Traefik Dashboard on EKS always returns 404 [Helm v37.1.2][NLB]

Traefik Traefik v3 (latest)
1

image
image320×133 5.08 KB

When connecting to my-domain to /dashboard/

  • Ingress

  • port-forwarding

    • the service

    • pod itself

always responds with 404

traefik pod logs see my request

10.108.9.237 - - [07/Oct/2025:18:58:31 +0000] "GET /dashboard/ HTTP/1.1" 404 19 "-" "-" 25 "-" "-" 0ms

Here is my values.yaml

service:
  enabled: true
  type: LoadBalancer
  annotations:
    external-dns.alpha.kubernetes.io/hostname: "example.com"
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: "tcp"
    service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "traffic-port"
    service.beta.kubernetes.io/aws-load-balancer-name: "example-eks-nlb"
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:eu-west-1:XXXXXXXXXXXXXXX:certificate/XXXXXXXXXXXXXXXXXXXXX"
    
ingressRoute:
  dashboard:
    enabled: true
    # Custom match rule with host domain
    matchRule: Host(`example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
    entryPoints: ["websecure", "web"]
    # Add custom middlewares : authentication and redirection
    middlewares:
      - name: traefik-dashboard-auth

# Create the custom middlewares used by the IngressRoute dashboard (can also be created in another way).
# /!\ Yes, you need to replace "changeme" password with a better one. /!\
extraObjects:
  - apiVersion: v1
    kind: Secret
    metadata:
      name: traefik-dashboard-auth-secret
    type: kubernetes.io/basic-auth
    stringData:
      username: admin
      password: changeme # Just for testing

  - apiVersion: traefik.io/v1alpha1
    kind: Middleware
    metadata:
      name: traefik-dashboard-auth
    spec:
      basicAuth:
        secret: traefik-dashboard-auth-secret

ports:
  traefik: # Inner traefik services
    port: 8080
    expose: 
      default: true
    exposedPort: 8080
  web: # HTTP
    expose:
      default: true
    port: 8000
    exposedPort: 80
  websecure: # HTTPS
    expose:
      default: true
    port: 8443
    exposedPort: 443
    tls:
      enabled: true
  metrics:
    port: 9100
    expose:
      default: true
    exposedPort: 9100

providers:
  kubernetesCRD:
    enabled: true
  kubernetesIngress:
    enabled: true
  kubernetesGateway:
    enabled: false
  
gateway:
  enabled: true
  listeners:
    web:
      port: 8000
      namespacePolicy:
        from: All
    # websecure::
    #   port: 8443
    #   protocol: HTTPS

logs:
  general:
    level: "DEBUG"
  access:
    enabled: true