跳至主要內容

Traefik作为Docker边缘路由

PaperDragon2023年8月13日...大约 3 分钟

Traefik作为Docker边缘路由

即： provider为docker

方案设计

流量想象成流动的水，我们的目的是把水进行分流到每个需要服务的地方，就如下图所示，我们要做的是需要利用Traefik的自动发现机制自动发现服务，然后自动注册到管道处：

image-20230112131250935

有以下几个要点：

  • 主管道： 外部nginx做第一次流量筛选，作为手动控制的开关
  • 二级管道： Treafik，自动将水管接到服务处
    • http
    • tcp
    • udp

主管道配置：

设计原理： 根据配置优先级，若server_name字段写一个具体的domain name，如果匹配不到则走下面的通用配置，由traefik进行域名路由和配置。

    upstream default_backend_traefik {
      server 127.0.0.1:82    max_fails=3 fail_timeout=10s;
    }
    
    server {
      server_name *.todesk.top;
  
      location / {
          proxy_pass http://default_backend_traefik;
          proxy_set_header Host       $http_host;
          proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
      }
    }

二级管道设置

设置Traefik服务

version: '3'

services:
  reverse-proxy:
    # The official v2 Traefik docker image
    image: traefik:v2.9
    # Enables the web UI and tells Traefik to listen to docker
    command: --api.insecure=true --providers.docker --entryPoints.web_80.address=:80 --entryPoints.tcpep.address=:3179 --entryPoints.udpep.address=:3179/udp
    ports:
      # The HTTP port
      - "127.0.0.1:82:80"
      # The Web UI (enabled by --api.insecure=true)
      - "127.0.0.1:8082:8080"
      - "3179:3179/tcp"
      - "3179:3179/udp"
    volumes:
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock
 # whoami:
 # # A container that exposes an API to show its IP address
 #   image: traefik/whoami
 #   labels:
 #     - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"

docker 运行http服务

例子1

docker run \
-ti \
-d \
-l 'traefik.http.routers.test.rule=Host(`test.todesk.top`)' \
--net treafik_default \
nginx

例子2

# Host
# entrypoint
# 连接到service
# service 用的端口
docker run -ti -d   \
-l 'traefik.http.routers.test.rule=Host(`test.todesk.top`)' \
-l 'traefik.http.routers.test.entrypoints=web_80' \
-l 'traefik.http.routers.test.service=test-service' \
-l 'traefik.http.services.test-service.loadbalancer.server.port=80' \
--net treafik_default \
nginx

docker运行tcp/udp服务

例子1：

docker run  -it \
-d \
--privileged \
--net treafik_default \
-l 'traefik.tcp.routers.tcprouter1.rule=HostSNI(`*`)' \
-l 'traefik.tcp.routers.tcprouter1.entrypoints=tcpep' \
-l 'traefik.tcp.routers.tcprouter1.service=tcprouter10-svc' \
-l 'traefik.tcp.services.tcprouter10-svc.loadbalancer.server.port=22' \
-l 'traefik.tcp.routers.tcprouter1.tls=false' \
seth0r/ubuntu-sshd:20.04

例子2：

docker run  -it \
-d \
--net treafik_default \
-e MYSQL_ROOT_PASSWORD: P@ssw0rd123 \
-e MYSQL_DATABASE: gogs \
-e MYSQL_USER: gogs \
-e MYSQL_PASSWORD: dalongrong \
-e TZ: Asia/Shanghai \
-l 'traefik.tcp.routers.tcprouter0.rule=HostSNI(`*`)' \
-l 'traefik.tcp.routers.tcprouter0.entrypoints=tcpep' \
-l 'traefik.tcp.routers.tcprouter0.service=tcprouter0-svc' \
-l 'traefik.tcp.services.tcprouter0-svc.loadbalancer.server.port=3306' \
mysql:5.7.16

