K
Q

enable https on local domain with Kubernetes / Traefik Ingress

10/29/2019

When I test my Spring boot app without docker, I test it with:

https://localhost:8081/points/12345/search

And it works great. I get an error if I use http

Now, I want to deploy it with Kubernetes in local, with url: https://sge-api.local

When I use http, I get the same error as when I don't use docker.

But when I use https, I get:

<html><body><h1>404 Not Found</h1></body></html>

Here is my deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sge-api-local
  name: sge-api-local
  namespace: sge
spec:
  selector:
    matchLabels:
      app: sge-api-local
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: sge-api-local
    spec:
      containers:
      - image: sge_api:local
        name: sge-api-local

Here is my ingress:

kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: sge-ingress
  namespace: sge
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: sge-api.local
    http:
      paths:
      - backend:
         serviceName: sge-api-local
         servicePort: 8081
  tls:
  - secretName: sge-api-tls-cert

with :

kubectl -n kube-system create secret tls sge-api-tls-cert --key=../certs/privkey.pem --cert=../certs/cert1.pem

Finally, here is my service:

apiVersion: v1
kind: Service
metadata:
  labels:
    app: sge-api-local
  name: sge-api-local
  namespace: sge
spec:
  ports:
  - name: "8081"
    port: 8081
  selector:
    app: sge-api-local

What should I do ?

EDIT:

traefik-config.yml:

kind: ConfigMap
apiVersion: v1
metadata:
  name: traefik-config
data:
  traefik.toml: |
    # traefik.toml
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      [entryPoints.http.redirect]
        entryPoint = "https"
      [entryPoints.https]
      address = ":443"
        [entryPoints.https.tls]

traefik-deployment:

kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: traefik-ingress-controller
  labels:
    k8s-app: traefik-ingress-lb
spec:
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      containers:
      - image: traefik:1.7
        name: traefik-ingress-lb
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        - name: https
          containerPort: 443
          hostPort: 443
        - name: admin
          containerPort: 8080
          hostPort: 8080
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        args:
        - --api
        - --kubernetes
        - --logLevel=INFO

traefik-service.yml

kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 8080
      name: admin
-- Juliatzin
kubernetes
traefik

Similar Questions

error: error parsing ssl2.yaml: error converting YAML to JSON: yaml: line 22: did not find expected key
RabbitMQ as pod in kubernetes cluster
How do I mount and format new google compute disk to be mounted in a GKE pod?
Kubernetes internal nginx ingress controller with SSL termination & ssl-passthrough
How to capture query per seconds or microservice call latency? (without istio or other envoy based tool)

1 Answer

10/30/2019

Please make sure that you have enable TLS. Let’s Encrypt is a free TLS Certificate Authority (CA) and you can use it to automatically request and renew Let’s Encrypt certificates for public domain names. Make sure that you have created configmap. Check if you follow every steps during traefik setup: traefik-ingress-controller.

Then you have to assign to which hosts creted secret have to be assigned, egg.

tls:
- secretName: sge-api-tls-cert
    hosts:
    - sge-api.local

Remember to add specific port assigned to host while executing link. In your case should be: https://sge-api.local:8081

When using SSL offloading outside of cluster it may be useful to enforce a redirect to HTTPS even when there is no TLS certificate available. You could also add annotations to ingress configuration file:

    traefik.ingress.kubernetes.io/frontend-entry-points: http, https
    traefik.ingress.kubernetes.io/redirect-entry-point: https

to enable Redirect to another entryPoint for that frontend (e.g. HTTPS).

Let me know if it helps.

-- MaggieO
Source: StackOverflow