使用Traefik实现跨Namespace的Hostname独立部署方案咨询

Absolutely, you can set up independent Ingress resources in both Namespace a and b using Traefik, with zero cross-namespace dependencies. This is actually the intended way to split traffic for different paths under the same domain across separate namespaces. Here's a step-by-step breakdown:

1. Configure Ingress for Namespace a (Root Domain) #

Create an Ingress resource in Namespace a that handles traffic for the root domain example.com. Traefik's path matching logic will ensure this only catches requests that don't match longer, more specific paths like /mypath.

# namespace-a-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-root-ingress
  namespace: a
  annotations:
    kubernetes.io/ingress.class: traefik  # Ensure this matches your Traefik ingress class
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: your-namespace-a-service
            port:
              number: 80

2. Configure Ingress for Namespace b (Specific Path) #

Next, create a separate Ingress in Namespace b targeting exactly the /mypath path. Traefik will prioritize this more specific path over the root prefix from Namespace a.

# namespace-b-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-mypath-ingress
  namespace: b
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /mypath
        pathType: Prefix  # Use Exact if you want to match only /mypath (not subpaths like /mypath/foo)
        backend:
          service:
            name: your-namespace-b-service
            port:
              number: 80

Key Notes to Ensure Success #

• Traefik's Path Matching Priority: Traefik uses longest prefix matching by default. This means any request to example.com/mypath or example.com/mypath/anything will be routed to Namespace b's service, while all other requests go to Namespace a.
• Traefik Permissions: Make sure your Traefik deployment has a ServiceAccount with cluster-wide permissions (or at least permissions to list/watch Ingress resources in both Namespace a and b). Most default Traefik installations include this, but double-check if you've restricted access.
• Independent Deployment: You can deploy these Ingress resources (and their associated services/deployments) completely separately. No need for cross-namespace services or proxying from a to b—Traefik handles all routing directly.

Optional: Fine-Tuning Path Matching #

If you only want to match the exact path /mypath (and not subpaths), change pathType: Prefix to pathType: Exact in Namespace b's Ingress. Adjust based on your application's routing needs.

内容的提问来源于stack exchange，提问作者Tobias