k8s学习(十六)安装traefik2.5：用TaoToken统一Key打通CRD与RBAC配置

1. 为什么在 k8s 里装 Traefik 2.5 总卡在 CRD 和 RBACTraefik 2.5 是一个云原生边缘路由器用 Go 写的单文件二进制在 k8s 里主要干两件事把外部流量按规则转发到集群内的 Service以及通过 CRD自定义资源来声明路由规则。它和传统 Nginx Ingress 最大的区别是路由、中间件、TLS 这些配置都能用kubectl apply直接下发不用改配置文件再 reload。适合正在学 k8s、想搞懂 Ingress 控制器权限模型的人也适合本地用 kind/minikube 搭测试集群的开发者。但很多人第一次装会卡住报错集中在两个地方。一是 CRD 没建全kubectl apply一个 IngressRoute 时报no matches for kind IngressRoute二是 RBAC 没绑对Traefik 的 Pod 日志里刷ingressroutes.traefik.containo.us is forbiddenDashboard 里看不到任何路由。这两个环节恰好是 Traefik 和普通 Deployment 最大的不同它要 watch 集群里的 CRD 资源就必须有对应的 ClusterRole 授权。这篇按「先建 CRD → 再建 RBAC → 建 ConfigMap → 建 Deployment/Service → 配 Dashboard 路由」的顺序走一遍每步都给可复制的 YAML 和验证命令。另外我会把 AI 工具侧的 Key 管理也串进来——用 TaoToken 的统一 Key 通道把本地 kubectl 辅助脚本、Claude Code 这类编码工具的模型调用收敛到一个入口省得每个工具单独配一遍。下面直接进操作。2. 前置TaoToken 统一 Key 与集群侧准备TaoToken 在这里的角色是「AI 工具的统一 API 通道」。你写 k8s YAML 时如果想让 Claude Code 或本地脚本帮忙补全 CRD 字段、检查 RBAC 规则不用给每个工具单独申请和轮换 Key统一走一个入口就行。官网入口在 https://taotoken.net/?utm_sourcetaotoken_aicg_blog_endutm_mediumcsdnutm_campaignrewriteutm_content API 基址是 https://taotoken.net/api 。集群侧的前置条件先确认kubectl version --short kubectl get nodes预期能看到 Server 版本在 v1.19 以上。Traefik 2.5 的 CRD 用的是apiextensions.k8s.io/v1beta1在 v1.22 会被移除所以如果你的集群是 v1.22 及以上需要把 CRD 的 apiVersion 换成apiextensions.k8s.io/v1并补schema字段。本文以 v1.19~v1.21 的测试集群为准v1.22 的差异我在第 5 节排障里单独说。镜像方面如果你在离线环境先在有网机器上拉取再推到私有仓库docker pull traefik:2.5 docker tag traefik:2.5 172.16.10.158:85/traefik:2.5 docker push 172.16.10.158:85/traefik:2.5注意 tag 明确写2.5别用latest否则下次拉镜像可能变成 3.xCRD 的 group 名从traefik.containo.us变成traefik.io整套 YAML 全废。AI 工具侧如果你用 Claude Code 辅助写这些 YAML可以在项目根目录建.claude/settings.json把模型请求指向统一通道{ env: { ANTHROPIC_BASE_URL: https://taotoken.net/api, ANTHROPIC_API_KEY: 你的TaoTokenKey } }Key 在控制台 https://taotoken.net/console?utm_sourcetaotoken_aicg_blog_endutm_contentconsoleutm_campaignrewrite 里生成API Keys 管理页在 https://taotoken.net/api-keys?utm_sourcetaotoken_aicg_blog_endutm_contentapi-keysutm_campaignrewrite 。这样你在终端里让 AI 帮你检查 RBAC 的 apiGroups 有没有写漏走的就是同一个 Key不用在多个工具间同步凭证。3. 可复制配置CRD、RBAC、ConfigMap、Deployment 全套 YAML3.1 创建 Traefik CRD 资源Traefik 2.5 一共需要 9 个 CRDIngressRoute、IngressRouteTCP、IngressRouteUDP、Middleware、MiddlewareTCP、ServersTransport、TLSOption、TLSStore、TraefikService。少建一个后面用到对应资源时就报no matches for kind。# traefik-crd.yaml apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: ingressroutes.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: IngressRoute plural: ingressroutes singular: ingressroute --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: ingressroutetcps.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: IngressRouteTCP plural: ingressroutetcps singular: ingressroutetcp --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: ingressrouteudps.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: IngressRouteUDP plural: ingressrouteudps singular: ingressrouteudp --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: middlewares.