Email"
crowdsec-bouncer:
forwardAuth:
address: "http://crowdsec-traefik-bouncer-service/api/v1/forwardAuth"
trustForwardHeader: true
traefik-servers-transport.yaml: |
http:
serversTransports:
skip-verify-https-backend:
insecureSkipVerify: true
traefik-tls-defaults-options.yaml: |
tls:
options:
default:
sniStrict: true
minVersion: VersionTLS12
curvePreferences:
- CurveP521
- CurveP384
cipherSuites:
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
alpnProtocols:
- h2
- http/1.1
{% if false %}
stores:
default:
defaultCertificate:
certFile: path/to/wildcardcert.crt
keyFile: path/to/wildcardcert.key
certificates:
- certFile: /path/to/domain.cert
keyFile: /path/to/domain.key
- certFile: /path/to/other-domain.cert
keyFile: /path/to/other-domain.key
{% endif %}
# dashboard.yaml: |
# http:
# routers:
# traefik:
# rule: "Host(`traefik.{{ domain | lower }}`)"
# entryPoints:
# - "websecure"
# middlewares:
# - "min_security@file"
#{% if basic_auth|bool %}
# - "basic-auth@file"
#{% endif %}
# service: "api@internal"

184
templates/traefik-helm-value.yaml.j2
View file

@ -1,184 +0,0 @@
# https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml
{% if traefik_version is defined %}
image:
tag: "{{ traefik_version }}"
{% endif %}
#fullnameOverride: "{{ my_context }}"
additionalArguments:
- --configFile=/etc/traefik/traefik.yaml
#podSecurityPolicy:
# enabled: true
service:
type: {{ traefik_service_type }}
{% if traefik_external_ips is defined %}
externalIPs:
{% for external_ip in traefik_external_ips %}
- {{ external_ip }}
{% endfor %}
{% endif %}
{% if traefik_service_type == "LoadBalancer" %}
annotations:
external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
{% endif %}
ingressRoute:
dashboard:
enabled: false
podDisruptionBudget:
enabled: true
minAvailable: 1
ingressClass:
enabled: true
isDefaultClass: true
{% if false %}
autoscaling:
enabled: true
minReplicas: 1
maxReplicas: 10
metrics:
- type: Resource
resource:
name: cpu
targetAverageUtilization: 60
- type: Resource
resource:
name: memory
targetAverageUtilization: 60
{% endif %}
{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) or traefik_hub_token is defined %}
ports:
{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) %}
web:
# redirectTo: websecure
{% if traefik_hostport is defined and traefik_hostport == true %}
hostPort: 80
{% endif %}
{% if traefik_service_type == "NodePort" %}
nodePort: 80
{% endif %}
websecure:
{% if traefik_hostport is defined and traefik_hostport == true %}
hostPort: 443
{% endif %}
{% if traefik_service_type == "NodePort" %}
nodePort: 443
{% endif %}
http3:
enabled: true
advertisedPort: 443
# tls:
# enabled: true
# options: default
{% endif %}
{% if traefik_hub_token is defined %}
traefikhub-tunl:
port: 9901
expose: true
exposedPort: 9901
protocol: "TCP"
{% endif %}
{% endif %}
volumes:
- mountPath: /etc/traefik
name: traefik-conf
type: configMap
- mountPath: /etc/traefik/file
name: traefik-files
type: configMap
- mountPath: /etc/traefik/basic-auth
name: basic-auth
type: secret
deployment:
{% if traefik_hostport is defined and traefik_hostport == true %}
kind: DaemonSet
{% else %}
replicas: 1
{% endif %}
revisionHistoryLimit: 3
# podAnnotations:
# prometheus.io/port: '9100'
# prometheus.io/scrape: 'true'
# prometheus.io/path: "/metrics"
{% if traefik_hostport is defined and traefik_hostport == true %}
updateStrategy:
type: OnDelete
{% endif %}
metrics:
prometheus:
service:
enabled: true
serviceMonitor:
metricRelabelings: []
# # - sourceLabels: [__name__]
# # separator: ;
# # regex: ^fluentd_output_status_buffer_(oldest|newest)_.+
# # replacement: $1
# # action: drop
relabelings: []
# # - sourceLabels: [__meta_kubernetes_pod_node_name]
# # separator: ;
# # regex: ^(.*)$
# # targetLabel: nodename
# # replacement: $1
# # action: replace
# jobLabel: traefik
# interval: 30s
# honorLabels: true
# # (Optional)
# # scrapeTimeout: 5s
# # honorTimestamps: true
# # enableHttp2: true
# # followRedirects: true
# # additionalLabels:
# # foo: bar
# # namespace: "another-namespace"
# # namespaceSelector: {}
# prometheusRule:
# enabled: true
# additionalLabels: {}
# namespace: "{{ traefik_namespace }}"
# rules:
# - alert: TraefikDown
# expr: up{job="traefik"} == 0
# for: 5m
# labels:
# context: traefik
# severity: warning
# annotations:
# summary: "Traefik Down"
# description: "{% raw %}{{ $labels.pod }} on {{ $labels.nodename }} is down{% endraw %}"
experimental:
{% if traefik_ondemand is defined %}
plugins:
sablier:
moduleName: "github.com/sablierapp/sablier"
version: "v1.8.1"
{% endif %}
{% if traefik_hub_token is defined %}
hub:
enabled: true
{% endif %}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
readOnlyRootFilesystem: true
seccompProfile:
type: RuntimeDefault
{% if false %}
{% raw %}
extraObjects:
- apiVersion: v1
kind: ConfigMap
metadata:
name: "extra"
data:
something: "extra"
- |
apiVersion: v1
kind: ConfigMap
metadata:
name: "templated"
data:
something: {{ printf "templated" }}
{% endraw %}
{% endif %}

