Cannnot access traefik dashboard under kubernetes

Traefik Traefik v3 (latest)
1

Running a test cluster with 2 servers/2 workers, i deployed traefik via helm

---
# we deploy we tf loadbalancer to align internal / external deployment
service:
  externalIPs: 
    - myIP

deployment:
  replicas: 2
providers:
  kubernetesCRD:
    enabled: false
    allowCrossNamespace: true
  kubernetesIngress:
    enabled: true

logs:
  general:
    # TODO: put on info at times
    level: INFO


# We don't need the ingressDefaultRoute for this, we just port-forward
ingressRoute:
  dashboard:
    enabled: true
    entryPoints: ["traefik"]

ports:
  web:
    transport:
      respondingTimeouts:
        readTimeout: 120
        writeTimeout: 120
  websecure:
    transport:
      respondingTimeouts:
        readTimeout: 120
        writeTimeout: 120

Still, using openlense to locally forward port 8080 from the traefik pod, i only get a “404 page not found” not matter if i use http://localhost:34097/dashboard or http://localhost:34097

What am i doing wrong in this case?

2

From the doc:

The dashboard is available at the same location as the API, but by default on the path /dashboard/ .

Enable Traefik debug log (doc) and Traefik access log in JSON format (doc).

1 Like
3

Activated log infor DEBUG and access logs:

When requesting /dashboard or /dashboard/ i get a 404 as expected

127.0.0.1 - - [31/Dec/2025:07:52:49 +0000] "GET / HTTP/1.1" 404 19 "-" "-" 41 "-" "-" 0ms
127.0.0.1 - - [31/Dec/2025:07:52:49 +0000] "GET /favicon.ico HTTP/1.1" 404 19 "-" "-" 42 "-" "-" 0ms
127.0.0.1 - - [31/Dec/2025:07:52:54 +0000] "GET /dashboard/ HTTP/1.1" 404 19 "-" "-" 43 "-" "-" 0ms

But i’am not sure what this helped with now. Since i cannot see which “endpoint” has been used (should be the endpoint “traefik” on 8080, which since i explicitly port forward 8080 vie openlense should just be the case.

4

Well, I clearly wrote:

5

I did not know and expect the log format to decide upon the verbosity of data, but obv. you knew.

{"ClientAddr":"127.0.0.1:39630","ClientHost":"127.0.0.1","ClientPort":"39630","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":87766,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":87766,"RequestAddr":"localhost:45987","RequestContentSize":0,"RequestCount":2,"RequestHost":"localhost","RequestMethod":"GET","RequestPath":"/","RequestPort":"45987","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"StartLocal":"2026-01-01T07:46:23.217798117Z","StartUTC":"2026-01-01T07:46:23.217798117Z","entryPointName":"traefik","level":"info","msg":"","time":"2026-01-01T07:46:23Z"}
{"ClientAddr":"127.0.0.1:39630","ClientHost":"127.0.0.1","ClientPort":"39630","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":31830,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":31830,"RequestAddr":"localhost:45987","RequestContentSize":0,"RequestCount":3,"RequestHost":"localhost","RequestMethod":"GET","RequestPath":"/favicon.ico","RequestPort":"45987","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"StartLocal":"2026-01-01T07:46:23.473629691Z","StartUTC":"2026-01-01T07:46:23.473629691Z","entryPointName":"traefik","level":"info","msg":"","time":"2026-01-01T07:46:23Z"}
{"ClientAddr":"127.0.0.1:39630","ClientHost":"127.0.0.1","ClientPort":"39630","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":40437,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":40437,"RequestAddr":"localhost:45987","RequestContentSize":0,"RequestCount":4,"RequestHost":"localhost","RequestMethod":"GET","RequestPath":"/dashboard","RequestPort":"45987","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"StartLocal":"2026-01-01T07:46:30.494340188Z","StartUTC":"2026-01-01T07:46:30.494340188Z","entryPointName":"traefik","level":"info","msg":"","time":"2026-01-01T07:46:30Z"}
{"ClientAddr":"127.0.0.1:39630","ClientHost":"127.0.0.1","ClientPort":"39630","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":45476,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":45476,"RequestAddr":"localhost:45987","RequestContentSize":0,"RequestCount":5,"RequestHost":"localhost","RequestMethod":"GET","RequestPath":"/dashboard/","RequestPort":"45987","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"StartLocal":"2026-01-01T07:46:32.208867055Z","StartUTC":"2026-01-01T07:46:32.208867055Z","entryPointName":"traefik","level":"info","msg":"","time":"2026-01-01T07:46:32Z"}

So the right endpoint has been used. I tried / and /dashboard and /dashbaord

Checked the helm and for the dashboard i find

    services:
      - name: api@internal
        kind: TraefikService

for the dashboard. But i cannot see that service under services.

If that is of any relevance, i’am currently (for the above reason) not forwading the service port, but rather the traeffik pod-port 8080 in lens.

If of any interest:

  • chart version 38.0.1
  • rke2 cluster 1.33.6
  • calico latest version as CNI, enc is VXLAN

And maybe to cool things down, i’am kind of familiar with traefik since years, i’am with you gents and lads since 1.x -, used 2.x a lot and 3.x is more recent since on k8s i used nginx as ingress and recently began switching my 2.x installations to 3.x (all non k8s, docker setups) which work fine, i can access the dashboard and do all the thing i’am used too.

I’am now trying my test-cluster to move from nginx-ingress to traefik-ingress (first tried die nginxIngress variant, which worked but did not support middlewares, not trying the ingress variant, but failing to get the backends/middlewares running and thus need dashboard access).

Maybe that background information helps

6

Since it is a test cluster without payload anyway, now also tried

ingressRoute:
  dashboard:
    enabled: true 
    entryPoints: ["traefik", "websecure"]

api:
  dashboard: true

But even on the externalIp:443, i cannot access the dashboard


{"ClientAddr":"10.12.52.128:38381","ClientHost":"10.12.52.128","ClientPort":"38381","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":52869,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":52869,"RequestAddr":"<REDACTED-EXTERNAL-IP>","RequestContentSize":0,"RequestCount":33,"RequestHost":"<REDACTED-EXTERNAL-IP>","RequestMethod":"GET","RequestPath":"/dashboard","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"StartLocal":"2026-01-01T08:09:03.097464126Z","StartUTC":"2026-01-01T08:09:03.097464126Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-01-01T08:09:03Z"}
7

After testinv more, the issue is

providers:
  kubernetesCRD:
    enabled: false # <--- this

If one disables the CRD based ingress, the dashboard route is not registered (since it is part of the Traefik IngressRoute CRD).

But even more, MiddleWares will not work either, if that is disabled (well they are CRDS too).

I disabled it since i planed to use either nginx-ingress or ingress and i was not aware that this will disable internals.

In the end, the point is, one expects to disable the Ingress-CRD support in terms of custom CRD ingress routes but disabling this will actually disable everything, including middleware support (which was the issue i was debugging in the first place). So maybe that should be part of the values.yaml and i’am not even sure it makes sense to disable kubernetesCRD ever, IMHO it renders traefik very limited if rather dysfunctional.

Maybe this should be part of the docs - i do not think this is obvious and if it were, you could not spot it yourself above (it was part of the initial post).

What are your thoughts?

8

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.