020-deployment.yaml 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263
  1. ###############################
  2. # ServiceAccount
  3. ###############################
  4. ---
  5. apiVersion: v1
  6. kind: ServiceAccount
  7. metadata:
  8. name: traefik
  9. namespace: kube-system
  10. ---
  11. apiVersion: v1
  12. kind: Secret
  13. metadata:
  14. name: google-crendential
  15. labels:
  16. name: google-crendential
  17. namespace: kube-system
  18. type: Opaque
  19. data:
  20. gcloud-credentials.json: "ewogICJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsCiAgInByb2plY3RfaWQiOiAibXlyb290LTI4MzYwMyIsCiAgInByaXZhdGVfa2V5X2lkIjogIjliYzkwODA4ODlmZjAxMDRiODI1ODE1ZTkwMGNjNGU0ZmVmNWNmYmQiLAogICJwcml2YXRlX2tleSI6ICItLS0tLUJFR0lOIFBSSVZBVEUgS0VZLS0tLS1cbk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ2ZxWHgzT2xtUmhyRWNcbmx2TXRnTnJ2QXdHTldSS0l0cmRPTDQ4QXFCd2xYTU9KYldyVURScWw2RHE5QTlZekVlWGRia0dVSm9UWDdSR2hcbnFqc2dHWjRtRWR3aWkybVpJNHIxajEwOXdUeGVBMkIwNjRlSXR6TXlGWGMrVXk1a3N5S3BzVWxHczBqWWdPUjVcbnY0QkE0NTBYZTBMYk9BWi8yMmhNNGRSNGRnRXcyNnBqMUVYMEc2d0lEaS8zM0dVYjAyZTRTbTRLNWU0T3VHSWVcblRzVHZzc2I3aHF1VzlsZ2VpZERPd3hYcXlIdHAzWFVENjJLK2ZZV2ZZYmhWbXhlWkFRK1NTaGpFSFArT0s1SUdcbkpJVmd3eEwvaTdaby82dnZyYytZRXlFMnF1eWNlZXRnQjJqUWorQllwYVYyWEphNWdOUHFGYWFpZStWeDBhN0NcbnJHRnlpYTUvQWdNQkFBRUNnZ0VBQS96RkxmMnFXWTNxbGlWOEZQZEV0MUtITHE1ZThFU094TkdJckFiUDZiVStcbjhPYjVwZUU1NW02SEJaVWt6ZVRaaU9wT2JVQlZCQ0pZaTZwVTFhNkppQ1VCd1dnK3hab3FXaDJkZUtoYVdiNGtcbnRCMnNBZHFBUnZUdC8wem1ndjlOdCtIRWxTVktoZ05qTVZvTTJjamVsaktLU25peDNXNG1WUjAwL3hBRWlIUHdcbnRNSHAwS1VCdnlkMnJWRFduRlZlNy9qT1RRUm52WEpic3NVRlRaZ2lXUG5EQXVhZlhsbU04ZTlQZ2lnVURtTU5cbnI4b1oxNlNHR2N0OXZsUktZdjVJSmNDWVRXMlV5MHdKWmtBbmw1S0R0bktIdnA4dzBKZmcyTFkrdEdkTytTQStcbkpEWFBaQ3BYU251VzVLOTl2L3VMclB0cHEyLysya09SQmZ1allZOVhVUUtCZ1FEVXpXQWxQYk9qK3NyOHV3RkNcbkNKUG5iZkpnN2VSeFVHR0VJWUFWdkxRc1NYRGRKVVE0OEpabEtTZjZuWUNOMXljVkQ2aS9ENmJIemkwaW9weExcbmZjbm5ZaEk0NEk1Y3h5dy9EK3BoVlNOK1ZMRVpuZm1iNFlGQjFGN2wwV293ODBOVHB5Nnl6NU9BSzBBUVBibjVcbmUySmdUMmpuZ0lJbHpjZHg1OUFjNHVndGlRS0JnUURBRXBkNSt3Z1hJYWNFU0N2S0hoYUdGMDRGUnBjTjJWYWVcbitvY0phMDBXUS9SdEI5RnpndnZvOGcwRUphTzY5UTR0UjN0WER6S2QvbHc2bTFQRjJhUkpsb0d4SkFuOHFtYU9cbjNmRUNnU05wdEgyNEV2dWFzUXU2WWlKTmNCREVoK0xrc2R3OGxvNTdRNVRJVXhrUG1DU2duTm5IeC9VbEhHTjFcbmJ6YVlFMnJCeHdLQmdRREFHOWdjUnFPUithcWVsY1FBOVBWeERCU3Y1Sk5DcUtvZ09vNERFYVFtQnZiWTdmZTBcbjM1MG1IZzExZGhMRCtlUFNZNXlYUDIzMUd2QXNRRmlRM2pJVHJMbCtsMXB0NzNER1RYdnQrb3BjVmVDN201M25cblY2RDA2Ti95NFNiWW9nTzUxVWVYTFVXZmcyd0dQWE5UQWt4QlhlNzZiMDBQQzhKdDFqUk9uNW15NFFLQmdBVkJcbi9RZUh5YWJvY3V2NUZjbkluUkU2bmhZaTRvdXNnV1NFc3lHYzRGVlZzdUV4TDVpYjQwMXpJc3dVUTdFZ2VDemhcbklnMDJDMHFyNWRaczNoUXlhdjdnc2RncGhtUjJQYXgzZ3R0d3NZbDVPVi9LbFR5YzBCZGdERlJXVnY4cVFSbkZcbmpLUFQ4ejZJa1JBU3hrTFpCVmVvTTRYMmdVMXN3NFE1Y1NNa2xPMk5Bb0dCQUlMbTNkVXoxSk5lS1RDeDBMdVVcbkVoaWJNTTJZY0k3VEdzdlBMUzFSTWlGMW1QS2lNL0RRbU1HeTdOUjZ5THE0dnJYZ2VLS2dEUXlMUUtCaklJYVlcbkpaVS9SdXdxVVN0SVp6MTBIa09GOHB2UEtOYWdkVDlLU1hjUnJjUVZLTWFTVlo4Wno2T2hXSUVjd093MXh6NHBcbitlSG41ZkFKdUNYSnpHR3JBd1lhNXVnZVxuLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLVxuIiwKICAiY2xpZW50X2VtYWlsIjogInRyYWVmaWtAbXlyb290LTI4MzYwMy5pYW0uZ3NlcnZpY2VhY2NvdW50LmNvbSIsCiAgImNsaWVudF9pZCI6ICIxMDM1MDEzNzgwMDg2ODQ1MjIwNjkiLAogICJhdXRoX3VyaSI6ICJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20vby9vYXV0aDIvYXV0aCIsCiAgInRva2VuX3VyaSI6ICJodHRwczovL29hdXRoMi5nb29nbGVhcGlzLmNvbS90b2tlbiIsCiAgImF1dGhfcHJvdmlkZXJfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9vYXV0aDIvdjEvY2VydHMiLAogICJjbGllbnRfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9yb2JvdC92MS9tZXRhZGF0YS94NTA5L3RyYWVmaWslNDBteXJvb3QtMjgzNjAzLmlhbS5nc2VydmljZWFjY291bnQuY29tIgp9Cgo="
  21. ###############################
  22. # Deployment
  23. ###############################
  24. ---
  25. apiVersion: apps/v1
  26. kind: Deployment
  27. metadata:
  28. labels:
  29. app: traefik
  30. release: traefik
  31. name: traefik
  32. namespace: kube-system
  33. spec:
  34. replicas: 1
  35. selector:
  36. matchLabels:
  37. app: traefik
  38. release: traefik
  39. template:
  40. metadata:
  41. labels:
  42. app: traefik
  43. release: traefik
  44. spec:
  45. volumes:
  46. - name: google-crendential
  47. secret:
  48. secretName: google-crendential
  49. containers:
  50. - args:
  51. - --api
  52. #- --api.insecure=true
  53. # Set insecure to fals to enable basic auth
  54. - --api.insecure=false
  55. - --api.dashboard=true
  56. - --accesslog
  57. - --global.checknewversion=true
  58. - --entryPoints.traefik.address=:8100
  59. - --entryPoints.web.address=:80
  60. - --entryPoints.websecure.address=:443
  61. # permanent redirecting of all requests on http (80) to https (443)
  62. - --entrypoints.web.http.redirections.entryPoint.to=websecure
  63. - --entrypoints.websecure.http.tls.certResolver=default
  64. - --entrypoints.websecure.http.tls.domains[0].main=k8s.eugeniocarvalho.dev
  65. - --entrypoints.websecure.http.tls.domains[0].sans=*.k8s.eugeniocarvalho.dev
  66. #- --entrypoints.websecure.http.tls.certResolver=letsencrypt
  67. # Let's Encrypt Configurtion:
  68. # Please note that this is the staging Let's Encrypt server configuration.
  69. # Once you get things working, you should remove that following line.
