# New to Traefik & K8 questions **URL:** \ **Category:** Traefik v1\ **Tags:** kubernetes-ingress, letsencrypt-acme\ **Created:** [July 22, 2019, 1:02pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985 "2019-07-22T13:02:20Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 22, 2019, 1:02pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/1 "2019-07-22T13:02:20Z")
Hi, I'm new to K8 and Traefik. It's supposedly supporting DevOps and it does seem like there is a lot of text to do quite simple things so far but it also basically switches manual configuration of NGINX for trusting and copy pasting yaml. However, I do have some questions: - should I switch to Traefik v2? - how do you issue Let's Encrypt certificates for the three cheeses K8 example? - from the Kubernetes website it seemed like Traefik is merely an Ingress for Kubernetes but looking at Traefik's website it isn't. It seems like Traefik is usually used with Docker directly, instead of a scheduler like K8. Is it? - given Traefik's role as Ingress for K8, if you would want to manage a node with numerous pods, for what would you use K8's API and for what Traefik's? ---
**Author:** ![mpl](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@mpl](https://community.traefik.io/u/mpl)\ **Post date:** [July 22, 2019, 2:57pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/2 "2019-07-22T14:57:32Z")
Hello, This community forum is specifically dedicated to Traefik, so it is not really the place to teach you about the whole stack of technologies you're mentioning. You'd be better off posting to generic forums such as Stack Overflow for this kind of question. However, when you do have a more precise question about Traefik itself, please do come back and post here. Regards, Mathieu ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 22, 2019, 5:06pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/3 "2019-07-22T17:06:12Z")
Hello @mpl, I edited my questions to be more specific to Traefik. ---
**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\ **Post date:** [July 22, 2019, 5:40pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/4 "2019-07-22T17:40:44Z")
Hi @tmpl, you might be interested in [https://medium.com/@geraldcroes/kubernetes-traefik-101-when-simplicity-matters-957eeede2cf8](https://medium.com/@geraldcroes/kubernetes-traefik-101-when-simplicity-matters-957eeede2cf8) , to get started with Traefik and Kubernetes. Also [Awesome Traefik 路 traefik/traefik Wiki 路 GitHub](https://github.com/containous/traefik/wiki/Awesome-Traefik) might help you to get resources 馃檪 . About your questions: > from the Kubernetes website it seemed like Traefik is merely an Ingress for Kubernetes but looking at Traefik's website it isn't. It seems like Traefik is usually used with Docker directly, instead of a scheduler like K8. Is it? Traefik _is_ a valid Kubernetes Ingress Controller, and I recommend you to install it in your Kubernetes cluster using the official [Helm Chart](https://github.com/helm/charts/tree/master/stable/traefik), as mentioned in [https://docs.traefik.io/v1.7/user-guide/kubernetes/#deploy-traefik-using-helm-chart](https://docs.traefik.io/v1.7/user-guide/kubernetes/#deploy-traefik-using-helm-chart). > - given Traefik's role as Ingress for K8, if you would want to manage a node with numerous pods, for what would you use K8's API and for what Traefik's? You might want to check [https://medium.com/@geraldcroes/kubernetes-traefik-101-when-simplicity-matters-957eeede2cf8](https://medium.com/@geraldcroes/kubernetes-traefik-101-when-simplicity-matters-957eeede2cf8) to get a better understanding about the role of Traefik Ingress Controller. TL;DR; In the context of Kubernetes, you must specify a [Kubernetes "Ingress Rule"](https://kubernetes.io/docs/concepts/services-networking/ingress/#the-ingress-resource) for your application. Traefik Ingress Controller watches Kubernetes API for Ingress rules, and dynamically update itself with these rules's configuration. > - how do you issue Let's Encrypt certificates for the three cheeses K8 example? If you followed my advise about using the Helm Chart for installing the Traefik Ingress Controller, then you can customize the installation through [helm values](https://helm.sh/docs/using_helm/#customizing-the-chart-before-installing), allowing to speicify the ACME/Let's Encrypt settings at installation time (chech the values `acme.