Traefik 在 Kubernetes 上暴露服务的进阶指南：Middleware、Let‘s Encrypt、Sticky Session、多层路由与服务级中间件

Traefik 在 Kubernetes 上暴露服务的进阶指南Middleware、Lets Encrypt、Sticky Session、多层路由与服务级中间件【免费下载链接】traefikThe Cloud Native Application Proxy项目地址: https://gitcode.com/GitHub_Trending/tr/traefik本文基于仓库中的 进阶指南 整理而成承接 入门指南 的部署基础面向已经在 Kubernetes 中通过 Traefik Proxy 完成基础服务暴露的开发者。你将系统掌握如何用 Middleware 施加安全头与 IP 白名单、用 Lets EncryptIngressRoute与 cert-managerGateway API实现证书自动化、用 TraefikService 实现会话粘滞、用 IngressRouteparentRefs构建按角色鉴权的多层路由并在路由与服务两个层级精准编排中间件最终打造可上生产环境的 Ingress 网关。前置要求已完成 入门指南拥有一个可用的 Traefik Kubernetes 部署环境一个已安装 Traefik Proxy 的 Kubernetes 集群本地kubectl已正确配置并指向该集群沿用入门指南中的whoami示例应用及其HTTPRoute/IngressRoute配置。后续所有 YAML 均可在集群中直接kubectl apply用于演示的域名whoami.docker.localhost可替换为你自己的真实域名。添加 Middlewares安全头与访问控制Middlewares 是 Traefik 处理管道中用于修改请求或响应的中间件是安全加固的第一道关卡。下面先创建两个典型中间件负责安全响应头的Headers详见 参考文档和负责来源控制的IP AllowList详见 参考文档。创建 Middleware 资源将下列内容保存为middlewares.yamlapiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: secure-headers namespace: default spec: headers: frameDeny: true sslRedirect: true browserXssFilter: true contentTypeNosniff: true stsIncludeSubdomains: true stsPreload: true stsSeconds: 31536000 --- apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: ip-allowlist namespace: default spec: ipAllowList: sourceRange: - 127.0.0.1/32 - 10.0.0.0/8 # Typical cluster network range - 192.168.0.0/16 # Common local network range应用它kubectl apply -f middlewares.yaml参数速查frameDeny添加X-Frame-Options: DENY阻止页面被第三方站点以 iframe 嵌入防点击劫持sslRedirectHTTP 请求被重定向到 HTTPSbrowserXssFilter添加X-XSS-Protection: 1; modeblockcontentTypeNosniff添加X-Content-Type-Options: nosniff禁止浏览器猜测 MIME 类型stsSeconds: 31536000HSTSmax-age秒数配合stsIncludeSubdomains作用于子域与stsPreload申请加入浏览器预加载列表构成完整 HSTS 策略ipAllowList.sourceRange以 CIDR 列表声明放行来源命中即放行其余来源返回 403。这些选项的实现与默认值逻辑位于仓库 pkg/middlewares/headers 与 pkg/middlewares/ipallowlist 包内阅读源码可核对每个头部字段在 Go 侧的默认行为。Gateway API通过 ExtensionRef 引用 MiddlewaresGateway API 的规范中对请求的细粒度加工使用Filters机制。Traefik 通过ExtensionRef这种可扩展 filter 类型让 HTTPRoute 能直接引用traefik.io组的 Middleware CRD——这是 Gateway API 场景下使用 Traefik 中间件的标准方式与 HTTPRoute 规范天然融合不依赖任何注解。更新whoami-route.yamlapiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: whoami namespace: default spec: parentRefs: - name: traefik-gateway sectionName: websecure hostnames: - whoami.docker.localhost rules: - matches: - path: type: PathPrefix value: /api filters: - type: ExtensionRef extensionRef: # Headers Middleware Definition group: traefik.io kind: Middleware name: secure-headers - type: ExtensionRef extensionRef: # IP AllowList Middleware Definition group: traefik.io kind: Middleware name: ip-allowlist backendRefs: - name: whoami-api port: 80 - matches: - path: type: PathPrefix value: / filters: - type: ExtensionRef extensionRef: # Headers Middleware Definition group: traefik.io kind: Middleware name: secure-headers - type: ExtensionRef extensionRef: # IP AllowList Middleware Definition group: traefik.io kind: Middleware name: ip-allowlist backendRefs: - name: whoami port: 80应用变更kubectl apply -f whoami-route.yaml注意/api与/两条规则都同时应用了两个中间件含义是无论走 API 还是首页路径都先加安全头、再做来源白名单校验。