Understanding why redirectScheme middleware does not work

Traefik Traefik v3 (latest)
,
1

I am working with Traefik v3 deployed on Kubernetes via the Helm chart and configured with the CRD types.

I have a simplified system in which I have a single IngressRoute defined against hostname.

If I configure the redirectScheme middleware as below when I query the hostname I expect to get a 301 redirect response, instead I get a 404 not found.

If I remove the middleware then I am served my underlying service.

Can anyone explain why the redirectScheme does not appear to be working?

const httpsOnly = new traefik.v1alpha1.Middleware(
  'https-only',
  {
    apiVersion: 'traefik.io/v1alpha1',
    kind: 'Middleware',
    metadata: { name: 'https-only', namespace },
    spec: {
      redirectScheme: {
        scheme: 'https',
        permanent: true,
      },
    },
  },
  { provider },
);

new traefik.v1alpha1.IngressRoute(
  'redirect-route',
  {
    apiVersion: 'traefik.io/v1alpha1',
    kind: 'IngressRoute',
    metadata: {
      name: 'redirect-route',
      namespace,
    },
    spec: {
      entryPoints: ['web'],
      routes: [
        {
          kind: 'Rule',
          match: pulumi.interpolate`Host(\`${hostname}\`)`,
          services: [
            {
              name: myService.metadata.name,
              port: 80,
            },
          ],
          middlewares: [{ name: mustGetMetadataName(httpsOnly) }],
        },
      ],
    },
  },
  { provider },
);
2 
❯ kubectl get ingressroutes.traefik.io -oyaml

apiVersion: v1
items:
- apiVersion: traefik.io/v1alpha1
  kind: IngressRoute
  metadata:
    annotations:
      external-dns.alpha.kubernetes.io/hostname: etctest.inco.org
      external-dns.alpha.kubernetes.io/target: ingress.inco.org
    creationTimestamp: "2024-07-02T21:40:22Z"
    generation: 1
    name: my-ingress-route
    namespace: monitoring
    resourceVersion: "399709"
    uid: a8c05a6a-ff73-4455-bc11-fce88dcd3846
  spec:
    entryPoints:
    - websecure
    routes:
    - kind: Rule
      match: Host(`etctest.inco.org`)
      services:
      - name: my-service-0fda3994
        port: 80
    tls:
      secretName: etctest-tls-secret
- apiVersion: traefik.io/v1alpha1
  kind: IngressRoute
  metadata:
    annotations:
      external-dns.alpha.kubernetes.io/hostname: etctest.inco.org
      external-dns.alpha.kubernetes.io/target: ingress.inco.org
    creationTimestamp: "2024-07-02T21:21:37Z"
    generation: 8
    name: redirect-route
    namespace: monitoring
    resourceVersion: "412496"
    uid: f67b7244-210d-45b8-9153-ff1caaf273e3
  spec:
    entryPoints:
    - websecure
    - web
    routes:
    - kind: Rule
      match: Host(`etctest.inco.org`)
      middlewares:
      - name: https-only
      services:
      - name: my-service-0fda3994
        port: 80
kind: List
metadata:
  resourceVersion: ""