apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: traefik-dashboard
  namespace: kube-system
  annotations:
    kubernetes.io/ingress.class: traefik # использовать traefk из IngressClass
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  rules:
  - host: ingress.od.com
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: traefik-v2
            port:
              number: 8090

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
  namespace: kube-system
spec:
  entryPoints:
  - web
  routes:
  - match: Host(`traefik.od.com`)  # Укажите доменное имя
    kind: Rule
    services:
    - name: api@internal
      kind: TraefikService

cat > whoami.yml <<EOF
apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  labels:
    app: whoami
spec:
  replicas: 1
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: containous/whoami
          ports:
            - name: web
              containerPort: 80
EOF

cat > who-ing.yml <<EOF
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroute-demo
spec:
  entryPoints:
    - web
  routes:
    - match: Host(\`whoami.od.com\`) && PathPrefix(\`/notls\`)
      kind: Rule
      services:
        - name: whoami
          port: 80
EOF

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=whoami.od.com"

# Обратите внимание, что имя файла сертификата должно быть да. tls.crt и tls.key
kubectl create secret tls who-tls --cert=tls.crt --key=tls.key

cat >> who-ing.yml <<EOF
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroute-tls-demo
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(\`whoami.od.com\`) && PathPrefix(\`/tls\`)
      kind: Rule
      services:
        - name: whoami
          port: 80
  tls:
    secretName: who-tls
EOF

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingressroute-tls-demo2
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  tls:
    - secretName: who-tls
  rules:
  - host: whoami.od.com
    http:
      paths:
      - pathType: Prefix
        path: /ssl
        backend:
          service:
            name: whoami
            port:
              number: 80

cat > mongo.yaml <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mongo-traefik
  labels:
    app: mongo-traefik
spec:
  selector:
    matchLabels:
      app: mongo-traefik
  template:
    metadata:
      labels:
        app: mongo-traefik
    spec:
      containers:
        - name: mongo
          image: mongo:5.0
          ports:
            - containerPort: 27017
---
apiVersion: v1
kind: Service
metadata:
  name: mongo-traefik
spec:
  selector:
    app: mongo-traefik
  ports:
    - port: 27017
EOF

cat > mongo-ingressroute-tcp.yaml <<EOF
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mongo-traefik-tcp
spec:
  entryPoints:
    - mongo
  routes:
    - match: HostSNI(\`*\`)  # потому что Traefik используется в TCP Требуется настройка маршрутизации СНИ, в то время как SNI Зависимость снова TLS из, поэтому нам нужен сертификат конфигурации. Если сертификата нет, мы можем использовать подстановочный символ.*(Известные видыip) Может Конфигурация
      services:
        - name: mongo-traefik
          port: 27017
EOF

vim cm.yml
...
   entryPoints:
      web:
        address: ":80"
      websecure:
        address: ":443"
      traefik:
        address: ":8090"
      metrics:
        address: ":9100"
      mongo:
        address: ":27017"        # Конфигурация порта 27017, как вход монго
...

kubectl apply -f cm.yml
kubectl delete pods -n kube-system -l app=traefix-v2

# Создать корневой сертификат
#-x509： Используется для создания самозаверяющего сертификата. Это не требуется, если вам не нужен самозаверяющий сертификат.
#-days: Срок действия сертификата, по умолчанию – 365 дней.
#Введите параметры напрямую и введите пароль напрямую.
openssl req -out ca.pem -new -x509 -days 3650 -subj "/C=CN/ST=BeiJing/O=Boysec/CN=server1/CN=Boysec/emailAddress=wangxiansen@boysec.cn"
#Просто используйте свой пароль, passwd

# Создать закрытый ключ сертификата
openssl genrsa -out server.key 2048

# Создание файлов приложения сертификата cat server.req
# CN=mongo.local Машина дамонго запускает информацию об имени домена узла. Если она не совпадает, будет сообщено об ошибке.
openssl req -key server.key -new -out server.req -subj "/C=CN/ST=BeiJing/O=Boysec/CN=server1/CN=Boysec/CN=mongo.local/emailAddress=wangxiansen@boysec.cn"

# Создать сертификат
openssl x509 -req -in server.req -CA ca.pem -CAkey privkey.pem -CAcreateserial -out server.crt -days 3650

