add ServersTransport on services
This commit is contained in:
Julien Salleyron
GitHub
parent
6075f7e8fd
commit
76f42a3013
64 changed files with 2359 additions and 242 deletions
|
|
@ -1488,9 +1488,9 @@ or referencing TLS stores in the [`IngressRoute`](#kind-ingressroute) / [`Ingres
|
|||
secretName: mySecret # [1]
|
||||
```
|
||||
|
||||
| Ref | Attribute | Purpose |
|
||||
|-----|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| [1] | `secretName` | The name of the referenced Kubernetes [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) that holds the default certificate for the store. |
|
||||
| Ref | Attribute | Purpose |
|
||||
|-----|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| [1] | `secretName` | The name of the referenced Kubernetes [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) that holds the default certificate for the store. |
|
||||
|
||||
??? example "Declaring and referencing a TLSStore"
|
||||
|
||||
|
|
@ -1537,6 +1537,84 @@ or referencing TLS stores in the [`IngressRoute`](#kind-ingressroute) / [`Ingres
|
|||
tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
|
||||
```
|
||||
|
||||
### Kind: `ServersTransport`
|
||||
|
||||
`ServersTransport` is the CRD implementation of a [ServersTransport](../services/index.md#serverstransport).
|
||||
|
||||
!!! important "Default serversTransport"
|
||||
If no `serversTransport` is specified, the `default@internal` will be used.
|
||||
The `default@internal` serversTransport is created from the [static configuration](../overview.md#transport-configuration).
|
||||
|
||||
!!! info "ServersTransport Attributes"
|
||||
|
||||
```yaml tab="TLSStore"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
serverName: foobar # [1]
|
||||
insecureSkipVerify: true # [2]
|
||||
rootCAsSecrets: # [3]
|
||||
- foobar
|
||||
- foobar
|
||||
certificatesSecrets: # [4]
|
||||
- foobar
|
||||
- foobar
|
||||
maxIdleConnsPerHost: 1 # [5]
|
||||
forwardingTimeouts: # [6]
|
||||
dialTimeout: 42s # [7]
|
||||
responseHeaderTimeout: 42s # [8]
|
||||
idleConnTimeout: 42s # [9]
|
||||
```
|
||||
|
||||
| Ref | Attribute | Purpose |
|
||||
|-----|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| [1] | `serverName` | ServerName used to contact the server. |
|
||||
| [2] | `insecureSkipVerify` | Disable SSL certificate verification. |
|
||||
| [3] | `rootCAsSecrets` | Add cert file for self-signed certificate. |
|
||||
| [4] | `certificatesSecrets` | Certificates for mTLS. |
|
||||
| [5] | `maxIdleConnsPerHost` | If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, `defaultMaxIdleConnsPerHost` is used. |
|
||||
| [6] | `forwardingTimeouts` | Timeouts for requests forwarded to the backend servers. |
|
||||
| [7] | `dialTimeout` | The amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists. |
|
||||
| [8] | `responseHeaderTimeout` | The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists. |
|
||||
| [9] | `idleConnTimeout` | The maximum period for which an idle HTTP keep-alive connection will remain open before closing itself. |
|
||||
|
||||
??? example "Declaring and referencing a ServersTransport"
|
||||
|
||||
```yaml tab="ServersTransport"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
serverName: example.org
|
||||
insecureSkipVerify: true
|
||||
```
|
||||
|
||||
```yaml tab="IngressRoute"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: testroute
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
entryPoints:
|
||||
- web
|
||||
routes:
|
||||
- match: Host(`example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
serversTransport: mytransport
|
||||
```
|
||||
|
||||
## Further
|
||||
|
||||
Also see the [full example](../../user-guides/crd-acme/index.md) with Let's Encrypt.
|
||||
|
|
|
|||
|
|
@ -460,6 +460,33 @@ By default, `passHostHeader` is true.
|
|||
passHostHeader: false
|
||||
```
|
||||
|
||||
#### ServersTransport
|
||||
|
||||
`serversTransport` allows to reference a ServersTransport configuration for the communication between Traefik and your servers.
|
||||
|
||||
??? example "Specify a transport -- Using the [File Provider](../../providers/file.md)"
|
||||
|
||||
```toml tab="TOML"
|
||||
## Dynamic configuration
|
||||
[http.services]
|
||||
[http.services.Service01]
|
||||
[http.services.Service01.loadBalancer]
|
||||
serversTransport = "mytransport"
|
||||
```
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
services:
|
||||
Service01:
|
||||
loadBalancer:
|
||||
serversTransport = "mytransport"
|
||||
```
|
||||
|
||||
!!! info default serversTransport
|
||||
If no serversTransport is specified, the `default@internal` will be used.
|
||||
The `default@internal` serversTransport is created from the [static configuration](../overview.md#transport-configuration).
|
||||
|
||||
#### Response Forwarding
|
||||
|
||||
This section is about configuring how Traefik forwards the response from the backend server to the client.
