traefik - deptno/deptno.github.io GitHub Wiki

traefik

v2.9

  • traefik container ๊ฐ€ api ๊ถŒํ•œ์„ ๊ฐ€์ ธ์•ผํ•˜๋ฏ€๋กœ ServiceAccount ๊ฐ€ ํ•„์š”
  • ํ•ด๋‹น ๊ถŒํ•œ์œผ๋กœ traefik deployment ๊ฐ€ ์ƒ์„ฑ๋˜๋ฉฐ ์—ฌ๊ธฐ์„œ ํฌํŠธ์™€ ํ•จ๊ป˜ dashboard๋„ ํ•จ๊ป˜ ์ฒ˜๋ฆฌ
  • options
    • static
      • entry point
        • port
        • protocol
      • provider
        • infrastructure component(container engine, cloud provider) - api server ๋ฅผ ์‚ฌ์šฉํ•˜๊ธฐ ๋•Œ๋ฌธ์— ์—ฐ๊ด€์„ฑ์ด ์žˆ์Œ
      • connection
      • information
    • dynamic
    • ์˜ต์…˜ ์ ์šฉ ์ˆœ์„œ
      1. config file
      • /etc/traefik/
      • $XDG_CONFIG_HOME/
      • $HOME/.config/
      1. cli options
      2. ํ™˜๊ฒฝ ๋ณ€์ˆ˜
  • installation
    • helm ์œผ๋กœ ์„ค์น˜์‹œ dashboard ๊นŒ์ง€ ๋ชจ๋‘ ์„ค์น˜๋จ
kubectl port-forward $(kubectl get pods --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000
  • http://localhost:9000/dashboard/ tail slash ๊ฐ€ ํ•„์ˆ˜๋‹ค
  • faq
    • 404 ๋ผ์šฐํ„ฐ ๋งค์นญ X
    • 502 ๋ผ์šฐํ„ฐ๋Š” ๋งค์นญ O, ์„œ๋น„์Šค ์—†์Œ
    • 503 ๋ผ์šฐํ„ฐ๋Š” ๋งค์นญ O, ์„œ๋ฒ„ ์—†์Œ
    • catchall ๋กœ statuscode ๋ณ€๊ฒฝ ๊ฐ€๋Šฅ + cloudfront ์™€ ์—ฐ๋™๋“ฑ์— ์œ ์šฉ
    • http to https ์˜ต์…˜์€ 2.9.9 helm chart ๋ฅผ ๊ธฐ์ค€์œผ๋กœ redirectTo: https ์„ ํ™œ์„ฑํ™” ํ•˜๋ฉด ๋œ๋‹ค
  • reload
    • file watch ์ด๋ฏ€๋กœ ์ปจํ”ผ๊ทธ๊ฐ€ ๋ณ€๊ฒฝ๋˜๋ฉด ์ ์šฉ๋˜๋‚˜ ์ปจํ”ผ๊ทธ์—์„œ ์ฐธ์กฐ์ค‘์ธ tls ๋“ฑ ์ธ์ฆ์„œ ์ฐธ์กฐ๋Š” ์ž๋™์œผ๋กœ ๋ณ€๊ฒฝ๋˜์ง€ ์•Š๋Š”๋‹ค
    • touch ์‚ฌ์šฉํ•˜์ž
  • tls
    • let's-encrypt ๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด์„œ ha ๋ฅผ ๋‹ฌ์„ฑํ•  ์ˆ˜ ์—†๋‹ค
      • enterprise ์‚ฌ์šฉ์œผ๋กœ ๋‹ฌ์„ฑ ๊ฐ€๋Šฅ
      • cert-manager ๋กœ ๋‹ฌ์„ฑ ๊ฐ€๋Šฅ

tls

tls ๋Š” ์ž˜์•ˆ๋˜๋‹ค๊ฐ€ ์ž๊ณ  ์ผ์–ด๋‚˜๋‹ˆ ๋˜๋Š” ๊ฒฝํ–ฅ์ด ์žˆ์–ด์„œ ์‹œ๊ฐ„์„ ์ข€ ๊ฐ€์งˆ ํ•„์š”๋„ ์žˆ๋‹ค. ์ธ์ฆ์„œ ๋ฐœ๊ธ‰์— ๊ฑธ๋ฆฌ๋Š” ์‹œ๊ฐ„์œผ๋กœ ๋ณด์ž„

  ports:
    - protocol: TCP
      name: web
      port: 8000
    - protocol: TCP
      name: admin
      port: 8080
    - protocol: TCP
      name: websecure
      port: 4443

