Traefik 面试题

K8s Provider ← Watch Ingress/CRD 资源 → Traefik 动态配置
Docker Provider ← Watch 容器 Labels
File Provider ← 监听配置文件变更
Consul/etcd Provider ← Watch KV 存储

# Traefik 监听到 Pod/Service 变更后自动更新路由
providers:
  kubernetesCRD: true
  kubernetesIngress:
    enabled: true
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: api-route
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`api.example.com`) && PathPrefix(`/v1`)
    kind: Rule
    services:
    - name: api-svc
      port: 8080

K8s 创建 Service + Pod → Traefik 通过 K8s API Watch
  → 自动生成路由配置 → 热加载到路由表
  → 外部请求 → Traefik → 新后端 Pod
  → Pod 删除时自动摘除

# Docker Compose Labels 自动注册
services:
  web:
    image: nginx
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web.rule=Host(`app.localhost`)"
      - "traefik.http.services.web.loadbalancer.server.port=80"

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
spec:
  headers:
    customFrameOptionsValue: "DENY"
    contentTypeNosniff: true
    browserXssFilter: true
    referrerPolicy: "strict-origin-when-cross-origin"
    permissionsPolicy: "camera=(), microphone=()"
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: secure-api
spec:
  entryPoints:
  - websecure
  routes:
  - match: Host(`api.example.com`)
    kind: Rule
    middlewares:
    - name: security-headers    # 中间件串联
    - name: rate-limit
    - name: auth
    services:
    - name: api-svc
      port: 8080

请求 → Middleware-1 → Middleware-2 → Middleware-3 → Service

# 静态配置
certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@example.com
      storage: /acme/acme.json
      httpChallenge:
        entryPoint: web  # 使用 HTTP-01 挑战
# IngressRoute 引用证书解析器
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: tls-app
spec:
  entryPoints:
  - websecure
  routes:
  - match: Host(`app.example.com`)
    kind: Rule
    services:
    - name: app-svc
      port: 80
  tls:
    certResolver: letsencrypt

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mysql-tcp
spec:
  entryPoints:
  - mysql
  routes:
  - match: HostSNI(`*`)
    services:
    - name: mysql-svc
      port: 3306
# EntryPoint 需要事先定义
entryPoints:
  mysql:
    address: ":3306"

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: dns-udp
spec:
  entryPoints:
  - dns
  routes:
  - services:
    - name: coredns-svc
      port: 53
entryPoints:
  dns:
    address: ":53/udp"

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: app-routing
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`app.example.com`)
    kind: Rule
    services:
    - name: app-blue-svc
      port: 80
      weight: 90    # 90% 流量到蓝
    - name: app-green-svc
      port: 80
      weight: 10    # 10% 流量到绿

spec:
  routes:
  - match: Host(`app.example.com`) && Headers(`X-Canary`, `true`)
    services:
    - name: app-canary-svc
      port: 80
  - match: Host(`app.example.com`)
    services:
    - name: app-stable-svc
      port: 80

# 启用 Dashboard
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: dashboard
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`traefik.example.com`)
    kind: Rule
    services:
    - name: api@internal  # 内置 API
      kind: TraefikService
# 静态配置启用
api:
  dashboard: true
  debug: true

metrics:
  prometheus:
    addEntryPointsLabels: true
    addServicesLabels: true
    addRoutersLabels: true
# ServiceMonitor
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
spec:
  endpoints:
  - port: metrics
    path: /metrics

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: cb-config
spec:
  circuitBreaker:
    expression: "NetworkErrorRatio() > 0.5 || LatencyAtQuantileMS(50) > 100"
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: resilient-api
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`api.example.com`)
    middlewares:
    - name: cb-config
    services:
    - name: api-svc
      port: 8080

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
spec:
  rateLimit:
    period: "1m"         # 时间窗口
    average: 100         # 平均速率
    burst: 50            # 突发允许
    sourceCriterion:
      ipStrategy:
        depth: 1         # 使用 X-Forwarded-For 深度
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: limited-api
spec:
  entryPoints:
  - web
  routes:
  - kind: Rule
    match: Host(`api.example.com`)
    middlewares:
    - name: rate-limit
    services:
    - name: api-svc
      port: 8080

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: cors
spec:
  headers:
    accessControlAllowOriginList:
    - "https://app.example.com"
    - "https://admin.example.com"
    accessControlAllowHeaders:
    - "Authorization"
    - "Content-Type"
    accessControlAllowMethods:
    - "GET"
    - "POST"
    - "PUT"
    - "DELETE"
    accessControlAllowCredentials: true
    accessControlMaxAge: 86400

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: basic-auth
spec:
  basicAuth:
    secret: auth-secret  # 包含 users 字段的 Secret
apiVersion: v1
kind: Secret
metadata:
  name: auth-secret
data:
  users: |
    $(echo -n "admin:$apr1$xxxxx" | base64)    

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: forward-auth
spec:
  forwardAuth:
    address: "https://auth.example.com/verify"
    trustForwardHeader: true
    authResponseHeaders:
    - X-Auth-User
    - X-Auth-Role
    tls:
      ca: "/certs/ca.pem"
    authRequestHeaders:
    - "Authorization"