*` in [https://github.com/helm/charts/tree/master/stable/traefik#configuration](https://github.com/helm/charts/tree/master/stable/traefik#configuration)). Technically, enabling Let's Encrypt in Kubernetes with Traefik v1 requires to change the `traefik.toml` configuration and add it the right `[acme]` settings referenced in [https://docs.traefik.io/v1.7/configuration/acme/](https://docs.traefik.io/v1.7/configuration/acme/). This `traefik.toml` is always stored as a [Kubernetes ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/), which you can always edit with `kubectl edit configmap --namespace ` if you already installed Traefik. > - should I switch to Traefik v2? I would recommend you to first get started on v1 in Kubernetes to get a better understanding of the Kubernetes ecosystem. The v2 is in beta, and introduces breaking changes, especially by introducing an alternative to the Kubernetes Ingress Rule. Read more here: [https://docs.traefik.io/v2.0/providers/kubernetes-crd/](https://docs.traefik.io/v2.0/providers/kubernetes-crd/) if you are interested. ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 28, 2019, 6:32pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/5 "2019-07-28T18:32:13Z")
Thank you @dduportal. I will try this. I don't use the Helm chart because I use minikube and not a cloud provider that can provide an external load balancer... I hope your answers answer the following questions as well, referring to that tutorial. Please take a look. I really liked how simple it was to get the things done that did work, but the security features seem more difficult. There are many questions on this board about those. That's a little unnerving because it is the main reason to use Traefik with K8. But that's an aside. From the tutorial > "Note > For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point. For more details see here." - =\> What am I looking at "here"? - where is the TOML? (The TOML is thus stored as a ConfigMap in the kube-system namespace, right? Can the arguments be applied before deploying the traefik ingress or pod?) Then, Q2; is this an alternative? Or does this "need a TLS entrypoint"?/ Or do you still not need a certificate?: "To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource." And Q3: basic authentication is for the dashboard right or are there more things that need access protection? TLS protects the routed hosts right? "Basic Authentication It's possible to protect access to Traefik through basic authentication." I tried the TLS and authentication sections but they leave the traefik dashboard a 404. I can get the dashboard without this section. However, the main point and where I want to go is, to get Let's Encrypt certification for "the 3 cheeses" (my web domains). I don't really know the difference between the TLS and Let's Encrypt certificates because before, without K8, I always got https with Let's Encrypt and https is TLS to me. Can Traefik automatically get LE certificates and wire the new cheese if I merely add a new deployment? ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 28, 2019, 6:44pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/6 "2019-07-28T18:44:58Z")
After editing the cheeses example, everything looks like it works but the \*.minikube URL's give 404. Can you see from this printout why? ```shell $ kubectl get services --all-namespaces NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default cheddar ClusterIP 10.106.204.162 80/TCP 8m32s default hugo ClusterIP 10.107.105.161 80/TCP 8m32s default kubernetes ClusterIP 10.96.0.1 443/TCP 107m default wensleydale ClusterIP 10.109.26.18 80/TCP 8m32s kube-system default-http-backend NodePort 10.99.66.176 80:30001/TCP 107m kube-system kube-dns ClusterIP 10.96.0.10 53/UDP,53/TCP,9153/TCP 107m kube-system kubernetes-dashboard ClusterIP 10.107.27.194 80/TCP 107m kube-system traefik-ingress-service NodePort 10.109.100.42 80:31032/TCP,8080:31214/TCP 29m kube-system traefik-web-ui ClusterIP 10.108.132.74 80/TCP 23m kubernetes-dashboard dashboard-metrics-scraper ClusterIP 10.106.176.28 8000/TCP 40m kubernetes-dashboard kubernetes-dashboard ClusterIP 10.99.100.7 443/TCP 40m ``` ```shell $ kubectl get ingress --all-namespaces NAMESPACE NAME HOSTS ADDRESS PORTS AGE default hugo-n-cheese hugo.minikube,cheddar.minikube,wensleydale.minikube 80 7m41s kube-system traefik-web-ui traefik-ui.minikube 10.0.2.15 80 24m ``` ```shell $ kubectl get deployments --all-namespaces NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE default cheddar 1/1 1 1 17m default hugo-site-local-registry 1/1 1 1 14m default wensleydale 1/1 1 1 17m kube-system coredns 2/2 2 2 112m kube-system default-http-backend 1/1 1 1 111m kube-system kubernetes-dashboard 1/1 1 1 111m kube-system nginx-ingress-controller 1/1 1 1 111m kube-system traefik-ingress-controller 1/1 1 1 33m kubernetes-dashboard kubernetes-dashboard 1/1 1 1 45m kubernetes-dashboard kubernetes-metrics-scraper 1/1 1 1 45m ``` I come from this [https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-18-04](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-18-04) you see. ---
