Hello Everyone, I'm using Traefik 2.6.3 and ingressRoute kind as below. Passthrough for pathprefix rule is not working after upgrading the Traefik to 2.6.3. The same configuration was working earlier prior to Traefik 2.6.3. Is any configuration is missing?
Thanks for your interest in Traefik.
I see several misunderstandings in your configuration.
TLS passthrough is not available on IngressRoute (or any HTTP based routers for that matter). This option prevents Traefik to look at the request content, so it is not possible for the proxy to look at any part of the (possibly) HTTP request. The only routing rule available with TLS passthrough is HostSNI (see IngressRouteTCP).
As well, it does not make sense to use both passthrough and secretName as the latter is used when Traefik does the TLS termination.
To sum up, your configuration never used TLS passthrough as the option does not exist on IngressRoute. I think you had a "false-positive" because you were providing a certificate.
If you need any help, could you please let me know what you are trying to achieve?
You use Traefik as a TCP reverse proxy. To do so, you use IngressRouteTCP to forward your traffic coming from a specific host to your server, and you enable TLS passthrough. Your backend should handle TLS termination and route the request based on the path.
You use Traefik as an HTTP reverse proxy. Traefik then handle the TLS termination, read the HTTP packet and can perform routing based on your PathPrefix rule. You can then create a dedicated server transport to re-secure the traffic between Traefik and your backend.
In any case, you CANNOT use path based routing if the request is encrypted. Traefik MUST be able to read the HTTP packet before doing any HTTP routing.
In the case of TLS routing (passthrough with host SNI), the TLS header contains the domain (domain only; no path nor query params) for which the request is sent, which explains why we can still do routing without reading the packet.
As suggested in previous thread, I have configured the ingressRoute as per option 2. Here I have configured ingressRoute TLS Termination at ingress. Configured Service port 443 for https connection between Traefik and backend microservice pod. And ServersTransport to resecure traefik between Traefik to backend.
I have used self signed certificates for ingress, serverstransport and application microservice pod.
I'm able to receive the response using the https and verified the same in traefik logs.
Here are the some of the questions.
I'm not sure which certificate is being used by Traefik to reencrypt and communicate with backend. Is there a way to validate the same.
Do we need serversTransport kind since we have enabled Service port 443 for https connection between Traefik and backend?
How to monitor the Traefik and back end communication in detail. Like what is the certificate used for Traefik and backend connection. SSL handshake details etc.
Traefik will use your application certificate to encrypt data.
The ServersTransport is used to customize the way Traefik communicates with your backend. So you can configure insecureSkipVerify if you have self-signed certificates on your backend. Or you can configure root CAs to verify the server certificates. One option is certificates which is use for mTLS. In your example, if you have valid certificates (e.g: provided by Let's Encrypt), you don't need the custom transport.