synology nas

dsm 7 ๊ธฐ์ค€ ์ œ์–ดํŒ -> ๋กœ๊ทธ์ธ ํฌํ„ธ -> ์ž๋™์œผ๋กœ HTTP ์—ฐ๊ฒฐ์„ DSM ๋ฐ์Šคํฌํ†ฑ์˜ HTTPS ๋กœ ๋ฆฌ๋””๋ ‰์…˜ ์„ ํ•ด์ œํ•˜๊ณ  headless service ์˜ 80 -> 5000(DSM ๋ฐ์Šคํฌํ†ฑ ๊ธฐ๋ณธ ํฌํŠธ) ๋กœ ์—ฐ๊ฒฐํ•˜์—ฌ ์ƒˆ๋กœ ๋ฐœํ–‰ํ•œ ์ธ์ฆ์„œ๋กœ ์‚ฌ์šฉํ•ด์•ผํ•œ๋‹ค.

error

 tls: client offered only unsupported versions: [301]
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="Serving default certificate for request: \"[domain.name]\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:20798: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:52461: tls: client offered only unsupported versions: [301]"

[traefik-5b88b748d-ddhp5] time="2023-01-14T06:45:21Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:07Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:07Z" level=debug msg="http: TLS handshake error from 192.168.0.7:58054: remote error: tls: unknown certificate authority"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="http: TLS handshake error from 192.168.0.7:6517: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="http: TLS handshake error from 192.168.0.7:18767: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="http: TLS handshake error from 192.168.0.7:60383: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="http: TLS handshake error from 192.168.0.7:24009: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="http: TLS handshake error from 192.168.0.7:35808: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:15Z" level=debug msg="http: TLS handshake error from 192.168.0.7:49872: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:14679: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:25925: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:34121: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:62899: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:20798: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:49:24Z" level=debug msg="http: TLS handshake error from 192.168.0.7:52461: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:50:30Z" level=debug msg="Serving default certificate for request: \"\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:50:38Z" level=debug msg="Serving default certificate for request: \"\""
k[traefik-5b88b748d-ddhp5] time="2023-01-14T06:52:25Z" level=debug msg="Serving default certificate for request: \"\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="http: TLS handshake error from 192.168.0.7:9941: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="http: TLS handshake error from 192.168.0.7:11811: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="http: TLS handshake error from 192.168.0.7:37216: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="http: TLS handshake error from 192.168.0.7:16574: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="http: TLS handshake error from 192.168.0.7:35759: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:53:20Z" level=debug msg="http: TLS handshake error from 192.168.0.7:42656: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:57:04Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:57:04Z" level=debug msg="http: TLS handshake error from 192.168.0.7:11717: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:57:04Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:57:04Z" level=debug msg="http: TLS handshake error from 192.168.0.7:60905: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:57:04Z" level=debug msg="http: TLS handshake error from 192.168.0.7:41380: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:58:26Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:58:26Z" level=debug msg="http: TLS handshake error from 192.168.0.7:13340: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:58:26Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:58:26Z" level=debug msg="http: TLS handshake error from 192.168.0.7:12410: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:58:26Z" level=debug msg="http: TLS handshake error from 192.168.0.7:43490: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:05Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:05Z" level=debug msg="http: TLS handshake error from 192.168.0.7:64332: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:05Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:05Z" level=debug msg="http: TLS handshake error from 192.168.0.7:6436: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:05Z" level=debug msg="http: TLS handshake error from 192.168.0.7:38429: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:28338: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:45046: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:12799: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:33325: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:11867: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:53477: tls: client offered only unsupported versions: [301]"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:4607: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="Serving default certificate for request: \"cluster.deptno.dev\""
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:10706: EOF"
[traefik-5b88b748d-ddhp5] time="2023-01-14T06:59:16Z" level=debug msg="http: TLS handshake error from 192.168.0.7:25606: tls: client offered only unsupported versions: [301]"
^R
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="No secret name provided" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Configuration received: {\"http\":{\"routers\":{\"default-traefik-dashboard-d012b7f875133eeab4e5\":{\"entryPoints\":[\"traefik\"],\"service\":\"api@internal\",\"rule\":\"PathPrefix(`/dashboard`) || PathPrefix(`/api`)\"},\"traefik-service-route-9ab4060701404e59ffcd\":{\"entryPoints\":[\"web\",\"websecure\"],\"service\":\"traefik-service-route-9ab4060701404e59ffcd\",\"rule\":\"PathPrefix(`/whoami`)\",\"tls\":{\"certResolver\":\"letsencrypt\"}},\"traefik-service-route-e663a23b674cedfd3387\":{\"entryPoints\":[\"web\",\"websecure\"],\"service\":\"traefik-service-route-e663a23b674cedfd3387\",\"rule\":\"Host(`cluster.deptno.dev`)\",\"tls\":{\"certResolver\":\"letsencrypt\"}}},\"services\":{\"traefik-service-route-9ab4060701404e59ffcd\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://10.244.182.135:80\"}],\"passHostHeader\":true}},\"traefik-service-route-e663a23b674cedfd3387\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://10.244.182.135:80\"}],\"passHostHeader\":true}}}},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="No default certificate, fallback to the internal generated certificate" tlsStoreName=default
