Hello, I was attempting to follow the official documentation for traefik.
To do a better example and see if I understood the logic behind that I will post all the yml file I am using.
I want to protect an app that run on port 3000 putting it behind traefic 3.2.1 and https, in order to get the letsencrypt certificate I will use http challenge and certificate manager 1.16.1
001-role.yml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: traefik-role
rules:
- apiGroups:
- ""
resources:
- services
- secrets
- nodes
verbs:
- get
- list
- watch
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.io
resources:
- middlewares
- middlewaretcps
- ingressroutes
- traefikservices
- ingressroutetcps
- ingressrouteudps
- tlsoptions
- tlsstores
- serverstransports
- serverstransporttcps
verbs:
- get
- list
- watch
002-account.yml
apiVersion: v1
kind: ServiceAccount
metadata:
name: traefik-account
003-role-binding.yml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: traefik-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik-role
subjects:
- kind: ServiceAccount
name: traefik-account
namespace: default
004-traefik.yml
kind: Deployment
apiVersion: apps/v1
metadata:
name: traefik-deployment
labels:
app: traefik
spec:
replicas: 1
selector:
matchLabels:
app: traefik
template:
metadata:
labels:
app: traefik
spec:
serviceAccountName: traefik-account
containers:
- name: traefik
image: traefik:v3.2
args:
- --api.insecure
- --providers.kubernetesingress
ports:
- name: web
containerPort: 80
- name: dashboard
containerPort: 8080`
005-traefik-services.yml
apiVersion: v1
kind: Service
metadata:
name: traefik-dashboard-service
spec:
type: LoadBalancer
ports:
- port: 8080
targetPort: dashboard
selector:
app: traefik
---
apiVersion: v1
kind: Service
metadata:
name: traefik-web-service
spec:
type: LoadBalancer
ports:
- targetPort: web
port: 80
selector:
app: traefik
006-program-frontend-deployment.yml
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
kompose.cmd: kompose convert -f compose.yml
kompose.version: 1.34.0 (HEAD)
labels:
io.kompose.service: program-frontend
name: program-frontend
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: program-frontend
template:
metadata:
annotations:
kompose.cmd: kompose convert -f compose.yml
kompose.version: 1.34.0 (HEAD)
labels:
io.kompose.service: program-frontend
spec:
containers:
- env:
- name: API_GATEWAY_BASE_URL
value: http://edge-thinghy:9000
image: program-image
name: program-frontend
ports:
- name: program-frontend
containerPort: 3000
protocol: TCP
imagePullSecrets:
- name: ghcr-secret
restartPolicy: Always
007-program-frontend-service.yml
apiVersion: v1
kind: Service
metadata:
annotations:
kompose.cmd: kompose convert -f compose.yml
kompose.version: 1.34.0 (HEAD)
labels:
io.kompose.service: program-frontend
name: program-frontend
spec:
ports:
- name: program-frontend
protocol: TCP
port: 3000
targetPort: program-frontend
selector:
io.kompose.service: program-frontend
008-edit-program-frontend-service.yml
apiVersion: v1
kind: Service
metadata:
name: program-frontend
spec:
ports:
- name: program-frontend
port: 80
targetPort: 3000
selector:
io.kompose.service: program-frontend
009-program-ingress.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: program-ingress
spec:
rules:
- http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: program-frontend
port:
name: program-frontend
010-challenge.yml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: program-challenge
namespace: default
spec:
acme:
email: my-mail@my.domain
server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
# if not existing, it will register a new account and stores it
name: program-issuer-account-key
solvers:
- http01:
# The ingressClass used to create the necessary ingress routes
ingress:
class: traefik
011-ingress-rule.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: program-ssl-ingress
namespace: default
annotations:
cert-manager.io/issuer: "program-challenge"
spec:
tls:
- hosts:
- program-demo.example.domain
secretName: tls-program-ingress-http
rules:
- host: program-demo.example.domain
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: program-frontend
port:
name: program-frontend
012-redirect-to-https
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: program-frontend-redirect
spec:
redirectScheme:
scheme: https
permanent: true
At this point, after applying all the yml files and getting no errors, if I understood the documentation correctly, I should be able to reach https://program-demo.example.domain but I'm not.
I get error timeout.
I reach only http://program-demo.example.domain
Am I missing something?
If I check the traefik pod logs i can see a lot of errors mentioning this fact:
ERR Skipping service: no endpoints found ingress=program-ingress namespace=default providerName=kubernetes serviceName=program-frontend servicePort=&ServiceBackendPort{Name:program-frontend,Number:0,}
ERR Skipping service: no endpoints found ingress=program-ssl-ingress namespace=default providerName=kubernetes serviceName=program-frontend servicePort=&ServiceBackendPort{Name:program-frontend,Number:0,}