Using Traefik to Proxy UDP Services

Previously, we introduced most of the usage methods in Traefik version 2.3.x, and starting from version 2.2, Traefik has provided support for UDP, allowing us to provide load for services such as DNS resolution.

First, deploy a UDP service as shown below:

apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
spec:
  ports:
  - protocol: UDP
    name: udp
    port: 8080
  selector:
    app: whoamiudp
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  labels:
    app: whoamiudp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoamiudp
  template:
    metadata:
      labels:
        app: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: containous/whoamiudp
          ports:
            - name: udp
              containerPort: 8080

Deploy the above application directly. Once the deployment is complete, we need to define a UDP entryPoint in Traefik by modifying the values-prod.yaml file (see previous text), adding the entry point for the UDP protocol:

# values-prod.yaml
# Configure ports
ports:
  web:
    port: 8000
    hostPort: 80
  websecure:
    port: 8443
    hostPort: 443
  mongo:
    port: 27017
    hostPort: 27017
  udpep:
    port: 18080
    hostPort: 18080
    protocol: UDP

Here we define an entry point named udpep, but the protocol is UDP (additionally, TCP and UDP can share the same port, but the protocols must be declared differently), and then update Traefik:

➜ helm upgrade --install traefik --namespace=kube-system ./traefik -f ./values-prod.yaml 

After the update is complete, we can export the resource list file of the Traefik deployment to check if the UDP entry point has been added:

➜ kubectl get deploy traefik -n kube-system -o yaml
......
containers:
- args:
  - --entryPoints.mongo.address=:27017/tcp
  - --entryPoints.traefik.address=:9000/tcp
  - --entryPoints.udpep.address=:18080/udp
  - --entryPoints.web.address=:8000/tcp
  - --entryPoints.websecure.address=:8443/tcp
  - --api.dashboard=true
  - --ping=true
  - --providers.kubernetescrd
  - --providers.kubernetesingress
......

Once the UDP entry point is successfully added, we can create an IngressRouteUDP type resource object to proxy UDP requests:

➜ cat <<EOF | kubectl apply -f -
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: whoamiudp
spec:
  entryPoints:
  - udpep
  routes:
  - services:
    - name: whoamiudp
      port: 8080
EOF
➜ kubectl get ingressrouteudp                       
NAME        AGE
whoamiudp   31s

After successful creation, we first access the above UDP application through Service on the cluster:

➜ kubectl get svc
NAME                TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                 AGE
whoamiudp           ClusterIP   10.106.10.185    <none>        8080/UDP                                36m
➜ echo "WHO" | socat - udp4-datagram:10.106.10.185:8080
Hostname: whoamiudp-d884bdb64-6mpk6
IP: 127.0.0.1
IP: 10.244.1.145
➜ echo "othermessage" | socat - udp4-datagram:10.106.10.185:8080
Received: othermessage

When we input WHO, the application will print out the hostname of the accessed Pod and other information; otherwise, it will print the received string. Now we test by accessing the UDP application using the IP of the node where Traefik is located (10.151.30.11) and port 18080:

➜ echo "othermessage" | socat - udp4-datagram:10.151.30.11:18080
Received: othermessage
➜  echo "WHO" | socat - udp4-datagram:10.151.30.11:18080
Hostname: whoamiudp-d884bdb64-hkw6k
IP: 127.0.0.1
IP: 10.244.2.87

We can see that the test was successful, proving that I successfully used Traefik to proxy the UDP application. In addition, Traefik has many other features, especially powerful middleware and custom plugin capabilities, providing us with the ability to continuously expand its functionality, allowing us to perform secondary development according to our needs.