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware prometheus@internal" middlewareType=TracingForwarder middlewareName=tracing entryPointName=metrics routerName=prometheus@internal
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=metrics middlewareName=traefik-internal-recovery middlewareType=Recovery
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware api@internal" routerName=default-traefik-dashboard-d012b7f875133eeab4e5@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware ping@internal" entryPointName=traefik middlewareName=tracing middlewareType=TracingForwarder routerName=ping@internal
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=traefik middlewareName=traefik-internal-recovery middlewareType=Recovery
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware acme-http@internal" routerName=acme-http@internal middlewareName=tracing middlewareType=TracingForwarder entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareName=traefik-internal-recovery middlewareType=Recovery entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=metrics middlewareType=Metrics middlewareName=metrics-entrypoint
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareName=metrics-entrypoint middlewareType=Metrics entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareType=Metrics middlewareName=metrics-entrypoint entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareType=Metrics entryPointName=websecure middlewareName=metrics-entrypoint
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" serviceName=traefik-service-route-e663a23b674cedfd3387 middlewareName=pipelining middlewareType=Pipelining entryPointName=web routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=web routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 middlewareName=metrics-service middlewareType=Metrics
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating load-balancer" routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating server 0 http://10.244.182.135:80" entryPointName=web routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd serverName=0 serviceName=traefik-service-route-e663a23b674cedfd3387
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-e663a23b674cedfd3387" routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=web routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd middlewareName=pipelining middlewareType=Pipelining
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd middlewareName=metrics-service middlewareType=Metrics entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating load-balancer" entryPointName=web routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating server 0 http://10.244.182.135:80" serviceName=traefik-service-route-9ab4060701404e59ffcd entryPointName=web routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serverName=0
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-9ab4060701404e59ffcd" middlewareName=tracing middlewareType=TracingForwarder entryPointName=web routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=web middlewareName=traefik-internal-recovery middlewareType=Recovery
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 middlewareName=pipelining middlewareType=Pipelining entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=websecure middlewareName=metrics-service middlewareType=Metrics routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating load-balancer" serviceName=traefik-service-route-e663a23b674cedfd3387 entryPointName=websecure routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating server 0 http://10.244.182.135:80" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 serverName=0 entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-e663a23b674cedfd3387" middlewareName=tracing middlewareType=TracingForwarder routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" serviceName=traefik-service-route-9ab4060701404e59ffcd middlewareName=pipelining middlewareType=Pipelining entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd middlewareName=metrics-service middlewareType=Metrics
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating load-balancer" entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating server 0 http://10.244.182.135:80" serviceName=traefik-service-route-9ab4060701404e59ffcd entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serverName=0
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-9ab4060701404e59ffcd" routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" entryPointName=websecure middlewareName=traefik-internal-recovery middlewareType=Recovery
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareType=Metrics entryPointName=metrics middlewareName=metrics-entrypoint
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareName=metrics-entrypoint middlewareType=Metrics entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareName=metrics-entrypoint middlewareType=Metrics entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Creating middleware" middlewareType=Metrics entryPointName=websecure middlewareName=metrics-entrypoint
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=warning msg="No domain found in rule PathPrefix(`/whoami`), the TLS options applied for this router will depend on the SNI of each request" entryPointName=web routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Adding route for cluster.deptno.dev with TLS options default" entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=warning msg="No domain found in rule PathPrefix(`/whoami`), the TLS options applied for this router will depend on the SNI of each request" routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Adding route for cluster.deptno.dev with TLS options default" entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="No domain parsed in provider ACME" ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd rule="PathPrefix(`/whoami`)" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="No domain parsed in provider ACME" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd rule="PathPrefix(`/whoami`)"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Trying to challenge certificate for domain [cluster.deptno.dev] found in HostSNI rule" routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Trying to challenge certificate for domain [cluster.deptno.dev] found in HostSNI rule" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Looking for provided certificate(s) to validate [\"cluster.deptno.dev\"]..." routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Domains [\"cluster.deptno.dev\"] need ACME certificates generation for domains \"cluster.deptno.dev\"." rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Loading