lukaszraczylo · April 9, 2023 01:40
diff --git a/0_traefik_mirror_lab.md b/0_traefik_mirror_lab.md
diff --git a/blue.helm-values.yaml b/blue.helm-values.yaml
 # helm values for blue's install
 # helm upgrade --install podinfo oci://ghcr.io/stefanprodan/charts/podinfo --values=blue.helm-values.yaml --namespace blue --create-namespace=true
 ---
 replicaCount: 1
 logLevel: info
 ui:
  color: "#0000FF" # blue
  message: "Greetings from blue app!"

 redis:
  enabled: true

 ingress:
  enabled: true
  className: "traefik"
  hosts:
  - host: blue.neoakris.dev
    paths:
    - path: /
      pathType: ImplementationSpecific
diff --git a/green-with-traffic-mirroring-to-blue.yaml b/green-with-traffic-mirroring-to-blue.yaml
 # https://doc.traefik.io/traefik/routing/providers/kubernetes-crd/#kind-ingressroute
 # mentions TraefikService CR is for mirroring
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: mirror
 ---
 # In this example
 # green will represent production (intended live)
 # blue will represent staging (work in progress / future version)
 # For traefik mirror:
 # traffic will go to primary route of green AND green will respond to client
 # traffic will be mirrored to blue AND blue will not respond to client as this is the nature of a mirror / helps test safely
 apiVersion: v1
 kind: Service
 metadata:
  name: primary-route
  namespace: mirror
 spec:
  type: ExternalName #v-- ExternalName must use FQDN 
  externalName: podinfo.green.svc.cluster.local #Comes from Kubernetes inner cluster DNS convention of $SERVICE_NAME.$NAMESPACE_NAME.svc.cluster.local
 # ports are purposefully missing as externalName doesn't respect their config, it's the service externalName points to that decides port
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: mirror-route
  namespace: mirror
 spec:
  type: ExternalName #v-- ExternalName must use FQDN
  externalName: podinfo.blue.svc.cluster.local #Comes from Kubernetes inner cluster DNS convention of $SERVICE_NAME.$NAMESPACE_NAME.svc.cluster.local
 # ports are purposefully missing as externalName doesn't respect their config, it's the service externalName points to that decides port
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: TraefikService 
 metadata:
  name: primary-route-with-mirror
  namespace: mirror
 spec:
  mirroring:
    kind: Service # referring to a Kubernetes Service
    name: primary-route #<-- "must" reference a pre-existing object (of kind: Service) in the same namespace
    port: 9898 # Required value
    mirrors: # The mirror "might" be able to exist in an external namespace, but using ExternalName service in same namespace gives best flexibility
    - kind: Service
      name: mirror-route
      port: 9898 # Required value
      percent: 100
 # Note: traefik 2.0 CRDs are very finicky
 #       If your syntax is slightly off, or you're missing a value like a port
 #       It won't show up in traefik dashboard GUI / the config will be silently ignored
 #       It's critical you have access to that to debug this stuff.
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
  name: primary-route-with-mirror
  namespace: mirror
 spec:
  entryPoints:
  - websecure
  routes:
  - kind: Rule
    match: Host(`green-with-traffic-mirroring-to-blue.neoakris.dev`)
    services:
    - kind: TraefikService 
      name: primary-route-with-mirror
      namespace: mirror
diff --git a/green.helm-values.yaml b/green.helm-values.yaml
 # helm values for green's install
 # helm upgrade --install podinfo oci://ghcr.io/stefanprodan/charts/podinfo --values=green.helm-values.yaml --namespace green --create-namespace=true
 ---
 replicaCount: 1
 logLevel: info
 ui:
  color: "#00FF00" # green
  message: "Greetings from green app!" 