14
templates/traefik-hub-certificate.yml.j2
View file

@ -1,14 +0,0 @@
apiVersion: v1
kind: List
items:
- apiVersion: v1
kind: Secret
metadata:
annotations:
app.kubernetes.io/managed-by: traefik-hub
name: hub-certificate
namespace: {{ traefik_namespace }}
type: kubernetes.io/tls
data:
tls.crt: {{ traefik_hub_tlscrt | b64encode }}
tls.key: {{ traefik_hub_tlskey | b64encode }}

50
templates/traefik-ingressroute.yml.j2
View file

@ -1,29 +1,19 @@
apiVersion: traefik.io/v1alpha1 apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute kind: IngressRoute
metadata: metadata:
name: traefik name: traefik
namespace: {{ traefik_namespace }}
labels: labels:
app: traefik app: traefik
annotations:
kubernetes.io/ingress.class: traefik
{% if false %}
external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
# external-dns.alpha.kubernetes.io/endpoints-type: HostIP
# external-dns.alpha.kubernetes.io/target: "1.2.3.4"
# external-dns.alpha.kubernetes.io/ttl: "120"
# external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
{% endif %}
spec: spec:
entryPoints: entryPoints:
- websecure - https
routes: routes:
# Match is the rule corresponding to an underlying router. # Match is the rule corresponding to an underlying router.
# Later on, match could be the simple form of a path prefix, e.g. just "/bar", # Later on, match could be the simple form of a path prefix, e.g. just "/bar",
# but for now we only support a traefik style matching rule. # but for now we only support a traefik style matching rule.
- match: Host(`traefik.{{ cluster_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`)) - match: Host(`traefik.{{ traefik_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
# kind could eventually be one of "Rule", "Path", "Host", "Method", "Header", # kind could eventually be one of "Rule", "Path", "Host", "Method", "Header",
# "Parameter", etc, to support simpler forms of rule matching, but for now we # "Parameter", etc, to support simpler forms of rule matching, but for now we
# only support "Rule". # only support "Rule".
@ -31,31 +21,43 @@ spec:
{% if basic_auth is defined or ingress_whitelist is defined %} {% if basic_auth is defined or ingress_whitelist is defined %}
middlewares: middlewares:
{% if ingress_whitelist is defined %} {% if ingress_whitelist is defined %}
- name: traefik-ipwhitelist@file - name: traefik-ipwhitelist
{% endif %} {% endif %}
{% if basic_auth is defined %} {% if basic_auth is defined %}
- name: basic-auth@file - name: basic-auth
{% endif %} {% endif %}
{% endif %} {% endif %}
services: services:
- name: api@internal - name: api@internal
kind: TraefikService kind: TraefikService
- match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/ping`) # - name: traefik-dashboard
# port: 8080
# # (default 1) A weight used by the weighted round-robin strategy (WRR).
# weight: 1
# # (default true) PassHostHeader controls whether to leave the request's Host
# # Header as it was before it reached the proxy, or whether to let the proxy set it
# # to the destination (backend) host.
# passHostHeader: true
# responseForwarding:
# # (default 100ms) Interval between flushes of the buffered response body to the client.
# flushInterval: 100ms
- match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/ping`)
kind: Rule kind: Rule
services: services:
- name: ping@internal - name: ping@internal
kind: TraefikService kind: TraefikService
# - match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/metrics`) - match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/metrics`)
# kind: Rule kind: Rule
# services: services:
# - name: prometheus@internal - name: prometheus@internal
# kind: TraefikService kind: TraefikService
tls: tls:
{% if traefik_dashboard_certificate is defined %} {% if traefik_dashboard_certificate is defined %}
secretName: {{ traefik_dashboard_certificate }} secretName: {{ traefik_dashboard_certificate }}
{% else %}
secretName: traefik.{{ cluster_domain }}
{% endif %} {% endif %}
options:
name: default
namespace: {{ traefik_namespace }}

