# Kubernetes ingress to external service

**URL:** <https://community.traefik.io/t/kubernetes-ingress-to-external-service/20001>\
**Category:** Traefik v2\
**Tags:** kubernetes-ingress, letsencrypt-acme\
**Created:** [September 27, 2023, 8:49pm UTC](https://community.traefik.io/t/kubernetes-ingress-to-external-service/20001 "2023-09-27T20:49:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![keylooper](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/keylooper/32/7645_2.png) [@keylooper](https://community.traefik.io/u/keylooper)\
**Post date:** [September 27, 2023, 8:49pm UTC](https://community.traefik.io/t/kubernetes-ingress-to-external-service/20001/1 "2023-09-27T20:49:20Z")

</div>

I'm currently learning Traefik and I'm struggling a bit with some of the terminology (file vs. dynamic, etc) and how to apply some of the examples I've found to my setup. So I seem to have traefik working 95% the way I want it to. Works great for services internal to my k8s cluster, currently using kubernetes ingress yaml to define my ingresses.

I'm now trying to use traefik as a proxy for some of my services that are not running on k8s. I've found a few examples and the documentation [here](https://doc.traefik.io/traefik/routing/services/#servers) on defining loadbalancers/servers. This seems to be exactly what I want but I can't seem to get that config to work. Temporarily, I've setup a generic nginx proxy within k8s and send my traefik to that which then proxies to the external services...it's hacktastic 😃 (works, but I'm sure there's a better way)

So here's an example of a current (working) ingress config for one of my services:

```auto
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: service1-ingress
  namespace: webapps
  annotations:    
spec:
  rules:
  - host: "service1.example.com"
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: service1
            port:
              number: 80

```

This works great for internal services to k8s. I'm now trying to apply the example from the documentation to proxy for an external service, this is my config:

```auto
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: service1-ingress
  namespace: apps
  annotations:    
spec:
  rules:
  - host: "service.example.com"
    http:
      paths:
      - path: /
        pathType: Prefix
        services:
          service1:
            loadBalancer:
              servers:
                - url: "http://10.1.122.50:8080"

```

That returns the following error:  
`Error from server (BadRequest): error when creating "service1-ingress.yaml": Ingress in version "v1" cannot be handled as a Ingress: strict decoding error: unknown field "spec.rules[0].http.paths[0].services"`

I'm assuming (probably should assume anything) that it's because I'm using the [networking.k8s.io/v1](http://networking.k8s.io/v1) api and need to use something else.

My desired outcome is traefik handles the TLS (via LE) and proxies the request to the backend services whether they are within the k8s cluster or not.

Any help would be appreciated. If it helps/matters, traefik was deployed using the helm chart traefik/traefik.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 28, 2023, 5:56am UTC](https://community.traefik.io/t/kubernetes-ingress-to-external-service/20001/2 "2023-09-28T05:56:10Z")

</div>

No clue about k8s. Usually in Traefik you need to define a router with a rule and a separate service with loadbalancer, then you assign the service to the router ([Doc](https://doc.traefik.io/traefik/routing/overview/#example-with-a-file-provider)). Not sure if this applies to k8s.

Maybe check the Traefik & k8s [doc](https://doc.traefik.io/traefik/providers/kubernetes-ingress/) and look at the [examples](https://github.com/traefik/traefik/tree/v2.10/pkg/provider/kubernetes/ingress/fixtures).

---

<div class="post-metadata">

**Author:** ![kchristidis](https://avatars.discourse-cdn.com/v4/letter/k/bc8723/32.png) [@kchristidis](https://community.traefik.io/u/kchristidis)\
**Post date:** [May 30, 2025, 12:30pm UTC](https://community.traefik.io/t/kubernetes-ingress-to-external-service/20001/3 "2025-05-30T12:30:39Z")

</div>

A bit late to the party.. but I wanted to share what finally worked for me. The example links were helpful, but I still couldn't get it working until I dug into the [commit](https://github.com/traefik/traefik/commit/3c1ed0d9b275c19a9469a56966f01599284cbe7a) that introduced those examples

> In `v2.4.10`, by default, it is no longer authorized to reference Kubernetes ExternalName services. To allow it, the `allowExternalNameServices` option should be set to `true`.

So, if you're seeing 404s when trying to route to ExternalName services, make sure you've enabled this option—otherwise, Traefik won't even create routes for them. Also [docs](https://doc.traefik.io/traefik/providers/kubernetes-ingress/#allowexternalnameservices) include this little detail.

Hope this helps