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: Middleware plural: middlewares singular: middleware --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: middlewaretcps.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: MiddlewareTCP plural: middlewaretcps singular: middlewaretcp --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: serverstransports.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: ServersTransport plural: serverstransports singular: serverstransport --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: tlsoptions.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: TLSOption plural: tlsoptions singular: tlsoption --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: tlsstores.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: TLSStore plural: tlsstores singular: tlsstore --- apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: traefikservices.traefik.containo.us spec: scope: Namespaced group: traefik.containo.us version: v1alpha1 names: kind: TraefikService plural: traefikservices singular: traefikservice应用并验证kubectl apply -f traefik-crd.yaml kubectl get crd | grep traefik.containo.us预期输出 9 行每行都是xxx.traefik.containo.us。如果只有 8 行对照上面数一下缺哪个。3.2 创建 RBAC 权限RBAC 这块是重点。Traefik 的 ServiceAccount 需要能读 Service、Endpoints、Secrets、Ingress还要能读它自己的 9 个 CRD另外对ingresses/status有 update 权限用来回写状态。# traefik-rbac.yaml apiVersion: v1 kind: ServiceAccount metadata: name: traefik-ingress-controller namespace: kube-system --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: traefik-ingress-controller rules: - apiGroups: [] resources: [services, endpoints, secrets] verbs: [get, list, watch] - apiGroups: [extensions, networking.k8s.io] resources: [ingresses, ingressclasses] verbs: [get, list, watch] - apiGroups: [extensions] resources: [ingresses/status] verbs: [update] - apiGroups: [traefik.containo.us] resources: - middlewares - middlewaretcps - serverstransports - ingressroutes - traefikservices - ingressroutetcps - ingressrouteudps - tlsoptions - tlsstores verbs: [get, list, watch] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: traefik-ingress-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controller subjects: - kind: ServiceAccount name: traefik-ingress-controller namespace: kube-system应用并验证kubectl apply -f traefik-rbac.yaml kubectl get sa -n kube-system traefik-ingress-controller kubectl get clusterrole traefik-ingress-controller kubectl get clusterrolebinding traefik-ingress-controller三条 get 都能查到对象说明 RBAC 骨架建好了。真正验证权限是否生效要等 Pod 起来后看日志第 4 节会做。3.3 创建 ConfigMap 配置Traefik 2.5 支持静态配置启动时读和动态配置CRD 下发。这里把静态配置塞进 ConfigMap用--configfile挂进去。# traefik-config.yaml kind: ConfigMap apiVersion: v1 metadata: name: traefik-config namespace: kube-system data: traefik.yaml: |- serversTransport: insecureSkipVerify: true api: insecure: true dashboard: true metrics: prometheus: entryPoint: metrics entryPoints: web: address: :80 websecure: address: :443 traefik: address: :8090 metrics: address: :8082 providers: kubernetescrd: ingressClass: traefik-v2.5 kubernetesingress: ingressClass: traefik-v2.5 log: level: error format: json accessLog: format: json bufferingSize: 0注意providers.kubernetescrd.ingressClass设成了traefik-v2.5后面 Dashboard 的 IngressRoute 注解要跟这个对上否则 Traefik 不认这条路由。kubectl apply -f traefik-config.yaml kubectl get configmap -n kube-system traefik-config3.4 创建 Deployment 与 Service# traefik-deploy.yaml apiVersion: apps/v1 kind: Deployment metadata: name: traefik-v2 namespace: kube-system labels: app: traefik-v2 spec: replicas: 2 selector: matchLabels: app: traefik-v2 template: metadata: labels: app: traefik-v2 spec: serviceAccountName: traefik-ingress-controller terminationGracePeriodSeconds: 1 hostNetwork: true containers: - name: traefik-v2 image: 172.16.10.158:85/traefik:2.5 args: - --configfile/config/traefik.yaml ports: - name: web containerPort: 80 hostPort: 80 - name: websecure containerPort: 443 hostPort: 443 - name: admin containerPort: 8090 resources: limits: cpu: 500m memory: 1024Mi requests: cpu: 300m memory: 1024Mi securityContext: capabilities: drop: [ALL] add: [NET_BIND_SERVICE] volumeMounts: - mountPath: /config name: config - mountPath: /etc/localtime name: timezone readOnly: true volumes: - name: config configMap: name: traefik-config - name: timezone hostPath: path: /etc/localtime type: File tolerations: - operator: Exists --- apiVersion: v1 kind: Service metadata: name: traefik-v2 namespace: kube-system spec: type: LoadBalancer selector: app: traefik-v2 ports: - protocol: TCP port: 80 name: web targetPort: 80 - protocol: TCP port: 443 name: websecure targetPort: 443 - protocol: TCP port: 8090 name: admin targetPort: 8090hostNetwork: true让 Pod 直接用宿主机 80/443测试环境省事生产环境建议去掉改用 LoadBalancer 或 NodePort。securityContext里 drop 掉所有 capability 再加回NET_BIND_SERVICE是因为容器默认不允许绑 1024 以下端口。kubectl apply -f traefik-deploy.yaml kubectl get pods -n kube-system -l apptraefik-v2 -o wide4. 验证请求确认 CRD 生效与 RBAC 权限打通4.1 看 Pod 状态和日志kubectl get pods -n kube-system -l apptraefik-v2预期两个 Pod 都是RunningREADY 1/1。如果 CrashLoopBackOff先看日志kubectl logs -n kube-system -l apptraefik-v2 --tail50日志里如果出现ingressroutes.traefik.containo.us is forbidden说明 RBAC 的 apiGroups 或 resources 写漏了回去对照 3.2 的 ClusterRole 检查。如果出现no matches for kind说明 CRD 没建全回去跑kubectl get crd | grep traefik。4.2 用 kubectl auth can-i 验证权限这是最直接的 RBAC 验证方式不用等 Pod 报错kubectl auth can-i list ingressroutes.traefik.containo.us \ --assystem:serviceaccount:kube-system:traefik-ingress-controller预期输出yes。再试一个不该有的权限kubectl auth can-i delete ingressroutes.traefik.containo.us \ --assystem:serviceaccount:kube-system:traefik-ingress-controller预期输出no因为我们只给了 get/list/watch没给 delete。这一对 yes/no 就说明 RBAC 最小权限生效了。4.3 创建 Dashboard 路由并访问# dashboard-route.yaml apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: dashboard-route namespace: kube-system annotations: kubernetes.io/ingress.class: traefik-v2.5 spec: entryPoints: - web routes: - match: Host(dashboard.test.com) PathPrefix(/) kind: Rule services: - name: traefik-v2 port: 8090kubectl apply -f dashboard-route.yaml kubectl get ingressroute -n kube-system预期能看到dashboard-route一行。