K8 - kibana - traefik ingressroute

[chrispward]

I'm trying to get an ingressroute (IR) to work with kibana (8.11.1) - bitnnami charts and getting 404 issues.
I can install kibana and portforward it just fine. I can add the basepath /kibana and have it rewritebasepath so all other pages inculde the basepath. ie http://127.0.0.1:8080/kibana
When i try to create a IR i can get it to initally connect via ie - match: Path(/kibana) but when it redirects say to `/kibana/spaces/enter' I get a 404 error.

In the logs I see.

GET /kibana HTTP/2.0" 302 0 "-" "-" 19399 "websecure-elasticsearch-kibana-ir-de4af144d26b9a2e4498@kubernetescrd" "http://172.20.0.54:5601" 14ms
GET /kibana/spaces/enter HTTP/2.0" 404 19 "-" "-" 19400 "-" "-" 0ms

Note: I'm using my own domain with certs it would be https//mydomain/kibana/spaces/enter

I'm fairly new to traefik so learning as I go.
(I'm not 100% sure that the /kibana is passed through to the app which is expecting `http://172.20.0.54:5601/kibana/spaces/enter' etc.

This is the what is expected when proxying

this is my ingressroute...

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: kibana-ir
namespace: elasticsearch
spec:
entryPoints:
- web
- websecure
routes:
- match: Path(/kibana)
kind: Rule
services: # Service to redirect requests to
- kind: Service
name: kibana
namespace: elasticsearch
port: 5601
tls:
secretName: internal-ca

Blockquote

Any help would be great.
(side question.. is there a way to see more detail on what traefik is passing in between... kibani logs are not either really simple or so much its too much to trace..)

[tarek-ops-guy]

any update about this one. I am having the same issue

[svx]

Hi @chrispward,

thanks for your interest in Traefik.

In your config I see:
- match: Path(/kibana)

Did you try it with PathPrefix?

[chrispward]

oh my god.. how did i miss that!!! lol
I had tried middleware stripprefix/addprefix/replacepath.. etc...
Wow.. rookie mistake!!

Yes... that fixed the issue.... thank u very much.

---

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: kibana-ir
namespace: elasticsearch
spec:
entryPoints:
- web
- websecure
routes:
- match: PathPrefix(/kibana/)
kind: Rule
services: # Service to redirect requests to
- kind: Service
name: kibana
namespace: elasticsearch
port: 5601
tls:
secretName: internal-ca

[chrispward]

just as fyi.. I have keycloak protecting all my apps so just adding in that info...
kibana is now protected via keycloak..

--
apiVersion: apps/v1
kind: Deployment
metadata:
name: traefik-forward-auth
namespace: traefik
labels:
app: traefik-forward-auth
spec:
replicas: 1
selector:
matchLabels:
app: traefik-forward-auth
strategy:
type: Recreate
template:
metadata:
labels:
app: traefik-forward-auth
spec:
terminationGracePeriodSeconds: 60
containers:
- image: funkypenguin/traefik-forward-auth
name: traefik-forward-auth
ports:
- containerPort: 4181
protocol: TCP
env:
- name: CLIENT_ID
value: "someclientid"
- name: CLIENT_SECRET
value: "###"
- name: OIDC_ISSUER
value: "##"
- name: SECRET
value: "##"
- name: COOKIE_DOMAIN
value: "mydomain.com"
- name: AUTH_HOST
value: "mydomain.com"

---

Auth Service

apiVersion: v1
kind: Service
metadata:
name: traefik-forward-auth
labels:
app: traefik-forward-auth
spec:
type: ClusterIP
selector:
app: traefik-forward-auth
ports:

• name: auth-http
  port: 4181
  targetPort: 4181

---

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: traefik-forward-auth
spec:
entryPoints:
- websecure
routes:

• match: Path(/_oauth)
  kind: Rule
  services:
  • name: traefik-forward-auth
    port: 4181
    middlewares:
    • name: traefik-forward-auth
      namespace: traefik
      tls:
      secretName: internal-ca

---

Auth Middleware

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: traefik-forward-auth
namespace : traefik
spec:
forwardAuth:
address: http://traefik-forward-auth:4181
authResponseHeaders:
- X-Forwarded-User
trustForwardHeader: true

---

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: kibana-ir
namespace: elasticsearch
spec:
entryPoints:
- web
- websecure
routes:
- match: PathPrefix(/kibana/)
kind: Rule
services: # Service to redirect requests to
- kind: Service
name: kibana
namespace: elasticsearch
port: 5601
middlewares:
- name: traefik-forward-auth
namespace: traefik
tls:
secretName: internal-ca