**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\ **Post date:** [July 29, 2019, 10:10am UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/7 "2019-07-29T10:10:08Z")
> [@tmpl](#): > > Thank you @dduportal. I will try this. I don't use the Helm chart because I use minikube and not a cloud provider that can provide an external load balancer... First of all, I insist on the fact that you should really use the Helm chart: as you are in a learning phase of the Kubernetes world (not Traefik as all your questions are related to pure-kubernetes concepts), starting with the Helm chart avoid you having to understand everything at first. Nice for you to know: - You can totally use the Helm chart and deploy Traefik as in Ingress Controller using a Service of type "NodePort". Please read carefully [https://github.com/helm/charts/tree/master/stable/traefik#configuration](https://github.com/helm/charts/tree/master/stable/traefik#configuration), you are searching on the configuration item `serviceType`, that should be specified as an "helm value" during the `helm install` command (ref. [https://helm.sh/docs/using\_helm/#customizing-the-chart-before-installing](https://helm.sh/docs/using_helm/#customizing-the-chart-before-installing)). - Minikube supports `LoadBalancer` type of Service, as referenced on the official project's page: [GitHub - kubernetes/minikube: Run Kubernetes locally](https://github.com/kubernetes/minikube#features). (for info, while searching for documentation to give you, I stumbled on [Install Tools | Kubernetes](https://kubernetes.io/docs/setup/learning-environment/minikube/#known-issues) , so I made a Pull Request for fixing Kubernetes' doc as it's not a limitation anymore - [Remove "LoadBalancer" limitation from Minikube by dduportal 路 Pull Request #15568 路 kubernetes/website 路 GitHub](https://github.com/kubernetes/website/pull/15568)). > [@tmpl](#): > > That's a little unnerving because it is the main reason to use Traefik with K8. I don't really get what do you mean? Traefik can run in a secure way without Kubernetes: wether you're using "Bare metal" with the binary, a Docker container on a single Docker Engine, or in Docker Swarm, or whatever other runtime system supporting Traefik, you can **always** enable both TLS and authentication. Do you have a specific requirements to explain here? I'm asking this, because having to learn Kubernetes "only" for securing Traefik seems a bit overkill, so maybe I'm missing some context 馃檪 > [@tmpl](#): > > From the tutorial > > > "Note > > For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point. For more details see here." > > - =\> What am I looking at "here"? `"here"` is a link pointing to [https://docs.traefik.io/v1.7/configuration/entrypoints](https://docs.traefik.io/v1.7/configuration/entrypoints). I feel like this could be rephrased to make it more explicit. If you share this feeling, do not hesitate to contribute to this documentation as it is an open project, so as much yours as ours 馃檪 It's easy: go to the top of the page, and click on the "blue pen" icon, on the right of the title: it will redirect you to a Github web editor so you can edit the Markdown source and propose a change to the project. I think the link might be better to point directly to the "TLS" section of the page "Entrypoints" (e.g. to [https://docs.traefik.io/v1.7/configuration/entrypoints/#tls](https://docs.traefik.io/v1.7/configuration/entrypoints/#tls)). > [@tmpl](#): > > - where is the TOML? > > (The TOML is thus stored as a ConfigMap in the kube-system namespace, right? Can the arguments be applied before deploying the traefik ingress or pod?) You are right, there is no mention of "how/where" the TOML file should be. Another improvement point for this documentation: feel free to contribute as well, but it's dully noted 馃檪 Your understanding is correct: you could define a ConfigMap containing the `traefik.toml` and mount it in Traefik's pod. Please read carefully [https://docs.traefik.io/v1.7/basics/#configuration-file](https://docs.traefik.io/v1.7/basics/#configuration-file) and [https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) before doing so. =\> My recurrent reminder about using Traefik's Helm Chart, as it takes care of this "plumbing" for you to avoid worrying about the details here. > [@tmpl](#): > > Then, Q2; is this an alternative? Or does this "need a TLS entrypoint"?