8
templates/traefik-middleware-basicauth.yml.j2 Normal file
View file

@ -0,0 +1,8 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: basic-auth
namespace: {{ traefik_namespace }}
spec:
basicAuth:
secret: basic-auth

31
templates/traefik-middleware-headers.yml.j2 Normal file
View file

@ -0,0 +1,31 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: security-headers
namespace: {{ traefik_namespace }}
spec:
headers:
browserXssFilter: "true"
contentTypeNosniff: "true"
forceSTSHeader: "true"
frameDeny: "true"
stsIncludeSubdomains: "true"
stsPreload: "true"
stsSeconds: "15768000"
sslRedirect: "true"
contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
customFrameOptionsValue: "SAMEORIGIN"
referrerPolicy: "same-origin"
featurePolicy: "vibrate 'self'"
# CORS
accessControlAllowMethods:
- "GET"
- "OPTIONS"
- "PUT"
accessControlAllowOrigin: "origin-list-or-null"
#accessControlAllowOriginList:
# - "https://foo.bar.org"
# - "https://example.org"
accessControlMaxAge: 100
addVaryHeader: "true"

8
templates/traefik-middleware-httpsredirect.yml.j2 Normal file
View file

@ -0,0 +1,8 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: https-only
namespace: {{ traefik_namespace }}
spec:
redirectScheme:
scheme: https

13
templates/traefik-middleware-ipwhitelist.yml.j2 Normal file
View file

@ -0,0 +1,13 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: traefik-ipwhitelist
namespace: {{ traefik_namespace }}
spec:
ipWhiteList:
sourceRange:
{% if ingress_whitelist is defined %}
{% for acl_whitelist in ingress_whitelist %}
- {{ acl_whitelist }}
{% endfor %}
{% endif %}

