Traefik 完全ガイド — IngressRoute、ミドルウェア、動的設定

                  インターネット / 外部クライアント
                            |
                            v
   +-------------------------------------------------+
   |                  EntryPoint                     |
   |     (:80 web / :443 websecure ポートで受信)      |
   +-------------------------------------------------+
                            |
                            v
   +-------------------------------------------------+
   |                    Router                       |
   |  ルールマッチ: Host(`app.example.com`) && Path   |
   |  一致したら Middleware チェインへ渡す             |
   +-------------------------------------------------+
                            |
                            v
   +-------------------------------------------------+
   |          Middleware チェイン (順番どおり)         |
   |   auth -> redirect -> ratelimit -> stripprefix  |
   +-------------------------------------------------+
                            |
                            v
   +-------------------------------------------------+
   |                   Service                       |
   |  ロードバランシング先 (k8s Service / Pod)        |
   +-------------------------------------------------+
                            |
                            v
                    バックエンド Pod

# traefik.yml (静的設定)
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: ":443"
    http:
      tls: {}
  metrics:
    address: ":9100"

# 動的設定の例
http:
  routers:
    my-app:
      rule: "Host(`app.example.com`) && PathPrefix(`/api`)"
      entryPoints:
        - websecure
      middlewares:
        - strip-api-prefix
      service: my-app-service
      tls:
        certResolver: letsencrypt

# 静的設定でプロバイダを有効化
providers:
  kubernetesCRD:
    allowCrossNamespace: false
  kubernetesIngress:
    ingressClass: traefik
  kubernetesGateway: {}

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: default-auth@kubernetescrd
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
  ingressClassName: traefik
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-app-service
                port:
                  number: 80

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-app
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`app.example.com`) && PathPrefix(`/api`)
      kind: Rule
      priority: 10
      middlewares:
        - name: api-auth
        - name: strip-api-prefix
      services:
        - name: my-app-service
          port: 80
  tls:
    certResolver: letsencrypt

apiVersion: v1
kind: Secret
metadata:
  name: dashboard-auth-secret
  namespace: default
type: Opaque
stringData:
  users: |
    admin:$apr1$abcd1234$encryptedpasswordhash
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-auth
  namespace: default
spec:
  basicAuth:
    secret: dashboard-auth-secret
    removeHeader: true

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: https-redirect
  namespace: default
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: legacy-redirect
  namespace: default
spec:
  redirectRegex:
    regex: "^https://old.example.com/(.*)"
    replacement: "https://new.example.com/${1}"
    permanent: true

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-ratelimit
  namespace: default
spec:
  rateLimit:
    average: 100
    burst: 50
    period: 1s
    sourceCriterion:
      ipStrategy:
        depth: 1

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-api-prefix
  namespace: default
spec:
  stripPrefix:
    prefixes:
      - /api
    forceSlash: false

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: secure-api
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`api.example.com`)
      kind: Rule
      middlewares:
        - name: https-redirect
        - name: api-auth
        - name: api-ratelimit
        - name: strip-api-prefix
      services:
        - name: api-service
          port: 8080
  tls:
    certResolver: letsencrypt

リクエスト
  -> https-redirect   (HTTP なら HTTPS へリダイレクト)
  -> api-auth         (認証の通過判定)
  -> api-ratelimit    (リクエスト速度の制限)
  -> strip-api-prefix (パス prefix の除去)
  -> api-service      (バックエンドへ転送)

# 静的設定 — HTTP-01 チャレンジ
certificatesResolvers:
  letsencrypt:
    acme:
      email: ops@example.com
      storage: /data/acme.json
      httpChallenge:
        entryPoint: web

certificatesResolvers:
  letsencrypt-dns:
    acme:
      email: ops@example.com
      storage: /data/acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"

# 静的設定でダッシュボードと API を有効化
api:
  dashboard: true
  insecure: false

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
  namespace: traefik
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`traefik.example.com`)
      kind: Rule
      middlewares:
        - name: dashboard-auth
      services:
        - name: api@internal
          kind: TraefikService
  tls:
    certResolver: letsencrypt

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: traefik
spec:
  controllerName: traefik.io/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: traefik-gateway
  namespace: traefik
spec:
  gatewayClassName: traefik
  listeners:
    - name: web
      protocol: HTTP
      port: 80
    - name: websecure
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: example-tls
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-app-route
  namespace: default
spec:
  parentRefs:
    - name: traefik-gateway
      namespace: traefik
  hostnames:
    - "app.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /api
      backendRefs:
        - name: my-app-service
          port: 80

# リポジトリ追加とインストール
helm repo add traefik https://traefik.github.io/charts
helm repo update
helm install traefik traefik/traefik \
  --namespace traefik --create-namespace \
  --values values.yaml

# values.yaml
deployment:
  replicas: 2

ingressClass:
  enabled: true
  isDefaultClass: true

providers:
  kubernetesCRD:
    enabled: true
    allowCrossNamespace: false
  kubernetesIngress:
    enabled: true
  kubernetesGateway:
    enabled: true

ports:
  web:
    redirectTo:
      port: websecure
  websecure:
    tls:
      enabled: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: ops@example.com
      storage: /data/acme.json
      httpChallenge:
        entryPoint: web

persistence:
  enabled: true
  size: 128Mi
  path: /data

dashboard:
  enabled: true

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 256Mi

logs:
  general:
    level: INFO
  access:
    enabled: true

kubectl get pods -n traefik
kubectl get svc -n traefik
kubectl logs -n traefik deploy/traefik --tail=100

metrics:
  prometheus:
    entryPoint: metrics
    addEntryPointsLabels: true
    addServicesLabels: true

accessLog:
  format: json
  filters:
    statusCodes:
      - "400-499"
      - "500-599"

ping:
  entryPoint: web

entryPoints:
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: 60s
        writeTimeout: 60s
        idleTimeout: 180s

# Router の状態を API で照会
kubectl port-forward -n traefik deploy/traefik 8080:8080
curl http://localhost:8080/api/http/routers

entryPoints:
  websecure:
    address: ":443"
    forwardedHeaders:
      trustedIPs:
        - "10.0.0.0/8"
        - "172.16.0.0/12"