Unable to Access Traefik Dashboard or K8s Services on DigitalOcean K8s using Traefik's IngressRoute CRD

Question

I'm getting into K8s on DigitalOcean's managed service, and am simply trying to setup the very basics to just get it working.

Setup

• Single node on DO's K8s service, no load balancers (unless recommended otherwise, looking to use Traefik for all of that.)
• One floating IP that I have attached to the K8s node in my cluster
• No firewall while diagnosing these issues
• DO K8s v1.15
• Traefik v2.0

Problem

I can confirm that things are being setup as I have them in the following config declarations as far as I can tell, but am having issues accessing the services of the example "whoami" pods that Traefik uses to test functionality, or even access the Traefik Dashboard.

When using kubectl proxy , I use http://localhost:8001/api/v1/namespaces/default/services/http:traefik:8080/proxy/dashboard/#/ to try and access the Traefik Dashboard, which "responds", but only gives a blank page.

In the logs to the Traefik pod, there is only the following:

time="2019-11-04T00:44:49Z" level=info msg="Configuration loaded from flags."
time="2019-11-04T00:44:58Z" level=error msg="Unable to obtain ACME certificate for domains \"<myDomain>\": unable to generate a certificate for the domains [<myDomain>]: acme: Error -> One or more domains had a problem:\n[<myDomain>] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Connection refused, url: \n" rule="Host(`<myDomain>`) && PathPrefix(`/tls`)" routerName=default-ingressroutetls-2c388d38f54b2bf1bbe2 providerName=default.acme

I'll be looking at the Let's Encrypt issue later on, as right now I'm focused on just getting this functional on a basic level.

When trying to access the WhoAmI service, on http://<myDomain>/notls , I get ERR_CONNECTION_REFUSED (Brave/Chrome)

Configuration

traefik.yaml

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutes.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRoute
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: ingressroutetcps.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: IngressRouteTCP
    plural: ingressroutetcps
    singular: ingressroutetcp
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: middlewares.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: Middleware
    plural: middlewares
    singular: middleware
  scope: Namespaced

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tlsoptions.traefik.containo.us

spec:
  group: traefik.containo.us
  version: v1alpha1
  names:
    kind: TLSOption
    plural: tlsoptions
    singular: tlsoption
  scope: Namespaced

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.containo.us
    resources:
      - middlewares
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - ingressroutetcps
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - traefik.containo.us
    resources:
      - tlsoptions
    verbs:
      - get
      - list
      - watch

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default
---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: default
  name: traefik-ingress-controller
---
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  namespace: default
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v2.0
          imagePullPolicy: Always
          args:
            - --api.insecure
            - --accesslog
            - --entrypoints.web.Address=:80
            - --entrypoints.websecure.Address=:443
            - --providers.kubernetescrd
            - --certificatesresolvers.default.acme.tlschallenge
            - --certificatesresolvers.default.acme.email=<myEmail>
            - --certificatesresolvers.default.acme.storage=acme.json
          ports:
            - name: web
              containerPort: 80
            - name: websecure
              containerPort: 443
            - name: admin
              containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: traefik

spec:
  ports:
    - protocol: TCP
      name: web
      port: 8000
    - protocol: TCP
      name: admin
      port: 8080
    - protocol: TCP
      name: websecure
      port: 4443
  selector:
    app: traefik

whoami.yaml

kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  namespace: default
  name: whoami
  labels:
    app: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: containous/whoami
          ports:
            - name: web
              containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: whoami

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: simpleingressroute
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`<myDomain>`) && PathPrefix(`/notls`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutetls
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`<myDomain>`) && PathPrefix(`/tls`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    certResolver: default

Any help would be greatly appreciated, thank you in advance!!

Answer 1

I could guess a couple of things that could help you out...

I'll start by getting rid of that floating IP you're using and just assign an External-IP to the Traefik service by creating the service as a 'LoadBalancer' type, like so:

apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
    - protocol: TCP
      name: websecure
      port: 443
  selector:
    app: traefik
  type: LoadBalancer
status:
  loadBalancer: {}

It will take a couple of secs for the service to obtain an external ip address. use 'kubectl get all' to see the status under the 'EXTERNAL-IP' column. In the end, that's what you're trying to do, isn't it? Configure Treafik as a load balancer? so all external traffic pointing and passing through the service itself makes sense, doesn't it?

The errors you see should get solved by changing/adding the following args to your Traefik Deployment:

- --certificatesresolvers.default.acme.tlschallenge=true
- --certificatesresolvers.default.acme.httpChallenge.entryPoint=web
- --api.dashboard=true (needed for the API route to work)

Then, create a route to the Traefik API. A route pointing to the API looks something like this (at least this is how I've done it):

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-dashboard
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`traefik.domain.com`)
    kind: Rule
    services:
    - name: api@internal
      kind: TraefikService

I would say give these a try first and leave the TLS certs for later.