# TLS passthrough with SNI and K3S

**URL:** <https://community.traefik.io/t/tls-passthrough-with-sni-and-k3s/1437>\
**Category:** Traefik v2\
**Tags:** kubernetes-ingress\
**Created:** [September 3, 2019, 3:13pm UTC](https://community.traefik.io/t/tls-passthrough-with-sni-and-k3s/1437 "2019-09-03T15:13:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![inorton](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/inorton/32/616_2.png) [@inorton](https://community.traefik.io/u/inorton)\
**Post date:** [September 3, 2019, 3:13pm UTC](https://community.traefik.io/t/tls-passthrough-with-sni-and-k3s/1437/1 "2019-09-03T15:13:22Z")

</div>

Hiya,

I have a service in kubernetes (k3s) that terminates it's own HTTPS connection and I'm running a recent k3s installation that has traefik installed as an ingress provider.

Are there any examples of configuring a kubernetes ingress to do TLS passthrough using SNI rather than termination+re-encrypt.

I am seeing that I can set various annotations in the kubernetes Ingress so I'm guessing I need some traefik specific annotations?

Many thanks

Ian

---

<div class="post-metadata">

**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\
**Post date:** [November 15, 2019, 3:06pm UTC](https://community.traefik.io/t/tls-passthrough-with-sni-and-k3s/1437/2 "2019-11-15T15:06:59Z")

</div>

Hi @inorton, the default traefik installation in k3s is using v1.7: [https://github.com/rancher/k3s/blob/master/manifests/traefik.yaml#L7](https://github.com/rancher/k3s/blob/master/manifests/traefik.yaml#L7) -\> [https://github.com/helm/charts/blob/master/stable/traefik/values.yaml#L3](https://github.com/helm/charts/blob/master/stable/traefik/values.yaml#L3).

Enabling TLS passthrough (without decryption by Traefik) requires to use Traefik v2.0 which support TCP routing (with SNI), which v1.7 does not.

How to make it work in k3s?

- Use the argument `--no-deploy traefik` when starting the k3s master(s) as specified in [https://rancher.com/docs/k3s/latest/en/networking/#traefik-ingress-controller](https://rancher.com/docs/k3s/latest/en/networking/#traefik-ingress-controller), so default Traefik v1.7 is not installed
- Install Traefik v2.0 using the beta helm chart (we are working actively on it) from [https://github.com/containous/traefik-helm-chart](https://github.com/containous/traefik-helm-chart) . Automating this should be easy with [https://rancher.com/docs/k3s/latest/en/configuration/#using-the-helm-crd](https://rancher.com/docs/k3s/latest/en/configuration/#using-the-helm-crd) .

You might find useful examples here: [https://github.com/containous/slides/tree/meetup-sf-devops-2019/demo/traefik-v2/canary/k8s](https://github.com/containous/slides/tree/meetup-sf-devops-2019/demo/traefik-v2/canary/k8s) (a demo of one of our talks: context is different than yours, but demonstrate Traefik v2.0 with k3s).

---

<div class="post-metadata">

**Author:** ![dduportal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dduportal/32/4_2.png) [@dduportal](https://community.traefik.io/u/dduportal)\
**Post date:** [November 15, 2019, 3:09pm UTC](https://community.traefik.io/t/tls-passthrough-with-sni-and-k3s/1437/3 "2019-11-15T15:09:30Z")

</div>

Regarding the TLS passtrough, you'll have to:

- Check what changed from Traefik v1.7 to v2.0 by checking the migration guide at [https://docs.traefik.io/v2.0/migration/v1-to-v2/](https://docs.traefik.io/v2.0/migration/v1-to-v2/)
- Define an "IngressRouteTCP" object (check [https://docs.traefik.io/v2.0/routing/providers/kubernetes-crd/](https://docs.traefik.io/v2.0/routing/providers/kubernetes-crd/) for more informations), specifying the [tls passthrough option](https://docs.traefik.io/v2.0/routing/routers/#general_2)