Increase MaxHeaderBytes for web/websecure entrypoints

Traefik Traefik v3 (latest)
1

Hello,

As referenced in a few other community posts and this github issue: Configurable max request header size by lucasrod16 · Pull Request #10995 · traefik/traefik · GitHub

Traefik blocks traffic with large http headers. I understand the default value is 1MB from the net/http go library that traefik uses but i cant seem to get that reconfigured (as per the pull request linked above)

I have added --entrypoints.web.http.maxheaderbytes=1073741824 to the start up args to no avail, and even mount a dyn.yaml configfile with it configured there too.

Error log: github.com/traefik/traefik/v3/pkg/proxy/httputil/proxy.go:121 > 500 Internal Server Error error="http2: request header list larger than peer's advertised limit"

please help!

2

Share your full Traefik static and dynamic config, and Docker compose file(s) if used.

3

Using the helm chart. Mostly default.

here is the dyn.yaml

dyn.yaml: |
tls:
stores:
default:
defaultCertificate:
certFile: '/certs/tls.crt'
keyFile: '/certs/tls.key'
http:
services:
pipeline-nifi-redirect-uri-ingress-16e5de26dc4ede04dc61:
loadBalancer:
sticky: true
pipeline-nifi-8091:
loadBalancer:
sticky: true
entrypoints:
web:
http:
maxheaderbytes: 1073741824

Relavant values.yaml:
globalArguments:

  • "--global.sendanonymoususage=false"

  • "--global.checknewversion=false"

  • "--providers.kubernetescrd.allowCrossNamespace=true"

additionalArguments:

  • "--serversTransport.insecureSkipVerify=true"

  • "--log.level=DEBUG"

  • "--providers.file.filename=/config/dyn.yaml"

  • "--api.basePath=/services/traefik"

  • "--entrypoints.web.http.maxheaderbytes=1073741824"

image:

registry: docker.io

repository: traefik

tag: v3.5.0

pullPolicy: IfNotPresent

volumes:

  • name: traefik-config

    mountPath: '/config'

    type: configMap

deployment:

enabled: true

replicas: 1

annotations: {}

podAnnotations: {}

additionalContainers:

initContainers:

ports:

web:

port: 8000

expose:

  default: true

exposedPort: 443

protocol: TCP

websecure: ~

Little unorthodox but we are not using websecure. Instead, we have exposed web on port 443 with tls passthrough. TLS is handled externally by an AWS LB.

4

Use 3 backticks before and after code/config to make it more readable and preserve spacing, which is important in yaml.

What’s the TLS passthrough used for? Your target service has its own TLS cert?

5

Oop sorry I mispoke.

There is no tls passthrough.

There is TLS on the aws lb (terminated), no tls between the LB and traefik, and no tls between traefik and the service.

relavant config for this issue:
--entrypoints.web.http.maxheaderbytes=1073741824