V2.2 doesn't create TLS / HTTP in Kubernetes Ingress (non CRD)

Traefik Traefik v2
1

Since upgrading to V2.2, our TLS sites based off Kubernetes Ingress objects (not IngressRoute) don't seem to work. It looks like the HTTP is loading fine in Traefik, however TLS is ignored.

There are no errors listed in the logs or anything that's useful.

2

Can you share a configuration example? I am also trying to setup Kubernetes Ingress with V2.2.

3

I wrote this blog how I solved the problem.

4

good to see it solved - I ended up moving to ingress routes.

Your blog post is slightly incorrect in saying that Ingress objects weren't supported before 2.2, they were in 2, but IngressRoutes are preferred.

However you're absolutely right in needing to split TLS and non TLS ingresses.

5

thanks for your feedback. I corrected my blog.

6

in fact with v2.2, you don't need to create 2 elements if you want to create a redirection:

Also I recommend to use api@internal instead of the insecure mode to create routing for the dashboard:

In your use case you don't need annotations:

        - --entrypoints.web.address=:80
        - --entrypoints.web.http.redirections.entryPoint.to=websecure
        
        - --entryPoints.websecure.address=:443
        - --entryPoints.websecure.tls.certResolver=default

        - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
        - --certificatesresolvers.default.acme.email=your-mail@foo.com
        - --certificatesresolvers.default.acme.storage=acme.json
        - --certificatesresolvers.default.acme.tlschallenge

also, to use Ingress provider you don't use enable the CRD provider if you use the HTTP Options of the entrypoint.

7

Thanks a lot for this clarification. It works now like a charm! I was not aware of this feature for the global redirect. I already updated my blog. The features of Traefik.io are so extensive that it is easy to overlook all the possible options in the documentation.

When you say I do not need the CRD provider but I should use the service name 'api@internal' for the dashboard, how can I configure this with an Ingress?

My IngressRouter, which I am still using, looks like this:

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
spec:
  routes:
  - match: Host(`{MY-HOST-NAME}`)
    kind: Rule
    services:
    - name: api@internal
      kind: TraefikService

But I find no way how to add the 'kind: TraefikService' into an Ingress Object?

8

If you want to use the api@internal, you need the CRD provider.