020-deployment.yaml 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264
  1. ###############################
  2. # ServiceAccount
  3. ###############################
  4. ---
  5. apiVersion: v1
  6. kind: ServiceAccount
  7. metadata:
  8. name: traefik
  9. namespace: kube-system
  10. ---
  11. apiVersion: v1
  12. kind: Secret
  13. metadata:
  14. name: google-crendential
  15. labels:
  16. name: google-crendential
  17. namespace: kube-system
  18. type: Opaque
  19. data:
  20. gcloud-credentials.json: "ewogICJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsCiAgInByb2plY3RfaWQiOiAibXlyb290LTI4MzYwMyIsCiAgInByaXZhdGVfa2V5X2lkIjogIjliYzkwODA4ODlmZjAxMDRiODI1ODE1ZTkwMGNjNGU0ZmVmNWNmYmQiLAogICJwcml2YXRlX2tleSI6ICItLS0tLUJFR0lOIFBSSVZBVEUgS0VZLS0tLS1cbk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ2ZxWHgzT2xtUmhyRWNcbmx2TXRnTnJ2QXdHTldSS0l0cmRPTDQ4QXFCd2xYTU9KYldyVURScWw2RHE5QTlZekVlWGRia0dVSm9UWDdSR2hcbnFqc2dHWjRtRWR3aWkybVpJNHIxajEwOXdUeGVBMkIwNjRlSXR6TXlGWGMrVXk1a3N5S3BzVWxHczBqWWdPUjVcbnY0QkE0NTBYZTBMYk9BWi8yMmhNNGRSNGRnRXcyNnBqMUVYMEc2d0lEaS8zM0dVYjAyZTRTbTRLNWU0T3VHSWVcblRzVHZzc2I3aHF1VzlsZ2VpZERPd3hYcXlIdHAzWFVENjJLK2ZZV2ZZYmhWbXhlWkFRK1NTaGpFSFArT0s1SUdcbkpJVmd3eEwvaTdaby82dnZyYytZRXlFMnF1eWNlZXRnQjJqUWorQllwYVYyWEphNWdOUHFGYWFpZStWeDBhN0NcbnJHRnlpYTUvQWdNQkFBRUNnZ0VBQS96RkxmMnFXWTNxbGlWOEZQZEV0MUtITHE1ZThFU094TkdJckFiUDZiVStcbjhPYjVwZUU1NW02SEJaVWt6ZVRaaU9wT2JVQlZCQ0pZaTZwVTFhNkppQ1VCd1dnK3hab3FXaDJkZUtoYVdiNGtcbnRCMnNBZHFBUnZUdC8wem1ndjlOdCtIRWxTVktoZ05qTVZvTTJjamVsaktLU25peDNXNG1WUjAwL3hBRWlIUHdcbnRNSHAwS1VCdnlkMnJWRFduRlZlNy9qT1RRUm52WEpic3NVRlRaZ2lXUG5EQXVhZlhsbU04ZTlQZ2lnVURtTU5cbnI4b1oxNlNHR2N0OXZsUktZdjVJSmNDWVRXMlV5MHdKWmtBbmw1S0R0bktIdnA4dzBKZmcyTFkrdEdkTytTQStcbkpEWFBaQ3BYU251VzVLOTl2L3VMclB0cHEyLysya09SQmZ1allZOVhVUUtCZ1FEVXpXQWxQYk9qK3NyOHV3RkNcbkNKUG5iZkpnN2VSeFVHR0VJWUFWdkxRc1NYRGRKVVE0OEpabEtTZjZuWUNOMXljVkQ2aS9ENmJIemkwaW9weExcbmZjbm5ZaEk0NEk1Y3h5dy9EK3BoVlNOK1ZMRVpuZm1iNFlGQjFGN2wwV293ODBOVHB5Nnl6NU9BSzBBUVBibjVcbmUySmdUMmpuZ0lJbHpjZHg1OUFjNHVndGlRS0JnUURBRXBkNSt3Z1hJYWNFU0N2S0hoYUdGMDRGUnBjTjJWYWVcbitvY0phMDBXUS9SdEI5RnpndnZvOGcwRUphTzY5UTR0UjN0WER6S2QvbHc2bTFQRjJhUkpsb0d4SkFuOHFtYU9cbjNmRUNnU05wdEgyNEV2dWFzUXU2WWlKTmNCREVoK0xrc2R3OGxvNTdRNVRJVXhrUG1DU2duTm5IeC9VbEhHTjFcbmJ6YVlFMnJCeHdLQmdRREFHOWdjUnFPUithcWVsY1FBOVBWeERCU3Y1Sk5DcUtvZ09vNERFYVFtQnZiWTdmZTBcbjM1MG1IZzExZGhMRCtlUFNZNXlYUDIzMUd2QXNRRmlRM2pJVHJMbCtsMXB0NzNER1RYdnQrb3BjVmVDN201M25cblY2RDA2Ti95NFNiWW9nTzUxVWVYTFVXZmcyd0dQWE5UQWt4QlhlNzZiMDBQQzhKdDFqUk9uNW15NFFLQmdBVkJcbi9RZUh5YWJvY3V2NUZjbkluUkU2bmhZaTRvdXNnV1NFc3lHYzRGVlZzdUV4TDVpYjQwMXpJc3dVUTdFZ2VDemhcbklnMDJDMHFyNWRaczNoUXlhdjdnc2RncGhtUjJQYXgzZ3R0d3NZbDVPVi9LbFR5YzBCZGdERlJXVnY4cVFSbkZcbmpLUFQ4ejZJa1JBU3hrTFpCVmVvTTRYMmdVMXN3NFE1Y1NNa2xPMk5Bb0dCQUlMbTNkVXoxSk5lS1RDeDBMdVVcbkVoaWJNTTJZY0k3VEdzdlBMUzFSTWlGMW1QS2lNL0RRbU1HeTdOUjZ5THE0dnJYZ2VLS2dEUXlMUUtCaklJYVlcbkpaVS9SdXdxVVN0SVp6MTBIa09GOHB2UEtOYWdkVDlLU1hjUnJjUVZLTWFTVlo4Wno2T2hXSUVjd093MXh6NHBcbitlSG41ZkFKdUNYSnpHR3JBd1lhNXVnZVxuLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLVxuIiwKICAiY2xpZW50X2VtYWlsIjogInRyYWVmaWtAbXlyb290LTI4MzYwMy5pYW0uZ3NlcnZpY2VhY2NvdW50LmNvbSIsCiAgImNsaWVudF9pZCI6ICIxMDM1MDEzNzgwMDg2ODQ1MjIwNjkiLAogICJhdXRoX3VyaSI6ICJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20vby9vYXV0aDIvYXV0aCIsCiAgInRva2VuX3VyaSI6ICJodHRwczovL29hdXRoMi5nb29nbGVhcGlzLmNvbS90b2tlbiIsCiAgImF1dGhfcHJvdmlkZXJfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9vYXV0aDIvdjEvY2VydHMiLAogICJjbGllbnRfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9yb2JvdC92MS9tZXRhZGF0YS94NTA5L3RyYWVmaWslNDBteXJvb3QtMjgzNjAzLmlhbS5nc2VydmljZWFjY291bnQuY29tIgp9Cgo="
  21. ###############################
  22. # Deployment
  23. ###############################
  24. ---
  25. apiVersion: apps/v1
  26. kind: Deployment
  27. metadata:
  28. labels:
  29. app: traefik
  30. release: traefik
  31. name: traefik
  32. namespace: kube-system
  33. spec:
  34. replicas: 1
  35. selector:
  36. matchLabels:
  37. app: traefik
  38. release: traefik
  39. template:
  40. metadata:
  41. labels:
  42. app: traefik
  43. release: traefik
  44. spec:
  45. volumes:
  46. - name: google-crendential
  47. secret:
  48. secretName: google-crendential
  49. containers:
  50. - args:
  51. - --api
  52. #- --api.insecure=true
  53. # Set insecure to fals to enable basic auth
  54. - --api.insecure=false
  55. - --api.dashboard=true
  56. - --accesslog
  57. - --global.checknewversion=true
  58. - --entryPoints.traefik.address=:8100
  59. - --entryPoints.web.address=:80
  60. - --entryPoints.websecure.address=:443
  61. # permanent redirecting of all requests on http (80) to https (443)
  62. - --entrypoints.web.http.redirections.entryPoint.to=websecure
  63. - --entrypoints.websecure.http.tls.certResolver=default
  64. - --entrypoints.websecure.http.tls.domains[0].main=k8s.eugeniocarvalho.dev
  65. - --entrypoints.websecure.http.tls.domains[0].sans=*.k8s.eugeniocarvalho.dev
  66. #- --entrypoints.websecure.http.tls.certResolver=letsencrypt
  67. # Let's Encrypt Configurtion:
  68. # Please note that this is the staging Let's Encrypt server configuration.
  69. # Once you get things working, you should remove that following line.
