织梦网站栏目访问目录本地电商平台开发

织梦网站栏目访问目录,本地电商平台开发,制作logo网站,深圳互联网企业有哪些前言 Traefik是一款现代化的云原生边缘路由器#xff0c;原生支持Docker和Kubernetes。与Nginx不同#xff0c;Traefik可以自动发现服务并动态更新配置#xff0c;非常适合微服务架构。 一、Traefik vs Nginx特性TraefikNginx服务发现✅ 自动❌ 需手动配置动态配置✅ 热更新…前言Traefik是一款现代化的云原生边缘路由器原生支持Docker和Kubernetes。与Nginx不同Traefik可以自动发现服务并动态更新配置非常适合微服务架构。一、Traefik vs Nginx特性TraefikNginx服务发现✅ 自动❌ 需手动配置动态配置✅ 热更新❌ 需reloadLet’s Encrypt✅ 自动❌ 需certbotDashboard✅ 内置❌ 需第三方学习曲线中等较低性能高极高适用场景云原生/容器传统/静态二、Docker快速开始2.1 基础部署# docker-compose.ymlversion:3.8services:traefik:image:traefik:v3.0container_name:traefikcommand:---api.dashboardtrue---providers.dockertrue---providers.docker.exposedbydefaultfalse---entrypoints.web.address:80---entrypoints.websecure.address:443ports:-80:80-443:443volumes:-/var/run/docker.sock:/var/run/docker.sock:ro-./traefik:/etc/traefiknetworks:-traefik-netlabels:# Dashboard-traefik.enabletrue-traefik.http.routers.dashboard.ruleHost(traefik.example.com)-traefik.http.routers.dashboard.serviceapiinternal-traefik.http.routers.dashboard.middlewaresauth-traefik.http.middlewares.auth.basicauth.usersadmin:$$apr1$$xxxnetworks:traefik-net:external:true2.2 配置文件# traefik/traefik.ymlapi:dashboard:trueinsecure:falseentryPoints:web:address::80http:redirections:entryPoint:to:websecurescheme:httpswebsecure:address::443providers:docker:endpoint:unix:///var/run/docker.sockexposedByDefault:falsenetwork:traefik-netfile:directory:/etc/traefik/dynamicwatch:truecertificatesResolvers:letsencrypt:acme:email:adminexample.comstorage:/etc/traefik/acme.jsonhttpChallenge:entryPoint:web三、服务代理配置3.1 Docker Labels方式# 应用服务services:webapp:image:nginx:alpinelabels:-traefik.enabletrue# 路由规则-traefik.http.routers.webapp.ruleHost(app.example.com)-traefik.http.routers.webapp.entrypointswebsecure-traefik.http.routers.webapp.tls.certresolverletsencrypt# 服务配置-traefik.http.services.webapp.loadbalancer.server.port80networks:-traefik-netapi:image:my-api:latestlabels:-traefik.enabletrue# 路径前缀路由-traefik.http.routers.api.ruleHost(app.example.com) PathPrefix(/api)-traefik.http.routers.api.entrypointswebsecure-traefik.http.routers.api.tls.certresolverletsencrypt# 去除路径前缀-traefik.http.routers.api.middlewaresstrip-api-traefik.http.middlewares.strip-api.stripprefix.prefixes/api-traefik.http.services.api.loadbalancer.server.port8080networks:-traefik-net3.2 文件配置方式# traefik/dynamic/services.ymlhttp:routers:external-service:rule:Host(external.example.com)entryPoints:-websecureservice:external-servicetls:certResolver:letsencryptservices:external-service:loadBalancer:servers:-url:http://192.168.1.100:8080-url:http://192.168.1.101:8080healthCheck:path:/healthinterval:10s四、中间件配置4.1 常用中间件# traefik/dynamic/middlewares.ymlhttp:middlewares:# Basic认证auth-basic:basicAuth:users:-admin:$apr1$xxx# 速率限制rate-limit:rateLimit:average:100burst:50# 