Kubernetes Ingress Controller Traefik路由配置与TLS自动证书管理实战

Kubernetes集群对外暴露服务通常需要Ingress Controller。Traefik作为云原生反向代理，原生支持Kubernetes CRD、自动服务发现和Let’s Encrypt自动证书。相比Nginx Ingress，Traefik无需手动reload配置文件，路由规则变更即时生效，且Dashboard提供直观的流量可视化。本文记录Traefik在Kubernetes中的完整部署与配置过程。

Traefik Helm部署与CRD资源定义

Traefik v3通过Helm安装，需要先添加Traefik仓库：

# 添加Traefik Helm仓库
helm repo add traefik https://traefik.github.io/charts
helm repo update

# 创建命名空间
kubectl create namespace traefik-system

# 自定义values.yaml
cat > traefik-values.yaml << 'EOF'
image:
  tag: v3.1.0

deployment:
  replicas: 2
  labels:
    app: traefik

service:
  type: LoadBalancer
  annotations:
    metallb.io/address-pool: production
  spec:
    loadBalancerIP: 10.0.1.50

ingressClass:
  enabled: true
  isDefaultClass: true

# 自动证书解析器配置
certResolvers:
  letsencrypt:
    email: admin@example.com
    tlsChallenge: true
    storage: /data/acme.json

# 持久化存储（ACME证书）
persistence:
  enabled: true
  storageClass: nfs-client
  size: 1Gi
  path: /data

# 资源限制
resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

# 日志配置
logs:
  access:
    enabled: true
    format: json
  general:
    level: INFO
    format: json

# 端口配置
ports:
  web:
    port: 8000
    redirectTo:
      port: websecure
  websecure:
    port: 8443
    tls:
      enabled: true

# 健康检查
healthchecks:
  enabled: true
  path: /ping
EOF

# 安装Traefik
helm install traefik traefik/traefik   -n traefik-system   -f traefik-values.yaml

# 验证部署
kubectl get pods -n traefik-system
kubectl get svc -n traefik-system

IngressRoute CRD路由规则配置

Traefik使用自定义资源IngressRoute替代标准Ingress，提供更细粒度的路由控制：

---
# HTTP自动跳转HTTPS
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: http-redirect
  namespace: production
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`api.example.com`)
      kind: Rule
      services:
        - name: api-service
          port: 8080
      middlewares:
        - name: redirect-https
          namespace: production

---
# HTTPS路由与TLS证书
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: api-https
  namespace: production
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`api.example.com`) && PathPrefix(`/v1`)
      kind: Rule
      services:
        - name: api-service
          port: 8080
          scheme: http
      middlewares:
        - name: rate-limit
          namespace: production
        - name: security-headers
          namespace: production
    - match: Host(`api.example.com`) && PathPrefix(`/v2`)
      kind: Rule
      services:
        - name: api-v2-service
          port: 8080
      middlewares:
        - name: jwt-auth
          namespace: production
  tls:
    certResolver: letsencrypt
    domains:
      - main: api.example.com
        sans:
          - "*.api.example.com"

路由匹配规则使用Traefik自有的DSL语法：Host()匹配域名，PathPrefix()匹配路径前缀，&&连接多个条件。路由规则按声明顺序匹配，第一条匹配的规则生效。

中间件链配置与请求处理流水线

Traefik通过Middleware实现请求拦截和转换，多个中间件组成处理链依次执行：

---
# HTTPS重定向中间件
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
  namespace: production
spec:
  redirectScheme:
    scheme: https
    permanent: true

---
# 限流中间件
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
  namespace: production
spec:
  rateLimit:
    average: 100
    period: 1s
    burst: 200
    sourceCriterion:
      requestHeader: X-Real-IP
      strategy: requestHeader

---
# 安全响应头中间件
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
  namespace: production
spec:
  headers:
    frameDeny: true
    sslRedirect: true
    sslForceHost: true
    stsSeconds: 31536000
    stsIncludeSubdomains: true
    stsPreload: true
    contentTypeNosniff: true
    browserXssFilter: true
    referrerPolicy: "strict-origin-when-cross-origin"
    contentSecurityPolicy: "default-src 'self'; script-src 'self' 'unsafe-inline'"
    customResponseHeaders:
      X-Robots-Tag: "noindex, nofollow"

---
# JWT认证中间件（使用ForwardAuth）
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: jwt-auth
  namespace: production
spec:
  forwardAuth:
    address: http://auth-service.production.svc.cluster.local:9090/verify
    authResponseHeaders:
      - "X-User-Id"
      - "X-User-Role"
      - "X-Auth-Token"
    tls:
      insecureSkipVerify: true
    trustForwardHeader: true

中间件执行顺序由IngressRoute中middlewares列表的顺序决定。上述配置中，限流先于安全头执行，安全头先于JWT认证执行。如果限流触发（返回429），后续中间件不再执行。

Traefik Dashboard访问控制与生产安全加固

Traefik Dashboard默认不暴露，生产环境需要通过IngressRoute访问并配合认证：

---
# Dashboard路由（仅内网访问）
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
  namespace: traefik-system
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`traefik.internal.example.com`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
      kind: Rule
      services:
        - name: traefik
          port: 9000
          namespace: traefik-system
      middlewares:
        - name: dashboard-auth
          namespace: traefik-system
        - name: ip-whitelist
          namespace: traefik-system
  tls:
    certResolver: letsencrypt
    domains:
      - main: traefik.internal.example.com

---
# Basic Auth中间件
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: dashboard-auth
  namespace: traefik-system
spec:
  basicAuth:
    users:
      - "admin:$apr1$v2d.3e8i$Q6xK8pN7m2jF9oB5lA0rJ1"

---
# IP白名单中间件
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: ip-whitelist
  namespace: traefik-system
spec:
  ipWhiteList:
    sourceRange:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16

Traefik与Nginx Ingress性能对比与选型参考

在同等硬件条件下（4 vCPU / 8GB / 10Gbps网络），对Traefik v3.1与Nginx Ingress Controller v1.10进行压测对比：

小请求（1KB响应体）：Traefik QPS约38,000，Nginx约42,000。Nginx领先约10%，差距来自Traefik的Go运行时开销。

大请求（1MB响应体）：Traefik QPS约2,800，Nginx约2,950。差距缩小，IO成为瓶颈而非协议处理。

配置更新生效时间：Traefik约50-100ms（CRD watch实时触发），Nginx约3-5秒（需要reload配置文件）。路由规则频繁变更场景下Traefik优势明显。

TLS握手性能：两者均使用Go的crypto/tls库，性能接近，约8,000 handshakes/s。

选型建议：路由规则需要动态调整、需要Dashboard可视化、需要Let's Encrypt原生集成的场景选择Traefik。追求极致吞吐量、已有大量Nginx配置需要迁移的场景选择Nginx Ingress。