  70. - --certificatesresolvers.default.acme.email=eugeniucarvalho@gmail.com
  71. - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
  72. - --certificatesresolvers.default.acme.storage=acme.json
  73. # - --certificatesresolvers.default.acme.tlschallenge=true
  74. - --certificatesresolvers.default.acme.dnsChallenge.provider=gcloud
  75. - --certificatesresolvers.default.acme.dnschallenge.delaybeforecheck=0
  76. - --certificatesresolvers.default.acme.dnsChallenge.resolvers=1.1.1.1:53,8.8.8.8:53
  77. # - --certificatesresolvers.default.acme.dnsChallenge.entryPoint=http
  78. - --ping=true
  79. - --providers.kubernetescrd=true
  80. - --providers.kubernetesingress=true
  81. # Use log level= INFO or DEBUG
  82. - --log.level=INFO
  83. image: traefik:2.2.1
  84. env:
  85. - name: GCE_PROJECT
  86. value: "myroot-283603"
  87. # - name: GCE_SERVICE_ACCOUNT
  88. # value: "traefik@myroot-283603.iam.gserviceaccount.com"
  89. - name: GCE_SERVICE_ACCOUNT_FILE
  90. value: /secrets/gcloud-credentials.json
  91. volumeMounts:
  92. - mountPath: /secrets
  93. name: google-crendential
  94. imagePullPolicy: IfNotPresent
  95. livenessProbe:
  96. failureThreshold: 3
  97. httpGet:
  98. path: /ping
  99. port: 8100
  100. scheme: HTTP
  101. initialDelaySeconds: 10
  102. periodSeconds: 10
  103. successThreshold: 1
  104. timeoutSeconds: 2
  105. name: traefik
  106. ports:
  107. - containerPort: 8100
  108. name: admin
  109. protocol: TCP
  110. - containerPort: 80
  111. name: web
  112. protocol: TCP
  113. - containerPort: 443
  114. name: websecure
  115. protocol: TCP
  116. # optional storage
  117. # enable this option only in case you have defined a persistence volume claim
  118. #volumeMounts:
  119. #- name: traefik-data
  120. # mountPath: /var/lib/traefik
  121. readinessProbe:
  122. failureThreshold: 1
  123. httpGet:
  124. path: /ping
  125. port: 8100
  126. scheme: HTTP
  127. initialDelaySeconds: 10
  128. periodSeconds: 10
  129. successThreshold: 1
  130. timeoutSeconds: 2
  131. resources: {}
  132. terminationMessagePath: /dev/termination-log
  133. terminationMessagePolicy: File
  134. dnsPolicy: ClusterFirst
  135. restartPolicy: Always
  136. schedulerName: default-scheduler
  137. securityContext: {}
  138. serviceAccount: traefik
  139. serviceAccountName: traefik
  140. terminationGracePeriodSeconds: 60
  141. # optional storage
  142. # enable this option only in case you have defined a persistence volume claim
  143. #volumes:
  144. # - name: traefik-data
  145. # persistentVolumeClaim:
  146. # claimName: traefik-data
  147. ###############################
  148. # Service
  149. ###############################
  150. ---
  151. apiVersion: v1
  152. kind: Service
  153. metadata:
  154. labels:
  155. app: traefik
  156. release: traefik
  157. name: traefik
  158. namespace: kube-system
  159. spec:
  160. externalIPs:
  161. - "10.128.0.8"
  162. externalTrafficPolicy: Cluster
  163. ports:
  164. - name: web
  165. port: 80
  166. protocol: TCP
  167. targetPort: 80
  168. - name: websecure
  169. port: 443
  170. protocol: TCP
  171. targetPort: 443
  172. - name: admin
  173. port: 8100
  174. protocol: TCP
  175. targetPort: 8100
  176. selector:
  177. app: traefik
  178. release: traefik
  179. sessionAffinity: None
  180. type: LoadBalancer
  181. status:
  182. loadBalancer: {}
  183. #########################################################
  184. # The Middleware configuration contains middleware componenst
  185. # for a HTTP->HTTS redirection and a BasicAuth example.
  186. #########################################################
  187. ###############################
  188. # Middleware for basicAuth
  189. ###############################
  190. ---
  191. apiVersion: traefik.containo.us/v1alpha1
  192. kind: Middleware
  193. metadata:
  194. name: basic-auth
  195. spec:
  196. basicAuth:
  197. secret: authsecret
  198. ---
  199. apiVersion: v1
  200. kind: Secret
  201. metadata:
  202. name: authsecret
  203. namespace: default
  204. #------------ Paste your own password file content here (default user/password=admin/adminadmin)--------------
  205. data:
  206. users: |2
  207. YWRtaW46JGFwcjEkWXdmLkF6Um0kc3owTkpQMi55cy56V2svek43aENtLwoKdXNl
  208. cjokYXByMSRaU2VKQW1pOSRVV1AvcDdsQy9KSzdrbXBIMXdGL28uCgo=
  209. ###############################
  210. # Middleware for HTTP->HTTPS
  211. # This middleware is not needed in case of:
  212. # entrypoints.web.http.redirections.entryPoint.to=websecure
  213. ###############################
  214. #---
  215. #apiVersion: traefik.containo.us/v1alpha1
  216. #kind: Middleware
  217. #metadata:
  218. # name: https-redirect
  219. #spec:
  220. # redirectScheme:
  221. # scheme: https
  222. # permanent: true
  223. # #port: 443
  224. ###############################
  225. # Middleware for CORS
  226. ###############################
  227. ---
  228. apiVersion: traefik.containo.us/v1alpha1
  229. kind: Middleware
  230. metadata:
  231. name: cors-all
  232. spec:
  233. headers:
  234. accessControlAllowMethods:
  235. - "GET"
  236. - "OPTIONS"
  237. - "PUT"
  238. - "POST"
  239. accessControlAllowOriginList:
  240. - "origin-list-or-null"
  241. accessControlMaxAge: 100
  242. accessControlAllowHeaders:
  243. - "Content-Type"
  244. addVaryHeader: true
  245. customRequestHeaders:
  246. X-Forwarded-Proto: "https"