IngressRoute通过 routes.middlewares 引用 Middlewares若你使用 Traefik 自有的 IngressRoute CRD更新whoami-ingressroute.yaml把中间件挂在每条 route 上apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: whoami namespace: default spec: entryPoints: - websecure routes: - match: Host(whoami.docker.localhost) Path(/api) kind: Rule middlewares: # Middleware Definition - name: secure-headers - name: ip-allowlist services: - name: whoami-api port: 80 - match: Host(whoami.docker.localhost) kind: Rule middlewares: # Middleware Definition - name: secure-headers - name: ip-allowlist services: - name: whoami port: 80 tls: certResolver: lekubectl apply -f whoami-ingressroute.yaml此处tls.certResolver: le指向后续小节配置的 Lets Encrypt 证书解析器。IngressRoute CRD 结构中routes[].middlewares类型[]MiddlewareRef与spec.tls.certResolver的定义见仓库 pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroute.go。验证中间件是否生效用 curl 检查响应头是否带上安全策略curl -k -I -H Host: whoami.docker.localhost https://localhost/预期可见类似输出HTTP/2 200 x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; modeblock strict-transport-security: max-age31536000; includeSubDomains; preload content-type: text/plain; charsetutf-8 content-length: 403验证 IP 白名单时可临时把sourceRange改成不包含你当前出口 IP 的网段再请求一次应收到 403 被拒绝的结果从而确认访问控制真实生效。使用 Lets Encrypt 自动化签发证书!!! info Traefik 内置的 Lets Encrypt 集成仅面向IngressRoute生效不会为 Gateway API 的 listener 自动签发证书。Gateway API 场景请使用 cert-manager 或其他证书控制器。!!! important Public DNS 前提 Lets Encrypt 需要公网可达的域名来完成所有权校验。若像示例一样使用whoami.docker.localhost这类本地域名证书将保持自签名。生产环境请换成拥有公网 DNS 记录并指向 Traefik 实例的真实域名。IngressRoute Traefik 内置 ACME在 Traefik 的 Helmvalues.yaml中配置证书解析器resolveradditionalArguments: - --certificatesresolvers.le.acme.emailyour-emailexample.com #replace with your email - --certificatesresolvers.le.acme.storage/data/acme.json - --certificatesresolvers.le.acme.httpchallenge.entrypointweb三个参数分别声明ACME 账户邮箱、证书存储文件路径持久化挂载的关键证书与账户密钥都写入该 json 文件、使用 HTTP-01 challenge 并指定走名为web的入口点完成质询。升级 Traefik 使其加载上述配置helm upgrade traefik traefik/traefik -n traefik --reuse-values -f values.yaml随后让 IngressRoute 使用该解析器申请证书apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: whoami namespace: default spec: entryPoints: - websecure routes: - match: Host(whoami.docker.localhost) Path(/api) kind: Rule middlewares: - name: secure-headers - name: ip-allowlist services: - name: whoami-api port: 80 - match: Host(whoami.docker.localhost) kind: Rule middlewares: - name: secure-headers - name: ip-allowlist services: - name: whoami port: 80 tls: certResolver: lekubectl apply -f whoami-ingressroute.yamlTraefik 会在配置热加载后按 Host 规则自动为匹配的域名申请并续期证书全程无需手工管理 Secret。Gateway API cert-managerGateway API 一侧先安装 cert-managerkubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.yaml随后创建 Issuer 与 Certificate保存为letsencrypt-issuer-andwhoami-certificate.yamlapiVersion: cert-manager.io/v1 kind: Issuer metadata: name: letsencrypt spec: acme: email: your-emailexample.com # replace with your email server: https://acme-v02-staging.api.letsencrypt.org/directory # Replace with the production server in production privateKeySecretRef: name: letsencrypt-account-key solvers: - http01: gatewayHTTPRoute: parentRefs: - name: traefik namespace: default kind: Gateway --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: whoami namespace: default spec: secretName: whoami-tls-le # Name of secret where the generated certificate will be stored. dnsNames: - whoami.docker.localhost # Replace a real domain issuerRef: name: letsencrypt kind: Issuer要点解读solvers[].http01.gatewayHTTPRoute.parentRefs告诉 cert-manager用 HTTP-01 质询时把挑战请求经名为traefik、位于default命名空间的 GatewayHTTPRoute发布出去由其转发到 ACME 验证服务器示例使用staging环境acme-v02-staging便于反复调试且不消耗生产配额上线前请替换为生产目录https://acme-v02.api.letsencrypt.org/directoryCertificate.secretName指定证书落地 Secret 名即下一步 Gateway 引用的whoami-tls-le。!!! important Public DNS 前提 Lets Encrypt 必须通过公网验证域名所有权。