  70. - --certificatesresolvers.default.acme.email=eugeniucarvalho@gmail.com
  71. - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
  72. - --certificatesresolvers.default.acme.storage=acme.json
  73. # - --certificatesresolvers.default.acme.tlschallenge=true
  74. - --certificatesresolvers.default.acme.dnsChallenge.provider=gcloud
  75. - --certificatesresolvers.default.acme.dnschallenge.delaybeforecheck=0
  76. # - --certificatesresolvers.default.acme.dnsChallenge.entryPoint=http
  77. - --ping=true
  78. - --providers.kubernetescrd=true
  79. - --providers.kubernetesingress=true
  80. # Use log level= INFO or DEBUG
  81. - --log.level=INFO
  82. image: traefik:2.2.1
  83. env:
  84. - name: GCE_PROJECT
  85. value: "myroot-283603"
  86. # - name: GCE_SERVICE_ACCOUNT
  87. # value: "traefik@myroot-283603.iam.gserviceaccount.com"
  88. - name: GCE_SERVICE_ACCOUNT_FILE
  89. value: /secrets/gcloud-credentials.json
  90. volumeMounts:
  91. - mountPath: /secrets
  92. name: google-crendential
  93. imagePullPolicy: IfNotPresent
  94. livenessProbe:
  95. failureThreshold: 3
  96. httpGet:
  97. path: /ping
  98. port: 8100
  99. scheme: HTTP
  100. initialDelaySeconds: 10
  101. periodSeconds: 10
  102. successThreshold: 1
  103. timeoutSeconds: 2
  104. name: traefik
  105. ports:
  106. - containerPort: 8100
  107. name: admin
  108. protocol: TCP
  109. - containerPort: 80
  110. name: web
  111. protocol: TCP
  112. - containerPort: 443
  113. name: websecure
  114. protocol: TCP
  115. # optional storage
  116. # enable this option only in case you have defined a persistence volume claim
  117. #volumeMounts:
  118. #- name: traefik-data
  119. # mountPath: /var/lib/traefik
  120. readinessProbe:
  121. failureThreshold: 1
  122. httpGet:
  123. path: /ping
  124. port: 8100
  125. scheme: HTTP
  126. initialDelaySeconds: 10
  127. periodSeconds: 10
  128. successThreshold: 1
  129. timeoutSeconds: 2
  130. resources: {}
  131. terminationMessagePath: /dev/termination-log
  132. terminationMessagePolicy: File
  133. dnsPolicy: ClusterFirst
  134. restartPolicy: Always
  135. schedulerName: default-scheduler
  136. securityContext: {}
  137. serviceAccount: traefik
  138. serviceAccountName: traefik
  139. terminationGracePeriodSeconds: 60
  140. # optional storage
  141. # enable this option only in case you have defined a persistence volume claim
  142. #volumes:
  143. # - name: traefik-data
  144. # persistentVolumeClaim:
  145. # claimName: traefik-data
  146. ###############################
  147. # Service
  148. ###############################
  149. ---
  150. apiVersion: v1
  151. kind: Service
  152. metadata:
  153. labels:
  154. app: traefik
  155. release: traefik
  156. name: traefik
  157. namespace: kube-system
  158. spec:
  159. externalIPs:
  160. - "10.128.0.8"
  161. externalTrafficPolicy: Cluster
  162. ports:
  163. - name: web
  164. port: 80
  165. protocol: TCP
  166. targetPort: 80
  167. - name: websecure
  168. port: 443
  169. protocol: TCP
  170. targetPort: 443
  171. - name: admin
  172. port: 8100
  173. protocol: TCP
  174. targetPort: 8100
  175. selector:
  176. app: traefik
  177. release: traefik
  178. sessionAffinity: None
  179. type: LoadBalancer
  180. status:
  181. loadBalancer: {}
  182. #########################################################
  183. # The Middleware configuration contains middleware componenst
  184. # for a HTTP->HTTS redirection and a BasicAuth example.
  185. #########################################################
  186. ###############################
  187. # Middleware for basicAuth
  188. ###############################
  189. ---
  190. apiVersion: traefik.containo.us/v1alpha1
  191. kind: Middleware
  192. metadata:
  193. name: basic-auth
  194. spec:
  195. basicAuth:
  196. secret: authsecret
  197. ---
  198. apiVersion: v1
  199. kind: Secret
  200. metadata:
  201. name: authsecret
  202. namespace: default
  203. #------------ Paste your own password file content here (default user/password=admin/adminadmin)--------------
  204. data:
  205. users: |2
  206. YWRtaW46JGFwcjEkWXdmLkF6Um0kc3owTkpQMi55cy56V2svek43aENtLwoKdXNl
  207. cjokYXByMSRaU2VKQW1pOSRVV1AvcDdsQy9KSzdrbXBIMXdGL28uCgo=
  208. ###############################
  209. # Middleware for HTTP->HTTPS
  210. # This middleware is not needed in case of:
  211. # entrypoints.web.http.redirections.entryPoint.to=websecure
  212. ###############################
  213. #---
  214. #apiVersion: traefik.containo.us/v1alpha1
  215. #kind: Middleware
  216. #metadata:
  217. # name: https-redirect
  218. #spec:
  219. # redirectScheme:
  220. # scheme: https
  221. # permanent: true
  222. # #port: 443
  223. ###############################
  224. # Middleware for CORS
  225. ###############################
  226. ---
  227. apiVersion: traefik.containo.us/v1alpha1
  228. kind: Middleware
  229. metadata:
  230. name: cors-all
  231. spec:
  232. headers:
  233. accessControlAllowMethods:
  234. - "GET"
  235. - "OPTIONS"
  236. - "PUT"
  237. - "POST"
  238. accessControlAllowOriginList:
  239. - "origin-list-or-null"
  240. accessControlMaxAge: 100
  241. accessControlAllowHeaders:
  242. - "Content-Type"
  243. addVaryHeader: true
  244. customRequestHeaders:
  245. X-Forwarded-Proto: "https"