init

traefik/config.yml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik
+data:
+  config: |
+    api:
+      insecure: true
+      dashboard: true
+
+    ping: {}
+
+    providers:
+      kubernetesingress: {}
+
+    entryPoints:
+      web:
+        address: :80
+        http:
+        #   redirections:
+        #     entryPoint:
+        #       to: websecure
+        #       scheme: https
+        #       permanent: false
+        # http3: {}
+      websecure:
+        address: :443
+        http2: 
+          maxConcurrentStreams: 16      
+        http3: {}

traefik/deployment.yml

@@ -0,0 +1,49 @@
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: traefik
+  labels:
+    app: traefik
+spec:
+  selector:
+    matchLabels:
+      name: traefik
+  template:
+    metadata:
+      labels:
+        k8s-app: traefik
+        name: traefik
+    spec:
+      serviceAccountName: traefik-account
+      terminationGracePeriodSeconds: 60
+      containers:
+      - image: traefik:v3.0
+        name: traefik
+        ports:
+        - name: web
+          containerPort: 80
+          hostPort: 80
+        - name: dashboard
+          containerPort: 8080
+          # hostPort: 8080
+        volumeMounts:
+        - name: config
+          mountPath: "/config"
+          readOnly: true
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE
+        args:
+        - --api.insecure
+        # - --providers.kubernetesingress
+        - --configFile=/config/traefik.yaml
+      volumes:
+        - name: config
+          configMap:
+            name: traefik
+            items:
+            - key: "config"
+              path: "traefik.yaml"

traefik/role.yml

@@ -0,0 +1,52 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik-role
+
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik-account
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik-role-binding
+
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-role
+subjects:
+  - kind: ServiceAccount
+    name: traefik-account
+    namespace: default