参考lables

labels:
  - "traefik.enable=true"
  - "traefik.docker.network=foobar"
  - "traefik.docker.lbswarm=true"
  - "traefik.http.middlewares.middleware00.addprefix.prefix=foobar"
  - "traefik.http.middlewares.middleware01.basicauth.headerfield=foobar"
  - "traefik.http.middlewares.middleware01.basicauth.realm=foobar"
  - "traefik.http.middlewares.middleware01.basicauth.removeheader=true"
  - "traefik.http.middlewares.middleware01.basicauth.users=foobar, foobar"
  - "traefik.http.middlewares.middleware01.basicauth.usersfile=foobar"
  - "traefik.http.middlewares.middleware02.buffering.maxrequestbodybytes=42"
  - "traefik.http.middlewares.middleware02.buffering.maxresponsebodybytes=42"
  - "traefik.http.middlewares.middleware02.buffering.memrequestbodybytes=42"
  - "traefik.http.middlewares.middleware02.buffering.memresponsebodybytes=42"
  - "traefik.http.middlewares.middleware02.buffering.retryexpression=foobar"
  - "traefik.http.middlewares.middleware03.chain.middlewares=foobar, foobar"
  - "traefik.http.middlewares.middleware04.circuitbreaker.expression=foobar"
  - "traefik.http.middlewares.middleware04.circuitbreaker.checkperiod=42s"
  - "traefik.http.middlewares.middleware04.circuitbreaker.fallbackduration=42s"
  - "traefik.http.middlewares.middleware04.circuitbreaker.recoveryduration=42s"
  - "traefik.http.middlewares.middleware05.compress=true"
  - "traefik.http.middlewares.middleware05.compress.excludedcontenttypes=foobar, foobar"
  - "traefik.http.middlewares.middleware05.compress.minresponsebodybytes=42"
  - "traefik.http.middlewares.middleware06.contenttype.autodetect=true"
  - "traefik.http.middlewares.middleware07.digestauth.headerfield=foobar"
  - "traefik.http.middlewares.middleware07.digestauth.realm=foobar"
  - "traefik.http.middlewares.middleware07.digestauth.removeheader=true"
  - "traefik.http.middlewares.middleware07.digestauth.users=foobar, foobar"
  - "traefik.http.middlewares.middleware07.digestauth.usersfile=foobar"
  - "traefik.http.middlewares.middleware08.errors.query=foobar"
  - "traefik.http.middlewares.middleware08.errors.service=foobar"
  - "traefik.http.middlewares.middleware08.errors.status=foobar, foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.address=foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.authresponseheaders=foobar, foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.authresponseheadersregex=foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.authrequestheaders=foobar, foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.tls.ca=foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.tls.caoptional=true"
  - "traefik.http.middlewares.middleware09.forwardauth.tls.cert=foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.tls.insecureskipverify=true"
  - "traefik.http.middlewares.middleware09.forwardauth.tls.key=foobar"
  - "traefik.http.middlewares.middleware09.forwardauth.trustforwardheader=true"
  - "traefik.http.middlewares.middleware10.headers.accesscontrolallowcredentials=true"
  - "traefik.http.middlewares.middleware10.headers.accesscontrolallowheaders=foobar, foobar"
  - "traefik.http.middlewares.middleware10.headers.accesscontrolallowmethods=foobar, foobar"
  - "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlist=foobar, foobar"
  - "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlistregex=foobar, foobar"
  - "traefik.http.middlewares.middleware10.headers.accesscontrolexposeheaders=foobar, foobar"
  - "traefik.http.middlewares.middleware10.headers.accesscontrolmaxage=42"
  - "traefik.http.middlewares.middleware10.headers.addvaryheader=true"
  - "traefik.http.middlewares.middleware10.headers.allowedhosts=foobar, foobar"
  - "traefik.http.middlewares.middleware10.headers.browserxssfilter=true"
  - "traefik.http.middlewares.middleware10.headers.contentsecuritypolicy=foobar"
