Traefik ingress

[Thijmen]

Hi there,

I am tinkering around a little bit, would it be possible to have Traefik as well as an ingress, just like nginx?

[vitobotta]

Hey, so even though hetzner-k3s uses k3s, which has Traefik support built in, I originally decided to keep things as standard as possible. This means avoiding k3s-specific implementations when thinking from the user's perspective. That's why you can't enable the built-in Traefik support right now. But I plan to make this configurable in an upcoming release.

For now, you can use a workaround. Just edit the file at https://github.com/vitobotta/hetzner-k3s/blob/main/templates/master_install_script.sh and remove the line that says --disable traefik. This will let k3s set up Traefik for you if you want to use the built-in support. You'll need to set up Crystal on your local machine to run the modified code until I add this as a native option.

Alternatively, you can just install Traefik using the Helm chart or manifests, similar to how you'd set up nginx or other ingress controllers.

[vitobotta]

A PR would be great! To keep things consistent, like with the CNI, I would go for this structure:

...
networking:
  ssh:
    ...
  ingress:
    enabled: true
    mode: traefik

This matches our other settings and also makes it easier to add support for other ingress controllers later on. Thanks a lot for working on this!

[Thijmen]

@vitobotta Sure thing, would you like to have some config options for the loadbalancer spec as well, so a predefined location can be set? Please note, that we'd have to alter some file as described here; https://docs.k3s.io/helm#customizing-packaged-components-with-helmchartconfig

Not sure how you would feel about that. I can understand that if you would recommend installing Traefik manually because that could be a better option.

[Thijmen]

Maybe it's better to extend the documentation to deploy Traefik as an ingress, on a second thought.

[vitobotta]

I'm not sure; I need to think about it. As I said, the idea was to create a tool that generates generic clusters. I'm not fully convinced about showing k3s-specific settings because of this.

[Thijmen]

Which I can totally understand. Let me know if you would be open for a PR that shows how to install Traefik.

[sandros94]

If I'm not mistaken, since version 2.3.8 we do have optionally the ability to add traefik via addons.traefik.enabled: true right?

If so, lets say I want to use Hetzner's loadbalancer, what would be a basic config for it?

[sandros94]

as of now I'm testing:

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    service:
      enabled: true
      type: LoadBalancer
      annotations:
        load-balancer.hetzner.cloud/location: nbg1
        load-balancer.hetzner.cloud/use-private-ip: "true"
        load-balancer.hetzner.cloud/name: traefik-lb
        load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
        load-balancer.hetzner.cloud/hostname: loadbalancer.example.com
      externalTrafficPolicy: Local

    ports:
      web:
        exposedPort: 80
      websecure:
        exposedPort: 443
      postgres:
        port: 5432
        protocol: TCP
        exposedPort: 5432
        expose:
          default: true

    providers:
      kubernetescrd:
        allowexternalnameservices: true

[sandros94]

Tho I'm having issues with TLS termination, as it seems that the loadbalancer try to terminate the postgres connections without sending them as they are

[sandros94]

Found the issue, traefik was rightfully not trusting the proxied request, adding trustedIPs to all entrypoints did fix it:

# [...] same as above example

    ports:
      web:
        exposedPort: 80
        proxyProtocol:
          trustedIPs:
            - 10.0.0.0/16
      websecure:
        exposedPort: 443
        proxyProtocol:
          trustedIPs:
            - 10.0.0.0/16
      postgres:
        port: 5432
        protocol: TCP
        exposedPort: 5432
        expose:
          default: true
        proxyProtocol:
          trustedIPs:
            - 10.0.0.0/16

# [...] same as above example