# Объединить закрытый ключ и открытый ключ,Создать файл server.pem
cat server.key server.crt > server.pem

$ kubectl create secret tls mongo-certs --cert=server.crt --key=server.key

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mongo-traefik-tcp
spec:
  entryPoints:
    - mongo
  routes:
    - match: HostSNI(`mongo.local`)
      services:
        - name: mongo-traefik
          port: 27017
  tls:
    secretName: mongo-certs

$ mongo --host mongo.local --port 27017 --ssl --sslCAFile=./ca.pem --sslPEMKeyFile=./server.pem
MongoDB shell version v4.4.24
connecting to: mongodb://mongo.local:27017/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("4a8a66b1-7371-415f-b353-23d71648e054") }
MongoDB server version: 5.0.5
WARNING: shell and server versions do not match
> show dbs
admin   0.000GB
config  0.000GB
local   0.000GB

mongo --host traefik.od.com --port 27017 --ssl --sslCAFile=./ca.pem --sslPEMKeyFile=./server.pem
{"t":{"$date":"2023-07-22T03:52:20.300Z"},"s":"W",  "c":"CONTROL",  "id":23321,   "ctx":"main","msg":"Option: This name is deprecated. Please use the preferred name instead.","attr":{"deprecatedName":"ssl","preferredName":"tls"}}
{"t":{"$date":"2023-07-22T03:52:20.300Z"},"s":"W",  "c":"CONTROL",  "id":23321,   "ctx":"main","msg":"Option: This name is deprecated. Please use the preferred name instead.","attr":{"deprecatedName":"sslPEMKeyFile","preferredName":"tlsCertificateKeyFile"}}
{"t":{"$date":"2023-07-22T03:52:20.300Z"},"s":"W",  "c":"CONTROL",  "id":23321,   "ctx":"main","msg":"Option: This name is deprecated. Please use the preferred name instead.","attr":{"deprecatedName":"sslCAFile","preferredName":"tlsCAFile"}}
MongoDB shell version v4.4.24
connecting to: mongodb://k8s.mongo.local:27017/?compressors=disabled&gssapiServiceName=mongodb
Error: couldn't connect to server k8s.mongo.local:27017, connection attempt failed: HostNotFound: Could not find address for k8s.mongo.local:27017: SocketException: Host not found (authoritative) :
connect@src/mongo/shell/mongo.js:374:17
@(connect):2:6
exception: connect failed
exiting with code 1

apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
spec:
  ports:
    - protocol: UDP
      name: udp
      port: 8080
  selector:
    app: whoamiudp
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  labels:
    app: whoamiudp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoamiudp
  template:
    metadata:
      labels:
        app: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: containous/whoamiudp
          ports:
            - name: udp
              containerPort: 8080

...
    entryPoints:
      web:
        address: ":80"          ## Конфигурация 80 порт и установите имя записи web
      websecure:
        address: ":443"         # Конфигурация443порт и установите имя записи websecure
      traefik:
        address: ":8090"        ## Конфигурация 8090 порт и установите имя записи dashboard
      metrics:
        address: ":9100"        ## Конфигурация 9100 Порт, используемый как вход в сбор метрик.
      mongo:
        address: ":27017"        # Конфигурация порт 9200, как TCP вход
      udpep:
        address: ":9300/udp"    # Конфигурация порта 9300, как вход udp
...

kubectl apply -f cm.yml
kubectl delete pods -n kube-system -l app=traefix-v2

cat <<EOF | kubectl apply -f -
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: whoamiudp
spec:
  entryPoints:
  - udpep
  routes:
  - services:
    - name: whoamiudp
      port: 8080
EOF
$  kubectl get ingressrouteudp
NAME        AGE
whoamiudp   27s

$ kubectl get svc
NAME            TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)     AGE
whoamiudp       ClusterIP   192.168.145.194   <none>        8080/UDP    112s

$ echo "WHO" | socat - udp4-datagram:192.168.145.194:8080
Hostname: whoamiudp-7d968ff858-c425d
IP: 127.0.0.1
IP: 172.16.130.8
$ echo "wangxiansen" | socat - udp4-datagram:192.168.145.194:8080            
Received: wangxiansen