modified: traefik/traefik-deployment.yml

akashop/deployment.yml

@@ -4,7 +4,7 @@ metadata:
   name: wp 
   namespace: akashop
 spec:
-  replicas: 3
+  replicas: 1
   selector:
     matchLabels:
       app: wp
@@ -19,11 +19,11 @@ spec:
         imagePullPolicy: Always
         resources:
           limits:
+            cpu: "2"
+            memory: "2Gi"
+          requests:
             cpu: "1"
             memory: "1Gi"
-          requests:
-            cpu: "0.5"
-            memory: "200Mi"
         ports:
         - name: http
           containerPort: 80
@@ -41,12 +41,12 @@ spec:
           #     secretKeyRef:
           #       name: my-secret # Name of the secret containing the variable
           #       key: VAR2_KEY
-        livenessProbe:
+        #livenessProbe:
-          httpGet:
+         #httpGet:
-            path: /
+           #path: /
-            port: 80
+           #port: 80
-          initialDelaySeconds: 5
+          #initialDelaySeconds: 5
-          periodSeconds: 10
+          #periodSeconds: 10
         volumeMounts:
           - name: wp-data
             mountPath: /var/www/html
@@ -78,8 +78,8 @@ spec:
         imagePullPolicy: Always
         resources:
           limits:
-            cpu: "1"
+            cpu: "2"
-            memory: "1Gi"
+            memory: "2Gi"
           requests:
             cpu: "0.5"
             memory: "200Mi"

akashop/hpa.yml

@@ -0,0 +1,19 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: wp-hpa
+  namespace: akashop
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: wp
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 50

akashop/traefik-ingressR.yml

@@ -1,3 +1,15 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: akashop-ratelimit
+  namespace: akashop
+spec:
+  rateLimit:
+    average: 30
+    burst: 50
+
+---
+
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -27,7 +39,8 @@ spec:
     - name: wp
       port: 80
 
-    # middlewares:
+    middlewares:
+    - name: akashop-ratelimit
     # - name: akashop-redir
 
 ---
@@ -60,3 +73,6 @@ spec:
       # strategy: RoundRobin
       # weight: 10
       # nativeLB: true  
+  
+    middlewares:
+    - name: akashop-ratelimit

traefik/traefik-deployment.yml

@@ -2,6 +2,7 @@ kind: Deployment
 apiVersion: apps/v1
 metadata:
   name: traefik-deployment
+  namespace: traefik
   labels:
     app: traefik
 
@@ -22,19 +23,35 @@ spec:
           image: traefik:latest
           args:
             - --api.insecure
-            - --accesslog
             - --log.level=DEBUG
+
+            # access log - https://doc.traefik.io/traefik/observability/access-logs/#limiting-the-fieldsincluding-headers
+            - --accesslog.filepath=/root/traefik/access.log
+            - --accesslog.fields.headers.names.X-Forwarded-For=keep
+            - --accesslog.fields.headers.names.User-Agent=keep
+
             # - --providers.kubernetesingress
             # - --providers.kubernetesingress.allowexternalnameservices=true
             - --providers.kubernetescrd
             - --providers.kubernetescrd.allowCrossNamespace=true
+
             - --entrypoints.web.address=:80
             - --entrypoints.websecure.address=:443
+            
+            # Get real client IP using proxy protocol 
+            # https://doc.traefik.io/traefik/routing/entrypoints/#proxyprotocol
+            - --entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,10.2.0.0/16,172.233.0.0/16
+            - --entryPoints.websecure.proxyProtocol.trustedIPs=127.0.0.1/32,10.2.0.0/16,172.233.0.0/16
+
+            # Get real client IP from X-Forwarded-For
+            # - --entrypoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,10.2.0.0/16
+            # - --entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,172.233.168.36/32
+
             - --certificatesresolvers.le.acme.email=learn@akamai.com
             - --certificatesresolvers.le.acme.storage=acme.json
             - --certificatesresolvers.le.acme.tlschallenge=true
-            # - --certificatesresolvers.le.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory
+            - --certificatesresolvers.le.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory
-            - --certificatesresolvers.le.acme.caServer=https://acme-v02.api.letsencrypt.org/directory
+            # - --certificatesresolvers.le.acme.caServer=https://acme-v02.api.letsencrypt.org/directory
             # change caServer to production https://acme-v02.api.letsencrypt.org/directory
           ports:
             - name: web