Traefik 고급 — 미들웨어 설계, TLS 옵션, 멀티 프로바이더

요청 흐름

Client
  |
  v
[EntryPoint :websecure]
  |
  v
[Router 매칭]  --- Host(api.example.com) && PathPrefix(/v1)
  |
  v
[Middleware 체인]
   1. rate-limit        (속도 제한)
   2. forward-auth      (SSO 인증)
   3. strip-prefix      (경로 재작성)
   4. secure-headers    (보안 헤더)
  |
  v
[Service]  --- weighted / mirroring / sticky
  |
  v
Pod (백엔드)

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
  namespace: edge
spec:
  rateLimit:
    average: 100
    burst: 50
    period: 1s
    sourceCriterion:
      ipStrategy:
        depth: 1
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: secure-headers
  namespace: edge
spec:
  headers:
    browserXssFilter: true
    contentTypeNosniff: true
    frameDeny: true
    stsSeconds: 31536000
    stsIncludeSubdomains: true
    stsPreload: true
    customResponseHeaders:
      X-Robots-Tag: "noindex, nofollow"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-api-prefix
  namespace: edge
spec:
  stripPrefix:
    prefixes:
      - /v1

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-edge-chain
  namespace: edge
spec:
  chain:
    middlewares:
      - name: rate-limit
      - name: forward-auth-sso
      - name: strip-api-prefix
      - name: secure-headers

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: api-route
  namespace: edge
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`api.example.com`) && PathPrefix(`/v1`)
      kind: Rule
      middlewares:
        - name: api-edge-chain
      services:
        - name: api-backend
          port: 8080
  tls:
    secretName: api-example-com-tls

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: forward-auth-sso
  namespace: edge
spec:
  forwardAuth:
    address: http://auth-service.auth.svc.cluster.local:4180/oauth2/auth
    trustForwardHeader: true
    authResponseHeaders:
      - X-Auth-Request-User
      - X-Auth-Request-Email
      - X-Auth-Request-Groups
    authRequestHeaders:
      - Cookie
      - Authorization

forwardAuth 동작 순서

Client --(1) 요청--> Traefik
Traefik --(2) /oauth2/auth 검증--> auth-service
auth-service --(3a) 200 OK + 사용자 헤더--> Traefik --(4) 백엔드 호출--> Backend
auth-service --(3b) 401/302--> Traefik --(5) 동일 응답 반환--> Client

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: modern-tls
  namespace: edge
spec:
  minVersion: VersionTLS13
  sniStrict: true
  alpnProtocols:
    - h2
    - http/1.1
---
apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: intermediate-tls
  namespace: edge
spec:
  minVersion: VersionTLS12
  cipherSuites:
    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  curvePreferences:
    - CurveP521
    - CurveP384

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: secure-route
  namespace: edge
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`secure.example.com`)
      kind: Rule
      services:
        - name: secure-backend
          port: 8443
  tls:
    secretName: secure-example-com-tls
    options:
      name: modern-tls
      namespace: edge

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mtls-required
  namespace: edge
spec:
  minVersion: VersionTLS13
  clientAuth:
    secretNames:
      - partner-ca-bundle
    clientAuthType: RequireAndVerifyClientCert

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default
  namespace: edge
spec:
  defaultCertificate:
    secretName: wildcard-example-com-tls

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-weighted
  namespace: edge
spec:
  weighted:
    services:
      - name: api-stable
        port: 8080
        weight: 90
      - name: api-canary
        port: 8080
        weight: 10

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-mirrored
  namespace: edge
spec:
  mirroring:
    name: api-stable
    port: 8080
    mirrors:
      - name: api-shadow
        port: 8080
        percent: 20

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-sticky
  namespace: edge
spec:
  weighted:
    services:
      - name: api-stable
        port: 8080
        weight: 1
    sticky:
      cookie:
        name: traefik_backend
        secure: true
        httpOnly: true
        sameSite: strict

providers:
  kubernetesCRD:
    allowCrossNamespace: false
    allowExternalNameServices: false
  kubernetesGateway: {}
  file:
    directory: /etc/traefik/dynamic
    watch: true

experimental:
  plugins:
    customHeader:
      moduleName: github.com/example/traefik-custom-header
      version: v0.2.0

package customheader

import (
	"context"
	"net/http"
)

type Config struct {
	HeaderName  string `json:"headerName,omitempty"`
	HeaderValue string `json:"headerValue,omitempty"`
}

func CreateConfig() *Config {
	return &Config{}
}

type CustomHeader struct {
	next        http.Handler
	name        string
	headerName  string
	headerValue string
}

func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
	return &CustomHeader{
		next:        next,
		name:        name,
		headerName:  config.HeaderName,
		headerValue: config.HeaderValue,
	}, nil
}

func (c *CustomHeader) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
	req.Header.Set(c.headerName, c.headerValue)
	c.next.ServeHTTP(rw, req)
}

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: add-custom-header
  namespace: edge
spec:
  plugin:
    customHeader:
      headerName: X-Internal-Trace
      headerValue: edge-gateway

# 1단계: 카나리에 5퍼센트만 분배
kubectl patch traefikservice api-weighted -n edge --type merge \
  -p '{"spec":{"weighted":{"services":[{"name":"api-stable","port":8080,"weight":95},{"name":"api-canary","port":8080,"weight":5}]}}}'

# 메트릭 관찰 후 문제 없으면 25퍼센트로 증가
kubectl patch traefikservice api-weighted -n edge --type merge \
  -p '{"spec":{"weighted":{"services":[{"name":"api-stable","port":8080,"weight":75},{"name":"api-canary","port":8080,"weight":25}]}}}'

# 최종 전환: 100퍼센트
kubectl patch traefikservice api-weighted -n edge --type merge \
  -p '{"spec":{"weighted":{"services":[{"name":"api-stable","port":8080,"weight":0},{"name":"api-canary","port":8080,"weight":100}]}}}'

카나리 진행 곡선

트래픽 비율
100% |                          ____ green/canary
     |                      ___/
 50% |              ______/
     |        _____/
  5% |  _____/
   0% |_/_______________________________ 시간
       T0   T1   T2   T3   T4   T5
       각 단계마다 메트릭/에러율 게이트 통과 확인

metrics:
  prometheus:
    addEntryPointsLabels: true
    addRoutersLabels: true
    addServicesLabels: true
    buckets:
      - 0.1
      - 0.3
      - 1.2
      - 5.0
tracing:
  otlp:
    http:
      endpoint: http://otel-collector.observability.svc.cluster.local:4318/v1/traces

# 라우터, 미들웨어, 서비스가 정상 등록되었는지 API로 확인
kubectl port-forward -n edge deploy/traefik 8080:8080
curl -s http://localhost:8080/api/http/routers | jq '.[] | {name, status, rule}'
curl -s http://localhost:8080/api/http/middlewares | jq '.[] | {name, status}'

# CRD 적용 상태와 이벤트 확인
kubectl describe ingressroute api-route -n edge
kubectl get events -n edge --sort-by=.lastTimestamp

# TLS 핸드셰이크 및 인증서 확인
openssl s_client -connect secure.example.com:443 -servername secure.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject

# mTLS 클라이언트 인증서로 호출 테스트
curl -v --cert client.crt --key client.key https://secure.example.com/health