Kubernetes Ingress — Traefik i Nginx Ingress Controller

Opublikowano: 10 kwietnia 2026 · Kategoria: VPS / Kubernetes

Każda usługa wystawiona jako LoadBalancer w Kubernetes kosztuje osobnego load balancera w chmurze — dla 10 serwisów to 10 external IP i 10 rachunków. Ingress to odwrócenie tego wzorca: jeden entry point dla całego klastra, routing HTTP(S) do dziesiątek serwisów, TLS termination i middleware — wszystko w jednym miejscu. Ten artykuł pokazuje dwie najpopularniejsze opcje: Traefik (Developer Experience, automatyczny TLS) i Nginx Ingress Controller (wydajność, precyzyjna konfiguracja).

Instalacja Traefik przez Helm

# Dodaj repo Traefik
helm repo add traefik https://traefik.github.io/charts
helm repo update

# Instalacja Traefik z wartosciami (values.yaml)
helm install traefik traefik/traefik \
  --namespace traefik \
  --create-namespace \
  --values traefik-values.yaml

# traefik-values.yaml
globalArguments:
  - "--global.sendanonymoususage=false"
additionalArguments:
  - "[email protected]"
  - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
  - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
ports:
  web:
    redirectTo:
      port: websecure  # redirect HTTP -> HTTPS
  websecure:
    tls:
      enabled: true
service:
  type: LoadBalancer
persistence:
  enabled: true
  storageClass: longhorn-ssd
  size: 1Gi   # przechowywanie acme.json z certyfikatami
ingressClass:
  enabled: true
  isDefaultClass: true

Podstawowy Ingress resource

# Ingress z TLS via cert-manager (Traefik lub Nginx)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: production
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # Dla Nginx Ingress:
    # nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    # Dla Traefik:
    # traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
  ingressClassName: traefik  # lub nginx
  tls:
    - hosts:
        - app.example.com
        - api.example.com
      secretName: app-tls-secret   # cert-manager zapisze tu certyfikat
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend-svc
                port:
                  number: 80
    - host: api.example.com
      http:
        paths:
          - path: /v1
            pathType: Prefix
            backend:
              service:
                name: api-svc
                port:
                  number: 8080

cert-manager — automatyczne certyfikaty TLS

# Instalacja cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

# Weryfikacja
kubectl get pods -n cert-manager

# ClusterIssuer dla Let's Encrypt (produkcja)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - http01:
          ingress:
            ingressClassName: traefik   # lub nginx
---
# ClusterIssuer dla testow (staging - bez limitow LE)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-staging-key
    solvers:
      - http01:
          ingress:
            ingressClassName: traefik

# Sprawdz status certyfikatu
kubectl get certificate -n production
# NAME            READY   SECRET           AGE
# app-tls-secret  True    app-tls-secret   2m

kubectl describe certificate app-tls-secret -n production

# Jesli certyfikat nie jest gotowy - sprawdz CertificateRequest i Order
kubectl get certificaterequest -n production
kubectl describe order -n production

Traefik Middleware — rate limiting i BasicAuth

# Middleware: rate limiting
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
  namespace: production
spec:
  rateLimit:
    average: 100      # 100 requestow/sekunde
    burst: 50         # burst do 50 ponad srednia
---
# Middleware: BasicAuth (username/password)
# Generuj hash: htpasswd -nb admin "SecurePass123"
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: basic-auth
  namespace: production
spec:
  basicAuth:
    secret: basic-auth-secret
---
# Secret z userem i haslem (htpasswd format)
apiVersion: v1
kind: Secret
metadata:
  name: basic-auth-secret
  namespace: production
type: Opaque
stringData:
  users: "admin:$apr1$xyz..."   # wygeneruj: htpasswd -nb admin pass
---
# Middleware: przekierowanie HTTP na HTTPS (301 Moved Permanently)
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: https-redirect
  namespace: production
spec:
  redirectScheme:
    scheme: https
    permanent: true

# Ingress z middleware (Traefik)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: admin-ingress
  namespace: production
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: "production-basic-auth@kubernetescrd,production-rate-limit@kubernetescrd"
spec:
  ingressClassName: traefik
  rules:
    - host: admin.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: admin-panel
                port:
                  number: 3000

Porównanie Traefik vs Nginx Ingress vs Caddy

Najczęstsze pytania