/ Or do you still not need a certificate?: > "To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource." > [@tmpl](#): > > I don't really know the difference between the TLS and Let's Encrypt certificates because before, without K8, I always got https with Let's Encrypt and https is TLS to me. > > Can Traefik automatically get LE certificates and wire the new cheese if I merely add a new deployment? My answers for these 2 questions: - An "entrypoint" (or a "TLS entrypoint") is a pure Traefik `v1.x` feature. You have to define 2 entrypoints for Traefik, aka. telling Traefik to listen on the ports 80 and 443. Defining an "entrypoint" as "TLS" is telling Traefik to encrypt the HTTP communication with TLS (aka. "HTTPS") for any request incoming on this entrypoint. It is a configuration item that you shall have to specify either on the `traefik.toml`, either with a command line flag. You can see the reference for TOML configuration for this topic on this page: [https://docs.traefik.io/v1.7/configuration/entrypoints/#tls](https://docs.traefik.io/v1.7/configuration/entrypoints/#tls). - With an entrypoint configured to do HTTPS (e.g. making it a "TLS entrypoint"), Traefik needs a TLS certificates for encrypting the connection. Traefik can be configured to get a collection of TLS certificates (from static files, from Let's Encrypt, etc.), and it **also** generates a self-signed certificate at startup, under the hood, to use as a "default" certificate. - The "TLS feature of ingress resource" is a pure Kubernetes features, that Traefik can use for retrieving TLS certificates, as an alternative to Let's Encrypt or files mounted on the pod: it is easier to manage in Kubernetes clusters. But you can use Let's Encrypt alternatively. =\> My recurrent reminder about using Traefik's Helm Chart, as it takes care all the https ("http+tls") stuff for you ,based on the installation values. It's way easier. [/quote] > [@tmpl](#): > > And Q3: basic authentication is for the dashboard right or are there more things that need access protection? TLS protects the routed hosts right? > > "Basic Authentication > > It's possible to protect access to Traefik through basic authentication." Authentication and TLS (HTTPS) are totally different things: TLS/HTTPS is about encrypting the exchanges between client and server, while "authentication" is the process of proving your identity as a client, to the server (and eventually add authorization based on this authentication). In Traefik, Authentication can be defined globally for and endpoints, likewise TLS, as described in [https://docs.traefik.io/v1.7/configuration/entrypoints/#authentication](https://docs.traefik.io/v1.7/configuration/entrypoints/#authentication). This is what to do for the "dashboard", as the entrypoint for the dashboard (("named `traefik` on port `8080` by default) is also exposing Traefik's API But you can also enable authentication per "service" (example: `http://example.com` should be wide open to the world, but `http://example.com/admin` and `http://admin.example.com` ask for user/password). How enable authentication on a specific Kubernetes Ingress rule is described here: [https://docs.traefik.io/v1.7/configuration/backends/kubernetes/#authentication](https://docs.traefik.io/v1.7/configuration/backends/kubernetes/#authentication). > [@tmpl](#): > > I tried the TLS and authentication sections but they leave the traefik dashboard a 404. I can get the dashboard without this section. However, the main point and where I want to go is, to get Let's Encrypt certification for "the 3 cheeses" (my web domains). To help you on this matter, you need to provide us more informations: - Traefik's deployment description (what are the CLI flags used? what are the `*.toml` file used, what is the version, how was it deployed?) - Runtime information (which Kubernetes distribution, which version, which kubernetes objects, etc.) - Logs (Traefik logs are "production ready by default", you might want to enable debug logging). ---
