SSH via Traefik to Gitea with K8s

Traefik Traefik v2
,
1

I tried to host Gitea in K8s with Traefik as Ingreess Controller. There is no problem with the https-clone-command, but the ssh-clone command always ends at the K8s host, not in the Traefik or Gitea Pod.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea
  namespace: gitea
  labels:
    app: gitea
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea
  template:
    metadata:
      labels:
        app: gitea
    spec:
      containers:
      - name: gitea
        image: gitea/gitea:1.21.0
        ports:
        - containerPort: 3000
          name: gitea
        - containerPort: 22
          name: gitea-ssh
        volumeMounts:
        - mountPath: /data
          name: gitea-data
      volumes:
      - name: gitea-data
        persistentVolumeClaim:
          claimName: gitea-pvc
---
kind: Service
apiVersion: v1
metadata:
  name: gitea-service
  namespace: gitea
spec:
  selector:
    app: gitea
  ports:
  - name: gitea-http
    port: 3000
---
kind: Service
apiVersion: v1
metadata:
  name: gitea-ssh-service
  namespace: gitea
spec:
  selector:
    app: gitea
  ports:
  - name: gitea-ssh
    port: 22
---
kind: IngressRouteTCP
apiVersion: traefik.io/v1alpha1
metadata:
  name: gitea-ssh-ingress
  namespace: gitea
spec:
  entryPoints:
    - ssh
  routes:
  - match: HostSNI(`*`)
    kind: Rule
    services:
    - name: gitea-ssh-service
      port: 22

IngressRouteTCP doesn't work as kind for it, but if I use just an IngressRoute, it is recognized as http in the dashboard. Does anyone have an idea how to solve this problem?

2

Hi there,

I found this post in a Google search, and was disappointed to see no replies. :joy:

But then I found this blog post when looking at other results, and figured I should post it here in case you haven't solved this yet, or if someone else finds this page in a future Google search. :slight_smile:

https://blog.b1-systems.de/forwarding-ssh-traffic-inside-kubernetes-using-traefik

I haven't tried the solution myself yet (I'm about to), but it looks fairly straightforward!