 redis:
  enabled: true

 ingress:
  enabled: true
  className: "traefik"
  hosts:
  - host: green.neoakris.dev
    paths:
    - path: /
      pathType: ImplementationSpecific
diff --git a/traefik.helm-values.yaml b/traefik.helm-values.yaml
 # helm values for traefik helm chart install
 # helm upgrade --install traefik traefik/traefik --version 21.1.0 --values=traefik.values.yaml --namespace=traefik --create-namespace=true
 # https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L492
 ---
 ingressClass: # Create a IngressClass for Traefik
  enabled: true
  isDefaultClass: true # and make it the default IngressClass
  fallbackApiVersion: v1

 ingressRoute:
  dashboard:       
    enabled: false
    # ^-- This is just disabling helm creating a traefik dashboard.
    # In a future step, I'll create it manually outside of helm's 
    # logic to gain more control over the configuration.
    # Mine will be exposed to the internet, but protected by
    # authentication via a username and password.

 service:
  annotations: # EKS / Kube on AWS config for L4 LB -----v
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"

 ports:
  web:
    redirectTo: websecure #Helps make an error message more obvious
    # Context:
    # curl green-with-traffic-mirroring-to-blue.neoakris.dev
    # shorthand for curl http://green-with-traffic-mirroring-to-blue.neoakris.dev
    # now gives "Moved Permanently" when before it gave 404 not found
    # which was a little confusing as the web browser worked
    # curl https://green-with-traffic-mirroring-to-blue.neoakris.dev also worked

 providers:
  kubernetesCRD: # https://doc.traefik.io/traefik/providers/kubernetes-crd/#provider-configuration
    allowCrossNamespace: true # IngressRoute resources able to reference other namespaces
    allowExternalNameServices: true # another variation of cross namespace reference
    allowEmptyServices: true # helps iteratively debug non-working configuration
  kubernetesIngress:
    enabled: true 
    allowExternalNameServices: true # makes cross namespace routing easier
    allowEmptyServices: true # helps iteratively debug non-working configuration
    # Note: If you do iterative debugging with allow empty on. traefik's
    #       dashboard won't clean up deleted CRDs until the traefik pods
    #       get rebooted so if the GUI of the traefik dashboard looks 
    #       off consider deleteing / rebooting the traefik pods.

 rbac:
  enabled: true
  namespaced: false # works clusterwide
diff --git a/traefik_dashboard_and_default_tls.yaml b/traefik_dashboard_and_default_tls.yaml
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  name: basic-auth-creds
  namespace: traefik
 type: kubernetes.io/basic-auth
 stringData: # v-- generated using 'head -c 100 /dev/urandom | base64 | head -c 30'
  username: et9B6fBZUYeDOmzvukiquYw5KrCqKy
  password: QREqS/DVPF6dye3/FE30UCS8S5pwID
 # ^-- You'd want this to be secret / not posted on the public internet
 #     I'm sharing a randomly generated secret of a throwaway sandbox environment
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
  name: basic-auth
  namespace: traefik
 spec:
  basicAuth:
    secret: basic-auth-creds
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
  name: dashboard
  namespace: traefik
 spec:
 # spec.entryPoints full list is available here --> https://doc.traefik.io/traefik/routing/routers/#entrypoints
 # web = port 80
 # websecure = port 443
  entryPoints:
  - websecure
  routes:
  - kind: Rule #Rule says dashboard reachable from https://dashboard.neoakris.dev using basic-auth
    match: Host(`dashboard.neoakris.dev`)
    services:
    - name: api@internal    #Referring to a built-in implicit default value that exists in
      kind: TraefikService  #traefik's dashboard, not a Kube Custom Resource of type TraefikService
    middlewares:
    - name: basic-auth
      namespace: traefik
 ---
 # v-- This Traefik Custom Resource tells traefik about our wildcard cert and says use as default
 apiVersion: traefik.containo.us/v1alpha1
 kind: TLSStore
 metadata:
  name: default
  namespace: traefik
 spec:
  certificates: 
  - secretName: https-wildcard-cert # kube tls secrets existing in the same namespace
  defaultCertificate:
    secretName: https-wildcard-cert
 ---
	# helm values for blue's install
	# helm upgrade --install podinfo oci://ghcr.io/stefanprodan/charts/podinfo --values=blue.helm-values.yaml --namespace blue --create-namespace=true
	---
	replicaCount: 1
	logLevel: info
	ui:
	color: "#0000FF" # blue
	message: "Greetings from blue app!"

