K
Q

Traefik behind ssl terminating load balancer return 404

1/21/2021

I have a K8s setup with traefik being exposed like this

kubernetes:
  ingressClass: traefik
service:
  nodePorts:
    http: 32080
serviceType: NodePort

Behind, I forward some requests to different services

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-name
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
    - host: my-host.com
      http:
        paths:
          - path: /my-first-path
            backend:
              serviceName: my-nodeJs-services
              servicePort: 3000

When the DNS is set directly to resolve to my ip, the application works fine with HTTP

http://my-host.com:32080/my-first-path

But when some one add SSL through AWS ALB / API Gateway, the application fail to be reached with 404-NotFound error

The route is like this https://my-host.com/my-first-path

On the AWS size, they configured something like this

https://my-host.com => SSL Termination and  => Forward all to 43.43.43.43:32080

I think this fail because traefik is expecting http://my-host.com but not https://my-host.com which lead to its failure to find the matching route? Or maybe at the ssl termination time, the hostname is lost so that traefik can not find a route?

What should I do in this situation?

-- qkhanhpro
kubernetes
kubernetes-ingress
traefik

Similar Questions

Spring boot 2 and ReadinessProbe / LivenessProbe
Is there a default NodePort when you deploy a service?
FTP server hosting in Azure Kubernetes
If I delete the pod data in etcd, what will happen in kubelet?
Delete oldest deployment in a namespace

1 Answer

1/26/2021

I am not very familiar with ALB but what is probably happening is that the requests received by the loadbalancer contain the header Host: my-host.com and when it gets forwarded to your ingress controller, the header is replaced by Host: 43.43.43.43. If this is the case, I see 3 solutions:

  1. ALB might be able to pass the original Host header to the target. (You will have to check in the doc if it's possible)
  2. If the application behind your ingress doesn't check the host header, you can write an ingress that doesn't check a specific host. For example on these examples you can see that the host field is not specified.
  3. If the name resolution works internally, you can define a name for your target, use this name in your ALB and in your ingress.
-- ITChap
Source: StackOverflow