attempt internal and external

external/deploy.yaml

@@ -1,21 +1,21 @@
 kind: Deployment
 apiVersion: apps/v1
 metadata:
-  name: traefik-custom-controller
+  name: traefik-external-controller
   labels:
-    app: traefik-custom-controller
+    app: traefik-external-controller
   namespace: kube-system
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: traefik-custom-controller
+      app: traefik-external-controller
   template:
     metadata:
       labels:
-        app: traefik-custom-controller
+        app: traefik-external-controller
     spec:
-      serviceAccountName: traefik-custom-controller
+      serviceAccountName: traefik-external-controller
       containers:
         - name: traefik
           image: traefik:v2.2
@@ -23,6 +23,7 @@ spec:
             - secretRef:
                 name: namedotcom
           args:
+            - --providers.kubernetescrd.ingressclass=traefik-internal
             - --log.level=DEBUG
             - --api
             - --api.insecure
@@ -39,7 +40,7 @@ spec:
             - --certificatesresolvers.myresolver.acme.dnschallenge.delaybeforecheck=0
           volumeMounts:
           - mountPath: /acme
-            name: traefik-acme
+            name: traefik-external-acme
           ports:
             - name: web
               containerPort: 9080
@@ -48,6 +49,6 @@ spec:
             - name: admin
               containerPort: 8080
       volumes:
-        - name: traefik-acme
+        - name: traefik-external-acme
           persistentVolumeClaim:
-              claimName: traefik-acme
+              claimName: traefik-external-acme

external/pvc/pvc.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: traefik-acme
+  name: traefik-external-acme
   labels:
-    app: traefik-custom-controller
+    app: traefik-external-controller
   namespace: kube-system
 spec:
   storageClassName: nfs-encrypted

external/rbac.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: traefik-custom-controller
+  name: traefik-external-controller
   namespace: kube-system
 ---
 
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
-  name: traefik-custom-controller
+  name: traefik-external-controller
 rules:
   - apiGroups:
       - ""
@@ -53,12 +53,12 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
-  name: traefik-custom-controller
+  name: traefik-external-controller
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: traefik-custom-controller
+  name: traefik-external-controller
 subjects:
   - kind: ServiceAccount
-    name: traefik-custom-controller
+    name: traefik-external-controller
     namespace: kube-system

external/service.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: traefik-custom-controller
+  name: traefik-external-controller
   namespace: kube-system
 spec:
   type: LoadBalancer
   selector:
-    app: traefik-custom-controller
+    app: traefik-external-controller
   ports:
     - protocol: TCP
       port: 9080

internal/deploy.yaml

@@ -0,0 +1,54 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: traefik-internal-controller
+  labels:
+    app: traefik-internal-controller
+  namespace: kube-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik-internal-controller
+  template:
+    metadata:
+      labels:
+        app: traefik-internal-controller
+    spec:
+      serviceAccountName: traefik-internal-controller
+      containers:
+        - name: traefik
+          image: traefik:v2.2
+          envFrom:
+            - secretRef:
+                name: namedotcom
+          args:
+            - --providers.kubernetescrd.ingressclass=traefik-internal
+            - --log.level=DEBUG
+            - --api
+            - --api.insecure
+            - --entrypoints.web.address=:80
+            - --entrypoints.websecure.address=:443
+            - --entrypoints.websecure.http.tls=true
+            - --providers.kubernetescrd
+            - --metrics.statsd=true
+            - --metrics.statsd.address=graphite.ducoterra.net:8125
+            - --certificatesresolvers.myresolver.acme.email=ducoterra@icloud.com
+            - --certificatesresolvers.myresolver.acme.storage=/acme/acme.json
+            - --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
+            - --certificatesresolvers.myresolver.acme.dnschallenge.provider=namedotcom
+            - --certificatesresolvers.myresolver.acme.dnschallenge.delaybeforecheck=0
+          volumeMounts:
+          - mountPath: /acme
+            name: traefik-internal-acme
+          ports:
+            - name: web
+              containerPort: 80
+            - name: websecure
+              containerPort: 443
+            - name: admin
+              containerPort: 8080
+      volumes:
+        - name: traefik-internal-acme
+          persistentVolumeClaim:
+              claimName: traefik-internal-acme

internal/pvc/pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-internal-acme
+  labels:
+    app: traefik-internal-controller
+  namespace: kube-system
+spec:
+  storageClassName: nfs-encrypted
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

internal/rbac.yaml

@@ -0,0 +1,64 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik-internal-controller
+  namespace: kube-system
+---
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-internal-controller
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+  - apiGroups:
+      - traefik.containo.us
+    resources:
+      - middlewares
+      - ingressroutes
+      - traefikservices
+      - ingressroutetcps
+      - ingressrouteudps
+      - tlsoptions
+      - tlsstores
+    verbs:
+      - get
+      - list
+      - watch
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-internal-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-internal-controller
+subjects:
+  - kind: ServiceAccount
+    name: traefik-internal-controller
+    namespace: kube-system

internal/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-internal-controller
+  namespace: kube-system
+spec:
+  type: LoadBalancer
+  selector:
+    app: traefik-internal-controller
+  ports:
+    - protocol: TCP
+      port: 9080
+      name: web
+      targetPort: 9080
+    - protocol: TCP
+      port: 9443
+      name: websecure
+      targetPort: 9443