Access dashboard of non-default traefik deployment

[jeusdi]

This is my k3d cluster creation command:

$ k3d cluster create arxius \
   --agents 3 \
   --k3s-server-arg --disable=traefik \
   -p "8888:80@loadbalancer" -p "9000:9000@loadbalancer" \
   --volume ${HOME}/.k3d/registries.yaml:/etc/rancher/k3s/registries.yaml

Here my nodes:

 CONTAINER ID        IMAGE                      COMMAND                  CREATED             STATUS              PORTS                                                                   NAMES
c83f2f746621        rancher/k3d-proxy:v3.0.1   "/bin/sh -c nginx-pr…"   2 weeks ago         Up 21 minutes       0.0.0.0:9000->9000/tcp, 0.0.0.0:8888->80/tcp, 0.0.0.0:45195->6443/tcp   k3d-arxius-serverlb
0ed525443da2        rancher/k3s:v1.18.6-k3s1   "/bin/k3s agent"         2 weeks ago         Up 21 minutes                                                                               k3d-arxius-agent-2
561a0a51e6d7        rancher/k3s:v1.18.6-k3s1   "/bin/k3s agent"         2 weeks ago         Up 21 minutes                                                                               k3d-arxius-agent-1
fc131df35105        rancher/k3s:v1.18.6-k3s1   "/bin/k3s agent"         2 weeks ago         Up 21 minutes                                                                               k3d-arxius-agent-0
4cfceabad5af        rancher/k3s:v1.18.6-k3s1   "/bin/k3s server --d…"   2 weeks ago         Up 21 minutes                                                                               k3d-arxius-server-0
873a4f157251        registry:2                 "/entrypoint.sh /etc…"   3 months ago        Up About an hour    0.0.0.0:5000->5000/tcp                                                  registry.localhost

I've installed traefik using default helm installation command:

$ helm install traefik traefik/traefik

After that, an ingressroute is also installed in order to reach dashboard:

Name:         traefik-dashboard
Namespace:    traefik
Labels:       app.kubernetes.io/instance=traefik
              app.kubernetes.io/managed-by=Helm
              app.kubernetes.io/name=traefik
              helm.sh/chart=traefik-9.1.1
Annotations:  helm.sh/hook: post-install,post-upgrade
API Version:  traefik.containo.us/v1alpha1
Kind:         IngressRoute
Metadata:
  Creation Timestamp:  2020-12-09T19:07:41Z
  Generation:          1
  Managed Fields:
    API Version:  traefik.containo.us/v1alpha1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:helm.sh/hook:
        f:labels:
          .:
          f:app.kubernetes.io/instance:
          f:app.kubernetes.io/managed-by:
          f:app.kubernetes.io/name:
          f:helm.sh/chart:
      f:spec:
        .:
        f:entryPoints:
        f:routes:
    Manager:         Go-http-client
    Operation:       Update
    Time:            2020-12-09T19:07:41Z
  Resource Version:  141805
  Self Link:         /apis/traefik.containo.us/v1alpha1/namespaces/traefik/ingressroutes/traefik-dashboard
  UID:               1cbcd5ec-d967-440c-ad21-e41a59ca1ba8
Spec:
  Entry Points:
    traefik
  Routes:
    Kind:   Rule
    Match:  PathPrefix(`/dashboard`) || PathPrefix(`/api`)
    Services:
      Kind:  TraefikService
      Name:  api@internal
Events:      <none>

As you can see:

Match:  PathPrefix(`/dashboard`) || PathPrefix(`/api`)

I'm trying to reach dashboard. Nevertheless:

Details are not shown.

I've also tried to launch a curl command:

curl 'http://localhost:9000/api/overview'
curl: (52) Empty reply from server

Any ideas?

[iwilltry42]

Hi @jeusdi, as this does not indicate any obvious problem with k3d itself (as in "we could fix this with code), I thought this would be the perfect first issue to convert to the new GitHub Discussions feature.

Back to the question itself: On first sight, I don't know, what's going on there.
What is obvious to me is, that the port-forwarding works as expected and that Traefik is up and running.
Did you check traefik's logs to find a hint?

Another good place to get help for more traefik-involved folks could be their slack instance: https://traefik.slack.com/

[iwilltry42]

So I tried this myself now and I noticed this:

• You correctly forwarded port 9000 which is the port that the traefik API is listening on (inside the traefik container). But that port is not exposed anywhere (i.e. there is no Service or whatsoever to access it)
• In the README.md of the Helm Chart, they write that they don't expose the dashboard by default (i.e. they simply expose it on a non-default entrypoint, which is not exposed in their LoadBalancer Service): https://github.com/traefik/traefik-helm-chart#exposing-the-traefik-dashboard
• In their documentation (last line here) they say, that the trailing / is mandatory (and it really returns 404 if it's not there: https://doc.traefik.io/traefik/operations/dashboard/#insecure-mode

So for me it worked by just changing the entryPoints in the IngressRoute to be web instead of traefik (as the traefik entrypoint is not exposed via the LoadBalancer service that's bundled with the chart):

# dashboard.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: dashboard
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`traefik.localhost`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
      kind: Rule
      services:
        - name: api@internal
          kind: TraefikService

Afterwards I could access the dashboard via http://localhost:8888/dashboard/ (then you can also drop the 9000 port mapping).

An alternative would be to install traefik via helm install traefik traefik/traefik --set ports.traefik.expose=true (see: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L206-L227) and continue accessing it via http://localhost:9000/dashboard/

[Mithrandir2k18]

For me changing the helm chart during install (expose=true) only worked in conjunction with running kubectl port-forward --address 0.0.0.0 $(kubectl get pods --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000 to access the dashboard. This isn't permanent though, which without auth might be a good thing.