Set up Traefik Kubernetes Ingress for HTTP and HTTPS with redirect to HTTPS

PublishedSeptember 17, 2021

•3 min read•View as Markdown

Set up Traefik Kubernetes Ingress for HTTP and HTTPS with redirect to HTTPS

Aqib Rahman

Comments (1)

Join the discussion

Tomas Norre Mikkelsen3y ago

Hi.

Thanks for writing the article, this is exactly what I was looking for, and it works like a charm for me, with one exception.

When I go to my traefik dashboard, I see the following error on the web-route.

middleware "default-traefik-redirectscheme@kubernetescrd" does not exist

I have applied the middleware, and it's also present when I do kubectl get middleware

Do you have an idea why this is happening?

More from this blog

Azure Conditional Access Policies as Code with Graph API, Part 3: Apply

In the third and final part of our Azure Conditional Access Policies as Code with Graph API series, we'll be covering the Apply phase of our policies. You can check out the other parts from the links below: Part 1: Write Part 2: Plan Part 3: Apply...

Jan 8, 20232 min read

Azure Conditional Access Policies as Code with Graph API, Part 2: Plan

In the second part of our Azure Conditional Access Policies as Code with Graph API series, we'll be covering the Plan phase of our policies. You can check out the other parts from the links below: Part 1: Write Part 2: Plan Part 3: Apply Now tha...

Dec 19, 20223 min read

Azure Conditional Access Policies as Code with Graph API, Part 1: Write

Conditional access is an additional layer of security whereby it looks for signals and makes a decision on which actions the user must complete in order to access a resource. Typically conditional access policies are manually managed in Azure AD thro...

Dec 3, 20223 min read

Deploy Azure Virtual Network Peering with a Terraform Module

In this blog post I'll take you through this Terraform module I created which you can use to deploy VNet peerings in your Azure tenant. Consider a typical hub and spoke network, the Virtual Networks may be spread out across your tenant in multiple su...

Jul 19, 20223 min read

Detecting and Remediating State Drift in Terraform

When you deploy your infrastructure with Terraform, the state is recorded to map the resource instances to the configuration. When the configuration is updated, Terraform looks at the current state and then creates a plan to update or delete the reso...

Apr 1, 20228 min read

Aqib Rahman

8 posts

When services are deployed to kubernetes, it is necessary to configure how to expose and redirect traffic to them from outside the cluster.

In this blog post I will show you how you can set up Traefik ingress routers to redirect HTTP traffic to HTTPS.

This post assumes you have Traefik deployed in your cluster with the kubernetes ingress and kubernetescrd provider, as well as the TLS certificate you want to use loaded on to it.

Ensure you have entrypoints defined in your kubernetes deployment, with ports 80 and 443 defined for web and websecure traffic respectively.

EntryPoints are the network entry points into Traefik. They define the port which will receive the packets, and whether to listen for TCP or UDP.

Deploy first router

In order to have Traefik listen to requests on HTTPS, you'll need to include a TLS section in your ingress definition. Here is an example definition of our first router:

---
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: traefik-ingress
  namespace: example
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"

spec:
  rules:
  - host: websecure.example.io
    http:
      paths:
      - backend:
          service:
            name: example
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - websecure.example.io

We incorporate the traefik.ingress.kubernetes.io/router.entrypoints annotation with value websecure only.

However, as per the Traefik documentation, this will instruct our router to ignore HTTP (non TLS) requests.

We want to have our service listen on both HTTP and HTTPS. To do this we'll need to deploy a second router dedicated to HTTP traffic, but first let's have a look at Middleware.

Middleware

The documentation explains it well, so I'll just copy the definition here:

Attached to the routers, pieces of middleware are a means of tweaking the requests before they are sent to your service (or before the answer from the services are sent to the clients).

That sounds good, we want to redirect all HTTP requests to HTTPS, so lets deploy the Middleware:

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: redirect
  namespace: example

spec:
  redirectScheme:
    scheme: https
    permanent: true

Now we need to attach this to our HTTP router, so let's proceed with it's creation.

Deploy second router

Here is the definition for our second router:

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-redirect
  namespace: example
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
    traefik.ingress.kubernetes.io/router.middlewares: example-redirect@kubernetescrd

spec:
  rules:
    - host: websecure.example.io
      http:
        paths:
          - backend:
              service:
                name: example
                port:
                  number: 80
            path: /
            pathType: ImplementationSpecific

We specify the entrypoint as web this time as it will listen for HTTP requests only.

Our middleware is attached with the traefik.ingress.kubernetes.io/router.middlewares annotation.

The value we associate is in the format <namespace>-<middleware-name>@kubernetescrd By doing this we also avoid global redirection for all our other services in the cluster

Great, I hope that helps with how you can redirect requests from outside your kubernetes cluster into your services.

Command Palette

Comments (1)

More from this blog

Deploy first router

Middleware

Deploy second router