	redis:
	enabled: true

	ingress:
	enabled: true
	className: "traefik"
	hosts:
	- host: blue.neoakris.dev
	paths:
	- path: /
	pathType: ImplementationSpecific
	# https://doc.traefik.io/traefik/routing/providers/kubernetes-crd/#kind-ingressroute
	# mentions TraefikService CR is for mirroring
	---
	apiVersion: v1
	kind: Namespace
	metadata:
	name: mirror
	---
	# In this example
	# green will represent production (intended live)
	# blue will represent staging (work in progress / future version)
	# For traefik mirror:
	# traffic will go to primary route of green AND green will respond to client
	# traffic will be mirrored to blue AND blue will not respond to client as this is the nature of a mirror / helps test safely
	apiVersion: v1
	kind: Service
	metadata:
	name: primary-route
	namespace: mirror
	spec:
	type: ExternalName #v-- ExternalName must use FQDN
	externalName: podinfo.green.svc.cluster.local #Comes from Kubernetes inner cluster DNS convention of $SERVICE_NAME.$NAMESPACE_NAME.svc.cluster.local
	# ports are purposefully missing as externalName doesn't respect their config, it's the service externalName points to that decides port
	---
	apiVersion: v1
	kind: Service
	metadata:
	name: mirror-route
	namespace: mirror
	spec:
	type: ExternalName #v-- ExternalName must use FQDN
	externalName: podinfo.blue.svc.cluster.local #Comes from Kubernetes inner cluster DNS convention of $SERVICE_NAME.$NAMESPACE_NAME.svc.cluster.local
	# ports are purposefully missing as externalName doesn't respect their config, it's the service externalName points to that decides port
	---
	apiVersion: traefik.containo.us/v1alpha1
	kind: TraefikService
	metadata:
	name: primary-route-with-mirror
	namespace: mirror
	spec:
	mirroring:
	kind: Service # referring to a Kubernetes Service
	name: primary-route #<-- "must" reference a pre-existing object (of kind: Service) in the same namespace
	port: 9898 # Required value
	mirrors: # The mirror "might" be able to exist in an external namespace, but using ExternalName service in same namespace gives best flexibility
	- kind: Service
	name: mirror-route
	port: 9898 # Required value
	percent: 100
	# Note: traefik 2.0 CRDs are very finicky
	# If your syntax is slightly off, or you're missing a value like a port
	# It won't show up in traefik dashboard GUI / the config will be silently ignored
	# It's critical you have access to that to debug this stuff.
	---
	apiVersion: traefik.containo.us/v1alpha1
	kind: IngressRoute
	metadata:
	name: primary-route-with-mirror
	namespace: mirror
	spec:
	entryPoints:
	- websecure
	routes:
	- kind: Rule
	match: Host(`green-with-traffic-mirroring-to-blue.neoakris.dev`)
	services:
	- kind: TraefikService
	name: primary-route-with-mirror
	namespace: mirror
	# helm values for green's install
	# helm upgrade --install podinfo oci://ghcr.io/stefanprodan/charts/podinfo --values=green.helm-values.yaml --namespace green --create-namespace=true
	---
	replicaCount: 1
	logLevel: info
	ui:
	color: "#00FF00" # green
	message: "Greetings from green app!"

