How to configure GCP Cloud Armour with Traefik ingress in GKE Autopilot?

Hello, I would like to open this thread again. After sometime I finally have come back to this project. I did all set up in my cluster as @WLun001 suggested in his article, but cannot make it work. When I set up another hello service service, I can very easily to reach it with gce ingress, but when I change backend to traefik, it stops working. I tried to deploy Traefik as a nodeport or clusterip. Nothing helped me.

In terms of configuration, nothing special. I installed Traefik with helm chart in GCP. Configured catch-all ingress with a backend service to Traefik and port 80 (Traefik is running on this port). No luck.

I even tried to configure Traefik service as a NEG. No luck.

Any help much appreciated.

Did you annotate ingress with kubernetes.io/ingress.class: gce ?

Yes, I did. Load balancer was created. + I created a global static ip address and used annotation for this. No errors were found when I described ingress. All resources were provisioned. However, I saw black message and 502 in logs.

Hi guys, after spending a lot of time, I finally found a root cause of the issue. Load balancer in GCP didn't route traffic to Traefik because the health check failed. So, I added a default backend ingress for traefik to always return 200 OK and it fixed the issue.

Cheers.

2 Likes

Great to hear that, cheers

hey man

Can you please provide us with the default backend ingress?

Hello guys,

I'm actually in that exact situation. I managed to have the healthy backend by setting BackendConfig to ping traefik.

Still I have issue with certificates and I have ERR_CONNECTION_CLOSED when trying to connect.
@WLun001 Did you manage http to https redirection on traefik ? What is your traefik config ?

Thanks !

Example of my BackendConfig:
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
namespace: "{{ .Release.Namespace }}"
name: my-backendconfig
spec:
healthCheck:
checkIntervalSec: 10
timeoutSec: 3
port: 8080
requestPath: /ping