Unable to use additionalServices to setup additional internal loadbalancer on AKS

[bronhy]

Welcome!

• [x] Yes, I've searched similar issues on GitHub and didn't find any.
• [x] Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What version of the Traefik's Helm Chart are you using?

27.0.2

What version of Traefik are you using?

v2.11.2

What did you do?

ports:
  internal80:
    expose:
      internal: true
    port: 80
    redirectTo:
      port: internal443
  internal443:
    expose:
      internal: true
    port: 443
  web:
    redirectTo:
      port: websecure

service:
  additionalServices:
    internal:
      enabled: true
      annotations:
        service.beta.kubernetes.io/azure-load-balancer-internal: "true"
      labels:
        traefik-service-label: internal

The lb changes the port to 443 and 80 but the chart update fails and reverts back to 9000

╷ │ Error: release traefik failed, and has been rolled back due to atomic being set: timed out waiting for the condition │ │ with module.traefik.helm_release.this, │ on ../../modules/traefik/main.tf line 47, in resource "helm_release" "this": │ 47: resource "helm_release" "this" { │

What did you see instead?

Looking for solution

What is your environment & configuration?

YAML

Additional Information

Looking for solution

[bronhy]

There is a similar issue here https://github.com/traefik/traefik-helm-chart/issues/1103

But the solution does not work for me

[mloiseleur]

There are two issues with this configuration.

1. Traefik cannot listen on port 80 or 443 without privileges
2. Those values does not follow expected format

There are EXAMPLES on this repository. The community forum might have examples of how other users addressed the issue.

Feel free to open a PR to complete EXAMPLES if there is one missing.

[bronhy]

Thank you very much for your feedback.

I think I don't understand how the configuration should be done. What I am trying to do is to create second service of type LoadBalancer. This load balancer should be an internal load balancer. I don't care on which port the traffic gets to the traefik pod. What i care is that the loadbalancer gets configured with 2 rules for port (80) and port (443). Also i want that the traffic from port 80 gets redirected to 443.

If I remove the changes I did

  internal80:
    expose:
      internal: true
    port: 80
    redirectTo:
      port: internal443
  internal443:
    expose:
      internal: true
    port: 443

and

service:
  additionalServices:
    internal:
      enabled: true
      annotations:
        service.beta.kubernetes.io/azure-load-balancer-internal: "true"
      labels:
        traefik-service-label: internal

In the default setup helm creates a traefik service of type loadbalancer. The yaml output of this service is.

k -n ingress get svc traefik -o yaml

  ports:
  - name: web
    nodePort: 31811
    port: 80
    protocol: TCP
    targetPort: web
  - name: websecure
    nodePort: 32499
    port: 443
    protocol: TCP
    targetPort: websecure
  selector:
    app.kubernetes.io/instance: traefik-ingress
    app.kubernetes.io/name: traefik
  sessionAffinity: None
  type: LoadBalancer

So in essence I just want to route internal traffic trough internal lb to the internal service to the existing traefik pod.

[mloiseleur]

To keep the repository focused, we recommend that all configuration questions should be be asked in the community forum. It is pretty active, so you might find that your question has already been answered there. If not, you can ask and get help from other community members pretty quickly.

I'll close this issue. Feel free to re-open it or open a new issue if you find an issue with the Chart.

[bronhy]

Ok thank you

[bronhy]

I got it working.

Here is the answer for users looking for the solution to this issue

ports:
  web:
    expose:
      internal: true
      default: true
    redirectTo:
      port: websecure
  websecure:
    expose:
      internal: true
      default:  true

service:
  additionalServices:
    internal:
      enabled: true
      annotations:
        service.beta.kubernetes.io/azure-load-balancer-internal: "true"
      labels:
        traefik-service-label: internal