使用whoami.docker.localhost之类的本地域名时cert-manager 会发起质询但无法完成证书仍将保持自签名。生产环境请改用指向集群入口的公网域名。应用上述资源kubectl apply -f letsencrypt-issuer-andwhoami-certificate.yaml更新 Gateway让websecurelistener 引用 cert-manager 生成的证书apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: traefik-gateway namespace: default spec: gatewayClassName: traefik listeners: - name: web port: 80 protocol: HTTP allowedRoutes: namespaces: from: All - name: websecure port: 443 protocol: HTTPS allowedRoutes: namespaces: from: All tls: certificateRefs: - name: whoami-tls-le # References the secret created by cert-managerkubectl apply -f gateway.yaml此后既有HTTPRoute在访问websecurelistener 时将自动使用这份证书完成 TLS 握手。验证证书签发结果# Check certificate status kubectl get certificate -n default # Verify the certificate chain curl -v https://whoami.docker.localhost/ 21 | grep -i server certificate当签发成功后可从返回的证书链中看到issuer为 Lets Encrypt。若使用 staging 环境证书链中会体现其 staging 根属正常现象。配置 Sticky Sessions会话粘滞会话粘滞保证同一用户的多次请求始终落在同一个后端 Pod 上是带本地会话状态应用如含内存 Session 的 Web 服务的必备能力。Traefik 通过加权负载均衡的sticky.cookie实现首次请求时种下一个 Cookie后续请求依据该 Cookie 计算同后端转发。先把副本扩容到 3kubectl scale deployment whoami --replicas3多副本才能直观对比粘滞与普通负载均衡的差异。Gateway API TraefikServiceGateway API 本身只认识原生 Service 后端要让其使用 Traefik 的负载均衡能力加权、粘滞需要借助 Traefik 扩展出的TraefikServiceCRD。先创建粘滞服务保存为whoami-sticky-service.yamlapiVersion: traefik.io/v1alpha1 kind: TraefikService metadata: name: whoami-sticky namespace: default spec: weighted: services: - name: whoami port: 80 weight: 1 sticky: cookie: name: sticky_cookie secure: true httpOnly: truekubectl apply -f whoami-sticky-service.yamlweighted分组只放一个成员也可启用粘滞——粘滞语义与权重互不冲突。接着在 HTTPRoute 中把对应backendRefs指向该 TraefikService通过group: traefik.iokind: TraefikService显式告知 Gateway API 这是扩展后端类型apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: whoami namespace: default spec: parentRefs: - name: traefik-gateway sectionName: websecure hostnames: - whoami.docker.localhost rules: - matches: - path: type: PathPrefix value: /api filters: - type: ExtensionRef extensionRef: # Headers Middleware Definition group: traefik.io kind: Middleware name: secure-headers - type: ExtensionRef extensionRef: # IP AllowList Middleware Definition group: traefik.io kind: Middleware name: ip-allowlist backendRefs: - name: whoami-api port: 80 - matches: - path: type: PathPrefix value: / backendRefs: - group: traefik.io # ── tell Gateway this is a TraefikService kind: TraefikService name: whoami-sticky filters: - type: ExtensionRef extensionRef: # Headers Middleware Definition group: traefik.io kind: Middleware name: secure-headers - type: ExtensionRef extensionRef: # IP AllowList Middleware Definition group: traefik.io kind: Middleware name: ip-allowlist backendRefs: - name: whoami port: 80kubectl apply -f whoami-route.yaml仓库 Gateway API provider 在解析 HTTPRoute 时对这类指向 Traefik 扩展资源的backendRef会转换为对应的 Traefik 服务模型其解析逻辑见 pkg/provider/kubernetes/gateway/httproute.go。