Tukukkk

I deploy traefik ingress controller pod and then two services, one of them a LoadBalancer type for reverse-proxy and the other a ClusterIP for dashboard.

Also I create ingress for redirect all <elb-address>/dashboard to my traefik dashboard.

but for some reason I get 404 error code when I trying to request my dashboard at aws-ip/dashboard

That is the manifest yamls that I use to set up traefik

---

apiVersion: v1

kind: ServiceAccount

metadata:

 name: traefik-ingress-controller

 namespace: kube-system

---

kind: Deployment

apiVersion: apps/v1

metadata:

  name: traefik-ingress-controller

  namespace: kube-system

  labels:

    k8s-app: traefik-ingress-lb

spec:

  replicas: 1

  selector:

    matchLabels:

      k8s-app: traefik-ingress-lb

  template:

    metadata:

      labels:

        k8s-app: traefik-ingress-lb

        name: traefik-ingress-lb

    spec:

      serviceAccountName: traefik-ingress-controller

      terminationGracePeriodSeconds: 60

      containers:

      - image: traefik

        name: traefik-ingress-lb

        ports:

        - name: http

          containerPort: 80

        - name: admin

          containerPort: 8080

        args:

        - --api

        - --kubernetes

        - --logLevel=INFO

---

kind: Service

apiVersion: v1

metadata:

  name: traefik-ingress-service

  namespace: kube-system

spec:

  selector:

    k8s-app: traefik-ingress-lb

  ports:

    - protocol: TCP

      targetPort: 80

      port: 80

  type: LoadBalancer

---

kind: Service

apiVersion: v1

metadata:

  name: traefik-web-ui

  namespace: kube-system

spec:

  selector:

    k8s-app: traefik-ingress-lb

  ports:

    - name: web

      port: 80

      targetPort: 8080

---

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

  namespace: kube-system

  name: traefik-ingress

  annotations:

    kubernetes.io/ingress.class: traefik

spec:

  rules:

  - http:

      paths:

      - path: /dashboard

        backend:

          serviceName: traefik-web-ui

          servicePort: web

Update

I am watching the log and get a the follow errors with rbac activated and the ClusterRole, ServiceRole and ServiceAccount created:

E1124 18:56:23.267560       1 reflector.go:205] github.com/containous/traefik/vendor/k8s.io/client-go/informers/factory.go:86: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:traefik-ingress" cannot list endpoints in the namespace "default"

E1124 18:56:23.648207       1 reflector.go:205] github.com/containous/traefik/vendor/k8s.io/client-go/informers/factory.go:86: Failed to list *v1.Service: services is forbidden: User "system:serviceaccount:kube-system:traefik-ingress" cannot list services in the namespace "default"

E1124 18:56:23.267560       1 reflector.go:205] github.com/containous/traefik/vendor/k8s.io/client-go/informers/factory.go:86: Failed to list *v1.Endpoints: endpoints is forbidden: User "system:serviceaccount:kube-system:traefik-ingress" cannot list endpoints in the namespace "default"

This are my serviceAccount, clusterRole and RoleBingind

kind: ServiceAccount

apiVersion: v1

metadata:

  name: traefik-ingress

---

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: traefik-ingress

rules:

  - apiGroups:

      - ""

    resources:

      - pods

      - services

      - endpoints

      - secrets

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - extensions

    resources:

      - ingresses

    verbs:

      - get

      - list

      - watch

  - apiGroups:

      - extensions

    resources:

      - ingresses/status

    verbs:

      - update

---

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: traefik-ingress

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: traefik-ingress

subjects:

- kind: ServiceAccount

  name: traefik-ingress

  namespace: default

I tried this myself. So basically when you create your Ingress it gets created with a host of traefik-ui.minikube (default), so you won't be able to access the dashboard with <elb-address>/dashboard/.

You will have to access it with traefik-ui.minikube/dashboard/. As an example:

$ kubectl -n kube-system get ingress

NAME              HOSTS                 ADDRESS                  PORTS   AGE

traefik-ingress   *                                                                                              80      8m13s

traefik-web-ui    traefik-ui.minikube   xxxx.elb.amazonaws.com   80      71d



$ curl -H 'Host: traefik-ui.minikube' xxxx.elb.amazonaws.com/dashboard/

<!doctype html><html class="has-navbar-fixed-top">

...

</html>

You can also add an entry to your /etc/hosts file if you'd like to see it on your browser.

 <one-of-the-ips-of-your-elb> traefik-ui.minikube 

And you can also use the host to the rules in your Ingress definition:

apiVersion: extensions/v1beta1

kind: Ingress

metadata:

  namespace: kube-system

  name: traefik-ingress

  annotations:

    kubernetes.io/ingress.class: traefik

spec:

  rules:

  - host: yourown.hostname.com

    http:

      paths:

      - path: /dashboard

        backend:

          serviceName: traefik-web-ui

          servicePort: web

Solution

I apply this

kubectl create serviceaccount --namespace kube-system tiller

kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

and then installed the stable/traefik template with helm

helm install stable/traefik --name=traefik-ingress-controller --values values.yaml

values.yaml file is:
dashboard:
enabled: true
domain: traefik-ui.k8s.io
rbac:
enabled: true
kubernetes:
namespaces:
- default
- kube-system

Thanks for help