Minio API behind Traefik in Kubernetes

[urbaman]

Hi,

I deployed minio operator and tenant through helm, everything works.
I also deployed traefik ingressroutes for operator console, tenant console (working) and api (not working, giving 400 error whrn culed and Client sent an HTTP request to an HTTPS server. from browsers.

It works when I proxy the tenant-hl service and curled (200, ok), not from browsers (it gets redirected to port 9443).

Here's the traefik settings I'm using:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: minioapi-urbaman
  namespace: urbaminio
spec:
  # Certificate will be valid for these domain names
  dnsNames:
  - minioapi.domain.com
  # Reference our issuer
  # As it's a ClusterIssuer, it can be in a different namespace
  issuerRef:
    kind: ClusterIssuer
    name: cert-manager-acme-issuer
  # Secret that will be created with our certificate and private keys
  secretName: minioapi-urbaman
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: traefik-minioapi-https-redirect
  namespace: urbaminio
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: traefik-minioapi-security
  namespace: urbaminio
spec:
  headers:
    frameDeny: true
    sslRedirect: true
    browserXssFilter: true
    contentTypeNosniff: true
    stsIncludeSubdomains: true
    stsPreload: true
    stsSeconds: 31536000
---
apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: traefik-minioapi-transport
  namespace: urbaminio
spec:
  serverName: minioapi
  insecureSkipVerify: true
---
apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
  name: traefik-minioapi-tlsoptions
  namespace: urbaminio
spec:
  minVersion: VersionTLS12
  cipherSuites:
    - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
    - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
    - TLS_AES_256_GCM_SHA384
    - TLS_AES_128_GCM_SHA256
    - TLS_CHACHA20_POLY1305_SHA256
    - TLS_FALLBACK_SCSV
  curvePreferences:
    - CurveP521
    - CurveP384
  sniStrict: false
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-minioapi-websecure
  namespace: urbaminio
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`minioapi.domain.com`)
      services:
        - name: urbaminio-hl
          port: 9000
          serversTransport: traefik-minioapi-transport
      middlewares:
        - name: traefik-minioapi-security
  tls:
    secretName: minioapi-urbaman
    options:
      name: traefik-minioapi-tlsoptions
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-minioapi-web
  namespace: urbaminio
spec:
  entryPoints:
    - web
  routes:
    - kind: Rule
      match: Host(`minioapi.domain.com`)
      services:
        - name: urbaminio-hl
          port: 9000
      middlewares:
        - name: traefik-minioapi-https-redirect

Is there a way to make it work?
Thank you.

[urbaman]

Hi,

Found out I was pointing to the wrong svc (confused by all of the examples pointing to port 9000), here are the right ingressRoutes:

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-minioapi-websecure
  namespace: urbaminio
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`minioapi.domain.com`)
      services:
        - name: minio
          port: 433
          serversTransport: traefik-minioapi-transport
      middlewares:
        - name: traefik-minioapi-security
  tls:
    secretName: minioapi-urbaman
    options:
      name: traefik-minioapi-tlsoptions
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-minioapi-web
  namespace: urbaminio
spec:
  entryPoints:
    - web
  routes:
    - kind: Rule
      match: Host(`minioapi.domain.com`)
      services:
        - name: minio
          port: 443
      middlewares:
        - name: traefik-minioapi-https-redirect