Odd IngressRoute for Traefik dashboard in K3s cluster

Traefik Traefik v2
, ,
1

I have K3s cluster (k3s version 1.32.1+k3s1, Traefik release v2.11.18 built-in) instaled using K3s install script. I've been trying to enable Traefik dashboard with LoadBalancer service (MetalLB as load balancer) and Traefik IngressRoute. Initially, issuing kubectl get ingressroutes -A gave nothing. So I created IngressRoute resource setting "web" as the entrypoint (it used to work formerly). It looked fine, but the dashboard continued to be inaccessible (HTTP 404 Not Found). I then checked CRDs in the cluster with kubectl get crd and found a definition with name ingressroutes.traefik.io seemingly responsible for IngressRoute CRD. Issuing kubectl get crd ingressroutes.traefik.io -o yaml produces the following (shortened to save space):

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    meta.helm.sh/release-name: traefik-crd
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2025-02-14T20:58:24Z"
  generation: 1
  labels:
    app.kubernetes.io/managed-by: Helm
  name: ingressroutes.traefik.io
  resourceVersion: "654"
  uid: 3b27a01f-7a39-4a53-909e-79bc0d08ef21
spec:
  conversion:
    strategy: None
  group: traefik.io
  names:
    kind: IngressRoute
    listKind: IngressRouteList
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced
  versions:
  - name: v1alpha1
  ...

Strangely enough, I found that issuing kubectl get ingressroutes.traefik.io -A gives this:

NAMESPACE NAME AGE
kube-system traefik-dashboard 17h

and that kubectl get -n kube-system ingressroutes.traefik.io traefik-dashboard -o yaml gives

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  annotations:
    meta.helm.sh/release-name: traefik
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2025-02-14T20:58:28Z"
  generation: 2
  labels:
    app.kubernetes.io/instance: traefik-kube-system
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: traefik
    helm.sh/chart: traefik-27.0.201_up27.0.2
  name: traefik-dashboard
  namespace: kube-system
  resourceVersion: "13472"
  uid: bcc346b5-a893-43d5-a388-13c088a38eb2
spec:
  entryPoints:
  - traefik
  routes:
  - kind: Rule
    match: PathPrefix(`/dashboard`) || PathPrefix(`/api`)
    services:
    - kind: TraefikService
      name: api@internal

Then, it turned out that editing kubectl edit -n kube-system ingressroutes.traefik.io traefik-dashboard and changing "traefik" entrypoint for "web" entrypoint does enable Traefik dashboard in the browser. Checking kubectl get -n kube-system ingressroutes.traefik.io traefik-dashboard -o yaml again we obtain:

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  annotations:
    meta.helm.sh/release-name: traefik
    meta.helm.sh/release-namespace: kube-system
  creationTimestamp: "2025-02-14T20:58:28Z"
  generation: 2
  labels:
    app.kubernetes.io/instance: traefik-kube-system
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: traefik
    helm.sh/chart: traefik-27.0.201_up27.0.2
  name: traefik-dashboard
  namespace: kube-system
  resourceVersion: "13472"
  uid: bcc346b5-a893-43d5-a388-13c088a38eb2
spec:
  entryPoints:
  - web
  routes:
  - kind: Rule
    match: PathPrefix(`/dashboard`) || PathPrefix(`/api`)
    services:
    - kind: TraefikService
      name: api@internal

It seems to work, but I do not understand the thing. The resource is not found by its plural/singular (ref. the first paragraph above), but can be selected using CRD name instead of plural/singular! A workaround as above must not be something formal/recommended, I guess. Can anyone explain what's going on here?