Using traefik in k3s as a reverse proxy for self-signed https services

user_827081 0
Viewed 277

I'm attempting to provide some https wrappers with valid certificates for services on my home network using my k3s cluster and cert-manager.

I do this with a headless service and a custom endpoint and this works fine for services that are not encrypted, and only exposed on port 80. However, for services with self signed certificates on port 443, I just get "Internal Service Error".

  • Nothing shows in Traefik's logs that might help.
  • There are no response headers except content-length, content-type and date.

This is identical behaviour on two services I'm trying to wrap, my router and my nas.

I believe what I'm looking for is Upstream TLS but from what I can tell Traefik does this automatically. This is my configuration:

---
kind: Endpoints
apiVersion: v1
metadata:
  name: nas
  namespace: routing
subsets:
  - addresses:
      - ip: 10.0.147.154
    ports:
      - name: https
        port: 443
        protocol: TCP

---
kind: Service
apiVersion: v1
metadata:
  name: nas
  namespace: routing
spec:
  clusterIP: None
  ports:
    - name: https
      port: 443
      targetPort: https
      protocol: TCP

---
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: nas
  namespace: routing
  annotations:
    cert-manager.io/cluster-issuer: cloudflare-issuer-example-com
spec:
  rules:
    - host: nas.example.com
      http:
        paths:
          - pathType: Prefix
            path: /
            backend:
              service:
                name: nas
                port:
                  name: https
  tls:
    - hosts:
        - nas.example.com
      secretName: nas-example-certificate

Note: I'm not actually using this domain name, I changed it for the example ;)

If I describe the ingress it looks correct.

Name:             nas
Labels:           <none>
Namespace:        routing
Address:          10.4.0.100,10.4.0.101,10.4.0.102
Ingress Class:    <none>
Default backend:  <default>
TLS:
  nas-example-certificate terminates nas.example.com
Rules:
  Host        Path  Backends
  ----        ----  --------
  nas.example.com  
              /   nas:https (10.0.147.154:443)
Annotations:  cert-manager.io/cluster-issuer: cloudflare-issuer-example-com
Events:
  Type    Reason             Age   From                       Message
  ----    ------             ----  ----                       -------
  Normal  CreateCertificate  42m   cert-manager-ingress-shim  Successfully created Certificate "nas-example-com-certificate"

I also tried adding a ServiceTransport ignore the self signed certificate:

---
apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
  name: nas
  namespace: routing
spec:
  insecureSkipVerify: true

referencing it with the traefik.ingress.kubernetes.io/service.serverstransport annotation on the ingress but this had no effect.

I'm not sure what else to try.

k3s traefik kubernetes reverse-proxy ssl
1 Answers

I also got caught by this as the traefik.ingress.kubernetes.io/service.serverstransport annotation goes on the service and not the ingress. Additionally, you'll need to set a serversscheme and the ServersTransport object itself must be referenced by Traefik's Custom Resource format of <namespace>-<name>@customcrd:

kind: Service
apiVersion: v1
metadata:
  name: nas
  namespace: routing
metadata:
  annotations:
    traefik.ingress.kubernetes.io/service.serversscheme: https
    traefik.ingress.kubernetes.io/service.serverstransport: routing-nas@kubernetescrd
spec:
  clusterIP: None
  ports:
    - name: https
      port: 443
      targetPort: https
      protocol: TCP
user_199508900
Related