K8s 集群部署 Traefik 并验证 Python HTTP 服务

2. 使用 Helm 部署 Traefik

将上述配置写入 traefik-values.yaml，执行以下命令完成部署：

# 添加 Traefik Helm 仓库
helm repo add traefik https://traefik.github.io/charts
helm repo update
# 部署 Traefik（指定 Chart 版本，使用自定义配置）
helm install traefik traefik/traefik \
  --namespace kube-system \
  --create-namespace \
  --version 39.1.0-ea.2 \
  -f traefik-values.yaml
# 验证 Traefik Pod 调度结果（应分别运行在 ubuntu-111/112）
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik -o wide

3. HAProxy 配置（多节点代理 + 健康检查）

3.1 完整 HAProxy 配置文件

修改 HAProxy 配置，代理两个 Traefik 节点的 80/443 端口，并增加 TCP 层健康检查（验证 Traefik 服务可用性）：

#!/bin/bash
set -euo pipefail

# 基础配置
HAPROXY_NODE_IP="192.168.56.102"
MASTER_NODES=("192.168.56.111" "192.168.56.112" "192.168.56.113")
K8S_API_PORT=6443
HAPROXY_PORT=6443

# Traefik 配置（代理 ubuntu-111/112 的 80/443 端口）
TRAEFIK_NODES=("192.168.56.111" "192.168.56.112")
TRAEFIK_HTTP_PORT=80
TRAEFIK_HTTPS_PORT=443

# 安装 haproxy
apt update -y && apt install -y haproxy net-tools || true
mv /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.bak$(date +%Y%m%d%H%M%S) || true

# 生成 haproxy.cfg
cat > /etc/haproxy/haproxy.cfg <<EOF
global
  log /dev/log local0
  log /dev/log local1 notice
  chroot /var/lib/haproxy
  stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
  stats timeout 30s
  user haproxy group haproxy daemon
  maxconn 2000

defaults
  log global
  mode tcp
  option tcplog
  option dontlognull
  timeout connect 5000
  timeout client 50000
  timeout server 50000
  errorfile 400 /etc/haproxy/errors/400.http
  errorfile 403 /etc/haproxy/errors/403.http
  errorfile 408 /etc/haproxy/errors/408.http
  errorfile 500 /etc/haproxy/errors/500.http
  errorfile 502 /etc/haproxy/errors/502.http
  errorfile 503 /etc/haproxy/errors/503.http
  errorfile 504 /etc/haproxy/errors/504.http

# K8s apiserver 代理（原有配置）
frontend k8s-api-frontend
  bind ${HAPROXY_NODE_IP}:${HAPROXY_PORT}
  default_backend k8s-api-backend

backend k8s-api-backend
  mode tcp
  balance roundrobin
  option tcp-check
EOF

# 添加 master 节点到 apiserver backend
for master in "${MASTER_NODES[@]}"; do
  cat >> /etc/haproxy/haproxy.cfg <<EOF
server master-${master//./-}${master}:${K8S_API_PORT} check inter 2000 fall 3 rise 2
EOF
done

# Traefik HTTP 代理（多节点 + 健康检查）
cat >> /etc/haproxy/haproxy.cfg <<EOF
frontend traefik-http-frontend
  bind ${HAPROXY_NODE_IP}:${TRAEFIK_HTTP_PORT}
  default_backend traefik-http-backend

backend traefik-http-backend
  mode tcp
  balance roundrobin
  option tcp-check
  tcp-check connect port ${TRAEFIK_HTTP_PORT}
  tcp-check send GET /ping HTTP/1.1\r\nHost: localhost\r\n\r\n
  tcp-check expect string 200 OK
EOF

# 添加两个 Traefik 节点到 HTTP backend（带健康检查）
for node in "${TRAEFIK_NODES[@]}"; do
  cat >> /etc/haproxy/haproxy.cfg <<EOF
server traefik-node-${node//./-}-http ${node}:${TRAEFIK_HTTP_PORT} check inter 2000 fall 3 rise 2 timeout connect 3s
EOF
done

# Traefik HTTPS 代理（多节点 + 健康检查）
cat >> /etc/haproxy/haproxy.cfg <<EOF
frontend traefik-https-frontend
  bind ${HAPROXY_NODE_IP}:${TRAEFIK_HTTPS_PORT}
  default_backend traefik-https-backend

backend traefik-https-backend
  mode tcp
  balance roundrobin
  option tcp-check
  tcp-check connect port ${TRAEFIK_HTTPS_PORT}
EOF

# 添加两个 Traefik 节点到 HTTPS backend（带健康检查）
for node in "${TRAEFIK_NODES[@]}"; do
  cat >> /etc/haproxy/haproxy.cfg <<EOF
server traefik-node-${node//./-}-https ${node}:${TRAEFIK_HTTPS_PORT} check inter 2000 fall 3 rise 2 timeout connect 3s
EOF
done

# 重启 haproxy 并验证
systemctl daemon-reload
systemctl enable --now haproxy
systemctl restart haproxy

# 验证 HAProxy 状态
if systemctl is-active --quiet haproxy; then
  echo -e "\033[32mHAProxy 部署成功：\"
echo -e " - K8s API: ${HAPROXY_NODE_IP}:${HAPROXY_PORT}"
echo -e " - Traefik HTTP: ${HAPROXY_NODE_IP}:${TRAEFIK_HTTP_PORT} (代理到${TRAEFIK_NODES[*]})"
echo -e " - Traefik HTTPS: ${HAPROXY_NODE_IP}:${TRAEFIK_HTTPS_PORT} (代理到${TRAEFIK_NODES[*]})\033[0m"
else
  echo -e "\033[31mHAProxy 启动失败\033[0m"
  systemctl status haproxy --no-pager
  exit 1
fi

3.2 健康检查关键配置说明

• option tcp-check：启用 TCP 层健康检查，验证后端端口是否存活；
• tcp-check send GET /ping HTTP/1.1\r\nHost: localhost\r\n\r\n：向 Traefik 的 /ping 接口发送请求（Traefik 内置健康检查接口）；
• tcp-check expect string 200 OK：期望返回 200 状态码，确认 Traefik 服务正常；
• check inter 2000 fall 3 rise 2：每 2 秒检查一次，连续 3 次失败标记为不可用，连续 2 次成功恢复可用；
• timeout connect 3s：连接超时时间 3 秒，避免健康检查阻塞。

3.3 验证 HAProxy 健康检查

# 查看 HAProxy 后端状态
echo "show stat" | socat /run/haproxy/admin.sock stdio | grep traefik
# 查看 HAProxy 日志（验证健康检查结果）
tail -f /var/log/haproxy.log | grep traefik

hostNetwork vs NodePort 对比

Python HTTP 服务部署

1. 服务代码

from http.server import BaseHTTPRequestHandler, HTTPServer
import os, socket, json

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type', 'text/html; charset=utf-8')
        self.end_headers()
        # 获取容器与 Pod 元数据
        pod_name = os.getenv("POD_NAME", socket.gethostname())
        node_name = os.getenv("NODE_NAME", "unknown-node")
        app_info = {
            "app": "python-http-server",
            "container": os.getenv("CONTAINER_NAME", "python-http-server")
        }
        response = f"""
<h1>✅ Python HTTP Server</h1>
<p>Pod: {pod_name}</p>
<p>Node: {node_name}</p>
<p>App Info: {json.dumps(app_info, indent=2)}</p>
"""
        self.wfile.write(response.encode('utf-8'))

def run(server_class=HTTPServer, handler_class=Handler, port=8080):
    server_address = ('0.0.0.0', port)
    httpd = server_class(server_address, handler_class)
    print(f"🚀 Python HTTP 服务器启动：0.0.0.0:{port}")
    try:
        httpd.serve_forever()
    except KeyboardInterrupt:
        httpd.server_close()
        print("🛑 服务器已停止")

if __name__ == '__main__':
    run()

2. K8s 资源配置

apiVersion: apps/v1
kind: Deployment
metadata:
  name: python-http-server
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: python-http-server
  template:
    metadata:
      labels:
        app: python-http-server
    spec:
      containers:
        - name: python-http-server
          image: 192.168.56.102/library/python-http-server:v1
          ports:
            - containerPort: 8080
              name: http
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: CONTAINER_NAME
              value: "python-http-server"
---
apiVersion: v1
kind: Service
metadata:
  name: python-http-server
  namespace: default
spec:
  selector:
    app: python-http-server
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP
      name: http
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: python-http-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: "traefik"
spec:
  rules:
    - host: python-http.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: python-http-server
                port:
                  number: 80

整体验证流程

1. 验证 Traefik 调度

kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik -o wide
# 预期结果：两个 Traefik Pod 分别运行在 ubuntu-111、ubuntu-112

2. 验证 HAProxy 健康检查

# 查看 Traefik 后端状态（STATUS 列为 UP 表示正常）
echo "show stat" | socat /run/haproxy/admin.sock stdio | grep traefik | awk '{print $1,$2,$18}'

3. 验证 Python 服务访问

# 配置本地 hosts
echo "192.168.56.102 python-http.example.com" >> /etc/hosts
# 多次访问验证负载均衡（会轮询到两个 Traefik 节点）
curl http://python-http.example.com
curl http://python-http.example.com

4. 故障模拟验证

# 停止 ubuntu-111 上的 Traefik Pod
kubectl delete pod -n kube-system $(kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik -o name | grep ubuntu-111 | cut -d/ -f2)
# 查看 HAProxy 后端状态（ubuntu-111 节点会被标记为 DOWN，流量自动切换到 ubuntu-112）
echo "show stat" | socat /run/haproxy/admin.sock stdio | grep traefik

总结

本次实践完成了 Traefik 在多节点（ubuntu-111/112）的部署，通过节点标签和亲和性实现精准调度，配合 HAProxy 的多节点代理和健康检查，保障了入口流量的高可用。对比 hostNetwork 和 NodePort 模式，清晰体现了不同网络模式的优劣，也验证了 Python HTTP 服务通过 Traefik Ingress 暴露的完整链路，为 K8s 流量管理的学习打下了坚实基础。