IngressRoute TraefikServiceIngressRoute 同样可把某条 route 的服务替换为粘滞版 TraefikServiceapiVersion: traefik.io/v1alpha1 kind: TraefikService metadata: name: whoami-sticky namespace: default spec: weighted: services: - name: whoami port: 80 sticky: cookie: name: sticky_cookie secure: true httpOnly: truekubectl apply -f whoami-sticky-service.yaml更新 IngressRoute在 services 项中指明kind: TraefikServiceapiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: whoami namespace: default spec: entryPoints: - websecure routes: - match: Host(whoami.docker.localhost) Path(/api) kind: Rule middlewares: # Middleware Definition - name: secure-headers - name: ip-allowlist services: - name: whoami-api port: 80 - match: Host(whoami.docker.localhost) kind: Rule middlewares: # Middleware Definition - name: secure-headers - name: ip-allowlist services: - name: whoami-sticky # Changed from whoami to whoami-sticky kind: TraefikService # Added kind: TraefikService tls: certResolver: lekubectl apply -f whoami-ingressroute.yaml底层实现上CRD provider 会把TraefikService的spec.weighted.sticky.cookie字段翻译成动态配置中的负载均衡Sticky含 Cookie 名称、Secure、HTTPOnly 以及可选的 SameSite、MaxAge、Domain、Path并写入LoadBalancer服务映射逻辑集中在 pkg/provider/kubernetes/crd/kubernetes_http.go。CRD 的类型定义则见 pkg/provider/kubernetes/crd/traefikio/v1alpha1/ingressroute.go。验证粘滞会话带 Cookie 连续请求应始终命中同一后端 Pod# First request - save cookies to a file curl -k -c cookies.txt -H Host: whoami.docker.localhost https://localhost/ # Subsequent requests - use the cookies curl -k -b cookies.txt -H Host: whoami.docker.localhost https://localhost/ curl -k -b cookies.txt -H Host: whoami.docker.localhost https://localhost/观察每次响应的Hostname字段使用同一 cookie 文件时它应保持不变即粘滞生效。对照实验——不带 Cookie 请求应被轮询到不同 Pod# Requests without cookies should be load-balanced across different pods curl -k -H Host: whoami.docker.localhost https://localhost/ curl -k -H Host: whoami.docker.localhost https://localhost/此时各次响应的Hostname会不同。!!! important 浏览器测试注意 浏览器中测试需保持同一浏览器会话以维持 Cookie。示例 Cookie 带有httpOnly与secure标记前者保证脚本JavaScript无法读取后者保证仅通过 HTTPS 传输因此只能用同一 HTTPS 会话持续访问。更完整的粘滞与加权配置说明见 负载均衡 Service 参考文档。搭建 Multi-Layer Routing多层路由多层路由让 Router 之间形成父子层级父 Router 先经过中间件处理请求如完成鉴权、注入头部再由子 Router 依据加工后的请求做最终路由决策。典型场景包括先鉴权、再按角色分发以及分层逐步叠加中间件父层做限流/CORS子层做更具体的处理。!!! info IngressRoute 专属能力 多层路由由 Kubernetes IngressRouteCRD通过spec.parentRefs字段原生支持标准 Kubernetes Ingress 与 Gateway API 资源不提供该能力。从源码结构看Gateway API provider 解析 HTTPRoute 时不具备 parentRefs 语义而 multi-layer-routing.md 明确指出其受支持面为 File、KV 存储与 Kubernetes CRD provider。基于认证的多层路由示例设计父 IngressRouteapi-parent负责Host(api.docker.localhost) PathPrefix(/api)匹配并施加 BasicAuth两个子 IngressRoute 依据中间件写入的X-Auth-User头分别路由到 admin 与 user 后端。!!! important 父 Router 约束 多层路由中的父 Router 不得定义 services服务选择完全交由子 Router 依据各自规则完成。所有子 IngressRoute 必须通过parentRefs正确引用父级。先部署两个后端服务保存为whoami-backends.yaml# whoami-backends.yaml apiVersion: apps/v1 kind: Deployment metadata: name: admin-backend namespace: default spec: replicas: 2 selector: matchLabels: app: admin-backend template: metadata: labels: app: admin-backend spec: containers: - name: whoami image: traefik/whoami env: - name: WHOAMI_NAME value: Admin Backend ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: admin-backend namespace: default spec: selector: app: admin-backend ports: - port: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: user-backend namespace: default spec: replicas: 2 selector: matchLabels: app: user-backend template: metadata: labels: app: user-backend spec: containers: - name: whoami image: traefik/whoami env: - name: WHOAMI_NAME value: User Backend ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: user-backend namespace: default spec: selector: app: user-backend ports: - port: 80kubectl apply -f whoami-backends.yaml接着创建 Secret存放 