How to create Traefik IngressRoute out of Traefik configuration?

Question

I want to deploy Zitadel in my Kube.netes Cluster, but I'm struggling to get the Traefik IngressRoute right to work with Zitadel. It's a problem with http2 and Grpc forwarding, but I can't figure out which options are needed.

I created a zitadel helm deployment with these options:

replicaCount: 1
zitadel: 
  masterkey: "changeM3"
  configmapConfig:
    ExternalPort: 443
    ExternalDomain: 'id.example.com'
    ExternalSecure: true
    TLS:
      Enabled: false
  secretConfig:
    Database:
      cockroach:
        User:
          Password: "cockroach-password"
cockroachdb:
  singel-node: true
  statefulset:
    replicas: 1

For Reverse Proxy configuration, the zitadel docs have configurations for traefik, but only for a static configuration file and not for kube.netes configuration:

entrypoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
tls:
  stores:
    default: 
      defaultCertificate:
providers:
  file:
    filename: /etc/traefik/traefik.yaml
http:
  middlewares:
    zitadel:
      headers:
        isDevelopment: false
        allowedHosts:
        - 'localhost'
    redirect-to-https:
      redirectScheme:
        scheme: https
        port: 443
        permanent: true
  routers:
    router0:
      entryPoints:
      - web
      middlewares:
      - redirect-to-https
      rule: 'HostRegexp(`localhost`, `{subdomain:[a-z]+}.localhost`)'
      service: zitadel
    router1:
      entryPoints:
      - websecure
      service: zitadel
      middlewares:
      - zitadel
      rule: 'HostRegexp(`localhost`, `{subdomain:[a-z]+}.localhost`)'
      tls:
        domains:
          - main: "localhost"
            sans:
              - "*.localhost"
              - "localhost"
  services:
    zitadel:
      loadBalancer:
        servers:
        - url: h2c://localhost:8080
        passHostHeader: true

I tried to convert this configuration to IngressRoute, but the dashboard is only loading the site's skeleton and giving an Unknown Content-type received Error like described in this github issue .

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: zitadel
  namespace: apps

spec:
  entryPoints:
    - websecure

  routes:
    - match: Host(`id.example.com`)
      kind: Rule
      services:
        - name: zitadel
          namespace: apps
          port: 8080
          scheme: h2c
          passHostHeader: true
    - match: Host(`id.example.com`)
      kind: Rule
      services:
        - name: zitadel
          namespace: apps
          port: 8080
          scheme: http
          passHostHeader: true
  tls:
    certResolver: letsencrypt-prod
    domains:
    - main: id.example.com

Am I missing something in my IngressRoute that causes that error?

Answer 1

the problem were the two rules of the Ingressroute overlapping. Removing the second route solves the problem:

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: zitadel
  namespace: apps

spec:
  entryPoints:
    - websecure

  routes:
    - match: Host(`id.example.com`)
      kind: Rule
      services:
        - name: zitadel
          namespace: apps
          port: 8080
          scheme: h2c
          passHostHeader: true
  tls:
    certResolver: letsencrypt-prod
    domains:
    - main: id.example.com