enable https on local domain with Kubernetes / Traefik Ingress

Question

When I test my Spring boot app without docker, I test it with:

https://localhost:8081/points/12345/search

And it works great. I get an error if I use http

Now, I want to deploy it with Kubernetes in local, with url: https://sge-api.local

When I use http, I get the same error as when I don't use docker.

But when I use https, I get:

<html><body><h1>404 Not Found</h1></body></html>

Here is my deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: sge-api-local
  name: sge-api-local
  namespace: sge
spec:
  selector:
    matchLabels:
      app: sge-api-local
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: sge-api-local
    spec:
      containers:
      - image: sge_api:local
        name: sge-api-local

Here is my ingress:

kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: sge-ingress
  namespace: sge
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: sge-api.local
    http:
      paths:
      - backend:
         serviceName: sge-api-local
         servicePort: 8081
  tls:
  - secretName: sge-api-tls-cert

with :

kubectl -n kube-system create secret tls sge-api-tls-cert --key=../certs/privkey.pem --cert=../certs/cert1.pem

Finally, here is my service:

apiVersion: v1
kind: Service
metadata:
  labels:
    app: sge-api-local
  name: sge-api-local
  namespace: sge
spec:
  ports:
  - name: "8081"
    port: 8081
  selector:
    app: sge-api-local

What should I do ?

EDIT:

traefik-config.yml:

kind: ConfigMap
apiVersion: v1
metadata:
  name: traefik-config
data:
  traefik.toml: |
    # traefik.toml
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      [entryPoints.http.redirect]
        entryPoint = "https"
      [entryPoints.https]
      address = ":443"
        [entryPoints.https.tls]

traefik-deployment:

kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: traefik-ingress-controller
  labels:
    k8s-app: traefik-ingress-lb
spec:
  selector:
    matchLabels:
      k8s-app: traefik-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-ingress-lb
        name: traefik-ingress-lb
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      containers:
      - image: traefik:1.7
        name: traefik-ingress-lb
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
        - name: https
          containerPort: 443
          hostPort: 443
        - name: admin
          containerPort: 8080
          hostPort: 8080
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        args:
        - --api
        - --kubernetes
        - --logLevel=INFO

traefik-service.yml

kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - protocol: TCP
      port: 80
      name: web
    - protocol: TCP
      port: 8080
      name: admin

I use traefik. For all other sites, traefik will generate a letsencrypt cert. But for this one, he must include the cert / key I give him. I will include traefik config if it helps — Juliatzin, Oct 30 '19 at 12:47
okay, I will give it a try in implementation at my end and will revert — Tushar Mahajan, Oct 30 '19 at 12:49
done, I added traefik file for local dev. I omitted traefik roles, just tell me if you need it — Juliatzin, Oct 30 '19 at 13:33
nop. I just added the traefik config so you have more elements to solve the issue — Juliatzin, Oct 30 '19 at 13:42

Malgorzata · Answer 1 · 2019-10-30T10:55:33.140

Please make sure that you have enable TLS. Let’s Encrypt is a free TLS Certificate Authority (CA) and you can use it to automatically request and renew Let’s Encrypt certificates for public domain names. Make sure that you have created configmap. Check if you follow every steps during traefik setup: traefik-ingress-controller.

Then you have to assign to which hosts creted secret have to be assigned, egg.

tls:
- secretName: sge-api-tls-cert
    hosts:
    - sge-api.local

Remember to add specific port assigned to host while executing link. In your case should be: https://sge-api.local:8081

When using SSL offloading outside of cluster it may be useful to enforce a redirect to HTTPS even when there is no TLS certificate available. You could also add annotations to ingress configuration file:

    traefik.ingress.kubernetes.io/frontend-entry-points: http, https
    traefik.ingress.kubernetes.io/redirect-entry-point: https

to enable Redirect to another entryPoint for that frontend (e.g. HTTPS).

Let me know if it helps.

enable https on local domain with Kubernetes / Traefik Ingress

1 Answers1