# IngressrouteTCP TLS Termination - K8s

**URL:** <https://community.traefik.io/t/ingressroutetcp-tls-termination-k8s/14878>\
**Category:** Traefik v2\
**Tags:** kubernetes-crd\
**Created:** [June 25, 2022, 6:34pm UTC](https://community.traefik.io/t/ingressroutetcp-tls-termination-k8s/14878 "2022-06-25T18:34:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![clemenko](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/clemenko/32/2179_2.png) [@clemenko](https://community.traefik.io/u/clemenko)\
**Post date:** [June 25, 2022, 6:34pm UTC](https://community.traefik.io/t/ingressroutetcp-tls-termination-k8s/14878/1 "2022-06-25T18:34:27Z")

</div>

Is it possible to get TLS termination with a ingressrouteTCP object? It does not seem to want to load the certs. I keep getting the default traefik cert. See the object code below. Yes the tls secret is there.

The setup is that I want traefik to be able to handle TLS passthrough and termination on the same port. Is this possible with 1 entrypoint?

```auto
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: rancher
  namespace: cattle-system
spec:
  entryPoints:
    - tcp
  routes:
    - match: HostSNI(`rancher.rfed.io`)
      services:
        - name: rancher
          port: 80
  tls:
    secretName: tls-rancher-ingress
    domains: - main: rancher.rfed.io

```

here is how I am deploying traefik

```auto
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: traefik
  namespace: traefik
  labels:
    app: traefik
spec:
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
      - name: traefik
        image: traefik
        imagePullPolicy: IfNotPresent
        args:
        - --api.insecure
        - --accesslog
        - --entrypoints.web.Address=:80
        - --entryPoints.web.forwardedHeaders.insecure
        - --entrypoints.tcp.Address=:443
        - --metrics.prometheus=true
        - --metrics.prometheus.addEntryPointsLabels=true
        - --metrics.prometheus.addServicesLabels=true
        - --providers.kubernetescrd
        - --global.sendAnonymousUsage=false
        - --log.level=DEBUG
        - --pilot.dashboard=false
        ports:
        - name: web
          containerPort: 80
        - name: tcp
          containerPort: 443
        - name: admin
          containerPort: 8080
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL    
      hostNetwork: true

```

---

<div class="post-metadata">

**Author:** ![clemenko](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/clemenko/32/2179_2.png) [@clemenko](https://community.traefik.io/u/clemenko)\
**Post date:** [June 25, 2022, 6:40pm UTC](https://community.traefik.io/t/ingressroutetcp-tls-termination-k8s/14878/2 "2022-06-25T18:40:06Z")

</div>

I am getting

```auto
time="2022-06-25T18:39:06Z" level=debug msg="Handling connection from 98.117.199.121:52765"
time="2022-06-25T18:39:06Z" level=error msg="Error during connection: readfrom tcp 10.42.0.0:62818->10.42.1.17:444: remote error: tls: unknown certificate"
time="2022-06-25T18:39:06Z" level=debug msg="Error while terminating connection: tls: CloseWrite called before handshake complete"

```

with a self signed cert in place. Is this traefik or Rancher?

---

<div class="post-metadata">

**Author:** ![clemenko](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/clemenko/32/2179_2.png) [@clemenko](https://community.traefik.io/u/clemenko)\
**Post date:** [June 26, 2022, 9:05pm UTC](https://community.traefik.io/t/ingressroutetcp-tls-termination-k8s/14878/3 "2022-06-26T21:05:31Z")

</div>

> [@clemenko](#):
>
> `kind: IngressRouteTCP`

If anyone finds this the problem is solved with changing `kind: IngressRouteTCP` to `kind: IngressRoute`.  
I was assuming the Kind and the Entrypoint had to the same. DOH!