# SSH via Traefik to Gitea with K8s

**URL:** <https://community.traefik.io/t/ssh-via-traefik-to-gitea-with-k8s/20612>\
**Category:** Traefik v2\
**Tags:** tcp, kubernetes-ingress\
**Created:** [November 29, 2023, 12:22am UTC](https://community.traefik.io/t/ssh-via-traefik-to-gitea-with-k8s/20612 "2023-11-29T00:22:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![CorvusGei](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/corvusgei/32/7903_2.png) [@CorvusGei](https://community.traefik.io/u/CorvusGei)\
**Post date:** [November 29, 2023, 12:22am UTC](https://community.traefik.io/t/ssh-via-traefik-to-gitea-with-k8s/20612/1 "2023-11-29T00:22:38Z")

</div>

I tried to host Gitea in K8s with Traefik as Ingreess Controller. There is no problem with the https-clone-command, but the ssh-clone command always ends at the K8s host, not in the Traefik or Gitea Pod.

```auto
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea
  namespace: gitea
  labels:
    app: gitea
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea
  template:
    metadata:
      labels:
        app: gitea
    spec:
      containers:
      - name: gitea
        image: gitea/gitea:1.21.0
        ports:
        - containerPort: 3000
          name: gitea
        - containerPort: 22
          name: gitea-ssh
        volumeMounts:
        - mountPath: /data
          name: gitea-data
      volumes:
      - name: gitea-data
        persistentVolumeClaim:
          claimName: gitea-pvc
---
kind: Service
apiVersion: v1
metadata:
  name: gitea-service
  namespace: gitea
spec:
  selector:
    app: gitea
  ports:
  - name: gitea-http
    port: 3000
---
kind: Service
apiVersion: v1
metadata:
  name: gitea-ssh-service
  namespace: gitea
spec:
  selector:
    app: gitea
  ports:
  - name: gitea-ssh
    port: 22
---
kind: IngressRouteTCP
apiVersion: traefik.io/v1alpha1
metadata:
  name: gitea-ssh-ingress
  namespace: gitea
spec:
  entryPoints:
    - ssh
  routes:
  - match: HostSNI(`*`)
    kind: Rule
    services:
    - name: gitea-ssh-service
      port: 22

```

IngressRouteTCP doesn't work as kind for it, but if I use just an IngressRoute, it is recognized as http in the dashboard. Does anyone have an idea how to solve this problem?

---

<div class="post-metadata">

**Author:** ![CaptainStealthy](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/captainstealthy/32/5595_2.png) [@CaptainStealthy](https://community.traefik.io/u/CaptainStealthy)\
**Post date:** [January 9, 2024, 8:26pm UTC](https://community.traefik.io/t/ssh-via-traefik-to-gitea-with-k8s/20612/2 "2024-01-09T20:26:44Z")

</div>

Hi there,

I found this post in a Google search, and was [disappointed to see no replies.](https://xkcd.com/979/) 😂

But then I found this blog post when looking at other results, and figured I should post it here in case you haven't solved this yet, or if someone else finds this page in a future Google search. 🙂

[https://blog.b1-systems.de/forwarding-ssh-traffic-inside-kubernetes-using-traefik](https://blog.b1-systems.de/forwarding-ssh-traffic-inside-kubernetes-using-traefik)

I haven't tried the solution myself yet (I'm about to), but it looks fairly straightforward!

---

<div class="post-metadata">

**Author:** ![bearskylab](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bearskylab](https://community.traefik.io/u/bearskylab)\
**Post date:** [April 2, 2025, 8:07pm UTC](https://community.traefik.io/t/ssh-via-traefik-to-gitea-with-k8s/20612/3 "2025-04-02T20:07:24Z")

</div>

With your config I got the error

```auto
IngressRouteTCP in version "v1alpha1" cannot be handled as a IngressRouteTCP: strict decoding error: unknown field "spec.routes[0].kind"

```

For everybody else looking for the solution, you need to remove kind: Rule in IngressRouteTCP, then it looks like this and works

```auto
kind: IngressRouteTCP
apiVersion: traefik.io/v1alpha1
metadata:
  name: gitea-ssh-ingress
  namespace: gitea
spec:
  entryPoints:
    - ssh
  routes:
  - match: HostSNI(`*`)
    services:
    - name: gitea-ssh-service
      port: 22

```

There is no kind for IngressRouteTCP, see the Traefik docs.