Kubernetes 许可问题w/helm3在端口80上安装traefik（主机网络）

我在学习helm3和k8s（microk8s）。 尝试执行以下命令时：

helm install traefik traefik/traefik  -n traefik --values traefik-values.yaml

和traefik-values.yaml具有以下值：

additionalArguments:
  - "--certificatesresolvers.letsencrypt.acme.email=<my-email>"
  - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
  - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
  - "--certificatesResolvers.letsencrypt.acme.tlschallenge=true"
  - "--api.insecure=true"
  - "--accesslog=true"
  - "--log.level=INFO"
hostNetwork: true
ipaddress: <my-ip>
service:
  type: ClusterIP
ports:
  web:
    port: 80
  websecure:
    port: 443

另一方面，我可以使用以下

yaml

文件在相同的端口（80和443）上安装Traefik（近似于上的示例）：

---
版本：v1
种类：名称空间
元数据：
姓名：traefik
---
版本：v1
种类：服务帐户
元数据：
名称：traefik入口控制器
名称空间：traefik
---
种类：守护进程
apiVersion:apps/v1
元数据：
名称：traefik入口控制器
名称空间：traefik
标签：
k8s应用程序：traefik入口lb
规格：
选择器：
火柴标签：
k8s应用程序：traefik入口lb
名称：traefik ingress lb
模板：
元数据：
标签：
k8s应用程序：traefik入口lb
名称：traefik ingress lb
规格：
容忍：
-影响：无时间表
操作员：存在
serviceAccountName:traefik入口控制器
终止时间：60秒
主机网络：对
容器：
-图片：traefik:2.4
名称：traefik ingress lb
端口：
-名称：http
集装箱港口：80
主机端口：80
#-姓名：管理员
#集装箱港口：8080
#主机端口：8080
securityContext：
能力：
删除：
-全部
加：
-网络绑定服务
args：
---providers.kubernetisingress=true
#您需要手动将此IP设置为传入的公共IP
#您的入口资源将使用。请注意，它只影响
#状态和kubectl UI，实际上什么都不做
#它甚至可以被忽略https://github.com/containous/traefik/issues/6303
---providers.kubernetesingress.ingresendpoint.ip=
##取消注释这些端口以及上面和下面的端口以启用
##主机NIC端口8080上的web UI处于**不安全**模式
---api.dashboard=true
---api.unsecure=true
---log=true
---log.level=INFO
---accesslog=true
---entrypoints.web.address=：80
---entrypoints.websecure.address=：443
---certificatesresolvers.leresolver.acme.tlschallenge=true#在Traefik helm图表上有一个建议工作解决方案：

hostNetwork: true
ports:
  web:
    port: 80
    redirectTo: websecure
  websecure:
    port: 443

securityContext:
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  readOnlyRootFilesystem: true
  runAsGroup: 0
  runAsNonRoot: false
  runAsUser: 0

掌舵图中缺少的部分是securityContext中的
NET\u BIND\u服务
功能

---
apiVersion: v1
kind: Namespace
metadata:
  name: traefik
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller
  namespace: traefik
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: traefik-ingress-controller
  namespace: traefik
  labels:
    k8s-app: traefik-ingress-lb
spec:
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
      name: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      tolerations:
      - effect: NoSchedule
        operator: Exists
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      hostNetwork: true
      containers:
      - image: traefik:2.4
        name: traefik-ingress-lb
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        # - name: admin
        #   containerPort: 8080
        #   hostPort: 8080
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        args:
        - --providers.kubernetesingress=true
        # you need to manually set this IP to the incoming public IP
        # that your ingress resources would use. Note it only affects
        # status and kubectl UI, and doesn't really do anything
        # It could even be left out https://github.com/containous/traefik/issues/6303
        - --providers.kubernetesingress.ingressendpoint.ip=<my-server-ip>
        ## uncomment these and the ports above and below to enable
        ## the web UI on the host NIC port 8080 in **insecure** mode
        - --api.dashboard=true
        - --api.insecure=true
        - --log=true
        - --log.level=INFO
        - --accesslog=true
        - --entrypoints.web.address=:80
        - --entrypoints.websecure.address=:443
        - --certificatesresolvers.leresolver.acme.tlschallenge=true # <== Enable TLS-ALPN-01 to generate and renew ACME certs
        - --certificatesresolvers.leresolver.acme.email=<email> # <== Setting email for certs
        - --certificatesresolvers.leresolver.acme.storage=/data/acme.json # <== Defining acme file to store cert information
        
---
kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: traefik
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web
    # - protocol: TCP
      # port: 8080
      # name: admin
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: traefik-ingress-controller
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: traefik

hostNetwork: true
ports:
  web:
    port: 80
    redirectTo: websecure
  websecure:
    port: 443

securityContext:
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  readOnlyRootFilesystem: true
  runAsGroup: 0
  runAsNonRoot: false
  runAsUser: 0