Kubernetes default backend should work

[jimmycuadra]

What version of Traefik are you using (traefik version)?

v1.1.2

What is your environment & configuration (arguments, toml...)?

traefik.toml:

defaultEntryPoints = ["http", "https"]

[entryPoints]

[entryPoints.http]
address = ":80"

[entryPoints.http.redirect]
entryPoint = "https"

[entryPoints.https]
address = ":443"

[entryPoints.https.tls]

[[entryPoints.https.tls.certificates]]
CertFile = "/etc/ssl/cert.pem"
KeyFile = "/etc/ssl/key.pem"

[kubernetes]
namespaces = []

[web]
address = ":8080"
ReadOnly = true

What did you do?

I'm trying to set up a Kubernetes ingress that matches all subdomains of my cluster's TLD that don't have other ingresses with an explicit host match. For example, if I have an ingress for the host "foo.example.com", then I want to send requests for that to service "foo". But if a request comes in for "bar.example.com", or any other subdomain that doesn't have its own ingress, I want the request to go to a default backend "catchall".

This is what I tried originally:

kind: "Ingress"
apiVersion: "extensions/v1beta1"
metadata:
  name: "catchall"
spec:
  rules:
    - host: "*.example.com"
      http:
        paths:
          - backend:
              serviceName: "catchall"
              servicePort: 80

After creating this ingress, the Traefik dashboard shows one frontend for ".example.com" with route ".example.com" and rule "Host:.example.com". One backend for ".example.com" shows up with all the correct endpoints for the "catchall" Kubernetes service. However, I get a 404 when making a request that I'd expect to work:

$ curl -i https://bar.example.com/
HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Thu, 26 Jan 2017 23:07:21 GMT
Content-Length: 19

404 page not found

I then tried an ingress using a default backend, which should do what I want, according to the Kubernetes documentation:

kind: "Ingress"
apiVersion: "extensions/v1beta1"
metadata:
  name: "catchall"
spec:
  backend:
    serviceName: "catchall"
    servicePort: 80

But this results in no frontends or backends showing up in the Traefik dashboard.

Finally, I tried a variation of the first ingress, but left out the host:

kind: "Ingress"
apiVersion: "extensions/v1beta1"
metadata:
  name: "catchall"
spec:
  rules:
    - http:
        paths:
          - backend:
              serviceName: "catchall"
              servicePort: 80

The Traefik dashboard shows an unnamed frontend with an empty route and an empty rule. An unnamed backend shows up with all the endpoints for the "catchall" Kubernetes service. My test request then works as I'd expect:

$ curl -i https://bar.example.com
HTTP/1.1 302 Found
# ...

Is it intentional that the first two ingresses I tried didn't work as expected? Am I misunderstanding something? Or is this a problem with Traefik and/or Kubernetes? Thanks very much!

[evanluc]

From what I understand Kubernetes stable does not yet support wildcards. The change is upcoming in v1.6 and is supported in the alpha.

You are right about the default backend in the traefik ingress. It seems to have a bug. I got the default ingress to work as intended in the following way:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: default
spec:
  tls:
    - secretName: secret-cert
  rules:
    - http:
        paths:
          - path: /
            backend:
              serviceName: svc1
              servicePort: 443

Note the path: /

[errm]

Yes the default backend should work, and that looks like a bug...

Wildcards in host was fixed in #1029 and will be in v1.2

[errm]

Closing as default backend issue dupes #1051