修改 traefik-controller 配置

manifests/ingress/test-hello.ing.yaml

@@ -1,3 +1,4 @@
+# kubectl run test-hello --image=nginx --expose --port=80
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:

manifests/ingress/traefik/tls/traefik-controller.yaml

@@ -11,9 +11,12 @@ data:
     [entryPoints]
       [entryPoints.http]
         address = ":80"
-        # 配置http 强制跳转 https
+        ### 配置http 强制跳转 https
         #[entryPoints.http.redirect]
         #  entryPoint = "https"
+        ### 配置只信任trustedIPs传递过来X-Forwarded-*，默认全部信任；为了防止客户端地址伪造，需开启这个
+        #[entryPoints.http.forwardedHeaders]
+        #  trustedIPs = ["10.1.0.0/16", "172.20.0.0/16", "192.168.1.3"]
       [entryPoints.https]
         address = ":443"
         [entryPoints.https.tls]
@@ -48,6 +51,8 @@ spec:
       - name: config
         configMap:
           name: traefik-conf
+      #nodeSelector:
+      #  node-role.kubernetes.io/traefik: "true"
       containers:
       - image: traefik:v1.7.4
         imagePullPolicy: IfNotPresent
@@ -69,6 +74,19 @@ spec:
         - --api
         - --kubernetes
         - --logLevel=INFO
+        securityContext:
+          capabilities:
+            drop:
+              - ALL
+            add:
+              - NET_BIND_SERVICE
+        ports:
+          - name: http
+            containerPort: 80
+            hostPort: 80
+          - name: https
+            containerPort: 443
+            hostPort: 443
 ---
 kind: Service
 apiVersion: v1

manifests/ingress/whoami.ing.yaml

@@ -0,0 +1,15 @@
+# kubectl run whoami --image=emilevauge/whoami --port=80 --expose
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: test-whoami
+spec:
+  rules:
+  - host: who.test.com
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: whoami
+          servicePort: 80
+