然后在本地 hosts 文件加一行Linux/macOS 是/etc/hostsWindows 是C:\Windows\System32\drivers\etc\hosts172.16.10.158 dashboard.test.com浏览器打开http://dashboard.test.com/能看到 Traefik Dashboard左侧 HTTP 里应该列出刚才那条 dashboard-route。如果 Dashboard 能打开但路由列表是空的检查 IngressRoute 的注解kubernetes.io/ingress.class是否和 ConfigMap 里的ingressClass: traefik-v2.5一致。4.4 用 AI 工具辅助排查配置写这些 YAML 时容易漏字段我习惯让 Claude Code 帮忙过一遍。走 TaoToken 统一通道的话在项目里直接问「检查这份 ClusterRole 是否覆盖了 traefik 2.5 全部 9 个 CRD 的 get/list/watch」它会逐条比对。模型对话入口在 https://taotoken.net/chat?utm_sourcetaotoken_aicg_blog_endutm_contentmodel-chatutm_campaignrewrite 如果你只是临时验证某个字段含义用这个页面比装工具快。长期在集群里做编码和 Agent 任务的话Coding Plan 入口在 https://taotoken.net/coding-plan?utm_sourcetaotoken_aicg_blog_endutm_contentcoding-planutm_campaignrewrite 接入文档在 https://taotoken.net/doc?utm_sourcetaotoken_aicg_blog_endutm_contentdocutm_campaignrewrite 。5. 本篇常见错排查报错一no matches for kind IngressRoute in version traefik.containo.us/v1alpha1原因CRD 没建或者建了但 group 名不对。Traefik 2.5 用的是traefik.containo.us3.x 改成了traefik.io。如果你镜像拉成了 3.xCRD 和 IngressRoute 的 apiVersion 都要跟着改。验证kubectl get crd ingressroutes.traefik.containo.us kubectl api-resources | grep traefik报错二apiextensions.k8s.io/v1beta1 CustomResourceDefinition is deprecated这是警告不是错误v1.16 会出现v1.22 直接不可用。如果你的集群是 v1.22 及以上需要把 CRD 的 apiVersion 改成apiextensions.k8s.io/v1并在 spec 里补versions数组和schema。Traefik 官方在 2.5 之后提供了适配 v1 的 CRD 文件建议直接取官方版本别手改。报错三Pod 日志刷is forbidden: User system:serviceaccount:kube-system:traefik-ingress-controller cannot list resource ingressroutes原因ClusterRole 里traefik.containo.us这个 apiGroup 的 resources 列表漏了某个 CRD或者 ClusterRoleBinding 的 subjects 里 namespace 写错。用 4.2 的kubectl auth can-i逐个 CRD 验证for r in ingressroutes middlewares traefikservices tlsoptions tlsstores; do kubectl auth can-i list $r.traefik.containo.us \ --assystem:serviceaccount:kube-system:traefik-ingress-controller done全 yes 才算通过。报错四Dashboard 能打开但看不到路由先确认 IngressRoute 的注解kubernetes.io/ingress.class: traefik-v2.5和 ConfigMap 里providers.kubernetescrd.ingressClass一致。再确认 IngressRoute 的 namespace 和 Traefik 的 watch 范围——Traefik 默认 watch 所有 namespace但如果你在 ConfigMap 里加了namespaces限制就要把 kube-system 加进去。报错五80 端口被占用Pod 起不来hostNetwork: true时 Pod 直接用宿主机 80如果宿主机上已经有 Nginx 或别的服务占了 80Pod 会一直 Pending 或 CrashLoop。验证ss -tlnp | grep :80要么停掉占用进程要么去掉hostNetwork改用 Service 的 LoadBalancer/NodePort。6. 后续接入与 Key 管理建议整套装完后日常操作就是写 IngressRoute 下发路由。如果你想让 AI 工具持续帮你维护这些 YAML——比如自动检查新加的 Middleware 有没有对应的 RBAC 权限、批量生成多环境 IngressRoute——建议把模型调用统一走 TaoToken 的 API 通道Key 在 https://taotoken.net/api-keys?utm_sourcetaotoken_aicg_blog_endutm_contentapi-keysutm_campaignrewrite 管理接入方式参考 https://taotoken.net/doc?utm_sourcetaotoken_aicg_blog_endutm_contentdocutm_campaignrewrite 。这样集群侧的 kubectl 辅助脚本、本地的 Claude Code、临时在模型对话页验证字段用的都是同一个 Key轮换时只改一处。最后留一个实用检查清单每次改完 RBAC 或 CRD 后跑一遍kubectl get crd | grep traefik.containo.us | wc -l # 应为 9 kubectl auth can-i list ingressroutes.traefik.containo.us \ --assystem:serviceaccount:kube-system:traefik-ingress-controller # 应为 yes kubectl get pods -n kube-system -l apptraefik-v2 # 应全 Running kubectl get ingressroute -A # 应列出已下发路由这四条都过Traefik 2.5 在集群里就算真正跑通了。