  - "traefik.http.middlewares.middleware10.headers.contenttypenosniff=true"
  - "traefik.http.middlewares.middleware10.headers.custombrowserxssvalue=foobar"
  - "traefik.http.middlewares.middleware10.headers.customframeoptionsvalue=foobar"
  - "traefik.http.middlewares.middleware10.headers.customrequestheaders.name0=foobar"
  - "traefik.http.middlewares.middleware10.headers.customrequestheaders.name1=foobar"
  - "traefik.http.middlewares.middleware10.headers.customresponseheaders.name0=foobar"
  - "traefik.http.middlewares.middleware10.headers.customresponseheaders.name1=foobar"
  - "traefik.http.middlewares.middleware10.headers.featurepolicy=foobar"
  - "traefik.http.middlewares.middleware10.headers.forcestsheader=true"
  - "traefik.http.middlewares.middleware10.headers.framedeny=true"
  - "traefik.http.middlewares.middleware10.headers.hostsproxyheaders=foobar, foobar"
  - "traefik.http.middlewares.middleware10.headers.isdevelopment=true"
  - "traefik.http.middlewares.middleware10.headers.permissionspolicy=foobar"
  - "traefik.http.middlewares.middleware10.headers.publickey=foobar"
  - "traefik.http.middlewares.middleware10.headers.referrerpolicy=foobar"
  - "traefik.http.middlewares.middleware10.headers.sslforcehost=true"
  - "traefik.http.middlewares.middleware10.headers.sslhost=foobar"
  - "traefik.http.middlewares.middleware10.headers.sslproxyheaders.name0=foobar"
  - "traefik.http.middlewares.middleware10.headers.sslproxyheaders.name1=foobar"
  - "traefik.http.middlewares.middleware10.headers.sslredirect=true"
  - "traefik.http.middlewares.middleware10.headers.ssltemporaryredirect=true"
  - "traefik.http.middlewares.middleware10.headers.stsincludesubdomains=true"
  - "traefik.http.middlewares.middleware10.headers.stspreload=true"
  - "traefik.http.middlewares.middleware10.headers.stsseconds=42"
  - "traefik.http.middlewares.middleware11.ipwhitelist.ipstrategy.depth=42"
  - "traefik.http.middlewares.middleware11.ipwhitelist.ipstrategy.excludedips=foobar, foobar"
  - "traefik.http.middlewares.middleware11.ipwhitelist.sourcerange=foobar, foobar"
  - "traefik.http.middlewares.middleware12.inflightreq.amount=42"
  - "traefik.http.middlewares.middleware12.inflightreq.sourcecriterion.ipstrategy.depth=42"
  - "traefik.http.middlewares.middleware12.inflightreq.sourcecriterion.ipstrategy.excludedips=foobar, foobar"
  - "traefik.http.middlewares.middleware12.inflightreq.sourcecriterion.requestheadername=foobar"
  - "traefik.http.middlewares.middleware12.inflightreq.sourcecriterion.requesthost=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.issuer.commonname=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.issuer.country=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.issuer.domaincomponent=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.issuer.locality=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.issuer.organization=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.issuer.province=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.issuer.serialnumber=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.notafter=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.notbefore=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.sans=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.serialnumber=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.commonname=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.country=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.domaincomponent=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.locality=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.organization=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.organizationalunit=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.province=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.info.subject.serialnumber=true"
