NGINX migration, backend SSL verification breaking

Traefik Traefik v3 (latest)
1

We’ve just embarked on our ingress migration from NGINX. Traefik was chosen due to the level of support for the NGINX annotations.

I’m having trouble getting my ingress to work, and wondering if anyone has some tips for me.

I understand that the way it works, it’ll connect directly to the backend pod IP so SAN validation is against the pod IP. I’ve tried adding the NGINX annotation proxy-ssl-server-name to mitigate it, but curl still fails with HTTP code 500. The Traefik logs show:

500 Internal Server Error error="tls: failed to verify certificate: x509: certificate is valid for 100.127.212.75, not 10.233.83.231"

The cert shows:

    X509v3 Subject Alternative Name: 
        DNS:rmgr.psa-restricted.svc.cluster.local, DNS:nspos-prometheus-endpoint, IP Address:100.127.212.75

Backend pod IP is: 10.233.83.231

Annotation is: nginx.ingress.kubernetes.io/proxy-ssl-server-name: rmgr.psa-restricted.svc.cluster.local

Setting “ssl-verify: off”’ doesn’t get past this either.

Is there something else I’m missing? Any pointers would be very much appreciated.

2

After reading the code a bit I suppose I should mention that proxy-ssl-name is also set to the same value as proxy-ssl-server-name. It seems ssl-server-name is irrelevant if ssl-server is specified.

3

Reading more about the ssl-server-name annotation - as opposed to just the google AI hallucination - it’s supposed to be a boolean (enables TLS SNI) which seems contrary to how it’s used in the Traefik code and a yaml file - see 07-ingress-with-proxy-ssl.yml where it’s set to the same as ssl-name - ‘whoami.localhost’.

That said, I don’t need SNI and so that annotation can’t help me anyway.

For my case I guess it’s back to ssl-name, and the question of why that isn’t forwarded in the code for use in the TLS validation. But perhaps that should be the topic of an official issue on github?

4

Never mind. Looks like due to chart misconfiguration the ingresses were being picked up by the Traefik provider, not their nginx provider.