ACME certificates [cluster.deptno.dev]..." routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Looking for provided certificate(s) to validate [\"cluster.deptno.dev\"]..." routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="No ACME certificate generation required for domains [\"cluster.deptno.dev\"]." routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Building ACME client..." providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="No secret name provided" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=debug msg="Using DNS Challenge provider: digitalocean" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:07Z" level=error msg="Unable to obtain ACME certificate for domains \"cluster.deptno.dev\": cannot get ACME client digitalocean: some credentials information are missing: DO_AUTH_TOKEN" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Configuration received: {\"http\":{\"routers\":{\"default-traefik-dashboard-d012b7f875133eeab4e5\":{\"entryPoints\":[\"traefik\"],\"service\":\"api@internal\",\"rule\":\"PathPrefix(`/dashboard`) || PathPrefix(`/api`)\"},\"traefik-service-route-9ab4060701404e59ffcd\":{\"entryPoints\":[\"web\",\"websecure\"],\"service\":\"traefik-service-route-9ab4060701404e59ffcd\",\"rule\":\"PathPrefix(`/whoami`)\",\"tls\":{\"certResolver\":\"letsencrypt\"}},\"traefik-service-route-e663a23b674cedfd3387\":{\"entryPoints\":[\"web\",\"websecure\"],\"service\":\"traefik-service-route-e663a23b674cedfd3387\",\"rule\":\"Host(`cluster.deptno.dev`)\",\"tls\":{\"certResolver\":\"letsencrypt\"}},\"traefik-traefik-dashboard-d012b7f875133eeab4e5\":{\"entryPoints\":[\"traefik\"],\"service\":\"api@internal\",\"rule\":\"PathPrefix(`/dashboard`) || PathPrefix(`/api`)\"}},\"services\":{\"traefik-service-route-9ab4060701404e59ffcd\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://10.244.182.135:80\"}],\"passHostHeader\":true}},\"traefik-service-route-e663a23b674cedfd3387\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://10.244.182.135:80\"}],\"passHostHeader\":true}}}},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="No default certificate, fallback to the internal generated certificate" tlsStoreName=default
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware prometheus@internal" entryPointName=metrics routerName=prometheus@internal middlewareName=tracing middlewareType=TracingForwarder
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" entryPointName=metrics middlewareName=traefik-internal-recovery middlewareType=Recovery
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware acme-http@internal" routerName=acme-http@internal middlewareName=tracing middlewareType=TracingForwarder entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareType=Recovery entryPointName=web middlewareName=traefik-internal-recovery
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware api@internal" routerName=default-traefik-dashboard-d012b7f875133eeab4e5@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware ping@internal" routerName=ping@internal entryPointName=traefik middlewareName=tracing middlewareType=TracingForwarder
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware api@internal" entryPointName=traefik routerName=traefik-traefik-dashboard-d012b7f875133eeab4e5@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" entryPointName=traefik middlewareName=traefik-internal-recovery middlewareType=Recovery
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" entryPointName=metrics middlewareName=metrics-entrypoint middlewareType=Metrics
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareType=Metrics entryPointName=traefik middlewareName=metrics-entrypoint
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=metrics-entrypoint middlewareType=Metrics entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=metrics-entrypoint middlewareType=Metrics entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=pipelining entryPointName=websecure routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 middlewareType=Pipelining
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" serviceName=traefik-service-route-e663a23b674cedfd3387 middlewareName=metrics-service middlewareType=Metrics entryPointName=websecure routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating load-balancer" serviceName=traefik-service-route-e663a23b674cedfd3387 entryPointName=websecure routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating server 0 http://10.244.182.135:80" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 serverName=0 entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-e663a23b674cedfd3387" entryPointName=websecure routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareType=Pipelining entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd middlewareName=pipelining
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=metrics-service middlewareType=Metrics entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating load-balancer" serviceName=traefik-service-route-9ab4060701404e59ffcd entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating server 0 http://10.244.182.135:80" routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serverName=0 serviceName=traefik-service-route-9ab4060701404e59ffcd entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-9ab4060701404e59ffcd" entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=traefik-internal-recovery middlewareType=Recovery entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareType=Pipelining routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 entryPointName=web middlewareName=pipelining
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareType=Metrics routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 entryPointName=web middlewareName=metrics-service
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating load-balancer" entryPointName=web routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating server 0 http://10.244.182.135:80" serverName=0 routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd serviceName=traefik-service-route-e663a23b674cedfd3387 entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-e663a23b674cedfd3387" middlewareName=tracing middlewareType=TracingForwarder entryPointName=web routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd middlewareName=pipelining middlewareType=Pipelining entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareType=Metrics entryPointName=web routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd middlewareName=metrics-service
