Windows下Kubernetes部署Traefik v2.5，无法访问面板及Nginx服务

问题描述 #

受技术文章启发，尝试在Kubernetes上搭建无安全配置的最小化Traefik v2.5环境（此前在Docker Swarm上使用Traefik多年，计划迁移至K8s）。已部署Traefik的Deployment、Service、IngressRoute，以及Nginx的对应资源，所有资源状态正常，但访问http://localhost/dashboard、http://localhost/dashboard/、http://localhost/nginx或http://localhost/nginx/时均出现ERR_CONNECTION_REFUSED错误。

Traefik配置文件 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik
spec:
  selector:
    matchLabels:
      app: traefik
  replicas: 1
  template:
    metadata:
      labels:
        app: traefik
    spec:
      containers:
      - name: traefik
        image: traefik:v2.5
        ports:
        - name: http
          containerPort: 80
        - name: admin
          containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  selector:
    app: traefik
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  - name: admin
    port: 8080
    protocol: TCP
    targetPort: admin
  type: NodePort
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-web-ui
spec:
  entryPoints:
    - web
  routes:
  - match: PathPrefix(`/dashboard`)
    kind: Rule
    services:
    - name: traefik
      port: 8080

Nginx配置文件 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - name: http
          containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  selector:
    app: nginx
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx
spec:
  entryPoints:
    - web
  routes:
  - match: PathPrefix(`/nginx`)
    kind: Rule
    services:
    - name: nginx
      port: http

执行命令 #

$ kubectl apply -f traefik.yaml
$ kubectl apply -f nginx.yaml

排查与解决方案 #

1. 端口访问方式错误 #

Traefik Service类型为NodePort，无法直接通过localhost:80访问。需先获取Traefik的NodePort端口：

kubectl get svc traefik

输出中http对应的PORT(S)列会显示80:XXXX/TCP，其中XXXX为NodePort端口。访问时需使用http://<节点IP>:XXXX/dashboard或http://<节点IP>:XXXX/nginx；本地K8s集群（如Minikube、Docker Desktop K8s）可直接用localhost:XXXX。

2. Traefik未启用入口点与必要配置 #

Traefik v2默认不自动启用入口点，需在Deployment的容器参数中添加配置，修改后容器部分如下：

containers:
- name: traefik
  image: traefik:v2.5
  args:
    - "--api.insecure=true" # 测试环境允许无认证访问dashboard
    - "--entrypoints.web.address=:80" # 启用web入口点监听80端口
    - "--providers.kubernetescrd=true" # 启用CRD provider以支持IngressRoute
  ports:
  - name: http
    containerPort: 80
  - name: admin
    containerPort: 8080

未启用入口点会导致Traefik不监听80端口，请求无法到达。

3. IngressRoute路径转发问题 #

Nginx默认监听根路径/，当前IngressRoute的PathPrefix(/nginx)会将/nginx路径转发给Nginx，需添加stripPrefix中间件去掉前缀：

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: nginx
spec:
  entryPoints:
    - web
  routes:
  - match: PathPrefix(`/nginx`)
    kind: Rule
    middlewares:
      - name: strip-nginx-prefix
    services:
    - name: nginx
      port: http
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: strip-nginx-prefix
spec:
  stripPrefix:
    prefixes:
      - "/nginx"

同时，结合--api.insecure=true参数，需访问/dashboard/（带尾斜杠）才能正常加载Traefik界面。

4. 集群网络连通性验证 #

• 检查Traefik Pod能否访问Nginx Service：

kubectl exec -it <traefik-pod-name> -- curl nginx:80

• 检查节点能否访问Traefik Pod的80端口：

kubectl exec -it <node-pod> -- curl <traefik-pod-ip>:80

若连通性异常，需排查集群CNI网络配置。

内容的提问来源于stack exchange，提问作者tm1701