Traefik 応用 — ミドルウェア設計、TLS オプション、マルチプロバイダ

リクエストの流れ

Client
  |
  v
[EntryPoint :websecure]
  |
  v
[Router マッチ]  --- Host(api.example.com) && PathPrefix(/v1)
  |
  v
[Middleware チェーン]
   1. rate-limit        (レート制限)
   2. forward-auth      (SSO 認証)
   3. strip-prefix      (パス書き換え)
   4. secure-headers    (セキュリティヘッダ)
  |
  v
[Service]  --- weighted / mirroring / sticky
  |
  v
Pod (バックエンド)

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
  namespace: edge
spec:
  rateLimit:
    average: 100
    burst: 50
    period: 1s
    sourceCriterion:
      ipStrategy:
        depth: 1
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: secure-headers
  namespace: edge
spec:
  headers:
    browserXssFilter: true
    contentTypeNosniff: true
    frameDeny: true
    stsSeconds: 31536000
    stsIncludeSubdomains: true
    stsPreload: true
    customResponseHeaders:
      X-Robots-Tag: "noindex, nofollow"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-api-prefix
  namespace: edge
spec:
  stripPrefix:
    prefixes:
      - /v1

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-edge-chain
  namespace: edge
spec:
  chain:
    middlewares:
      - name: rate-limit
      - name: forward-auth-sso
      - name: strip-api-prefix
      - name: secure-headers

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: api-route
  namespace: edge
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`api.example.com`) && PathPrefix(`/v1`)
      kind: Rule
      middlewares:
        - name: api-edge-chain
      services:
        - name: api-backend
          port: 8080
  tls:
    secretName: api-example-com-tls

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: forward-auth-sso
  namespace: edge
spec:
  forwardAuth:
    address: http://auth-service.auth.svc.cluster.local:4180/oauth2/auth
    trustForwardHeader: true
    authResponseHeaders:
      - X-Auth-Request-User
      - X-Auth-Request-Email
      - X-Auth-Request-Groups
    authRequestHeaders:
      - Cookie
      - Authorization

forwardAuth の動作順序

Client --(1) リクエスト--> Traefik
Traefik --(2) /oauth2/auth 検証--> auth-service
auth-service --(3a) 200 OK + ユーザヘッダ--> Traefik --(4) バックエンド呼び出し--> Backend
auth-service --(3b) 401/302--> Traefik --(5) 同じ応答を返す--> Client

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: modern-tls
  namespace: edge
spec:
  minVersion: VersionTLS13
  sniStrict: true
  alpnProtocols:
    - h2
    - http/1.1
---
apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: intermediate-tls
  namespace: edge
spec:
  minVersion: VersionTLS12
  cipherSuites:
    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  curvePreferences:
    - CurveP521
    - CurveP384

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: secure-route
  namespace: edge
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`secure.example.com`)
      kind: Rule
      services:
        - name: secure-backend
          port: 8443
  tls:
    secretName: secure-example-com-tls
    options:
      name: modern-tls
      namespace: edge

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mtls-required
  namespace: edge
spec:
  minVersion: VersionTLS13
  clientAuth:
    secretNames:
      - partner-ca-bundle
    clientAuthType: RequireAndVerifyClientCert

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default
  namespace: edge
spec:
  defaultCertificate:
    secretName: wildcard-example-com-tls

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-weighted
  namespace: edge
spec:
  weighted:
    services:
      - name: api-stable
        port: 8080
        weight: 90
      - name: api-canary
        port: 8080
        weight: 10

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-mirrored
  namespace: edge
spec:
  mirroring:
    name: api-stable
    port: 8080
    mirrors:
      - name: api-shadow
        port: 8080
        percent: 20

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-sticky
  namespace: edge
spec:
  weighted:
    services:
      - name: api-stable
        port: 8080
        weight: 1
    sticky:
      cookie:
        name: traefik_backend
        secure: true
        httpOnly: true
        sameSite: strict

providers:
  kubernetesCRD:
    allowCrossNamespace: false
    allowExternalNameServices: false
  kubernetesGateway: {}
  file:
    directory: /etc/traefik/dynamic
    watch: true

experimental:
  plugins:
    customHeader:
      moduleName: github.com/example/traefik-custom-header
      version: v0.2.0

package customheader

import (
	"context"
	"net/http"
)

type Config struct {
	HeaderName  string `json:"headerName,omitempty"`
	HeaderValue string `json:"headerValue,omitempty"`
}

func CreateConfig() *Config {
	return &Config{}
}

type CustomHeader struct {
	next        http.Handler
	name        string
	headerName  string
	headerValue string
}

func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
	return &CustomHeader{
		next:        next,
		name:        name,
		headerName:  config.HeaderName,
		headerValue: config.HeaderValue,
	}, nil
}

func (c *CustomHeader) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
	req.Header.Set(c.headerName, c.headerValue)
	c.next.ServeHTTP(rw, req)
}

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: add-custom-header
  namespace: edge
spec:
  plugin:
    customHeader:
      headerName: X-Internal-Trace
      headerValue: edge-gateway

# ステップ1: カナリアに 5 パーセントだけ分配
kubectl patch traefikservice api-weighted -n edge --type merge \
  -p '{"spec":{"weighted":{"services":[{"name":"api-stable","port":8080,"weight":95},{"name":"api-canary","port":8080,"weight":5}]}}}'

# メトリクス観察後に問題なければ 25 パーセントへ増やす
kubectl patch traefikservice api-weighted -n edge --type merge \
  -p '{"spec":{"weighted":{"services":[{"name":"api-stable","port":8080,"weight":75},{"name":"api-canary","port":8080,"weight":25}]}}}'

# 最終切り替え: 100 パーセント
kubectl patch traefikservice api-weighted -n edge --type merge \
  -p '{"spec":{"weighted":{"services":[{"name":"api-stable","port":8080,"weight":0},{"name":"api-canary","port":8080,"weight":100}]}}}'

カナリアの進行曲線

トラフィック比率
100% |                          ____ green/canary
     |                      ___/
 50% |              ______/
     |        _____/
  5% |  _____/
   0% |_/_______________________________ 時間
       T0   T1   T2   T3   T4   T5
       各ステップでメトリクス/エラー率のゲート通過を確認

metrics:
  prometheus:
    addEntryPointsLabels: true
    addRoutersLabels: true
    addServicesLabels: true
    buckets:
      - 0.1
      - 0.3
      - 1.2
      - 5.0
tracing:
  otlp:
    http:
      endpoint: http://otel-collector.observability.svc.cluster.local:4318/v1/traces

# ルータ、ミドルウェア、サービスが正常に登録されたか API で確認
kubectl port-forward -n edge deploy/traefik 8080:8080
curl -s http://localhost:8080/api/http/routers | jq '.[] | {name, status, rule}'
curl -s http://localhost:8080/api/http/middlewares | jq '.[] | {name, status}'

# CRD の適用状態とイベントを確認
kubectl describe ingressroute api-route -n edge
kubectl get events -n edge --sort-by=.lastTimestamp

# TLS ハンドシェイクと証明書を確認
openssl s_client -connect secure.example.com:443 -servername secure.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject

# mTLS クライアント証明書で呼び出しテスト
curl -v --cert client.crt --key client.key https://secure.example.com/health