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating load-balancer" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating server 0 http://10.244.182.135:80" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd serviceName=traefik-service-route-9ab4060701404e59ffcd entryPointName=web serverName=0
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="child http://10.244.182.135:80 now UP"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Propagating new UP status"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Added outgoing tracing middleware traefik-service-route-9ab4060701404e59ffcd" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd middlewareName=tracing middlewareType=TracingForwarder entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=traefik-internal-recovery middlewareType=Recovery entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareType=Metrics entryPointName=metrics middlewareName=metrics-entrypoint
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=metrics-entrypoint middlewareType=Metrics entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" middlewareName=metrics-entrypoint middlewareType=Metrics entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Creating middleware" entryPointName=websecure middlewareType=Metrics middlewareName=metrics-entrypoint
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=warning msg="No domain found in rule PathPrefix(`/whoami`), the TLS options applied for this router will depend on the SNI of each request" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Adding route for cluster.deptno.dev with TLS options default" entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=warning msg="No domain found in rule PathPrefix(`/whoami`), the TLS options applied for this router will depend on the SNI of each request" entryPointName=websecure routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Adding route for cluster.deptno.dev with TLS options default" entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="No domain parsed in provider ACME" ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=traefik-service-route-9ab4060701404e59ffcd@kubernetescrd rule="PathPrefix(`/whoami`)" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="No domain parsed in provider ACME" routerName=websecure-traefik-service-route-9ab4060701404e59ffcd@kubernetescrd rule="PathPrefix(`/whoami`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Trying to challenge certificate for domain [cluster.deptno.dev] found in HostSNI rule" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Trying to challenge certificate for domain [cluster.deptno.dev] found in HostSNI rule" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Looking for provided certificate(s) to validate [\"cluster.deptno.dev\"]..." ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Domains [\"cluster.deptno.dev\"] need ACME certificates generation for domains \"cluster.deptno.dev\"." providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Loading ACME certificates [cluster.deptno.dev]..." rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Building ACME client..." providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Looking for provided certificate(s) to validate [\"cluster.deptno.dev\"]..." ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="No ACME certificate generation required for domains [\"cluster.deptno.dev\"]." routerName=traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="No secret name provided" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Skipping Kubernetes event kind *v1.Endpoints" providerName=kubernetes
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Skipping Kubernetes event kind *v1.Endpoints" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="No secret name provided" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Skipping Kubernetes event kind *v1.Endpoints" providerName=kubernetes
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Skipping Kubernetes event kind *v1.Endpoints" providerName=kubernetescrd
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=info msg="I have to go..."
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=info msg="Stopping server gracefully"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Waiting 10s seconds before killing connections." entryPointName=metrics
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Waiting 10s seconds before killing connections." entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Waiting 10s seconds before killing connections." entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="accept tcp [::]:9100: use of closed network connection" entryPointName=metrics
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Waiting 10s seconds before killing connections." entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="accept tcp [::]:8443: use of closed network connection" entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="close tcp [::]:9100: use of closed network connection" entryPointName=metrics
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Entry point metrics closed" entryPointName=metrics
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="accept tcp [::]:8000: use of closed network connection" entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="accept tcp [::]:9000: use of closed network connection" entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="close tcp [::]:9000: use of closed network connection" entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="close tcp [::]:8000: use of closed network connection" entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Entry point traefik closed" entryPointName=traefik
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Entry point web closed" entryPointName=web
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="close tcp [::]:8443: use of closed network connection" entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Entry point websecure closed" entryPointName=websecure
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=info msg="Server stopped"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=info msg="Shutting down"
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=debug msg="Using DNS Challenge provider: digitalocean" providerName=letsencrypt.acme
[traefik-5b88b748d-ddhp5] time="2023-01-14T07:06:09Z" level=error msg="Unable to obtain ACME certificate for domains \"cluster.deptno.dev\": cannot get ACME client digitalocean: some credentials information are missing: DO_AUTH_TOKEN" routerName=websecure-traefik-service-route-e663a23b674cedfd3387@kubernetescrd rule="Host(`cluster.deptno.dev`)" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"

