<p>I am following this <a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/" rel="nofollow noreferrer">concept guide</a> on the kubernetes docs to connect to a service in a different namespace using the fully qualified domain name for the service.</p>

<p><strong>service.yml</strong></p>

<pre><code>---
# declare front service
kind: Service
apiVersion: v1
metadata:
  name: traefik-frontend-service
  namespace: traefik
spec:
  selector:
    k8s-app: traefik-ingress-lb
    tier: reverse-proxy
  ports:
    - port: 80
      targetPort: 8080
  type: NodePort
</code></pre>

<p><strong>ingress.yml</strong></p>

<pre><code>---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-web-ui-ingress
  namespace: traefik
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.frontend.passHostHeader: "false"
    traefik.frontend.priority: "1"
spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            backend:
              serviceName: traefik-frontend-service.traefik.svc.cluster.local
              servicePort: 80
</code></pre>

<p>But I keep getting this error:</p>

<blockquote>
  <p>The Ingress "traefik-web-ui-ingress" is invalid: spec.rules[0].http.backend.serviceName: Invalid value: "traefik-frontend-service.traefik.svc.cluster.local": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name',  or 'abc-123', regex used for validation is 'a-z?')</p>
</blockquote>

<p>The service name of <code>traefik-frontend-service.traefik.svc.cluster.local</code>:</p>

<ul>
<li>starts with an alphanumeric character</li>
<li>ends with an alphanumeric character</li>
<li>only contains alphanumeric numbers or <code>-</code></li>
</ul>

<p>Not sure what I'm doing wrong here... <strong>unless a new ingress has to be created for each namespace</strong>.</p>

<p>This is by design to avoid cross-namespace exposure, In this <a href="https://github.com/kubernetes/kubernetes/issues/17088" rel="nofollow noreferrer">thread</a> is explained why this limitation on the ingress specification was intentional.</p>

<p>That means, the <strong>Ingress can only expose services within the same namespace</strong>.</p>

<p><strong><em>The values provided should be the service name, not the FQDN.</em></strong></p>

<p>If you really need to design this way, your other alternatives are:</p>

<ul>
<li>Expose Traefik as a LB Service and then create a data service to provide the routing rules to traefik.</li>
<li><p>Use <a href="https://github.com/heptio/contour/blob/master/docs/ingressroute.md#across-namespaces" rel="nofollow noreferrer">Contour Ingress (by heptio)</a> to delegate the routing to other namespaces.</p>

<p>Using Contour would be something like this:</p>

<pre><code># root.ingressroute.yaml
apiVersion: contour.heptio.com/v1beta1
kind: IngressRoute
metadata:
  name: namespace-delegation-root
  namespace: default
spec:
  virtualhost:
    fqdn: ns-root.bar.com
  routes:
    - match: /
      services:
        - name: s1
          port: 80
# delegate the subpath, `/blog` to the IngressRoute object in the marketing namespace with the name `blog`
    - match: /blog
      delegate:
        name: blog
        namespace: marketing
------------------------------------------------------------
# blog.ingressroute.yaml
apiVersion: contour.heptio.com/v1beta1
kind: IngressRoute
metadata:
  name: blog
  namespace: marketing
spec:
  routes:
    - match: /blog
      services:
        - name: s2
          port: 80
</code></pre></li>
</ul>