134
templates/traefik-ondemand-plugin.yml.j2
View file

@ -1,134 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: sablier
labels:
app.kubernetes.io/name: sablier
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: sablier
template:
metadata:
labels:
app.kubernetes.io/name: sablier
spec:
serviceAccountName: sablier
serviceAccount: sablier
containers:
- name: sablier
image: sablierapp/sablier:{{ traefik_sabblier_version }}
args:
- "start"
- "--provider.name=kubernetes"
- "--server.port=10000"
- "--storage.file=/dev/shm/state.json"
ports:
- containerPort: 10000
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: [ALL]
readOnlyRootFilesystem: true
seccompProfile:
type: RuntimeDefault
securityContext:
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
# --configFile=path/to/myconfigfile.yml
---
apiVersion: v1
kind: Service
metadata:
name: sablier
spec:
selector:
app.kubernetes.io/name: sablier
ports:
- protocol: TCP
port: 10000
targetPort: 10000
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: sablier
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: sablier
# namespace: {{ traefik_namespace }}
rules:
- apiGroups:
- apps
- ""
resources:
- deployments
- statefulsets
verbs:
- get # Retrieve info about specific dep
- list # Events
- watch # Events
- apiGroups:
- apps
- ""
resources:
- deployments/scale
- statefulsets/scale
verbs:
- patch # Scale up and down
- get # Retrieve info about specific dep
- update # Scale up and down
- list # Events
- watch # Events
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: sablier
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: sablier
subjects:
- kind: ServiceAccount
name: sablier
namespace: {{ traefik_namespace }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-traefik-to-sablier
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: sablier
ingress:
- ports:
- port: 10000
from:
- podSelector:
matchLabels:
app.kubernetes.io/name: traefik
policyTypes:
- Ingress
#---
#apiVersion: traefik.io/v1alpha1
#kind: Middleware
#metadata:
# name: ondemand
#spec:
# plugin:
# names: toto # Comma separated names of containers/services/deployments etc.
# group: default # Group name to use to filter by label, ignored if names is set
# dynamic:
# displayName: My Title # (Optional) Defaults to the middleware name
# refreshFrequency: 5s # (Optional) The loading page refresh frequency
# showDetails: "true" # (Optional) Set to true or false to show details specifcally for this middleware, unset to use Sablier server defaults
# theme: hacker-terminal # (Optional) The theme to use
# sablierUrl: http://sablier.{{ traefik_namespace }}:10000 # The sablier URL service, must be reachable from the Traefik instance
# sessionDuration: 1m # The session duration after which containers/services/deployments instances are shutdown

41
templates/traefik-ping.yml.j2 Normal file
View file

@ -0,0 +1,41 @@
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-ping
namespace: {{ traefik_namespace }}
labels:
app: traefik
spec:
entryPoints:
- https
routes:
# Match is the rule corresponding to an underlying router.
# Later on, match could be the simple form of a path prefix, e.g. just "/bar",
# but for now we only support a traefik style matching rule.
- match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/ping`)
# kind could eventually be one of "Rule", "Path", "Host", "Method", "Header",
# "Parameter", etc, to support simpler forms of rule matching, but for now we
# only support "Rule".
kind: Rule
# (optional) Priority disambiguates rules of the same length, for route matching.
priority: 14
services:
- name: ping@internal
kind: TraefikService
# - name: traefik-dashboard
# port: 8080
# # (default 1) A weight used by the weighted round-robin strategy (WRR).
# weight: 1
# # (default true) PassHostHeader controls whether to leave the request's Host
# # Header as it was before it reached the proxy, or whether to let the proxy set it
# # to the destination (backend) host.
# passHostHeader: true
# responseForwarding:
# # (default 100ms) Interval between flushes of the buffered response body to the client.
# flushInterval: 100ms
tls:
secretName: wildcard-cluster
options:
name: default
namespace: {{ traefik_namespace }}

49
templates/traefik-psp.yml.j2 Normal file
View file

@ -0,0 +1,49 @@
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
name: traefik-ingress-controller
spec:
requiredDropCapabilities:
- ALL
allowedCapabilities:
- NET_BIND_SERVICE
privileged: false
allowPrivilegeEscalation: false
# Allow core volume types.
volumes:
- configMap
- downwardAPI
- secret
- emptyDir
- projected
# - persistentVolumeClaim
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
# Require the container to run without root privileges.
rule: 'MustRunAsNonRoot'
supplementalGroups:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
hostPorts:
readOnlyRootFilesystem: true
seLinux:
rule: 'RunAsAny'
hostPorts:
- max: 65535
min: 1
#allowedUnsafeSysctls:
# - kernel.net.ipv4.ip_unprivileged_port_start

