在Google Cloud Kubernetes中运行Traefik时，LoadBalancer Healthy失败

Question

我正在尝试在Google Cloud Kubernetes中配置Traefik，正在创建一个集群，并使用以下文件配置该集群。

我的代码是基于这里的：

• https://supergiant.io/blog/using-traefik-as-ingress-controller-for-your-kubernetes-cluster/
• https://docs.traefik.io/user-guide/kubernetes/

---

run.sh

#!/usr/bin/env bash

PROJECT="my-beautiful-project" # Replace This
CLUSTER_NAME="cluster-traefik-x"

# Create Cluster
gcloud container clusters create $CLUSTER_NAME --zone europe-west4-c

# Connect to Cluster:
gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT

# Reserve IPs
gcloud compute addresses create my-web-static-ip-rui --global
gcloud compute addresses create my-web-static-ip-rui-dashboard --global

# Setup Traefik
kubectl apply -f 10-traefik-service-acc.yaml
kubectl apply -f 20-traefik-cr.yaml
kubectl apply -f 30-traefik-crb.yaml

kubectl apply -f 40-traefik-deployment.yaml
kubectl apply -f 50-traefik-svc.yaml

# gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT && kubectl port-forward --namespace kube-system $(kubectl get pod --namespace kube-system --selector="k8s-app=traefik-ingress-lb" --output jsonpath='{.items[0].metadata.name}') 8080:8080 # DASHBOARD
# gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT && kubectl port-forward --namespace kube-system $(kubectl get pod --namespace kube-system --selector="k8s-app=traefik-ingress-lb" --output jsonpath='{.items[0].metadata.name}') 8081:80 # HTTP

kubectl apply -f 60-traefik-webui-svc.yaml
# gcloud container clusters get-credentials $CLUSTER_NAME --zone europe-west4-c --project $PROJECT && kubectl port-forward --namespace kube-system $(kubectl get pod --namespace kube-system --selector="k8s-app=traefik-ingress-lb" --output jsonpath='{.items[0].metadata.name}') 8082:8080 # DASHBOARD

kubectl apply -f 70-traefik-ingress.yaml
kubectl apply -f 75-traefik-ingress-lb-rui.yaml
kubectl apply -f 210-ws-rui-deployment.yaml
kubectl apply -f 220-ws-rui-svc.yaml
kubectl apply -f 230-ws-rui-ingress.yaml

# curl http://127.0.0.1:8081/hello # Should fail
# curl -H host:api.my-domain.com http://127.0.0.1:8081/hello # Returns ok

---

10-traefik-service-acc.yaml：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress
  namespace: kube-system

---

20-traefik-cr.yaml

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch

---

30-traefik-crb.yaml

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress
subjects:
- kind: ServiceAccount
  name: traefik-ingress
  namespace: kube-system

---

40-traefik-deployment.yaml

kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: traefik-ingress
  namespace: kube-system
  labels:
    k8s-app: traefik-ingress-lb
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress
      terminationGracePeriodSeconds: 60
      containers:
      - image: traefik
        name: traefik-ingress-lb
        ports:
        - name: http
          containerPort: 80 # LOADBALANCER
        - name: admin
          containerPort: 8080 # DASHBOARD
        args:
        - --api
        - --kubernetes
        - --logLevel=DEBUG # INFO | DEBUG

---

50-traefik-svc.yaml

kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: kube-system
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web # LOADBALANCER
    - protocol: TCP
      port: 8080
      name: admin # DASHBOARD
  type: NodePort # -> https://docs.traefik.io/user-guide/kubernetes/
# I read in internet some examples with NodePort and some with LoadBalancer. 
# I think that the most correct is NodePort
#  type: LoadBalancer
#  loadBalancerIP: 130.211.20.21 # Use when type is LoadBalancer # THIS DOES NOT WORK WITH RESERVED IPs

---

60-traefik-webui-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: traefik-web-ui
  namespace: kube-system
spec:
  type: NodePort
#  type: ClusterIP # ClusterIP is the default ServiceType. The examples that I saw don't have anything, then is ClusterIP by default, but Kubernetes Ingress says: `error while evaluating the ingress spec: service "kube-system/traefik-web-ui" is type "ClusterIP", expected "NodePort" or "LoadBalancer"` then, I choose NodePort
  selector:
    k8s-app: traefik-ingress-lb
  ports:
  - name: web
    port: 80
    targetPort: 8080 # DASHBOARD

