IngressRouteTCP CRD ignored even when labelselector is specified

Traefik Traefik v2
1

Hey All,

I have been trying to get ssl-passthrough or tls-passthrough work with Traefik Ingress Controller on v2.

Apparently CRD (IngressRouteTCP) to implement this. This cannot be done using Ingress (kubernetes ingress - Please correct me and point to a direction if I am wrong.

Next, I have multiple Ingress controllers deployed, I need to map the CRD to be picked by one ingress controller only. I am looking at using labelselector at kubernetes crd (controller and resource).

values.yaml

providers:
  kubernetesCRD:
    enabled: true
    labelselector: "ingressclass=traefik-kafka"
    allowCrossNamespace: true
    namespaces: []
additionalArguments:
  - "--log.level=DEBUG"
  - "--providers.kubernetesingress.ingressclass=traefik-kafka"

Resultant Deployment args

      --providers.kubernetescrd.labelselector=ingressclass=traefik-kafka

IngressRouteTCP CRD

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  annotations:
    kubernetes.io/ingress.class: traefik-kafka
  name: shared-kafka-kafka-0
  namespace: mynamespace
  labels:
      ingressclass: traefik-kafka
spec:
  entryPoints:
    - websecure
  routes:
  - match: HostSNI(`hostname-FQDN`)
    services:
    - name: my-service
      port: 9094
      #weight: 3
      #TerminationDelay: 400
  tls:
    passthrough: true

Resource is created as expected.

Note: Controller namespace and IngressRouteTCP are in different namespaces.

Controller is not picking up the resource when defined in different namespace.
It is skipping the resource when defined in same namespace.

Log

time="2021-10-05T13:25:43Z" level=debug msg="Skipping Kubernetes event kind *v1alpha1.IngressRouteTCP" providerName=kubernetescrd

Please help troubleshoot and make it work.

2

It seems to work when using the namespace default for your IngressRoute using helm. It works with all namespace using the yml way
Here's my IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: simplecrd
  namespace: default
  labels:
      ingressclass: traefik-kafka
spec:
  entryPoints:
    - web
  routes:
  - match: HostSNI(`*`)
    services:
    - name: whoamitcp
      port: 8080

And my values.yaml:

providers:
  kubernetesCRD:
    enabled: true
    labelselector: "ingressclass=traefik-kafka"
    allowCrossNamespace: true
    namespaces: []
additionalArguments:
  - "--log.level=DEBUG"
  - "--providers.kubernetesingress.ingressclass=traefik-kafka"
1 Like
3

Hello Tom,

Thanks a lot for your time on this.

Could you please confirm, for ssl-passthrough to work,
Do I need to setup both IngressRoute and IngressRouteTCP or only IngressRouteTCP alone is enough

Thanks

4

No, you don't have to setup both IngressRoute and IngressRouteTCP to have passthrough to work. IngressRouteTCP alone is enough