Traefik as ingress - is the ingress annotation really needed? #7387
-
|
I'm trying to figure out what and Traefik throws a bunch of errors like this on startup: So, can anyone explain why there is a need for the annotation change on to |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
|
Hi @rabidsloth, it all depends on how traffic is routed from the ingress controller to the downstream services. Linkerd generally expects the IP of a Kubernetes service (i.e virtual IP) and a port number when intercepting traffic. It does service discovery based on this virtual IP: current endpoints are collected and additional metadata such as Most ingresses, by default, do their own endpoint selection. If the endpoint has already been picked, Linkerd will connect directly to it, but you won't have any other features enabled, such as load balancing, traffic splitting, and so on. When running in ingress mode, the proxy is configured to read the target based on header values. Since we can expect the target to be the FQDN of a service, we can do service discovery on it and provide all the features that are missing in
It's not necessary for mTLS. If you're happy with the ingress controller making its own routing decision, then you can leave it as is. If you want linkerd to be the authority here (no http header pun intended) then you can enable ingress mode. Both ways work, it really depends on what you need.
In ingress mode, we only support HTTP calls (since we need to read the http headers to figure out where the target is). Port 443 is HTTPS, I've seen this before and I think it's very likely that Traefik is talking to the kubelet on 443 for readiness check. In this instance, you can bypass the proxy on 443 through
Hm, perhaps it's related to the above error? Skip port on 443 and Traefik will be able to talk to the k8s api server. In "normal" mode, the proxy should just transparently forward the request so you shouldn't need to do it.
I can't speak for how it breaks Traefik's routing (ideally Traefik wouldn't even have a say in the routing decision), but based on the logs, the proxy breaks because of the request on port 443. You don't need the annotation for linkerd to work, it's a convinient way of enabling linkerd's feature alongside your ingress controller. Unfortunately, Traefik doesn't have a way of letting us overwrite its routing behaviour (e.g like You can read more about everything here: https://linkerd.io/2.11/tasks/using-ingress/#ingress-details Thanks for the question, hope this solves your issues. :) |
Beta Was this translation helpful? Give feedback.
-
|
@mateiidavid Thanks a ton for the quick response and very thorough answer! I'm strictly looking at Linkerd for mTLS, so this works great for me. Your explaination completely answers what I was confused about! Cheers! |
Beta Was this translation helpful? Give feedback.
Hi @rabidsloth, it all depends on how traffic is routed from the ingress controller to the downstream services. Linkerd generally expects the IP of a Kubernetes service (i.e virtual IP) and a port number when intercepting traffic. It does service discovery based on this virtual IP: current endpoints are collected and additional metadata such as
ServiceProfileresources.Most ingresses, by default, do their own endpoint selection. If the endpoint has already been picked, Linkerd will connect directly to it, but you won't have any other features enabled, such as load balancing, traffic splitting, and so on. When running in ingress mode, the proxy is configured to read the target based on he…