请求头secure-headers:headers:frameDeny:truesslRedirect:truebrowserXssFilter:truecontentTypeNosniff:truestsSeconds:31536000stsIncludeSubdomains:true# IP白名单ip-whitelist:ipWhiteList:sourceRange:-10.0.0.0/8-192.168.0.0/16# 重试retry:retry:attempts:3initialInterval:100ms# 压缩compress:compress:{}# 熔断circuit-breaker:circuitBreaker:expression:NetworkErrorRatio() 0.5 || ResponseCodeRatio(500, 600, 0, 600) 0.54.2 应用中间件# Docker Labelslabels:-traefik.http.routers.myapp.middlewaresrate-limit,secure-headers,compress# 文件配置http:routers:myapp:middlewares:-rate-limit-secure-headers-compress五、负载均衡5.1 轮询策略http:services:my-service:loadBalancer:servers:-url:http://server1:80-url:http://server2:80-url:http://server3:805.2 加权轮询http:services:my-service:weighted:services:-name:server1weight:3-name:server2weight:15.3 会话保持http:services:my-service:loadBalancer:sticky:cookie:name:server_idsecure:truehttpOnly:true六、Kubernetes集成6.1 Helm安装helm repoaddtraefik https://traefik.github.io/charts helm repo update helminstalltraefik traefik/traefik -n traefik --create-namespace6.2 IngressRoute配置apiVersion:traefik.io/v1alpha1kind:IngressRoutemetadata:name:webappnamespace:defaultspec:entryPoints:-websecureroutes:-match:Host(app.example.com)kind:Ruleservices:-name:webappport:80middlewares:-name:rate-limittls:certResolver:letsencrypt---apiVersion:traefik.io/v1alpha1kind:Middlewaremetadata:name:rate-limitspec:rateLimit:average:100burst:50七、多站点代理7.1 跨网络服务代理当需要代理不同网络中的服务时传统方式需要公网IP或VPN。使用组网软件如星空组网可以将多个站点组成虚拟局域网# traefik/dynamic/multi-site.ymlhttp:routers:beijing-api:rule:Host(api.example.com) PathPrefix(/beijing)service:beijing-apishanghai-api:rule:Host(api.example.com) PathPrefix(/shanghai)service:shanghai-apiservices:# 北京站点服务通过虚拟内网访问beijing-api:loadBalancer:servers:-url:http://10.26.0.10:8080# 上海站点服务通过虚拟内网访问shanghai-api:loadBalancer:servers:-url:http://10.26.0.20:8080八、监控与日志8.1 Prometheus指标# traefik.ymlmetrics:prometheus:addEntryPointsLabels:trueaddServicesLabels:truebuckets:-0.1-0.3-1.2-5.08.2 访问日志accessLog:filePath:/var/log/traefik/access.logformat:jsonfilters:statusCodes:-400-499-500-599retryAttempts:trueminDuration:10ms8.3 Grafana Dashboard导入Dashboard ID:17346Traefik官方Dashboard九、生产配置示例# docker-compose-production.ymlversion:3.8services:traefik:image:traefik:v3.0container_name:traefikrestart:unless-stoppedsecurity_opt:-no-new-privileges:trueports:-80:80-443:443volumes:-/var/run/docker.sock:/var/run/docker.sock:ro-./traefik:/etc/traefik-./logs:/var/log/traefikenvironment:-TZAsia/Shanghainetworks:-traefik-nethealthcheck:test:[CMD,traefik,healthcheck]interval:30stimeout:3sretries:3deploy:resources:limits:memory:512Mnetworks:traefik-net:driver:bridge十、总结Traefik是云原生时代的优秀网关选择特点优势自动发现Docker/K8s服务自动注册动态配置无需重启热更新Let’s Encrypt自动申请和续期证书中间件认证、限流、熔断开箱即用Dashboard可视化管理界面适用场景微服务架构Docker/Kubernetes环境需要自动SSL的场景频繁变更的服务配置参考资料Traefik官方文档https://doc.traefik.io/traefik/Traefik GitHubhttps://github.com/traefik/traefikLet’s Encrypt配置https://doc.traefik.io/traefik/https/acme/本文首发于CSDN转载请注明出处。