---

70-traefik-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-web-ui
  namespace: kube-system
  annotations:
#    kubernetes.io/ingress.class: traefik # SHOULD I USE THIS HERE?
    kubernetes.io/ingress.global-static-ip-name: "my-web-static-ip-rui-dashboard"
spec:
  rules:
    - host: dashboard.api.my-domain.com
      http:
        paths:
        - path: /
          backend:
            serviceName: traefik-web-ui
            servicePort: web

---

75-traefik-ingress-lb-rui.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-lb-ingress
  namespace: kube-system
  annotations:
#    kubernetes.io/ingress.class: traefik # SHOULD I USE THIS HERE?
    kubernetes.io/ingress.global-static-ip-name: "my-web-static-ip-rui"

spec:
  rules:
    - host: api.my-domain.com
      http:
        paths:
        - path: /
          backend:
            serviceName: traefik-ingress-service
            servicePort: web

---

210-ws-rui-deployment.yaml

kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: ws-rui-hello-world
  labels:
    app: animals
    animal: bear
spec:
  replicas: 2
  selector:
    matchLabels:
      app: animals
      task: bear
  template:
    metadata:
      labels:
        app: animals
        task: bear
        version: v0.0.1
    spec:
      containers:
      - name: bear
#        image: supergiantkir/animals:bear
        image: registry.hub.docker.com/ruimartinsptl/python-user-web-service-lixo
        ports:
        - containerPort: 80

---

220-ws-rui-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: ws-rui-hello-world
spec:
  type: NodePort
  ports:
  - name: http
    targetPort: 80
    port: 80
  selector:
    app: animals
    task: bear

---

230-ws-rui-ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ws-rui-ingress
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: api.my-domain.com
    http:
      paths:
      # - path: / # SHOULD I USE also `/`?
      #   backend:
      #     serviceName: ws-rui-hello-world
      #     servicePort: http
      - path: /hello
        backend:
          serviceName: ws-rui-hello-world
          servicePort: http

---

但是，我遇到了一些问题：

• 我可以在localhost中映射服务端口，并运行curl -H host:api.my-domain.com http://127.0.0.1:8081/hello或curl -H host:dashboard.api.my-domain.com http://127.0.0.1:8080/dashboard。但是我无法从外部获得服务。

这是我的Kubernetes集群：

部署得当：

IP创建得很好

服务创建良好，但是入口在运行状况检查中失败，并且由于域而不会出现问题，因为我已经尝试过使用域。

这是健康检查：

端口31398存在健康检查问题：

这是通过身份验证创建的健康检查：

但是，如果我将端口从此端口转发到我的本地主机，则其工作：

但是当我尝试访问realdomain时，总是收到404错误。 有人可以帮我吗？

有人已经在Google Cloud Platform中配置Traefik吗？

欢迎所有提示:)?

更新：解决方案

Traefik服务应为LoadBalancer类型而不是NodePort（文件50-traefik-svc.yaml），那么我不需要为Traefik创建入口（文件70-traefik-ingress.yaml可以是删除）

我还需要在loadBalancerIP: xxx.xxx.xxx.xxx中插入50-traefik-svc.yaml而不是在kubernetes.io/ingress.global-static-ip-name: "my-web-static-ip-rui-dashboard"中插入70-traefik-ingress.yaml。 （此IP有时需要很长时间才能被设置为15分钟左右）

感谢所有试图帮助我的人：）

Answer 1

您显然知道自己在做什么，而我不知道有关该工具的详细信息。

但是我看到这个问题偶尔会弹出...并且如果您在某种“托管”环境中运行，其中安全人员会自动“修复”安全漏洞，则这尤其重要。

1）是否有人删除允许GCP健康检查程序访问您IP的规则？ （该规则本来是自动创建的，但有时“安全人员”会删除它们

2）是否有人从公开的API中删除了0.0.0.0/0规则。 （因为您的健康检查失败而无法猜测）。

检查日志文件中是否有任何PATCH到防火墙的规则。

Answer 2

当您尝试到达/rui时，您的python应用程序侦听/rui/hello或/hello路径，这就是为什么它重定向到默认的后备404的原因。

所以有两个选择：

a）使用正确的路径

http://127.0.0.1:8080/rui/hello

b）或在入口对象中设置重写目标

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ws-rui-ingress
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/rewrite-target: /rui/hello
spec:
  rules:
  - host:
    http:
      paths:
      - path: /hello
        backend:
          serviceName: ws-rui-hello-world
          servicePort: http