My environment is:
traefik version: 2.2.0
kubernetes version: v1.15.9
I am using the traefik 2.2 TCP tls sni function to configure redis tcp exposure, and found that my connection to redis does not work. My configuration is as follows:
cat redis.yaml:
apiVersion: apps/v1
kind: Deployment
metadata:
name: redis
spec:
selector:
matchLabels:
app: redis
template:
metadata:
labels:
app: redis
spec:
containers:
- name: redis
image: redis:3.2.11
ports:
- containerPort: 6379
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: redis
spec:
ports:
- port: 6379
targetPort: 6379
selector:
app: redis
cat tcp-ingressroute-redis.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
name: redis
spec:
tcp:
routes:
Route-1:
entryPoints:
- websecure
rule: HostSNI(`redis-test.abc.com`)
services: redis
tls:
secretName: svc-tls
The traefik deployment configuration part is as follows:
containers:
- args:
- --global.checknewversion
- --global.sendanonymoususage
- --entryPoints.traefik.address=:9000
- --entryPoints.web.address=:8000
- --entryPoints.websecure.address=:8443
- --api.dashboard=true
- --ping=true
- --providers.kubernetescrd
- --log.level=INFO
- --accesslog=true
image: traefik:2.2.0
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
httpGet:
path: /ping
port: 9000
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
name: traefik
ports:
- containerPort: 9000
name: traefik
protocol: TCP
- containerPort: 8000
name: web
protocol: TCP
- containerPort: 8443
name: websecure
protocol: TCP
kubectl get svc -n traefik-v2
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
traefik NodePort 10.88.112.172 <none> 80:43323/TCP,443:10551/TCP 4d16h
After the above configuration, I tried to use the redis client to connect to the redis server through the domain name + nodeport port. The following error:
[root@xxx src]# ./redis-cli -h redis-test.abc.com -p 10551
redis-test.ihomefnt.com:10551> set hello worl
Error: Protocol error, got "H" as reply type byte
PS:
My certificate is the domain name purchased by a regular CA. It was used for my nginx domain name here. For security, I temporarily wrote abc.com. I created the certificate secret in the following way:
kubectl create secret tls svc-tls --cert=214238164490717.pem --key=214238164490717.key
May I ask what is causing this problem, or where is my configuration problem, and how do I need to configure it?