**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\ **Post date:** [July 29, 2019, 12:08pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/8 "2019-07-29T12:08:03Z")
By the way @tmpl, if you are seeking for professional support, you might want to check [https://containo.us/traefikee/](https://containo.us/traefikee/), as the forum is community based, as Traefik is an Open Source project. ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 12:28pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/9 "2019-07-29T12:28:21Z")
Thank you, I seem to be wasting your time with not using the Helm chart, that however has a [prerequisite](github helm/charts/tree/master/stable/traefik): "You are deploying the chart to a cluster with a cloud provider capable of provisioning an external load balancer (e.g. AWS or GKE)" I started with `minikube delete` and then `minikube start` several times and I do no configuration of Traefik outside the traefik tutorial. `minikube version: v1.2.0` I do have more pods by default than the traefik tutorial though: ```auto kube-system coredns-5c98db65d4-svgbq 1/1 Running 0 38m kube-system coredns-5c98db65d4-txr59 1/1 Running 0 38m kube-system default-http-backend-59f7ff8999-h64sp 1/1 Running 0 38m kube-system etcd-minikube 1/1 Running 0 37m kube-system kube-addon-manager-minikube 1/1 Running 0 37m kube-system kube-apiserver-minikube 1/1 Running 0 36m kube-system kube-controller-manager-minikube 1/1 Running 0 37m kube-system kube-proxy-sp6rs 1/1 Running 0 38m kube-system kube-scheduler-minikube 1/1 Running 0 37m kube-system kubernetes-dashboard-7b8ddcb5d6-44rnr 1/1 Running 0 38m kube-system nginx-ingress-controller-7b465d9cf8-ng5lb 1/1 Running 0 38m kube-system storage-provisioner 1/1 Running 0 38m kube-system traefik-ingress-controller-668df9b887-nz4fk 1/1 Running 0 32m ``` I want to combine [https://www.linode.com/docs/applications/containers/deploy-container-image-to-kubernetes/#configure-your-kubernetes-cluster](https://www.linode.com/docs/applications/containers/deploy-container-image-to-kubernetes/#configure-your-kubernetes-cluster) with [https://docs.traefik.io/user-guide/kubernetes/](https://docs.traefik.io/user-guide/kubernetes/) . Since the combination doesn't seem to work, I am looking at the differences (each works separately). - The hugo example goes without an Ingress. (I think that the EXTERNAL-IP PORT(S) 80:30304/TCP is not available when the minikube Ingress addon is enabled?) - The hugo service uses ```auto spec: ports: - protocol: TCP port: 80 targetPort: 80 ``` Its deployment uses apiVersion: apps/v1 and different labels. I use deployment.yaml: ```auto apiVersion: extensions/v1beta1 kind: Deployment metadata: name: hugo-site spec: replicas: 2 selector: matchLabels: app: hugo-site template: metadata: labels: app: hugo-site spec: containers: - name: hugo-site image: qkuykuy/hugo-site:v1 imagePullPolicy: Always ports: - containerPort: 80 ``` and service.yaml: ```auto apiVersion: v1 kind: Service metadata: name: hugo-site spec: selector: app: hugo-site ports: - name: http targetPort: 80 port: 80 ``` ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 12:29pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/10 "2019-07-29T12:29:03Z")
and ingress.yaml ```auto apiVersion: extensions/v1beta1 kind: Ingress metadata: name: hugo-site annotations: kubernetes.io/ingress.class: traefik spec: rules: - host: hugo-site.minikube http: paths: - path: / backend: serviceName: hugo-site servicePort: http ``` ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 12:32pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/11 "2019-07-29T12:32:12Z")
It seems like some small thing makes the two definitions non-compatible. ![11](https://us1.discourse-cdn.com/flex020/uploads/containo/original/1X/dc8b47ea1affd48ae50aabdf272fb1a9a1f7476d.png) $ kubectl get svc --all-namespaces ```auto NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default hugo-site ClusterIP 10.109.198.22 80/TCP 37m default kubernetes ClusterIP 10.96.0.1 443/TCP 54m kube-system default-http-backend NodePort 10.107.28.13 80:30001/TCP 53m kube-system kube-dns ClusterIP 10.96.0.10 53/UDP,53/TCP,9153/TCP 54m kube-system kubernetes-dashboard ClusterIP 10.105.209.85 80/TCP 53m kube-system traefik-ingress-service NodePort 10.109.138.93 80:30380/TCP,8080:31655/TCP 48m kube-system traefik-web-ui ClusterIP 10.102.112.72 80/TCP 45m ``` ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 12:44pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/12 "2019-07-29T12:44:07Z")