์ตœ์ข…์ ์œผ๋กœ ์•„๋ž˜์™€ ๊ฐ™์€ traefik deployment ๋ฅผ ๋งŒ๋“ค์–ด์•ผํ•จ

  Containers:
   traefik:
    Image:       traefik:v2.9.6
    Ports:       9100/TCP, 9000/TCP, 8000/TCP, 8443/TCP
    Host Ports:  0/TCP, 0/TCP, 0/TCP, 0/TCP
    Args:
      --global.checknewversion
      --entrypoints.metrics.address=:9100/tcp
      --entrypoints.traefik.address=:9000/tcp
      --entrypoints.web.address=:8000/tcp
      --entrypoints.websecure.address=:8443/tcp
      --api.dashboard=true
      --ping=true
      --metrics.prometheus=true
      --metrics.prometheus.entrypoint=metrics
      --providers.kubernetescrd
      --providers.kubernetesingress
      --entrypoints.websecure.http.tls=true
      [email protected]
      --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json
      --certificatesresolvers.letsencrypt.acme.tlsChallenge=true
      --log.level=DEBUG

ํ•ด๋‹น ์—๋Ÿฌ๊ฐ€ ๋ฐœ์ƒํ•  ๋•Œ helm chart ์—์„œ certResolver.letsencrypt.dnsChallenge ๋ฅผ ์ฃผ์„ ์ฒ˜๋ฆฌํ•˜๊ณ  ์œ„์™€ ๊ฐ™์€ Args ๋ฅผ ๋งŒ๋“ค์–ด์•ผํ•˜๋ฉฐ ๋‹ค๋ฅธ ๋ถ€๋ถ„ ๋ณด๋‹ค๋Š” ์•„๋ž˜์„ค์ •์ด ์ค‘์š”ํ•  ๊ฒƒ ๊ฐ™๋‹ค

      --entrypoints.web.address=:8000/tcp
      --entrypoints.websecure.address=:8443/tcp
      --entrypoints.websecure.http.tls=true
      [email protected]
      --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json
      --certificatesresolvers.letsencrypt.acme.tlsChallenge=true

ingress ๋ฅผ ์ˆ˜์ •ํ•ด์„œ tls ํ”„๋กœ์„ธ์Šค๋ฅผ ๋ฐŸ ์„ ์ˆ˜ ์žˆ๋„๋ก ํ•˜๋ฉด ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•˜๋‹ค

CRD: IngressRoute

IngressRoute ๋Š” ์ฐธ์กฐํ•  service ๊ฐ€ ์žˆ๋Š” ์˜์—ญ์— ์ƒ์„ฑํ•œ๋‹ค.

error

LOG_LEVEL=trace ๋ฅผ ํ™˜๊ฒฝ๋ณ€์ˆ˜๋กœ ์ฃผ์ž…ํ•ด์„œ middleware ๋ฅผ ๋„์šฐ๊ณ  ๋กœ๊ทธ๋ฅผ ํ™•์ธ

Error calling http

  • traefik pod log
time="2023-01-21T17:28:46Z" level=debug msg="Error calling http://forward-auth-google. Cause: Get \"http://forward-auth-google
\": dial tcp: lookup forward-auth-google on 10.96.0.10:53: no such host" middlewareType=ForwardedAuthType middlewareName=test-
forward-auth-google@kubernetescrd
  • middleware pod ์— ๋กœ๊ทธ๊ฐ€ ์•ˆ์ฐํžˆ๋Š” ๊ฒฝ์šฐ traefik -> middleware ์ ‘๊ทผ์ด ์•ˆ๋˜๋Š” ๊ฒฝ์šฐ๋กœ traefik, middleware ๊ฐ€ ๊ฐ๊ธฐ ๋‹ค๋ฅธ namespace์— ์กด์žฌํ•  ๋•Œ ๋ฐœ์ƒ
    • traefik ์—์„œ crossname ๋ฅผ ํ—ˆ์šฉ
    • forward-auth-google.[namespace] ๋ฅผ ํ†ตํ•ด์„œ ์ ‘๊ทผํ•˜๋„๋ก ์„ค์ •
  • ๋กœ๊ทธ์ธ ํ›„ ์„œ๋น„์Šค๋กœ ๊ฐ€์ง€๋ชปํ•˜๊ณ  ๊ณ„์† ๋กœ๊ทธ์ธ์œผ๋กœ ๋ฆฌ๋‹ค์ด๋ ‰ํŒ… ๋˜๋Š” ์ด์Šˆ