htpasswd 账号、BasicAuth 中间件与三份 IngressRoute保存为mlr-ingressroute.yaml# mlr-ingressroute.yaml apiVersion: v1 kind: Secret metadata: name: auth-secret namespace: default type: Opaque stringData: users: | admin:$apr1$DmXR3Add$wfdbGw6RWIhFb0ffXMM4d0 user:$apr1$GJtcIY1o$mSLdsWYeXpPHVsxGDqadI. --- apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: auth-middleware namespace: default spec: basicAuth: secret: auth-secret headerField: X-Auth-User --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: api-parent namespace: default spec: entryPoints: - websecure routes: - match: Host(api.docker.localhost) PathPrefix(/api) kind: Rule middlewares: - name: auth-middleware # Note: No services and no TLS config - this is a parent IngressRoute --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: api-admin namespace: default spec: parentRefs: - name: api-parent namespace: default # Optional, defaults to same namespace routes: - match: HeadersRegexp(X-Auth-User, admin) kind: Rule services: - name: admin-backend port: 80 --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: api-user namespace: default spec: parentRefs: - name: api-parent namespace: default # Optional, defaults to same namespace routes: - match: HeadersRegexp(X-Auth-User, user) kind: Rule services: - name: user-backend port: 80配置要点BasicAuth 中间件的headerField: X-Auth-User让认证通过后把用户名写入请求头供下游规则匹配——这是先鉴权、再分流的枢纽父 IngressRoute 的 route 只挂中间件、无 services、无 TLS子 IngressRoute 不声明 entryPoints仅凭parentRefs挂接到父级其中namespace省略时默认同命名空间。!!! note 生成密码哈希 上文哈希由 Apache 工具htpasswd生成。需要自建账号时执行bash # Using htpasswd (Apache utils) htpasswd -nb admin yourpassword 应用整份配置kubectl apply -f mlr-ingressroute.yaml在 CRD 层spec.parentRefs []IngressRouteRef即为多层路由入口字段见 ingressroute.goHTTP provider 会读取每个子路由的 parentRefs 建立父子拓扑并把这些引用并入父路由器名集合处理逻辑见 kubernetes_http.go。验证多层路由# Request goes through parent router → auth middleware → admin child router curl -k -u admin:test -H Host: api.docker.localhost https://localhost/api以admin:test认证应得到 admin-backend 的响应改用user:test则命中 user-backend。工作原理请求到达api.docker.localhost/api父 IngressRouteapi-parent按 host path 命中BasicAuth 中间件完成认证并把用户名写入X-Auth-User头子 IngressRouteapi-admin或api-user按该头的值匹配请求被转发到对应的 Kubernetes Service。跨命名空间引用父级在子路由parentRefs中显式给出父级所在命名空间即可apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: api-child namespace: app-namespace spec: parentRefs: - name: api-parent namespace: shared-namespace # Parent in different namespace routes: - match: Path(/child) kind: Rule services: - name: child-service port: 80!!! important 跨命名空间开关 使用跨命名空间父引用必须先在 Traefik Helm values 中开启allowCrossNamespaceyaml providers: kubernetesCRD: allowCrossNamespace: true 该开关即 CRD provider 配置结构中的 AllowCrossNamespace 字段见 [kubernetes.go](https://link.gitcode.com/i/99d4dff644b6d67c3c2ba53e84601f8d)开启时 Traefik 会打印一条警示日志提醒你已允许跨命名空间引用资源、请确认符合安全预期。一个子路由挂接多个父级apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: api-child namespace: default spec: parentRefs: - name: parent-one - name: parent-two routes: - match: Path(/api) kind: Rule services: - name: child-service port: 80同一份路由逻辑可被多个入口域/路径共享减少重复配置。仓库集成测试中也有同构用例integration/fixtures/routing/multi_layer_auth.toml 即文件 provider 下的多层鉴权示例。更完整语义参见 多层路由参考文档。Service Middlewares服务级中间件路由级中间件只在命中某条路由规则时生效服务级中间件则挂在服务上对流向该服务的所有请求生效——无论流量来自哪个 Router。适合把同一套 headers / 限流 / 鉴权统一下沉到服务层避免在每个 Router 上重复声明。