logs from [http://127.0.0.1:49486/api/v1/namespaces/kube-system/services/http:kubernetes-dashboard:/proxy/#!/pod/kube-system/traefik-ingress-controller-668df9b887-nz4fk?namespace=kube-system](http://127.0.0.1:49486/api/v1/namespaces/kube-system/services/http:kubernetes-dashboard:/proxy/#!/pod/kube-system/traefik-ingress-controller-668df9b887-nz4fk?namespace=kube-system) ```auto time="2019-07-29T11:46:31Z" level=info msg="Traefik version v1.7.12 built on 2019-05-29_07:35:02PM" time="2019-07-29T11:46:31Z" level=info msg="\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://docs.traefik.io/basics/#collected-data\n" time="2019-07-29T11:46:31Z" level=info msg="Preparing server http &{Address::80 TLS: Redirect: Auth: WhitelistSourceRange:[] WhiteList: Compress:false ProxyProtocol: ForwardedHeaders:0xc000656d20} with readTimeout=0s writeTimeout=0s idleTimeout=3m0s" time="2019-07-29T11:46:31Z" level=info msg="Preparing server traefik &{Address::8080 TLS: Redirect: Auth: WhitelistSourceRange:[] WhiteList: Compress:false ProxyProtocol: ForwardedHeaders:0xc000656d40} with readTimeout=0s writeTimeout=0s idleTimeout=3m0s" time="2019-07-29T11:46:31Z" level=info msg="Starting provider configuration.ProviderAggregator {}" time="2019-07-29T11:46:31Z" level=info msg="Starting server on :80" time="2019-07-29T11:46:31Z" level=info msg="Starting server on :8080" time="2019-07-29T11:46:31Z" level=info msg="Starting provider *kubernetes.Provider {\"Watch\":true,\"Filename\":\"\",\"Constraints\":[],\"Trace\":false,\"TemplateVersion\":0,\"DebugLogGeneratedTemplate\":false,\"Endpoint\":\"\",\"Token\":\"\",\"CertAuthFilePath\":\"\",\"DisablePassHostHeaders\":false,\"EnablePassTLSCert\":false,\"Namespaces\":null,\"LabelSelector\":\"\",\"IngressClass\":\"\",\"IngressEndpoint\":null}" time="2019-07-29T11:46:31Z" level=info msg="ingress label selector is: \"\"" time="2019-07-29T11:46:31Z" level=info msg="Creating in-cluster Provider client" time="2019-07-29T11:46:31Z" level=info msg="Server configuration reloaded on :80" time="2019-07-29T11:46:31Z" level=info msg="Server configuration reloaded on :8080" ``` ---
**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\ **Post date:** [July 29, 2019, 12:54pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/13 "2019-07-29T12:54:23Z")
Hi @tmpl thanks for this details. Based on this screenshot, everything is good from Traefik point's of view: I see that Traefik correctly autoconfigured itself from the ingress rules: I see a couple of frontend and backends for Traefik's UI itself, which are correctly linked (as you can see the dashboard on your webbrowser), and a couple for the Hugo application you defined, which looks well: 2 servers for the 2 replicas pods, and frontend linked to the backend. Your next step is to configure your DNS or `/etc/hosts` to have the domain `hugo-site.minikube` to the IP of the NodePort service. It looks like you already did it with `traefik-ui.minikube` as you can see the dashboard. So what is the result of accessing [http://hugo-site.minikube](http://hugo-site.minikube) for you? ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 12:55pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/14 "2019-07-29T12:55:25Z")
I did edit hosts, but get `default backend - 404` ---
**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\ **Post date:** [July 29, 2019, 12:58pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/15 "2019-07-29T12:58:23Z")
What is the result of the following command: ```shell curl -v http://hugo-site.minikube echo "==" curl -v http://traefik-ui.minikube ``` ? ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 1:01pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/16 "2019-07-29T13:01:54Z")
I'm thinking, can I log in to one of the containers if there is an NGINX running? They don't seem to have `/bin/ash` though (nor `ls`). ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 1:03pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/17 "2019-07-29T13:03:52Z")
