<p>I'm a newbie in kubernetes and Traefik. </p>

<p>I follow up that tutorial: 
<a href="https://docs.traefik.io/user-guides/crd-acme/" rel="nofollow noreferrer">https://docs.traefik.io/user-guides/crd-acme/</a></p>

<p>And I changed it to use my Service in Scala, that it is under https and 9463 port.
I'm trying to deploy my Scala service with kubernetes and traefik. </p>

<p>When I forward directly to the service :</p>

<pre><code>kubectl port-forward service/core-service 8001:9463
</code></pre>

<p>And I perform a <code>curl -k 'https://localhost:8001/health'</code> :</p>

<p>I get the <code>"{Message:Ok}"</code></p>

<p>But when I perform a port forward to traefik</p>

<pre><code>kubectl port-forward service/traefik 9463:9463 -n default
</code></pre>

<p>And perform a <code>curl -k 'https://ejemplo.com:9463/tls/health'</code>
I get an <code>"Internal server error"</code></p>

<p>I guess the problem is that my "core-service" is listening over HTTPS protocol, that's what I add <code>scheme:https</code>. 
I tried to find the solution over the documentation but it is confusing.</p>

<p>Those are my yml files:</p>

<p>Services.yaml</p>

<pre><code>apiVersion: v1  
kind: Service  
metadata:  
  name: traefik

spec:  
  ports:
    - protocol: TCP
      name: admin
      port: 8080
    - protocol: TCP
      name: websecure
      port: 9463
  selector:
    app: traefik

---
apiVersion: v1  
kind: Service  
metadata:  
  name: core-service

spec:  
  ports:
    - protocol: TCP
      name: websecure
      port: 9463
  selector:
    app: core-service
</code></pre>

<p>Deployment.yaml</p>

<pre><code>apiVersion: v1  
kind: ServiceAccount  
metadata:  
  namespace: default
  name: traefik-ingress-controller

---
kind: Deployment  
apiVersion: apps/v1  
metadata:  
  namespace: default
  name: traefik
  labels:
    app: traefik

spec:  
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v2.0
          args:
            - --api.insecure
            - --accesslog
            - --entrypoints.websecure.Address=:9463
            - --providers.kubernetescrd
            - --certificatesresolvers.default.acme.tlschallenge
            - --certificatesresolvers.default.acme.email=foo@you.com
            - --certificatesresolvers.default.acme.storage=acme.json
            # Please note that this is the staging Let's Encrypt server.
            # Once you get things working, you should remove that whole line altogether.
            - --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
          ports:
            - name: websecure
              containerPort: 9463
            - name: admin
              containerPort: 8080

---
kind: Deployment  
apiVersion: apps/v1  
metadata:  
  namespace: default
  name: core-service
  labels:
    app: core-service

spec:  
  replicas: 1
  selector:
    matchLabels:
      app: core-service
  template:
    metadata:
      labels:
        app: core-service
    spec:
      containers:
        - name: core-service
          image: core-service:0.1.4-SNAPSHOT
          ports:
            - name: websecure
              containerPort: 9463
          livenessProbe:
            httpGet:
              port: 9463
              scheme: HTTPS
              path: /health
            initialDelaySeconds: 10
</code></pre>

<p>IngressRoute2.yaml</p>

<pre><code>apiVersion: traefik.containo.us/v1alpha1  
kind: IngressRoute  
metadata:  
  name: ingressroutetls
  namespace: default
spec:  
  entryPoints:
    - websecure
  routes:
  - match: Host(`ejemplo.com`) &amp;&amp; PathPrefix(`/tls`)
    kind: Rule
    services:
    - name: core-service
      port: 9463
      scheme: https
  tls:
    certResolver: default
</code></pre>

user1432966
<p>From the <a href="https://docs.traefik.io/routing/routers/#passthrough" rel="nofollow noreferrer">docs</a></p>

<blockquote>
  <p>A TLS router will terminate the TLS connection by default. However,
  the passthrough option can be specified to set whether the requests
  should be forwarded "as is", keeping all data encrypted.</p>
</blockquote>

<p>In your case SSL Passthrough need to be enabled because the pod is expecting HTTPS traffic.</p>

<pre><code>apiVersion: traefik.containo.us/v1alpha1  
kind: IngressRoute  
metadata:  
  name: ingressroutetls
  namespace: default
spec:  
  entryPoints:
    - websecure
  routes:
  - match: Host(`ejemplo.com`) &amp;&amp; PathPrefix(`/tls`)
    kind: Rule
    services:
    - name: core-service
      port: 9463
      scheme: https
  tls:
    certResolver: default
    passthrough: true
</code></pre>