Authenticating request

time="2023-01-21T16:43:54Z" level=debug msg="Authenticating request" cookies="[]" handler=Auth host= method= proto= rule=defau
lt source_ip= uri=
time="2023-01-21T16:43:52Z" level=debug msg="Set CSRF cookie and redirected to provider login url" csrf_cookie="_forward_auth_
csrf=e020b6a2d282deed96185016aea24fcf; Path=/; Expires=Sun, 22 Jan 2023 04:43:52 GMT; HttpOnly" handler=Auth host= login_url="
  • insecure_cookie=true ์ œ๊ฑฐ๋กœ ํ•ด๊ฒฐ๋˜๋Š” ๊ฒƒ์œผ๋กœ ๋ณด์ž„
400 ์˜ค๋ฅ˜: redirect_uri_mismatch

duplicate-certificate-limit

  • Unable to obtain ACME certificate for domains 429
time="2023-05-02T17:18:53Z" level=error msg="Unable to obtain ACME certificate for domains \"example.com\": unable to generate a certificate for the domains [exmaple.com]: acme: error: 429 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168 hours: exmaple.com, retry after 2023-05-03T03:59:03Z: see https://letsencrypt.org/docs/duplicate-certificate-limit/" routerName=route-name-56fe52824516edf84cb6@kubernetescrd rule="Host(`example.com`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme

์—๋Ÿฌ๊ฐ€ ๋ฐœ์ƒํ•˜๋Š” ์‹œ๋‚˜๋ฆฌ์˜ค

  1. traefik ์„ ํ†ตํ•ด์„œ cert๋ฅผ ๋ฐœ๊ธ‰ํ•œ๋‹ค
  2. persistent ์„ค์ •์ด ์—†๋‹ค๋ฉด traefik ์€ ์‹œ์ž‘ํ•˜๋ฉด์„œ ์ด์ „์— ๋ฐœ๊ธ‰ํ•œ cert ๋ฅผ ๊ฐ€์ ธ์˜ค์ง€ ๋ชปํ•˜๊ณ  ์ƒˆ๋กญ๊ฒŒ ๋ฐœ๊ธ‰์š”์ฒญ์„ํ•œ๋‹ค
  3. ์–ด๋–ค ์ด์œ ๋กœ ์ธํ•ด์„œ traefik ์ด ์ฃฝ๊ฒŒ๋˜๋ฉด ์‚ด์•„๋‚  ๋•Œ๋งˆ๋‹ค ๋ฐœ๊ธ‰ ์š”์ฒญ์„ ํ•˜๊ฒŒ๋œ๋‹ค.

  • ์ด๋ฒˆ ๋‚˜์˜ ๊ฒฝ์šฐ์—๋Š” node ์— disk-pressure ๊ฐ€ ๋ฐœ์ƒํ•˜๋ฉด์„œ traefik ์ด ์ฃฝ์—ˆ๋‹ค ์‚ด์•˜๋‹ค๋ฅผ ๋ฐ˜๋ณตํ•˜๋ฉด์„œ ๋ฐœ์ƒํ–ˆ๋‹ค

  • persistent ๋ฅผ ์„ค์ •ํ•ด์„œ ์ด์ „ ๋ฐœ๊ธ‰์„ ๊ธฐ์–ตํ•˜๋ฉด ๋ ๊ฒƒ์œผ๋กœ ๋ณด์ธ๋‹ค

  • tls ๊ฐ€ ํ„ฐ์ง€๋Š” ๊ฒฝ์šฐ harbor ๊ฐ€ ๊ฐ™์ด ๋ป—์œผ๋ฉด image pull ์ด ์‹คํŒจํ•˜๋ฏ€๋กœ ๋ชจ๋“  ํŒŒ๋“œ๊ฐ€ ๋ป—๊ฒŒ๋จ

