apiVersion: apps/v1
kind: Deployment
metadata:
  name: traefik
  namespace: kube-system
  labels:
    app: traefik
spec:
  selector:
    matchLabels:
      app: traefik
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik
      containers:
      - image: traefik:2.1.1
        name: traefik
        ports:
        - name: admin
          containerPort: 8080
        - name: web
          containerPort: 80
         # hostPort: 80
        - name: websecure
          containerPort: 443
          #hostPort: 443
        args:
        - --entryPoints.web.address=:80
        - --entryPoints.web.forwardedHeaders.insecure
        #- --entryPoints.web.forwardedHeaders.trustedIPs=0.0.0.0/0
        - --entryPoints.websecure.address=:443
        #- --entryPoints.mongo.address=:27017
        #- --entryPoints.postgres.address=:5432
        - --api=true
        - --api.insecure=true #必须打开这个才能访问webui暴露的端口
        - --api.dashboard=true
        - --ping=true
        - --providers.kubernetesingress
        - --providers.kubernetescrd
       # - --serversTransport.insecureSkipVerify=true
        # - --providers.file.filename=/config/traefik-tls.toml
        - --log.level=INFO
        - --accesslog
        # 使用 dns 验证方式
        #- --certificatesResolvers.ali.acme.dnsChallenge.provider=alidns
        # 邮箱配置
        #- --certificatesResolvers.ali.acme.email=ych_1024@163.com
        # 保存 ACME 证书的位置
        #- --certificatesResolvers.ali.acme.storage=/etc/acme/acme.json
        # 下面是用于测试的ca服务，如果https证书生成成功了，则移除下面参数
        # - --certificatesresolvers.ali.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
            # ALICLOUD_ACCESS_KEY
            # ALICLOUD_SECRET_KEY
            # ALICLOUD_REGION_ID
        resources:
          requests:
            cpu: "50m"
            memory: "50Mi"
          limits:
            cpu: "200m"
            memory: "100Mi"
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        readinessProbe:
          httpGet:
            path: /ping
            port: 8080
          failureThreshold: 1
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        livenessProbe:
          httpGet:
            path: /ping
            port: 8080
          failureThreshold: 3
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2

