Docker for Mac with Kubernetes — Ingress Controller with Traefik

Thomas Hamm

This is a follow up story of “Docker for Mac with Kubernetes — Enable K8s Dashboard” which covers the basics to get a more permanent solution to access the dashboard (or any other web service).

Therefore we will use the cloud native load balancer Traefik as our Ingress controller.


Installing Helm

Helm is a package manager which makes it easy to deploy software to a K8s cluster. It can be installed via Homebrew.

$ brew install kubernetes-helm
$ helm repo update

Packages are called Charts. A Chart contains all the Kubernetes manifests needed for a deployment. Manifests can be enhanced with template logic to get a configurable package suitable for different purposes (e.g. staging).

The Helm client needs a component running on the cluster which manages all the packages installed/submitted from the client. This component called is Tiller.

Create a file called “rbac-config.yaml” which is used to create a Service Account for Tiller.

apiVersion: v1
kind: ServiceAccount
metadata:
name: tiller
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: tiller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: tiller
namespace: kube-system

Deploy Tiller.

$ kubectl create -f rbac-config.yaml
serviceaccount "tiller" created
clusterrolebinding "tiller" created
$ helm init --service-account tiller
Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster.
Please note: by default, Tiller is deployed with an insecure 'allow unauthenticated users' policy.
For more information on securing your installation see: https://docs.helm.sh/using_helm/#securing-your-helm-installation
Happy Helming!

Installing Traefik

As we now have Helm installed we can easily install Traefik. Helm Charts usually come with a default configuration. But we need to create a custom configuration to specify our domain. I choose “traefik.k8s”.

Create a file called “traefik-values.yaml”.

dashboard:
enabled: true
domain: traefik.k8s
kubernetes:
namespaces:
- default
- kube-system

Install the Traefik Chart and check if the pod is up and running.

$ helm install stable/traefik --name traefik --values traefik-values.yaml$ kubectl --namespace default get pods
NAME READY STATUS RESTARTS AGE
traefik-6bcf94dc95-9w2fk 1/1 Running 0 1m

Traefik routes traffic based on domain names. Therefore we need to configure the DNS server (/etc/hosts ;-) and add our previously defined domain from the config.

127.0.0.1       localhost traefik.k8s

As we’ve enabled the dashboard it is now accessible in a browser (traefik.k8s).

Traefik dashboard

Deploying the K8s dashboard

I’ve created a basic Helm Chart containing all configs from the previous story needed for the dashboard.

$ git clone https://github.com/thmshmm/chart-k8s-dashboard.git k8s-dshbrd/
$ helm install k8s-dshbrd --name kubernetes-dashboard

Traefik is an ingress controller taking care of Ingress resources. The Chart created such an Ingress resource for us.

Note: Somewhere hardcoded in the Chart (don’t do this :-( I specified “web.traefik.k8s” as hostname within the domain.

Extended /etc/hosts.

127.0.0.1       localhost traefik.k8s web.traefik.k8s

Well done.

Now there is a second frontend and backend in Traefik

Traefik dashboard

and the K8s dashboard is accessible under web.traefik.k8s.

K8s dashboard

Generic Ingress usage

We’ve seen some possibilities to publish an internal service to the outside world. In addition, we can apply this to any other service which should be externally accessible.

Edit the “traefik-values.yaml” file and add any namespace Traefik should be aware of.

dashboard:
enabled: true
domain: traefik.k8s
kubernetes:
namespaces:
- default
- kube-system
- some-other-namespace

Upgrade the release of Traefik.

$ helm upgrade traefik stable/traefik --values traefik-values.yaml

Create an Ingress resource for the new service.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: some-backend
namespace: some-other-namespace
annotations:
kubernetes.io/ingress.class: traefik
spec:
rules:
- host: some-backend.traefik.k8s
http:
paths:
- backend:
serviceName: some-backend-service
servicePort: 8080

And don’t forget the DNS entries.

Have fun.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade