Jakub Hajek gave a presentation on routing microservice architectures with Traefik. Traefik is a cloud native edge router that provides automatic discovery, integrates with major cluster technologies, and includes features like TLS termination, load balancing, and request routing. It can be used to implement canary deployments and traffic mirroring to gradually rollout new versions of services. Hajek demonstrated Traefik's capabilities through a demo environment using K3s and Kubernetes custom resource definitions.

1. ROUTING MICROSERVICE
ARCHITECTURES WITH TRAEFIK
JAKUB HAJEK
JUNE, 24TH, 2020
CNCF MEETUP, BRATISLAVA, SLOVAKIA 🇸🇰

2. ▸ I am company owner, technical consultant (SRE)
▸ @_jakubhajek
▸ I work for Cometari
▸ I’ve been system admin since 1998
▸ Traefik Ambassador
▸ Cometari is a solutions company implementing DevOps culture and
providing consultancy, workshops and software services.
▸ Our expertise are DevOps, Elastic Stack - log analysis
INTRODUCTION - JAKUB HAJEK

3. The aim of this presentation is to show how you can easily use
Traefik to publish services in your micro service architectures.

4. WHERE IS THE SERVICE?

5. TRAEFIKTHE CLOUD NATIVE EDGE ROUTER

6. ENTRYPOINT ROUTER SERVICE
MIDDLEWARE 1 MIDDLEWARE 2 MIDDLEWARE 3
Request Calls to backend servers
WHAT IS IT TRAEFIK?

7. TRAEFIK KEY FEATURES
▸ Automatic discovery
▸ Integrates with major cluster technologies
▸ Tracing
▸ Metrics
▸ Lets Encrypt integrated
▸ Route HTTP and TCP/UDP/GRPC requests
▸ Middlewares

8. TRAEFIK 2.X KEY FEATURES
▸ ROUTER= frontend, SERVICE=backend, MIDDLEWARE=rules
▸ Kubernetes CRD
▸ Fully customisable routes via middleware, it can be reused on many
routers
▸ A new dashboard with web UI
▸ Canary deployment with Service Load balancer
▸ Network traffic Mirroring with Service Load balancer
▸ Session Stickiness

9. TRAEFIK ENTERPRISE EDITION
▸ Clustered
▸ Fault Tolerant
▸ Distributed Features (SSL, Middlewares)
▸ Supported

10. TRAEFIK EE - HIGH LEVEL ARCHITECTURE

11. TRAEFIK CONFIGURATION

12. ENTRYPOINTS :80, :443
ROUTERS
PROVIDER 1
PROVIDER
CONNECTION
INFORMATION
SERVICES
MIDDLEWARES
CERTIFICATES
PROVIDER 2
DYNAMIC (WHILE RUNNING)STATIC (STARTUP TIME)

13. MIDDLEWARES

14. MIDDLEWARES OVERVIEW
▸ Circuit breaker
▸ Forward Auth
▸ Automatic retries
▸ Buffering
▸ Response Compression
▸ Headers
▸ …and many more
https://docs.traefik.io/middlewares/overview/

15. KUBERNETES CRD

16. KUBERNETES CRD AND AVAILABLE CUSTOM RESOURCES
▸ Ingressroute - HTTP routing - http router
▸ Middleware - tweaks the HTTP before they are sent to a
service - HTTP Middleware
▸ TraefikService - abstraction for HTTP LB/mirroring
▸ IngressRouteTCP/IngressRouteUDP - TCP/UDP routing
▸ TLSOptions - TLS connection parameters
https://docs.traefik.io/routing/providers/kubernetes-crd/
https://github.com/containous/traefik/blob/master/docs/content/providers/kubernetes-crd.md

17. CANARY DEPLOYMENT AND
TRAFFIC MIRRORING

19. CANARY DEPLOYMENT
▸ Deployment vs Release
▸ Instead of switching to new version in one step, we use a phased
approach
▸ We deploy a new app in a small part of the production
infrastructure
▸ Only a few users (1%) are routed to the newest version (Release)
▸ With no errors reported, the new version can be released to the
rest of the infrastructure.

20. CANARY
VERSION 2
VERSION 1
https://service
Canary deployment with Service Load balancers
1% of live traffic, a few users
Majority of users
https://github.com/containous/traefik/issues/1164

21. CANARY VERSION 2
https://service
Canary deployment with Service Load balancers
VERSION 2VERSION 2VERSION 2

22. MIRRORING OR LIVE TRAFFIC SHADOW
▸ Understand difference between Deployment vs Release
▸ Deployment brings new code to the production, no
production traffic yet!
▸ Run smoke, integration tests to make sure that new deployment has no
impact to your users
▸ Release brings live traffic to a deployment.
▸ We can shadow live traffic to the new deployment and reduce the risk
of failure.
▸ No response send back to the user.

23. MIRRORING
VERSION 2
VERSION 1
https://service
Mirroring with Service Load Balancer
20%
https://github.com/containous/traefik/issues/2989

24. DEMO ENVIRONMENT

25. DEMO ENVIRONMENT IN DETAILS
▸ K3S cluster consisting of 3 nodes
▸ SSL certs issued by Lets Encrypt
▸ FQDN domains:
▸ https://a.labs.cometari.eu
▸ https://c.labs.cometari.eu
▸ DNS Round Robin: Route 53 with its implemented health
checks

26. K3S CLUSTER IN 2 COMMANDS
▸ MASTER:
▸ curl -sfL https://get.k3s.io |
INSTALL_K3S_EXEC="server --no-deploy traefik --
node-name node1" sh -
▸ WORKERS:
▸ curl -sfL https://get.k3s.io | K3S_URL=https://master-
node.com:6443 K3S_TOKEN=SECRET_TOKEN
INSTALL_K3S_EXEC=“agent --node-name node2" sh -

27. Talk is cheap, show me the code!

28. DEMO TIME

29. DEMO SCENARIOS
▸ Web UI to see how services are deployed
▸ Example of Canary deployment
▸ Example of Mirroring configuration

30. A FEW BENEFITS OF TRAEFIK
▸ Dynamic configuration for dynamic environments
▸ Automatic service discovery
▸ HTTP / TCP / UDP / GRPC
▸ Lets Encrypt, HA with Traefik EE
▸ One single (static) binary
▸ Works also fine with old fashioned environments (VM’s, bare metal)
▸ Tracing, Metrics
▸ Rolling update releases
▸ Custom Middlewares will be added

31. A FEW BENEFITS OF CANARY DEPLOYMENT
▸ Traefik provides flexible way to proceed with canary (K8S, K3S,
Swarm)
▸ Reduce time to market
▸ Canary deployment allows you validate your application in real
production environment
▸ Rolling out releases
▸ No need to maintain a lot of staging / testing environments

32. SOURCE CODE OF CONFIGURATION FILES
▸ https://github.com/jakubhajek/traefik-kubernetescrd

33. THANK YOU
@_JAKUBHAJEK
JAKUB.HAJEK@COMETARI.COM

34. “I strongly believe that implementing DevOps culture, across
the entire organisation, should provide measurable value and
solve the real issue rather than generate a new one.”
Jakub Hajek, Cometari