Traefik Kubernetes (k3s): Expose non-Kubernetes service with https - kubernetes

Question

I have two clusters relevant for this question.
k3s-0 [10.12.9.113]
k3s-2 [10.12.9.115]
Both clusters have traefik 2.4.8 running.
My interal domain k3s.lan points to k3s-0. (My DNS server is pihole)
In k3s-0, I have the following working perfectly.
---
kind: Service
apiVersion: v1
metadata:
name: k2-service
spec:
ports:
- protocol: TCP
port: 80
targetPort: 80
name: http
---
kind: Endpoints
apiVersion: v1
metadata:
name: k2-service
subsets:
- addresses:
- ip: 10.12.9.115
ports:
- protocol: TCP
port: 80
name: http
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: nginx2
spec:
entryPoints:
- web
routes:
- match: Host(`k2.k3s.lan`)
kind: Rule
services:
- name: k2-service
port: 80
when I type http://k2.k3s.lan, I see my nginx landing page.
Now I want to access the same landing page using https instead of http. I tried the following, but it does not work.
kind: Service
apiVersion: v1
metadata:
name: k2-service-sec
spec:
ports:
- protocol: TCP
port: 443
targetPort: 80
name: https
---
kind: Endpoints
apiVersion: v1
metadata:
name: k2-service-sec
subsets:
- addresses:
- ip: 10.12.9.115
ports:
- protocol: TCP
port: 80
name: https
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: nginx2-sec
spec:
entryPoints:
- websecure
routes:
- match: Host(`k2sec.k3s.lan`)
kind: Rule
services:
- name: k2-service-sec
port: 443
when I type https://k2sec.k3s.lan, I get an Internal Server Error.
For reference, here are the settings of the ingressroute/service in k3s-2.
The only thing I changed here was to host k2sec.k3s.lan in the route.
apiVersion: v1
kind: Service
metadata:
labels:
run: nginx
name: nginx
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
run: nginx
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: nginx
spec:
entryPoints:
- web
routes:
- match: Host(`k2.k3s.lan`,`k2sec.k3s.lan`)
kind: Rule
services:
- name: nginx
port: 80

Answer 1

I think I solved my own problem, thanks to this
At least it is working right now. As a true beginner, all this feels like magic.
Here is the updated manifest in k3s-0.
Main changes:
Added a middleware to redirect from http to https
Referenced the middleware to the web IngressRoute
Added a ServersTransport to set the insecureSkipVerify flag to true
Referenced the ServersTransport in the websecure IngressRoute
Added scheme to https to the websecure IngressRoute. I have not tried it without it. It may not be necessary
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: redirectscheme
spec:
redirectScheme:
scheme: https
permanent: true
---
kind: Service
apiVersion: v1
metadata:
name: k2-service
spec:
ports:
- protocol: TCP
port: 80
targetPort: 80
name: http
---
kind: Endpoints
apiVersion: v1
metadata:
name: k2-service
subsets:
- addresses:
- ip: 10.12.9.115
ports:
- protocol: TCP
port: 80
name: http
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: k2-service
spec:
entryPoints:
- web
routes:
- match: Host(`k2.k3s.lan`)
kind: Rule
services:
- name: k2-service
port: 80
middlewares:
- name: redirectscheme
---
kind: Service
apiVersion: v1
metadata:
name: k2-service-sec
spec:
ports:
- protocol: TCP
port: 443
targetPort: 443
name: https
---
kind: Endpoints
apiVersion: v1
metadata:
name: k2-service-sec
subsets:
- addresses:
- ip: 10.12.9.115
ports:
- protocol: TCP
port: 443
name: https
---
apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
name: traefik-servers-transport
spec:
serverName: "test"
insecureSkipVerify: true
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: k2-service-sec
spec:
entryPoints:
- websecure
routes:
- match: Host(`k2.k3s.lan`)
kind: Rule
services:
- name: k2-service-sec
port: 443
scheme: https
serversTransport: traefik-servers-transport
I also changed the IngressRoute in k3s-2
Added a middleware to redirect from http to https
Referenced the middleware to the web IngressRoute
Create a new websecure IngressRoute
Here it is:
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: redirectscheme
spec:
redirectScheme:
scheme: https
permanent: true
---
apiVersion: v1
kind: Service
metadata:
labels:
run: nginx
name: nginx
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
run: nginx
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: nginx
spec:
entryPoints:
- web
routes:
- match: Host(`k2.k3s.lan`)
kind: Rule
services:
- name: nginx
port: 80
middlewares:
- name: redirectscheme
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: nginx-sec
spec:
entryPoints:
- websecure
routes:
- match: Host(`k2.k3s.lan`)
kind: Rule
services:
- name: nginx
port: 80