Ingress, TLS, маршрутизація трафіку та діагностика edge

helm repo add traefik https://traefik.github.io/charts
helm repo update traefik
helm upgrade --install traefik traefik/traefik \
  --version 41.4.0 --namespace traefik-system --create-namespace \
  --wait --timeout 5m --set api.dashboard=false \
  --set ingressRoute.dashboard.enabled=false \
  --set service.spec.type=NodePort \
  --set ports.web.nodePort=30080 --set ports.websecure.nodePort=30443
kubectl -n traefik-system get deployment,pod,service
kubectl get ingressclass traefik -o yaml

mkdir -p /tmp/k8s-m08
kubectl create namespace k8s-m08
cat > /tmp/k8s-m08/app.yaml <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata: {name: web, namespace: k8s-m08}
spec:
  replicas: 2
  selector: {matchLabels: {app: web}}
  template:
    metadata: {labels: {app: web}}
    spec:
      containers:
      - name: nginx
        image: nginx:1.29-alpine
        command: ["sh", "-c"]
        args: ["printf 'web=%s\n' "$HOSTNAME" > /usr/share/nginx/html/index.html; exec nginx -g 'daemon off;'"]
        ports: [{name: http, containerPort: 80}]
---
apiVersion: apps/v1
kind: Deployment
metadata: {name: api, namespace: k8s-m08}
spec:
  replicas: 2
  selector: {matchLabels: {app: api}}
  template:
    metadata: {labels: {app: api}}
    spec:
      containers:
      - name: nginx
        image: nginx:1.29-alpine
        command: ["sh", "-c"]
        args: ["mkdir -p /usr/share/nginx/html/api; printf 'api=%s\n' "$HOSTNAME" > /usr/share/nginx/html/api/index.html; exec nginx -g 'daemon off;'"]
        ports: [{name: http, containerPort: 80}]
---
apiVersion: v1
kind: Service
metadata: {name: web, namespace: k8s-m08}
spec: {selector: {app: web}, ports: [{name: http, port: 80, targetPort: http}]}
---
apiVersion: v1
kind: Service
metadata: {name: api, namespace: k8s-m08}
spec: {selector: {app: api}, ports: [{name: http, port: 80, targetPort: http}]}
EOF
kubectl apply --dry-run=server -f /tmp/k8s-m08/app.yaml
kubectl apply -f /tmp/k8s-m08/app.yaml
kubectl -n k8s-m08 wait --for=condition=Available deployment/web deployment/api --timeout=180s
kubectl -n k8s-m08 get service,endpointslice,pod -o wide

cat > /tmp/k8s-m08/ingress.yaml <<'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: course
  namespace: k8s-m08
  annotations: {traefik.ingress.kubernetes.io/router.entrypoints: "web,websecure"}
spec:
  ingressClassName: traefik
  rules:
  - host: app.course.test
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend: {service: {name: api, port: {name: http}}}
      - path: /
        pathType: Prefix
        backend: {service: {name: web, port: {name: http}}}
EOF
kubectl apply --dry-run=server -f /tmp/k8s-m08/ingress.yaml
kubectl apply -f /tmp/k8s-m08/ingress.yaml
kubectl -n k8s-m08 describe ingress course
node_ip=$(hostname -I | awk '{print $1}')
curl -fsS -H 'Host: app.course.test' "http://$node_ip:30080/"
curl -fsS -H 'Host: app.course.test' "http://$node_ip:30080/api/"

openssl req -x509 -nodes -newkey rsa:2048 -days 30 \
  -keyout /tmp/k8s-m08/tls.key -out /tmp/k8s-m08/tls.crt \
  -subj '/CN=app.course.test' -addext 'subjectAltName=DNS:app.course.test'
kubectl -n k8s-m08 create secret tls edge-tls --cert=/tmp/k8s-m08/tls.crt --key=/tmp/k8s-m08/tls.key
kubectl -n k8s-m08 patch ingress course --type=merge -p \
  '{"spec":{"tls":[{"hosts":["app.course.test"],"secretName":"edge-tls"}]}}'
node_ip=$(hostname -I | awk '{print $1}')
curl --resolve "app.course.test:30443:$node_ip" --cacert /tmp/k8s-m08/tls.crt https://app.course.test:30443/
openssl s_client -connect "$node_ip:30443" -servername app.course.test </dev/null 2>/dev/null \
 | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

kubectl -n k8s-m08 patch ingress course --type=merge -p '{"spec":{"ingressClassName":"missing"}}'
curl -sS -o /dev/null -w 'status=%{http_code}\n' -H 'Host: app.course.test' "http://$(hostname -I | awk '{print $1}'):30080/"
kubectl get ingressclass; kubectl -n k8s-m08 describe ingress course
kubectl -n k8s-m08 patch ingress course --type=merge -p '{"spec":{"ingressClassName":"traefik"}}'
kubectl -n k8s-m08 patch service api --type=merge -p '{"spec":{"selector":{"app":"missing"}}}'
curl -sS -o /dev/null -w 'status=%{http_code}\n' -H 'Host: app.course.test' "http://$(hostname -I | awk '{print $1}'):30080/api/"
kubectl -n traefik-system logs deployment/traefik --since=2m | tail -40
kubectl -n k8s-m08 patch service api --type=merge -p '{"spec":{"selector":{"app":"api"}}}'

kubectl delete namespace k8s-m08 --wait=true
rm -rf /tmp/k8s-m08
# Traefik остаётся инфраструктурой следующих лабораторий.
# Полное удаление: helm uninstall traefik -n traefik-system