Traefik returns 503 "no available server" when routing to external IP via headless service

Traefik Traefik v3 (latest)
1

Hi all,

We're trying to configure Traefik to route HTTP traffic to an external IP using a headless Kubernetes service with manually defined Endpoints. However, we're getting a 503 no available server error when trying to access the service via the domain.

Our current setup is:

  • Traefik v3.3.3 (installed via Helm chart)
  • kubernetes v1.32.

We want to forward requests to http://a.example.com (pointing to Traefik's NLB) to an external IP (X.X.X.X) that is reachable from within the cluster.

The service configuration is the following:

Traefik IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  annotations:
    kubernetes.io/ingress.class: my-traefik
  name: my-ingress-route
spec:
  routes:
  - kind: Rule
    match: Host(`a.example.com`) # This points to the traefik NLB DNS record
    services:
    - kind: Service
      name: my-service
      port: 80

Headless Service

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  clusterIP: None
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  type: ClusterIP

Endpoint

apiVersion: v1
kind: Endpoints
metadata:
  name: my-service # Same name as the headless service.
subsets:
  - addresses:
      - ip: X.X.X.X # This IP is reachable.
    ports:
      - port: 80

Observations

  • Doing a kubectl port-forward to the headless service works fine
  • The Traefik dashboard shows the router and service correctly created.
  • Access logs are enabled, and log level is set to DEBUG, but we don't see any specific error messages — just the 503.
  • We are not using ExternalName because we want to use a static IP.
  • We can see the in the metrics the request in the entrypoint but not in the service
    image
    image2505×613 53.5 KB

Any tips on how to debug or troubleshoot this would be greatly appreciated.

Thanks in advance!

2

"Redirect" is a fixed term in HTTP networking, it means the server sends back a redirect status code and the client/browser should request a different address. Do you mean to proxy/forward a request internally to a target service?

3

Yes exactly. I've edited it to make it clearer. Thanks!

4

Enable Traefik debug log (doc) and Traefik access log in JSON format (doc).

Which router is used and what are the stati in access log during a request?

5

Yes, we already enabled both. The debug logs didn't show anything. The access logs show the request with 503 status, and the router used was the one we have configured . Example log:

10.0.46.33 - - [06/May/2025:08:23:19 +0000] "GET / HTTP/1.1" 503 20 "-" "-" 418 "my-ingress-route-b979b52959904234963b@kubernetescrd" "-" 0ms
6

Let me repeat my last post: