<p>I am using traefik as ingress controller in a K8s cluster. I'd like to enforce all traffic via HTTPS.</p>

<p>It is a bit confusing the documentation because apparently there are different ways to do the same thing? Namely, I'd like to know what is the difference between these 2:</p>

<ul>
<li><a href="https://docs.traefik.io/user-guide/examples/#http-redirect-on-http" rel="nofollow noreferrer">https://docs.traefik.io/user-guide/examples/#http-redirect-on-http</a></li>
<li><a href="https://docs.traefik.io/configuration/backends/kubernetes/#general-annotations" rel="nofollow noreferrer">https://docs.traefik.io/configuration/backends/kubernetes/#general-annotations</a></li>
</ul>

<p>If I use K8s is enough to use general annotations or I still have to edit the TOML file? </p>

<p>I have tried to use <code>traefik.ingress.kubernetes.io/redirect-entry-point: https</code> but doesn't find the service so I guess something is missing in my config.</p>

<p>If I remove the above line then everything works but HTTP -> HTTPS is, of course, not working. When I place the line back it returns a 404.</p>

<p>FWIW, the ingress definition is as follows (with traefik redirecting to 404):  </p>

<pre><code>  - apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      generation: 1
      name: rekover-ingress
      namespace: prod
      annotations:
        kubernetes.io/ingress.class: traefik
        traefik.ingress.kubernetes.io/frontend-entry-points: http, https
        traefik.ingress.kubernetes.io/redirect-entry-point: https
    spec:
      rules:
        - host: www.xxx.com
          http:
            paths:
              - backend:
                  serviceName: xxx-frontend
                  servicePort: 80
</code></pre>

<p>I have tried the very same configuration with nginx and changing to respective metadata and worked!. Below metadata used for nginx and Ingress:</p>

<pre><code>nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
kubernetes.io/ingress.class: nginx
</code></pre>

<p>For completeness, I copy-paste the service definition for both nginx and traefik. First one works as expected:</p>

<pre><code>kind: Service
apiVersion: v1
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:xxxx
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
spec:
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: https
      port: 443
      targetPort: http
  type: LoadBalancer
&lt;/code&gt;
&lt;code&gt;
kind: Service
apiVersion: v1
metadata:
  name: traefik-ingress-service
  namespace: ingress-prod
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:xxxx
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
spec:
  selector:
    k8s-app: traefik-ingress-lb
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
    - name: https
      port: 443
      targetPort: http
      protocol: TCP
  type: LoadBalancer
</code></pre>

Oscar Perez
<p>The first one is the toml <code>Traefik</code> configuration file, that can be modified in Kubernetes through a ConfigMap or in the Traefik container itself, or in the Traefik container command line (depending on how you deployed the Traefik Ingress Controller).</p>

<p>The second is what is mostly used to manage the configuration in the Traefik Ingress Controller through the <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer"><code>Ingress</code></a> Kubernetes resource.</p>

<p>You didn't post your Ingress definition but most likely it doesn't have a way to handle HTTPS and that's why when you add the annotation it sends traffic to port <code>443</code> and Traefik returns a <code>404</code>.</p>

<p>To handle HTTPS/TLS you would need to <a href="https://docs.traefik.io/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress" rel="nofollow noreferrer">enable it first</a> (Create a K8s cert secret, configure TLS in the Ingress, etc). Or <a href="https://medium.com/@dusansusic/traefik-ingress-controller-for-k8s-c1137c9c05c4" rel="nofollow noreferrer">this is another example</a> on how to enable it using a ConfigMap.</p>
