Traefik云原生网关从入门到生产实践

前言

Traefik是一款现代化的云原生边缘路由器，原生支持Docker和Kubernetes。与Nginx不同，Traefik可以自动发现服务并动态更新配置，非常适合微服务架构。

一、Traefik vs Nginx

二、Docker快速开始

2.1 基础部署

# docker-compose.ymlversion:'3.8'services:traefik:image:traefik:v3.0container_name:traefikcommand:-"--api.dashboard=true"-"--providers.docker=true"-"--providers.docker.exposedbydefault=false"-"--entrypoints.web.address=:80"-"--entrypoints.websecure.address=:443"ports:-"80:80"-"443:443"volumes:-/var/run/docker.sock:/var/run/docker.sock:ro-./traefik:/etc/traefiknetworks:-traefik-netlabels:# Dashboard-"traefik.enable=true"-"traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"-"traefik.http.routers.dashboard.service=api@internal"-"traefik.http.routers.dashboard.middlewares=auth"-"traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xxx"networks:traefik-net:external:true

2.2 配置文件

# traefik/traefik.ymlapi:dashboard:trueinsecure:falseentryPoints:web:address:":80"http:redirections:entryPoint:to:websecurescheme:httpswebsecure:address:":443"providers:docker:endpoint:"unix:///var/run/docker.sock"exposedByDefault:falsenetwork:traefik-netfile:directory:/etc/traefik/dynamicwatch:truecertificatesResolvers:letsencrypt:acme:email:admin@example.comstorage:/etc/traefik/acme.jsonhttpChallenge:entryPoint:web

三、服务代理配置

3.1 Docker Labels方式

# 应用服务services:webapp:image:nginx:alpinelabels:-"traefik.enable=true"# 路由规则-"traefik.http.routers.webapp.rule=Host(`app.example.com`)"-"traefik.http.routers.webapp.entrypoints=websecure"-"traefik.http.routers.webapp.tls.certresolver=letsencrypt"# 服务配置-"traefik.http.services.webapp.loadbalancer.server.port=80"networks:-traefik-netapi:image:my-api:latestlabels:-"traefik.enable=true"# 路径前缀路由-"traefik.http.routers.api.rule=Host(`app.example.com`) && PathPrefix(`/api`)"-"traefik.http.routers.api.entrypoints=websecure"-"traefik.http.routers.api.tls.certresolver=letsencrypt"# 去除路径前缀-"traefik.http.routers.api.middlewares=strip-api"-"traefik.http.middlewares.strip-api.stripprefix.prefixes=/api"-"traefik.http.services.api.loadbalancer.server.port=8080"networks:-traefik-net

3.2 文件配置方式

# traefik/dynamic/services.ymlhttp:routers:external-service:rule:"Host(`external.example.com`)"entryPoints:-websecureservice:external-servicetls:certResolver:letsencryptservices:external-service:loadBalancer:servers:-url:"http://192.168.1.100:8080"-url:"http://192.168.1.101:8080"healthCheck:path:/healthinterval:10s

四、中间件配置

4.1 常用中间件

# traefik/dynamic/middlewares.ymlhttp:middlewares:# Basic认证auth-basic:basicAuth:users:-"admin:$apr1$xxx"# 速率限制rate-limit:rateLimit:average:100burst:50# 请求头secure-headers:headers:frameDeny:truesslRedirect:truebrowserXssFilter:truecontentTypeNosniff:truestsSeconds:31536000stsIncludeSubdomains:true# IP白名单ip-whitelist:ipWhiteList:sourceRange:-"10.0.0.0/8"-"192.168.0.0/16"# 重试retry:retry:attempts:3initialInterval:100ms# 压缩compress:compress:{}# 熔断circuit-breaker:circuitBreaker:expression:"NetworkErrorRatio() > 0.5 || ResponseCodeRatio(500, 600, 0, 600) > 0.5"

4.2 应用中间件

# Docker Labelslabels:-"traefik.http.routers.myapp.middlewares=rate-limit,secure-headers,compress"# 文件配置http:routers:myapp:middlewares:-rate-limit-secure-headers-compress

五、负载均衡

5.1 轮询策略

http:services:my-service:loadBalancer:servers:-url:"http://server1:80"-url:"http://server2:80"-url:"http://server3:80"

5.2 加权轮询

http:services:my-service:weighted:services:-name:server1weight:3-name:server2weight:1

5.3 会话保持

http:services:my-service:loadBalancer:sticky:cookie:name:server_idsecure:truehttpOnly:true

六、Kubernetes集成

6.1 Helm安装

helm repoaddtraefik https://traefik.github.io/charts helm repo update helminstalltraefik traefik/traefik -n traefik --create-namespace

6.2 IngressRoute配置

apiVersion:traefik.io/v1alpha1kind:IngressRoutemetadata:name:webappnamespace:defaultspec:entryPoints:-websecureroutes:-match:Host(`app.example.com`)kind:Ruleservices:-name:webappport:80middlewares:-name:rate-limittls:certResolver:letsencrypt---apiVersion:traefik.io/v1alpha1kind:Middlewaremetadata:name:rate-limitspec:rateLimit:average:100burst:50

七、多站点代理

7.1 跨网络服务代理

当需要代理不同网络中的服务时，传统方式需要公网IP或VPN。使用组网软件（如星空组网）可以将多个站点组成虚拟局域网：

# traefik/dynamic/multi-site.ymlhttp:routers:beijing-api:rule:"Host(`api.example.com`) && PathPrefix(`/beijing`)"service:beijing-apishanghai-api:rule:"Host(`api.example.com`) && PathPrefix(`/shanghai`)"service:shanghai-apiservices:# 北京站点服务（通过虚拟内网访问）beijing-api:loadBalancer:servers:-url:"http://10.26.0.10:8080"# 上海站点服务（通过虚拟内网访问）shanghai-api:loadBalancer:servers:-url:"http://10.26.0.20:8080"

八、监控与日志

8.1 Prometheus指标

# traefik.ymlmetrics:prometheus:addEntryPointsLabels:trueaddServicesLabels:truebuckets:-0.1-0.3-1.2-5.0

8.2 访问日志

accessLog:filePath:"/var/log/traefik/access.log"format:jsonfilters:statusCodes:-"400-499"-"500-599"retryAttempts:trueminDuration:"10ms"

8.3 Grafana Dashboard

导入Dashboard ID:17346（Traefik官方Dashboard）

九、生产配置示例

# docker-compose-production.ymlversion:'3.8'services:traefik:image:traefik:v3.0container_name:traefikrestart:unless-stoppedsecurity_opt:-no-new-privileges:trueports:-"80:80"-"443:443"volumes:-/var/run/docker.sock:/var/run/docker.sock:ro-./traefik:/etc/traefik-./logs:/var/log/traefikenvironment:-TZ=Asia/Shanghainetworks:-traefik-nethealthcheck:test:["CMD","traefik","healthcheck"]interval:30stimeout:3sretries:3deploy:resources:limits:memory:512Mnetworks:traefik-net:driver:bridge

十、总结

Traefik是云原生时代的优秀网关选择：

适用场景：

• 微服务架构
• Docker/Kubernetes环境
• 需要自动SSL的场景
• 频繁变更的服务配置

参考资料

1. Traefik官方文档：https://doc.traefik.io/traefik/
2. Traefik GitHub：https://github.com/traefik/traefik
3. Let’s Encrypt配置：https://doc.traefik.io/traefik/https/acme/

本文首发于CSDN，转载请注明出处。