I'm currently using traefik 1.6.x as ingress controller in my K8s clusters. I wanted to update to 1.7.x (and then to 2.x later on), but my ingresses are not working anymore after the update.
The issue seems to be, that I do http method restrictions on my ingresses by adding the methods to the traefik.frontend.rule.type
annotation as follows:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: app-name
namespace: namespace1
annotations:
kubernetes.io/ingress.class: traefik
traefik.frontend.rule.type: "Method: CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT; PathPrefix"
ingress.kubernetes.io/hsts-max-age: "315360000"
ingress.kubernetes.io/hsts-include-subdomains: "true"
ingress.kubernetes.io/custom-frame-options-value: "SAMEORIGIN"
ingress.kubernetes.io/content-type-nosniff: "true"
ingress.kubernetes.io/browser-xss-filter: "true"
ingress.kubernetes.io/custom-response-headers: "Server:||X-Application-Context:||X-Powered-By:||exception:"
spec:
rules:
- host: ...
I don't know if this was ever intended to be done in this way, but apparently it worked. I found that in some other StackOverflow post, iirc.
Removing the Method part (or the whole annotation then, because PathPrefix
is the default) brings the routes back to life. But of course this allows the TRACE
method again, for example.
Is there another way to restrict those (maybe even for all ingresses) with traefik versions from 1.7.x?
Thanks in advance!
Actually the comment of @Crou about CORS headers worked! I just now stumbled upon this problem again and moved the method part to the custom-reponse-headers and it seems to work:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: app-name
namespace: namespace1
annotations:
kubernetes.io/ingress.class: traefik
ingress.kubernetes.io/hsts-max-age: "315360000"
ingress.kubernetes.io/hsts-include-subdomains: "true"
ingress.kubernetes.io/custom-frame-options-value: "SAMEORIGIN"
ingress.kubernetes.io/content-type-nosniff: "true"
ingress.kubernetes.io/browser-xss-filter: "true"
ingress.kubernetes.io/custom-response-headers: "Server:||X-Application-Context:||X-Powered-By:||exception:||Access-Control-Allow-Headers:CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT"
spec:
rules:
- host: ...
I removed the traefik.frontend.rule.type
part then completely, since PathPrefix
is the default.
(!) I only moved up to traefik 1.7.20. I've not managed to do the migration to traefik 2 yet. So I'm not sure if this works with traefik 2!