ssl - Traefik 证书和路由功能

Question

我们正在开发一个 on-prim k8 集群(没有像云一样的本地负载均衡器)探索用于 SSL 终止和路由的 traefik。我们有几个问题
1) 它是否支持超过 1 个证书(我们没有通配符)，我们可以为每个路由配置 1 个证书吗？
2) 我们可以在低端口 443 上监听到集群的所有入口流量吗？我们使用 on-prim 全局负载均衡器对节点进行前端规划。
3)是否所有入口配置都需要在一个 yaml 中？我们可以为每个应用程序拆分配置(路由和 SSL 信息)
4) 我们正在使用 istio 进行东西向流量，集成有什么问题吗？

Answer 1

得到@nicomengin的回复

希望这些回复对您有所帮助:

1) does it support more than 1 certs ( no wild card for us), Yes you can define many services per entrypoints statically (in the Traefik configuration) or dynamically (thanks to the TLS secrets in K8s)

can we configure 1 cert per route ? The certificates are linked to entrypoints. As you can define many certificates per entrypoints, you can define a certificate for each (sub) domains. So, I'll say yes you can do that.

2) can we listen on low ports , 443 for all the ingress traffic to the cluster ? We plan front-end the nodes with a on-prim global load balancer. Yes, you can define entrypoints on all the ports you need, then you can define if they are TLS or not

3) does all ingress configuration needs to be in ONE yaml ? can can we split configurations(route and ssl info) per application Yes you can split your ingress rules in many YAML files

4) We are using istio for east-west traffic , any issues with integration ? No issues you can use together Traefik for nourth-south and Istio for esat-west