Kubernetes中Traefik路由异常及TLS证书配置问题求助

我无法将Traefik Ingress配置为预期状态：原本期望dev.mywebsite.io的/、/api-server、/hermes路径分别对应theia-svc、api-server-svc、hermes-svc三个服务，但所有路径均返回theia-svc内容或404错误。

初始Ingress配置文件（k8.ingress-traefik.yml） #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/force-ssl-redirect: "false"
    ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/cluster-issuer: letsencrypt
    # traefik.ingress.kubernetes.io/rewrite-target: "/"
    # traefik.ingress.kubernetes.io/rule-type: "PathPrefixStrip"
    traefik.ingress.kubernetes.io/app-root: "/"
    # traefik.ingress.kubernetes.io/frontend-entry-points: "http,https"

  name: traefik-ingress
spec:
  ingressClassName: traefik
  rules:
    - host: dev.mywebsite.io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: theia-svc
                port:
                  number: 80
          - path: /api-server
            pathType: Prefix
            backend:
              service:
                name: api-server-svc
                port:
                  number: 8082
          - path: /hermes
            pathType: Exact
            backend:
              service:
                name: hermes-svc
                port:
                  number: 8000
          - path: /hermes2/
            pathType: Exact
            backend:
              service:
                name: hermes-svc
                port:
                  number: 8000
          - path: /hermes3/
            pathType: Prefix
            backend:
              service:
                name: hermes-svc
                port:
                  number: 8000
  tls:
    - hosts:
        - dev.mywebsite.io
      secretName: tls-secret

集群服务列表（kubectl get service输出） #

NAME             TYPE           CLUSTER-IP      EXTERNAL-IP    PORT(S)          AGE     SELECTOR
api-server-svc   LoadBalancer   10.104.36.20    23.29.118.63   8082:32017/TCP   137m    app=api-server-pod
hermes-svc       ClusterIP      10.106.25.215   <none>         8000/TCP         67m     app=hermes-pod
kubernetes       ClusterIP      10.96.0.1       <none>         443/TCP          5h36m   <none>
theia-svc        ClusterIP      10.96.41.226    <none>         80/TCP           5h7m    app=theia-pod

hermes-svc服务连通性测试（curl 10.106.25.215:8000输出） #

<!DOCTYPE html><html>...</html>

浏览器访问测试结果 #

• https://dev.mywebsite.io/api-server => 404错误
• https://dev.mywebsite.io/ => 返回theia-svc内容
• https://dev.mywebsite.io/hermes => 返回theia-svc内容
• https://dev.mywebsite.io/hermes/ => 返回theia-svc内容
• https://dev.mywebsite.io/hermes2 => 返回theia-svc内容
• https://dev.mywebsite.io/hermes2/ => 404错误
• https://dev.mywebsite.io/hermes3 => 返回theia-svc内容
• https://dev.mywebsite.io/hermes3/ => 404错误

更新：2023年7月3日 #

发现此前参考错误文档使用了不正确的Manifest语法，改用Traefik的IngressRoute后修复了路由问题，但原有的TLS（HTTPS）证书无法正常生效。

新配置文件（k8.ingress-traefik.yml） #

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-ingressroute
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: Host(`dev.mywebsite.io`) && PathPrefix(`/api-server`)
      kind: Rule
      services:
        - name: api-server-svc
          port: 8082
      middlewares:
        - name: stripprefix
    - match: Host(`dev.mywebsite.io`) && PathPrefix(`/hermes`)
      kind: Rule
      services:
        - name: hermes-svc
          port: 8000
      middlewares:
        - name: stripprefix
  tls:
    certResolver: myresolver
    options:
      name: traefik-tls-option
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
spec:
  stripPrefix:
    prefixes:
      - /api-server
      - /hermes
---
apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
  name: traefik-tls-option
spec:
  minVersion: VersionTLS12
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
    - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  curvePreferences:
    - CurveP521
    - CurveP384
  sniStrict: true

内容的提问来源于stack exchange，提问作者passionateLearner