# Traefik on Kubernetes - HELP

**URL:** <https://community.traefik.io/t/traefik-on-kubernetes-help/24137>\
**Category:** Traefik v3 (latest)\
**Tags:** kubernetes-crd\
**Created:** [August 23, 2024, 5:09pm UTC](https://community.traefik.io/t/traefik-on-kubernetes-help/24137 "2024-08-23T17:09:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jymitar](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jymitar/32/9221_2.png) [@Jymitar](https://community.traefik.io/u/Jymitar)\
**Post date:** [August 23, 2024, 5:09pm UTC](https://community.traefik.io/t/traefik-on-kubernetes-help/24137/1 "2024-08-23T17:09:07Z")

</div>

I have been fighting traefik ingress for the 2 days now and I cannot understand what I am doing wrong.

I am running a k3s kubernetes cluster and I have deployed traefik using helm with the following values:

```auto
  values:
    logs:
      general:
        level: DEBUG
    service:
      type: NodePort
    persistence:
      enabled: true
      storageClass: apps-nfs
    certResolvers:
      letsencrypt:
        dnsChallenge:
          provider: cloudflare
        storage: /data/acme.json
    env:
      - name: CF_DNS_API_TOKEN
        valueFrom:
          secretKeyRef:
            name: cloudflare
            key: token
    deployment:
      initContainers:
        - name: volume-permissions
          image: busybox:latest
          command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"]
          volumeMounts:
          - mountPath: /data
            name: data
    podSecurityContext:
      fsGroup: 65532
      fsGroupChangePolicy: "OnRootMismatch"
    ingressRoute:
      dashboard:
        enabled: true
    extraObjects:
      - apiVersion: v1
        kind: Service
        metadata:
          name: traefik-api
        spec:
          type: NodePort
          selector:
            app.kubernetes.io/name: traefik
            app.kubernetes.io/instance: traefik-traefik
          ports:
            - port: 8080
              name: traefik
              targetPort: 9000
              protocol: TCP
              nodePort: 30090
    ingressClass:
      name: traefik
    providers:
      kubernetesCRD:
        ingressClass: traefik
        allowCrossNamespace: true
      kubernetesIngress:
        ingressClass: traefik

```

When I create Ingress resource like this one it works. It does issue certificate everything and I am able to access the app on the domain

```auto
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echo-server
  namespace: default
  annotations:
    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
    traefik.ingress.kubernetes.io/router.entrypoints: websecure

spec:
  rules:
    - host: echo.example.com
      http:
        paths:
          - path: /
            pathType: Exact
            backend:
              service:
                name: echo-server
                port:
                  number: 80

```

However, when I try to create an ingressroute or middleware resource it creates them but they do not work. For instance:  
When I create the following

```auto
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: echo-server
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`echo.example.com`) 
    kind: Rule
    services:
    - name: echo-server
      port: 80

```

It is successfully created but I cannot reach the app. I get an error about some TLS handshake or whatever and that is

If I create the following it is the same case:

```auto
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: echo-server
  namespace: default

spec:
  entryPoints:
    - websecure

  routes:
  - match: Host(`echo.jimytar.com`)
    kind: Rule
    services:
    - name: echo-server
      port: 80
  tls: 
    certResolver: letsencrypt

```

When I create a middle ware and reference it I get an error

error="middleware "default-test-header@kubernetescrd" does not exist" entryPointName=websecure routerName=default-echo-server-echo-example-com@kubernetes

```auto
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-header
  namespace: default
spec:
  headers:
    frameDeny: true
    browserXssFilter: true

```

So from my observation none of the CRD resources seems to be working but the Kubernetes Ingress does work....

What is wrong ? Is there a bug in the helm chart or I am missing some configuration?

---

<div class="post-metadata">

**Author:** ![Jymitar](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jymitar/32/9221_2.png) [@Jymitar](https://community.traefik.io/u/Jymitar)\
**Post date:** [August 23, 2024, 6:30pm UTC](https://community.traefik.io/t/traefik-on-kubernetes-help/24137/2 "2024-08-23T18:30:51Z")

</div>

Alright I have resolved the issue seems like I was following the official documentation on github and that was breaking the kubernetescrd

> <https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md#use-an-ingressclass>

if you set the below it breaks the crds  
providers:  
kubernetesCRD:  
ingressClass: traefik  
allowCrossNamespace: true  
kubernetesIngress:  
ingressClass: traefik