<p>kubernetes: 1.25</p>
<p>traefik: 2.8.7</p>
<p>domain: gitlab.mydomain-prod.dk (I have already certificates for this domain)</p>
<p>kubectl get svc gitlab-ce -n gitlab -o yaml</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  labels:
    app: gitlab-ce
  name: gitlab-ce
  namespace: gitlab
spec:
  clusterIP: 10.98.93.9
  clusterIPs:
  - 10.98.93.9
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: port-1
    port: 80
    protocol: TCP
    targetPort: 80
  - name: port-2
    port: 443
    protocol: TCP
    targetPort: 443
  selector:
    app: gitlab-ce
  sessionAffinity: None
  type: ClusterIP
</code></pre>
<p>so, I have a gitlab pod configured  with both http:</p>
<p>gitlab.rb I have  <strong>external_url 'http://gitlab.mydomain-prod.dk'</strong></p>
<p>here is the ingressroute</p>
<p>kubectl get ingressroute -n gitlab -o yaml</p>
<pre><code>apiVersion: v1
items:
- apiVersion: traefik.containo.us/v1alpha1
  kind: IngressRoute
  metadata:
    name: gitlab-ingress
    namespace: gitlab
  spec:
    entryPoints:
    - websecure
    routes:
    - kind: Rule
      match: Host(`gitlab.mydomain-prod.dk`) &amp;&amp; PathPrefix(`/`)
      priority: 1
      services:
      - name: gitlab-ce
        port: 80
    tls:
      secretName: gitlab-test-cert
</code></pre>
<p>With actual config, I can access the <a href="https://gitlab.mydomain-prod.dk" rel="nofollow noreferrer">https://gitlab.mydomain-prod.dk</a></p>
<p>But, if I enable also https inside gitlab pod (gitlab will listen both 80 and 443)</p>
<p><strong>external_url 'https://gitlab.mydomain-prod.dk'</strong></p>
<p>With the same ingressroute I get bad gateway...</p>
<p>So, my question is, once I have configured gitlab for both http/https how do I define traefik for ssl passthrough  ?</p>
<pre><code>Something similar to  openshift:

oc create route passthrough route-passthrough-secured --service=frontend --port=80
</code></pre>

johnny bravo
<p>To define the traefik for ssl passthrough , the gitlab should listen to the HTTP and HTTPs Ports. As per the question seems to be getting a bad gateway when you are running the same ingress route on HTTPS. Refer to this <a href="https://traefik.io/blog/https-on-kubernetes-using-traefik-proxy/" rel="nofollow noreferrer">HTTPS on Kubernetes Using Traefik Proxy</a> by Rahul Sharma and <a href="https://traefik.io/blog/traefik-2-tls-101-23b4fbee81f1/" rel="nofollow noreferrer">Traefik Proxy 2.x and TLS 101</a> by Gerald Croes .</p>
<p>To configure this SSL passthrough, you need to configure a TCP router by following this <a href="https://oracle.github.io/fmw-kubernetes/20.3.3/soa-domains/adminguide/configure-load-balancer/traefik/#create-ingressroutetcp" rel="nofollow noreferrer">traefik SSL termination doc</a> by oracle fusion middleware and modify your IngressRoute configuration so that Traefik can pass through SSL traffic to the backend GitLab service. Make sure <code>tls.passthrough is true</code>, this delegates the SSL termination to the backend and verifies the application whether you are able to access or not.</p>