1
templates/traefik-sa.yml.j2
View file

@ -1,4 +1,5 @@
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
metadata: metadata:
namespace: {{ traefik_namespace }}
name: traefik-ingress-controller name: traefik-ingress-controller

29
templates/traefik-svc.yml.j2
View file

@ -2,31 +2,20 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
app.kubernetes.io/instance: traefik app: traefik
app.kubernetes.io/name: traefik
name: traefik name: traefik
namespace: {{ traefik_namespace }}
spec: spec:
ports: ports:
- name: web - name: http
port: 80 port: 80
protocol: TCP protocol: TCP
targetPort: web targetPort: 80
- name: websecure - protocol: TCP
port: 443 port: 443
protocol: TCP name: https
targetPort: websecure targetPort: 443
- name: websecure-http3 type: LoadBalancer
port: 443
protocol: UDP
targetPort: websecure
{% if traefik_external_ips is defined %}
externalIPs:
{% for traefik_external_ip in traefik_external_ips %}
- {{ traefik_external_ip }}
{% endfor %}
{% endif %}
selector: selector:
app.kubernetes.io/instance: traefik app: traefik
app.kubernetes.io/name: traefik
sessionAffinity: None

16
templates/traefik-tls-options.yml.j2 Normal file
View file

@ -0,0 +1,16 @@
apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
name: default
namespace: {{ traefik_namespace }}
spec:
sniStrict: true
minVersion: VersionTLS12
cipherSuites:
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
curvePreferences:
- CurveP521
- CurveP384

12
todo.sh
View file

@ -1,12 +0,0 @@
#!/usr/bin/env bash
cat << 'EOF' | kubectl --context my_context apply -f -
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
name: traefik
spec:
controller: traefik.io/ingress-controller
EOF

43
vars/main.yml
View file

@ -1 +1,42 @@
--- traefik_version_2_0: 2.0.7
traefik_2_0_list:
- 2.0/traefik-clusterrole.yml.j2
- 2.0/traefik-clusterrolebinding.yml.j2
- 2.0/traefik-crd-ingressroute.yml.j2
- 2.0/traefik-crd-ingressroutetcp.yml.j2
- 2.0/traefik-crd-middleware.yml.j2
- 2.0/traefik-crd-tlsoption.yml.j2
traefik_version_2_1: 2.1.9
traefik_2_1_list:
- 2.1/traefik-clusterrole.yml.j2
- 2.1/traefik-clusterrolebinding.yml.j2
- 2.1/traefik-crd-ingressroute.yml.j2
- 2.1/traefik-crd-ingressroutetcp.yml.j2
- 2.1/traefik-crd-middleware.yml.j2
- 2.1/traefik-crd-tlsoption.yml.j2
- 2.1/traefik-crd-traefikservice.yml.j2
traefik_version_2_2: 2.2.11
traefik_2_2_list:
- 2.2/traefik-crd-ingressroutes.yml.j2
- 2.2/traefik-crd-ingressroutetcps.yml.j2
- 2.2/traefik-crd-ingressrouteudps.yml.j2
- 2.2/traefik-crd-middlewares.yml.j2
- 2.2/traefik-crd-tlsoptions.yml.j2
- 2.2/traefik-crd-tlsstores.yml.j2
- 2.2/traefik-crd-traefikservices.yml.j2
- 2.2/traefik-clusterrole.yml.j2
- 2.2/traefik-clusterrolebinding.yml.j2
traefik_version_2_3: 2.3.2
traefik_2_3_list:
- 2.3/traefik-crd-ingressroutes.yml.j2
- 2.3/traefik-crd-ingressroutetcps.yml.j2
- 2.3/traefik-crd-ingressrouteudps.yml.j2
- 2.3/traefik-crd-middlewares.yml.j2
- 2.3/traefik-crd-tlsoptions.yml.j2
- 2.3/traefik-crd-tlsstores.yml.j2
- 2.3/traefik-crd-traefikservices.yml.j2
- 2.3/traefik-clusterrole.yml.j2
- 2.3/traefik-clusterrolebinding.yml.j2