    • ๋ฌธ์ œ๊ฐ€ ์‹ฌ๊ฐํ•˜๊ธดํ•œ๋ฐ ๊ธฐ๋ณธ์ ์œผ๋กœ ์ธ์ฆ์„œ๊ฐ€ ๋Š๊ธฐ๋Š”๊ฑฐ ์ž์ฒด๊ฐ€ ์‹ฌ๊ฐํ•œ ์ด์Šˆ๊ณ  ์ด์— ๋Œ€ํ•ด ํ”Œ๋žœB ๋ฅผ ํ•ด๋‘ฌ์•ผํ•˜๋Š”์ง€๋Š” ์ƒ๊ฐํ•ด๋ณผ ๋ฌธ์ œ ๋Œ€์‘์„ ์›ํ•œ๋‹ค๋ฉด insecure_registeries ๊ด€๋ จ ์„ค์ •์ด ํ•„์š”

  • too many certificates (5) already issued for this exact set of domains in the last 168 hours: exmaple.com, retry after 2023-05-03T03:59:03Z

    • retry after ๋ฅผ ๋ณด๋ฉด ์–ธ์ œ๋ถ€ํ„ฐ ์‹œ๋„ํ•ด์•ผํ• ์ง€ ๊ฐ€๋ฅด์ฒ˜์ค€๋‹ค. ๊ผญ 7์ผ์„ ๊ธฐ๋‹ค๋ฆฌ๋Š”๊ฒƒ์ด ์•„๋‹˜์— ์ฃผ์˜
time="2023-05-01T19:43:54Z" level=debug msg="http: TLS handshake error from 192.168.0.7:34578: remote error: tls: bad certificate"
time="2023-05-01T19:43:58Z" level=debug msg="Serving default certificate for request: \"example.com\""

time="2023-05-01T19:45:46Z" level=error msg="Unable to obtain ACME certificate for domains \"example.com\": unable to generate a certificate for the domains [example.com]: acme: error: 429 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn
time="2023-05-01T19:45:46Z" level=debug msg="Serving default certificate for request: \"example.com\""
time="2023-05-01T19:45:46Z" level=debug msg="http: TLS handshake error from 192.168.0.7:57734: remote error: tls: bad certificate"

unable to generate a wildcard certificate in ACME provider for domain

์ด๊ฑฐ ์ผ๋‹จ ipv6 ์ง€์›์ด ๋˜์•ผํ•˜๋Š” ๊ฒƒ์œผ๋กœ ์ƒ๊ฐ๋จ

time="2023-05-02T18:43:33Z" level=error msg="Unable to obtain ACME certificate for domains \"example.com,*.example.com\"" rule="Host(`???.example.com`)" error="unable to generate a wildcard certificate in ACME provider for domain \"example.com,*.example.com\" : ACME needs a DNSChallenge" ACME CA=
"https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme routerName=harbor-harbor-499b22a125e5ffa3fe26@kubernetescrd

660 too open

traefik ์ด ์ž๊ธฐ๊ฐ€ ๋งŒ๋“  acme.json ํŒŒ์ผ ํผ๋ฏธ์…˜์ด ๋„ˆ๋ฌด ์—ด๋ ค์žˆ๋‹ค๊ณ ํ•ด์„œ ์ˆ˜๋™์œผ๋กœ 600 ํผ๋ฏธ์…˜์œผ๋กœ ๋ณ€๊ฒฝํ•˜๊ณ  ๋ฆฌ๋ถ“ํ•ด์„œ ํ•ด๊ฒฐ

  • ๋ถ€ํŒ…๋•Œ๋งˆ๋‹ค 660์œผ๋กœ ์„ค์ •๋˜์–ด ์žˆ์–ด์„œ ์ˆ˜์ • ํ•„์š”
    • helm ์ฐจํŠธ์— ์ฃผ์„์œผ๋กœ ์ด๋ฏธ ๋˜์–ด์žˆ์Œ ๋กœ์ปฌ ๋””๋ฐ”์ด์Šค๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ์ƒ๊ธฐ๋Š” ๊ฒƒ์œผ๋กœ ๋ณด์ž„
    • initConatiner ๋กœ ์‹œ์ž‘ํ•˜๋ฉด์„œ ํผ๋ฏธ์…˜์„ ์ˆ˜์ •ํ•˜๋Š” ๋ฐฉ์‹

secret ์—์„œ ๊ฐœํ–‰ ์ œ๊ฑฐํ•˜๊ณ  ๋‚˜์„œ ๋‚˜์˜ค๊ธฐ ์‹œ์ž‘

middleware ์˜ namespace ์™€ ๊ด€๊ณ„์—†์ด ingressroute ์˜ namespace ๋ฅผ ๋ณด๋Š” ๊ฒƒ ๊ฐ™๋‹ค middleware.forwardAuth ๋ฅผ ์„ค์ •ํ• ๋•Œ namespace ๋ฅผ ๋ช…์‹œํ•œ๋‹ค

link