  - "traefik.http.middlewares.middleware13.passtlsclientcert.pem=true"
  - "traefik.http.middlewares.middleware14.plugin.foobar.foo=bar"
  - "traefik.http.middlewares.middleware15.ratelimit.average=42"
  - "traefik.http.middlewares.middleware15.ratelimit.burst=42"
  - "traefik.http.middlewares.middleware15.ratelimit.period=42"
  - "traefik.http.middlewares.middleware15.ratelimit.sourcecriterion.ipstrategy.depth=42"
  - "traefik.http.middlewares.middleware15.ratelimit.sourcecriterion.ipstrategy.excludedips=foobar, foobar"
  - "traefik.http.middlewares.middleware15.ratelimit.sourcecriterion.requestheadername=foobar"
  - "traefik.http.middlewares.middleware15.ratelimit.sourcecriterion.requesthost=true"
  - "traefik.http.middlewares.middleware16.redirectregex.permanent=true"
  - "traefik.http.middlewares.middleware16.redirectregex.regex=foobar"
  - "traefik.http.middlewares.middleware16.redirectregex.replacement=foobar"
  - "traefik.http.middlewares.middleware17.redirectscheme.permanent=true"
  - "traefik.http.middlewares.middleware17.redirectscheme.port=foobar"
  - "traefik.http.middlewares.middleware17.redirectscheme.scheme=foobar"
  - "traefik.http.middlewares.middleware18.replacepath.path=foobar"
  - "traefik.http.middlewares.middleware19.replacepathregex.regex=foobar"
  - "traefik.http.middlewares.middleware19.replacepathregex.replacement=foobar"
  - "traefik.http.middlewares.middleware20.retry.attempts=42"
  - "traefik.http.middlewares.middleware20.retry.initialinterval=42"
  - "traefik.http.middlewares.middleware21.stripprefix.forceslash=true"
  - "traefik.http.middlewares.middleware21.stripprefix.prefixes=foobar, foobar"
  - "traefik.http.middlewares.middleware22.stripprefixregex.regex=foobar, foobar"
  - "traefik.http.routers.router0.entrypoints=foobar, foobar"
  - "traefik.http.routers.router0.middlewares=foobar, foobar"
  - "traefik.http.routers.router0.priority=42"
  - "traefik.http.routers.router0.rule=foobar"
  - "traefik.http.routers.router0.service=foobar"
  - "traefik.http.routers.router0.tls=true"
  - "traefik.http.routers.router0.tls.certresolver=foobar"
  - "traefik.http.routers.router0.tls.domains[0].main=foobar"
  - "traefik.http.routers.router0.tls.domains[0].sans=foobar, foobar"
  - "traefik.http.routers.router0.tls.domains[1].main=foobar"
  - "traefik.http.routers.router0.tls.domains[1].sans=foobar, foobar"
  - "traefik.http.routers.router0.tls.options=foobar"
  - "traefik.http.routers.router1.entrypoints=foobar, foobar"
  - "traefik.http.routers.router1.middlewares=foobar, foobar"
  - "traefik.http.routers.router1.priority=42"
  - "traefik.http.routers.router1.rule=foobar"
  - "traefik.http.routers.router1.service=foobar"
  - "traefik.http.routers.router1.tls=true"
  - "traefik.http.routers.router1.tls.certresolver=foobar"
  - "traefik.http.routers.router1.tls.domains[0].main=foobar"
  - "traefik.http.routers.router1.tls.domains[0].sans=foobar, foobar"
  - "traefik.http.routers.router1.tls.domains[1].main=foobar"
  - "traefik.http.routers.router1.tls.domains[1].sans=foobar, foobar"
  - "traefik.http.routers.router1.tls.options=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.followredirects=true"
  - "traefik.http.services.service01.loadbalancer.healthcheck.headers.name0=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.headers.name1=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.hostname=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.interval=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.path=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.method=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.port=42"
  - "traefik.http.services.service01.loadbalancer.healthcheck.scheme=foobar"
  - "traefik.http.services.service01.loadbalancer.healthcheck.timeout=foobar"
  - "traefik.http.services.service01.loadbalancer.passhostheader=true"