|
||||
|
|
@ -492,6 +519,301 @@ Below are the available options for the Response Forwarding mechanism:
|
|||
flushInterval: 1s
|
||||
```
|
||||
|
||||
### ServersTransport
|
||||
|
||||
ServersTransport allows to configure the transport between Traefik and your servers.
|
||||
|
||||
#### `ServerName`
|
||||
|
||||
_Optional_
|
||||
|
||||
`serverName` configure the server name that will be used for SNI.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[http.serversTransports.mytransport]
|
||||
serverName = "myhost"
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
serverName: "myhost"
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
serverName: "test"
|
||||
```
|
||||
|
||||
#### `Certificates`
|
||||
|
||||
_Optional_
|
||||
|
||||
`certificates` is the list of certificates (as file paths, or data bytes)
|
||||
that will be set as client certificates for mTLS.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[[http.serversTransports.mytransport.certificates]]
|
||||
certFile = "foo.crt"
|
||||
keyFile = "bar.crt"
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
certficates:
|
||||
- certFile: foo.crt
|
||||
keyFile: bar.crt
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
certificatesSecrets:
|
||||
- mycert
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mycert
|
||||
|
||||
data:
|
||||
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
||||
tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
|
||||
```
|
||||
|
||||
#### `insecureSkipVerify`
|
||||
|
||||
_Optional_
|
||||
|
||||
`insecureSkipVerify` disables SSL certificate verification.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[http.serversTransports.mytransport]
|
||||
insecureSkipVerify = true
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
insecureSkipVerify: true
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
insecureSkipVerify: true
|
||||
```
|
||||
|
||||
#### `rootCAs`
|
||||
|
||||
_Optional_
|
||||
|
||||
`rootCAs` is the list of certificates (as file paths, or data bytes)
|
||||
that will be set as Root Certificate Authorities when using a self-signed TLS certificate.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[http.serversTransports.mytransport]
|
||||
rootCAs = ["foo.crt", "bar.crt"]
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
rootCAs:
|
||||
- foo.crt
|
||||
- bar.crt
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
rootCAsSecrets:
|
||||
- myca
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: myca
|
||||
|
||||
data:
|
||||
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
||||
```
|
||||
|
||||
#### `maxIdleConnsPerHost`
|
||||
|
||||
_Optional, Default=2_
|
||||
|
||||
If non-zero, `maxIdleConnsPerHost` controls the maximum idle (keep-alive) connections to keep per-host.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[http.serversTransports.mytransport]
|
||||
maxIdleConnsPerHost = 7
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
maxIdleConnsPerHost: 7
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
maxIdleConnsPerHost: 7
|
||||
```
|
||||
|
||||
#### `forwardingTimeouts`
|
||||
|
||||
`forwardingTimeouts` is about a number of timeouts relevant to when forwarding requests to the backend servers.
|
||||
|
||||
##### `forwardingTimeouts.dialTimeout`
|
||||
|
||||
_Optional, Default=30s_
|
||||
|
||||
`dialTimeout` is the maximum duration allowed for a connection to a backend server to be established.
|
||||
Zero means no timeout.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[http.serversTransports.mytransport.forwardingTimeouts]
|
||||
dialTimeout = "1s"
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
forwardingTimeouts:
|
||||
dialTimeout: "1s"
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
forwardingTimeouts:
|
||||
dialTimeout: "1s"
|
||||
```
|
||||
|
||||
##### `forwardingTimeouts.responseHeaderTimeout`
|
||||
|
||||
_Optional, Default=0s_
|
||||
|
||||
`responseHeaderTimeout`, if non-zero, specifies the amount of time to wait for a server's response headers
|
||||
after fully writing the request (including its body, if any).
|
||||
This time does not include the time to read the response body.
|
||||
Zero means no timeout.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[http.serversTransports.mytransport.forwardingTimeouts]
|
||||
responseHeaderTimeout = "1s"
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
forwardingTimeouts:
|
||||
responseHeaderTimeout: "1s"
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
forwardingTimeouts:
|
||||
responseHeaderTimeout: "1s"
|
||||
```
|
||||
|
||||
##### `forwardingTimeouts.idleConnTimeout`
|
||||
|
||||
_Optional, Default=90s_
|
||||
|
||||
`idleConnTimeout`, is the maximum amount of time an idle (keep-alive) connection
|
||||
will remain idle before closing itself.
|
||||
Zero means no limit.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
[http.serversTransports.mytransport.forwardingTimeouts]
|
||||
idleConnTimeout = "1s"
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
serversTransports:
|
||||
mytransport:
|
||||
forwardingTimeouts:
|
||||
idleConnTimeout: "1s"
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: ServersTransport
|
||||
metadata:
|
||||
name: mytransport
|
||||
namespace: default
|
||||
|
||||
spec:
|
||||
forwardingTimeouts:
|
||||
idleConnTimeout: "1s"
|
||||
```
|
||||
|
||||
### Weighted Round Robin (service)
|
||||
|
||||
The WRR is able to load balance the requests between multiple services based on weights.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue