How to configure GCP Cloud Armour with Traefik ingress in GKE Autopilot?

Hello, I would like to open this thread again. After sometime I finally have come back to this project. I did all set up in my cluster as @WLun001 suggested in his article, but cannot make it work. When I set up another hello service service, I can very easily to reach it with gce ingress, but when I change backend to traefik, it stops working. I tried to deploy Traefik as a nodeport or clusterip. Nothing helped me.

In terms of configuration, nothing special. I installed Traefik with helm chart in GCP. Configured catch-all ingress with a backend service to Traefik and port 80 (Traefik is running on this port). No luck.

I even tried to configure Traefik service as a NEG. No luck.

Any help much appreciated.

Did you annotate ingress with kubernetes.io/ingress.class: gce ?

Yes, I did. Load balancer was created. + I created a global static ip address and used annotation for this. No errors were found when I described ingress. All resources were provisioned. However, I saw black message and 502 in logs.

Hi guys, after spending a lot of time, I finally found a root cause of the issue. Load balancer in GCP didn't route traffic to Traefik because the health check failed. So, I added a default backend ingress for traefik to always return 200 OK and it fixed the issue.

Cheers.

Great to hear that, cheers

hey man

Can you please provide us with the default backend ingress?

Hello guys,

I'm actually in that exact situation. I managed to have the healthy backend by setting BackendConfig to ping traefik.

Still I have issue with certificates and I have ERR_CONNECTION_CLOSED when trying to connect.
@WLun001 Did you manage http to https redirection on traefik ? What is your traefik config ?

Thanks !

Example of my BackendConfig:
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
namespace: "{{ .Release.Namespace }}"
name: my-backendconfig
spec:
healthCheck:
checkIntervalSec: 10
timeoutSec: 3
port: 8080
requestPath: /ping