  - "traefik.http.services.service01.loadbalancer.responseforwarding.flushinterval=foobar"
  - "traefik.http.services.service01.loadbalancer.serverstransport=foobar"
  - "traefik.http.services.service01.loadbalancer.sticky.cookie=true"
  - "traefik.http.services.service01.loadbalancer.sticky.cookie.httponly=true"
  - "traefik.http.services.service01.loadbalancer.sticky.cookie.name=foobar"
  - "traefik.http.services.service01.loadbalancer.sticky.cookie.samesite=foobar"
  - "traefik.http.services.service01.loadbalancer.sticky.cookie.secure=true"
  - "traefik.http.services.service01.loadbalancer.server.port=foobar"
  - "traefik.http.services.service01.loadbalancer.server.scheme=foobar"
  - "traefik.tcp.middlewares.tcpmiddleware00.ipwhitelist.sourcerange=foobar, foobar"
  - "traefik.tcp.middlewares.tcpmiddleware01.inflightconn.amount=42"
  - "traefik.tcp.routers.tcprouter0.entrypoints=foobar, foobar"
  - "traefik.tcp.routers.tcprouter0.middlewares=foobar, foobar"
  - "traefik.tcp.routers.tcprouter0.rule=foobar"
  - "traefik.tcp.routers.tcprouter0.priority=42"
  - "traefik.tcp.routers.tcprouter0.service=foobar"
  - "traefik.tcp.routers.tcprouter0.tls=true"
  - "traefik.tcp.routers.tcprouter0.tls.certresolver=foobar"
  - "traefik.tcp.routers.tcprouter0.tls.domains[0].main=foobar"
  - "traefik.tcp.routers.tcprouter0.tls.domains[0].sans=foobar, foobar"
  - "traefik.tcp.routers.tcprouter0.tls.domains[1].main=foobar"
  - "traefik.tcp.routers.tcprouter0.tls.domains[1].sans=foobar, foobar"
  - "traefik.tcp.routers.tcprouter0.tls.options=foobar"
  - "traefik.tcp.routers.tcprouter0.tls.passthrough=true"
  - "traefik.tcp.routers.tcprouter1.entrypoints=foobar, foobar"
  - "traefik.tcp.routers.tcprouter1.middlewares=foobar, foobar"
  - "traefik.tcp.routers.tcprouter1.rule=foobar"
  - "traefik.tcp.routers.tcprouter1.priority=42"
  - "traefik.tcp.routers.tcprouter1.service=foobar"
  - "traefik.tcp.routers.tcprouter1.tls=true"
  - "traefik.tcp.routers.tcprouter1.tls.certresolver=foobar"
  - "traefik.tcp.routers.tcprouter1.tls.domains[0].main=foobar"
  - "traefik.tcp.routers.tcprouter1.tls.domains[0].sans=foobar, foobar"
  - "traefik.tcp.routers.tcprouter1.tls.domains[1].main=foobar"
  - "traefik.tcp.routers.tcprouter1.tls.domains[1].sans=foobar, foobar"
  - "traefik.tcp.routers.tcprouter1.tls.options=foobar"
  - "traefik.tcp.routers.tcprouter1.tls.passthrough=true"
  - "traefik.tcp.services.tcpservice01.loadbalancer.proxyprotocol.version=42"
  - "traefik.tcp.services.tcpservice01.loadbalancer.terminationdelay=42"
  - "traefik.tcp.services.tcpservice01.loadbalancer.server.port=foobar"
  - "traefik.udp.routers.udprouter0.entrypoints=foobar, foobar"
  - "traefik.udp.routers.udprouter0.service=foobar"
  - "traefik.udp.routers.udprouter1.entrypoints=foobar, foobar"
  - "traefik.udp.routers.udprouter1.service=foobar"
  - "traefik.udp.services.udpservice01.loadbalancer.server.port=foobar"
  - "traefik.tls.stores.Store0.defaultcertificate.certfile=foobar"
  - "traefik.tls.stores.Store0.defaultcertificate.keyfile=foobar"
  - "traefik.tls.stores.Store0.defaultgeneratedcert.domain.main=foobar"
  - "traefik.tls.stores.Store0.defaultgeneratedcert.domain.sans=foobar, foobar"
  - "traefik.tls.stores.Store0.defaultgeneratedcert.resolver=foobar"
  - "traefik.tls.stores.Store1.defaultcertificate.certfile=foobar"
  - "traefik.tls.stores.Store1.defaultcertificate.keyfile=foobar"
  - "traefik.tls.stores.Store1.defaultgeneratedcert.domain.main=foobar"
  - "traefik.tls.stores.Store1.defaultgeneratedcert.domain.sans=foobar, foobar"
  - "traefik.tls.stores.Store1.defaultgeneratedcert.resolver=foobar"
上次编辑于: 2024/3/19 08:48:16
贡献者: PaperDragon-SH,PaperDragon
你认为这篇文章怎么样？
  • 0
  • 0
  • 0
  • 0
  • 0
  • 0
0  字
评论
  • 按正序
  • 按倒序
  • 按热度
Powered by Waline v3.4.2
运维开发绿皮书
copyleft 2023-至今 PaperDragon