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: ip-whitelist
spec:
  ipWhiteList:
    sourceRange:
    - "10.0.0.0/8"
    - "192.168.0.0/16"
    ipStrategy:
      depth: 2
      excludedIPs:
      - "10.0.0.1"

# HTTP → HTTPS 重定向
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
spec:
  redirectScheme:
    scheme: https
    port: 443
# 路径前缀重写
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-prefix
spec:
  stripPrefix:
    prefixes:
    - "/api"
# 正则重写
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: replace-path
spec:
  replacePathRegex:
    regex: "^/api/v1/(.*)"
    replacement: "/v1/$1"

# 直接路由到 WebSocket 后端
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ws-route
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`ws.example.com`)
    services:
    - name: websocket-svc
      port: 8080
    serversTransport: websocket-transport
apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: websocket-transport
spec:
  forwardHeaders: true
  insecureSkipVerify: false

# 静态或动态配置
serversTransports:
  websocket:
    forwardHeaders: true
    maxIdleConnsPerHost: 200
    disableHTTP2: false

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: grpc-route
spec:
  entryPoints:
  - websecure
  routes:
  - kind: Rule
    match: Host(`grpc.example.com`)
    services:
    - name: grpc-svc
      port: 50051
      scheme: h2c  # HTTP/2 Cleartext
  tls:
    certResolver: letsencrypt

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: custom-errors
spec:
  errors:
    status:
    - "404"
    - "503"
    service:
      name: error-pages-svc
      port: 80
    query: "/{status}.html"

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: buffer
spec:
  buffering:
    maxRequestBodyBytes: 10485760     # 10MB
    memRequestBodyBytes: 2097152      # 2MB 内存缓冲
    maxResponseBodyBytes: 10485760
    memResponseBodyBytes: 2097152

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: mirror-api
spec:
  entryPoints:
  - web
  routes:
  - kind: Rule
    match: Host(`api.example.com`)
    services:
    - name: api-prod
      port: 8080
    mirroring:
      name: api-mirror
      percent: 10
      mirrors:
      - name: api-staging
        port: 8080

// plugin 开发示例
package middleware

import (
    "net/http"
)

type CustomMiddleware struct {
    next http.Handler
    name string
}

func New(ctx context.Context, next http.Handler, config *Config) (http.Handler, error) {
    return &CustomMiddleware{next: next, name: config.Name}, nil
}

func (a *CustomMiddleware) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
    req.Header.Set("X-Custom", a.name)
    a.next.ServeHTTP(rw, req)
}

# 静态配置
experimental:
  plugins:
    my-custom:
      moduleName: github.com/example/my-custom
      version: v0.1.0

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: sticky-api
spec:
  weighted:
    services:
    - name: api-svc
      port: 8080
      sticky:
        cookie:
          name: _affinity
          secure: true
          httpOnly: true
          sameSite: lax

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: upload-buffer
spec:
  buffering:
    maxRequestBodyBytes: 0             # 不限制
    memRequestBodyBytes: 4194304       # 4MB 内存缓冲
  headers:
    customRequestHeaders:
      X-Upload-Size: "10000000000"

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: health-api
spec:
  entryPoints:
  - web
  routes:
  - kind: Rule
    match: Host(`api.example.com`)
    services:
    - name: api-svc
      port: 8080
      healthCheck:
        path: "/healthz"
        interval: "10s"
        timeout: "3s"
        healthyThreshold: 2
        unhealthyThreshold: 3

# 动态自动匹配
tls:
  stores:
    default:
      defaultCertificate:
        secretName: wildcard-example
  certificates:
  - secretName: app-example
  - secretName: admin-example
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: sni-route
spec:
  entryPoints:
  - websecure
  routes:
  - match: Host(`app.example.com`)
    services:
    - name: app-svc
      port: 80
  tls:
    domains:
    - main: example.com
      sans:
      - "*.example.com"

# traefik.yaml
entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
providers:
  kubernetesCRD:
    enabled: true
  kubernetesIngress:
    enabled: true

providers:
  # K8s Provider（主配置来源）
  kubernetesCRD:
    enabled: true
    namespaces:
    - default
    - production
  
  # 文件 Provider（补充配置）
  file:
    filename: /dynamic/traefik-dynamic.yaml
    watch: true
  
  # Consul Provider
  consul:
    rootKey: traefik
    endpoints:
    - consul:8500
  
  # Docker Provider
  docker:
    endpoint: unix:///var/run/docker.sock
    exposedByDefault: false

# 检查 Traefik 进程
kubectl logs -l app=traefik --tail=100

# 查看动态配置
traefik health --ping
traefik api --insecure --server localhost:8080/api/rawdata

# 查看路由表
curl -s http://localhost:8080/api/http/routers | jq .
curl -s http://localhost:8080/api/http/services | jq .

# 查看证书
curl -s http://localhost:8080/api/tls/certificates | jq .

# 配置 dump
traefik debug --dump

# 调试日志
# 静态配置开启
log:
  level: DEBUG
  filePath: /var/log/traefik/traefik.log