```auto $ curl -v http://hugo-site.minikube echo "==" curl -v http://traefik-ui.minikube * Rebuilt URL to: http://hugo-site.minikube/ * Trying 192.168.99.120... * TCP_NODELAY set * Connected to hugo-site.minikube (192.168.99.120) port 80 (#0) > GET / HTTP/1.1 > Host: hugo-site.minikube > User-Agent: curl/7.54.0 > Accept: */* > < HTTP/1.1 404 Not Found < Server: nginx/1.15.9 < Date: Mon, 29 Jul 2019 13:03:09 GMT < Content-Type: text/plain; charset=utf-8 < Content-Length: 21 < Connection: keep-alive < * Connection #0 to host hugo-site.minikube left intact default backend - 404* Rebuilt URL to: echo/ * Could not resolve host: echo * Closing connection 1 curl: (6) Could not resolve host: echo * Rebuilt URL to: ==/ * Could not resolve host: == * Closing connection 2 curl: (6) Could not resolve host: == * Rebuilt URL to: curl/ * Could not resolve host: curl * Closing connection 3 curl: (6) Could not resolve host: curl * Rebuilt URL to: http://traefik-ui.minikube/ * Trying 192.168.99.120... * TCP_NODELAY set * Connected to traefik-ui.minikube (192.168.99.120) port 80 (#4) > GET / HTTP/1.1 > Host: traefik-ui.minikube > User-Agent: curl/7.54.0 > Accept: */* > < HTTP/1.1 302 Found < Server: nginx/1.15.9 < Date: Mon, 29 Jul 2019 13:03:09 GMT < Content-Type: text/html; charset=utf-8 < Content-Length: 34 < Connection: keep-alive < Location: /dashboard/ < Found. * Connection #4 to host traefik-ui.minikube left intact ``` ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 1:12pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/18 "2019-07-29T13:12:19Z")
I find a log message in the K8 NGINX ingress log: AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15" 394 0.001 [kube-system-traefik-web-ui-web] 172.17.0.9:8080 432 0.000 200 fb06b048b29e48ac3d361c3a9c66e003 I0729 11:58:50.972573 6 store.go:348] ignoring add for ingress hugo-site based on annotation [kubernetes.io/ingress.class](http://kubernetes.io/ingress.class) with value but it may be me doing `minikube apply -f` more than once actually, I did create -f the first time and when I indeed do `$ kubectl apply -f ingress.yaml`: ```auto Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply ingress.extensions/hugo-site configured ``` ---
**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\ **Post date:** [July 29, 2019, 1:27pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/19 "2019-07-29T13:27:32Z")
> [@tmpl](#): > > I find a log message in the K8 NGINX ingress log: > AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15" 394 0.001 [kube-system-traefik-web-ui-web] 172.17.0.9:8080 432 0.000 200 fb06b048b29e48ac3d361c3a9c66e003 > I0729 11:58:50.972573 6 store.go:348] ignoring add for ingress hugo-site based on annotation [kubernetes.io/ingress.class](http://kubernetes.io/ingress.class) with value -\> Given that the nginx version of the hugo pod is `1.16.0`, and that the "HTTP/404 error" you have come from a Nginx server in version `1.15.9`, then it means that: - Your configuration for the deploymeny of Hugo is not culprit - Traefik is not used for the requests from your host. It's because the DNS in `*.minikube` are pointing to the external IP of the minikube VM. So the request you are trying are incoming on the port 80 of the interface `eth1` of minikube's VM, which are mapped to the port `30001`, associated to the service `default-http-backend` of type `NodePort`. This is not what you want obviously 馃檪 =\> Start by deleting the "default nginx controller" of minikube. It can work with it still installed, but let's simplify your environment for the sake of a better learning path. =\> Then, can you try the following request: ```shell curl -v http://hugo-site.minikube: 30380 ``` please? As you installed Traefik as a service of type "NodePort", then Kubernetes allocated a port on the minikube's VM network interfaces (`eth0`, `eth1` and `l0` at least). This port is the public port to be used to reach the service. In the case of your Traefik installation, I see on the output of `kubectl get svc --all-namespaces` that you gave us earlier, that the allocated external port is 30380. Let us know if it works with this port. > [@tmpl](#): > > but it may be me doing `minikube apply -f` more than once This should not be a problem as Kubernetes objects are idempotent: you did nothing wrong here. ---
**Author:** ![tmpl](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@tmpl](https://community.traefik.io/u/tmpl)\ **Post date:** [July 29, 2019, 1:29pm UTC](https://community.traefik.io/t/new-to-traefik-k8-questions/985/20 "2019-07-29T13:29:56Z")
Should I disable the ingress addon or delete the NGINX pod? The [https://www.linode.com/docs/applications/containers/deploy-container-image-to-kubernetes/#create-a-docker-image](https://www.linode.com/docs/applications/containers/deploy-container-image-to-kubernetes/#create-a-docker-image) Dockerfile also includes NGINX. [Next page](https://community.traefik.io/t/new-to-traefik-k8-questions/985.md?page=2)