005-deployment.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: kube-system
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: kube-system
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
      annotations:
        container.apparmor.security.beta.kubernetes.io/traefik: runtime/default
    spec:
      serviceAccountName: traefik-ingress-controller
      securityContext:
        # Use nogroup (and needs nobody) for the acme.json file
        # for storing TLS
        fsGroup: 65534
      initContainers:
        - name: volume-permissions
          image: busybox:1.32
          command: ['sh', '-c', 'touch /etc/traefik/certs/acme.json && chown 65534:65534 /etc/traefik/certs/acme.json && chmod 600 /etc/traefik/certs/acme.json']
          volumeMounts:
            - name: certificates
              mountPath: /etc/traefik/certs
      containers:
        - name: traefik
          image: traefik:v2.9.4
          args:
            - --api.dashboard=true
            - --ping=true
            - --accesslog
            - --entrypoints.traefik.address=:9080
            - --entrypoints.web.address=:8080
            - --entrypoints.websecure.address=:8443
            # Uncomment the below lines to redirect http requests to https.
            # This specifies the port :443 and not the https entrypoint name for the
            # redirect as the service is listening on port 443 and directing traffic
            # to the 8443 target port. If the entrypoint name "websecure" was used,
            # instead of "to=:443", then the browser would be redirected to port 8443.
            # - --entrypoints.web.http.redirections.entrypoint.to=:443
            # - --entrypoints.web.http.redirections.entrypoint.scheme=https
            - --providers.kubernetescrd
            - --providers.kubernetescrd.allowCrossNamespace=true
            - --providers.kubernetesingress
            - --certificatesresolvers.godaddy.acme.email=me@mydomain.io
            - --providers.kubernetesgateway
            - --experimental.kubernetesgateway=true
            - --certificatesresolvers.godaddy.acme.storage=/etc/traefik/certs/acme.json
            - --certificatesResolvers.godaddy.acme.dnsChallenge.provider=godaddy
            - --certificatesResolvers.godaddy.acme.dnsChallenge.delayBeforeCheck=0
            # Please note that this is the staging Let's Encrypt server.
            # Once you get things working, you should remove that whole line altogether.
            # - --certificatesresolvers.godaddy.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
            - --log
            - --log.level=INFO
          securityContext:
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            # Run the container as nobody:nogroup
            runAsUser: 65534
            runAsGroup: 65534
            capabilities:
              drop:
                - ALL
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /ping
              port: 9080
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 3
          resources:
            limits:
              memory: '100Mi'
              cpu: '1000m'
          ports:
            # The Traefik container is listening on ports > 1024 so the container
            # can be run as a non-root user and they can bind to these ports.
            - name: web
              containerPort: 8080
            - name: websecure
              containerPort: 8443
            - name: admin
              containerPort: 9080
          volumeMounts:
            - name: certificates
              mountPath: /etc/traefik/certs
          env:
            - name: GODADDY_API_KEY
              valueFrom:
                secretKeyRef:
                  name: godaddy
                  key: GODADDY_API_KEY
            - name: GODADDY_API_SECRET
              valueFrom:
                secretKeyRef:
                  name: godaddy
                  key: GODADDY_API_SECRET
      volumes:
        - name: certificates
          persistentVolumeClaim:
            claimName: traefik-certs-pvc