	redis:
	enabled: true

	ingress:
	enabled: true
	className: "traefik"
	hosts:
	- host: green.neoakris.dev
	paths:
	- path: /
	pathType: ImplementationSpecific
	# helm values for traefik helm chart install
	# helm upgrade --install traefik traefik/traefik --version 21.1.0 --values=traefik.values.yaml --namespace=traefik --create-namespace=true
	# https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L492
	---
	ingressClass: # Create a IngressClass for Traefik
	enabled: true
	isDefaultClass: true # and make it the default IngressClass
	fallbackApiVersion: v1

	ingressRoute:
	dashboard:
	enabled: false
	# ^-- This is just disabling helm creating a traefik dashboard.
	# In a future step, I'll create it manually outside of helm's
	# logic to gain more control over the configuration.
	# Mine will be exposed to the internet, but protected by
	# authentication via a username and password.

	service:
	annotations: # EKS / Kube on AWS config for L4 LB -----v
	service.beta.kubernetes.io/aws-load-balancer-type: "nlb"

	ports:
	web:
	redirectTo: websecure #Helps make an error message more obvious
	# Context:
	# curl green-with-traffic-mirroring-to-blue.neoakris.dev
	# shorthand for curl http://green-with-traffic-mirroring-to-blue.neoakris.dev
	# now gives "Moved Permanently" when before it gave 404 not found
	# which was a little confusing as the web browser worked
	# curl https://green-with-traffic-mirroring-to-blue.neoakris.dev also worked

	providers:
	kubernetesCRD: # https://doc.traefik.io/traefik/providers/kubernetes-crd/#provider-configuration
	allowCrossNamespace: true # IngressRoute resources able to reference other namespaces
	allowExternalNameServices: true # another variation of cross namespace reference
	allowEmptyServices: true # helps iteratively debug non-working configuration
	kubernetesIngress:
	enabled: true
	allowExternalNameServices: true # makes cross namespace routing easier
	allowEmptyServices: true # helps iteratively debug non-working configuration
	# Note: If you do iterative debugging with allow empty on. traefik's
	# dashboard won't clean up deleted CRDs until the traefik pods
	# get rebooted so if the GUI of the traefik dashboard looks
	# off consider deleteing / rebooting the traefik pods.

	rbac:
	enabled: true
	namespaced: false # works clusterwide
	---
	apiVersion: v1
	kind: Secret
	metadata:
	name: basic-auth-creds
	namespace: traefik
	type: kubernetes.io/basic-auth
	stringData: # v-- generated using 'head -c 100 /dev/urandom \| base64 \| head -c 30'
	username: et9B6fBZUYeDOmzvukiquYw5KrCqKy
	password: QREqS/DVPF6dye3/FE30UCS8S5pwID
	# ^-- You'd want this to be secret / not posted on the public internet
	# I'm sharing a randomly generated secret of a throwaway sandbox environment
	---
	apiVersion: traefik.containo.us/v1alpha1
	kind: Middleware
	metadata:
	name: basic-auth
	namespace: traefik
	spec:
	basicAuth:
	secret: basic-auth-creds
	---
	apiVersion: traefik.containo.us/v1alpha1
	kind: IngressRoute
	metadata:
	name: dashboard
	namespace: traefik
	spec:
	# spec.entryPoints full list is available here --> https://doc.traefik.io/traefik/routing/routers/#entrypoints
	# web = port 80
	# websecure = port 443
	entryPoints:
	- websecure
	routes:
	- kind: Rule #Rule says dashboard reachable from https://dashboard.neoakris.dev using basic-auth
	match: Host(`dashboard.neoakris.dev`)
	services:
	- name: api@internal #Referring to a built-in implicit default value that exists in
	kind: TraefikService #traefik's dashboard, not a Kube Custom Resource of type TraefikService
	middlewares:
	- name: basic-auth
	namespace: traefik
	---
	# v-- This Traefik Custom Resource tells traefik about our wildcard cert and says use as default
	apiVersion: traefik.containo.us/v1alpha1
	kind: TLSStore
	metadata:
	name: default
	namespace: traefik
	spec:
	certificates:
	- secretName: https-wildcard-cert # kube tls secrets existing in the same namespace
	defaultCertificate:
	secretName: https-wildcard-cert
	---