何时使用服务级中间件多个 Router 转发到同一服务且都需要施加同一中间件需要确保无论流量从何而来该服务始终经过某个中间件希望把中间件配置集中在服务层统一管理。!!! info 服务级 vs 路由级 -路由级仅当流量命中该 Router 规则时执行 -服务级对该服务收到的全部流量执行 - 两者同时配置时先执行路由级中间件再执行服务级中间件。这一顺序由动态配置的服务引用机制保证请求先穿过路由构建的中间件链再进入服务内的负载均衡处理器链。IngressRoute在 services 项内嵌中间件apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: service-headers namespace: default spec: headers: customRequestHeaders: X-Service-Middleware: applied --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: whoami namespace: default spec: entryPoints: - websecure routes: - match: Host(whoami.docker.localhost) kind: Rule services: - name: whoami port: 80 middlewares: - name: service-headers tls: {}保存为service-middleware-ingressroute.yaml并应用kubectl apply -f service-middleware-ingressroute.yamlCRD 类型中ServiceSpec.middlewares []MiddlewareRef正是该内嵌引用的定义位置见 ingressroute.go。Gateway APIbackendRefs 内置 FiltersGateway API 支持在单个后端上直接施加 filter既可用 Traefik 扩展的ExtensionRef引用任意 Middleware CRD也可用原生RequestHeaderModifier完成纯增删改头的场景。ExtensionRef 方式apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: service-headers namespace: default spec: headers: customRequestHeaders: X-Service-Middleware: applied --- apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: whoami namespace: default spec: parentRefs: - name: traefik-gateway sectionName: websecure hostnames: - whoami.docker.localhost rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: whoami port: 80 filters: - type: ExtensionRef extensionRef: group: traefik.io kind: Middleware name: service-headers原生RequestHeaderModifier方式apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: whoami namespace: default spec: parentRefs: - name: traefik-gateway sectionName: websecure hostnames: - whoami.docker.localhost rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: whoami port: 80 filters: - type: RequestHeaderModifier requestHeaderModifier: add: - name: X-Backend-Header value: gateway-api-filter保存为service-middleware-gateway.yaml并应用kubectl apply -f service-middleware-gateway.yaml标准 Ingress服务注解方式使用标准 Kubernetes Ingress 时用 Service 注解声明服务级中间件apiVersion: v1 kind: Service metadata: name: whoami namespace: default annotations: traefik.ingress.kubernetes.io/service.middlewares: default-service-headerskubernetescrd spec: selector: app: whoami ports: - port: 80注解值格式为namespace-middleware-namekubernetescrd其中kubernetescrd表明中间件来源为 Kubernetes CRD provider。验证服务级中间件curl -k -H Host: whoami.docker.localhost https://localhost/whoami 返回体中应能看到由服务级中间件注入的自定义请求头X-Service-Middleware: applied服务级中间件更完整的字段语义见 service.md 中 middlewares 一节。总结完成本篇后你已具备生产级 Traefik on Kubernetes 的关键能力用 Middleware 施加安全头HSTS、X-Frame-Options、nosniff 等与 IP 白名单在 Gateway APIExtensionRef与 IngressRouteroutes.middlewares两条路径上都可编排证书自动化双方案IngressRoute 走内置 Lets Encrypt resolverGateway API 走 cert-manager GatewaycertificateRefs并理解本地域名下证书保持自签名的约束通过 TraefikService 的加权粘滞 Cookie 为有状态应用启用会话保持覆盖 Gateway API 与 IngressRoute 两种后端引用形态用parentRefs构建父层鉴权、子层按角色分流的多层路由包括跨命名空间需开启allowCrossNamespace与多父级引用把中间件下沉到服务层IngressRoute services 内嵌 / HTTPRoutebackendRefs.filters/ Ingress Service 注解实现集中化管理。延伸方向在 入门指南 与本文基础上可继续探索更精细的路由规则与优先级如按查询参数、请求头、HTTP 方法匹配更多中间件能力如鉴权Basic/Digest/Forward、限流ratelimit 等、请求改写StripPrefix、AddPrefix 等Kubernetes CRD 与 Gateway API provider 的完整配置项分别对应providers.kubernetesCRD与providers.kubernetesGateway可用于调整命名空间隔离、标签选择器、入口点绑定等行为。【免费下载链接】traefikThe Cloud Native Application Proxy项目地址: https://gitcode.com/GitHub_Trending/tr/traefik创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考