title: Unable to Access Traefik Dashboard or K8s Services on DigitalOcean K8s using Traefik's IngressRoute CRD
body: <p>I'm getting into K8s on DigitalOcean's managed service, and am simply trying to setup the very basics to just get it working.</p>
  
  <h1>Setup</h1>
  
  <ul>
  <li>Single node on DO's K8s service, no load balancers (unless recommended otherwise, looking to use Traefik for all of that.)</li>
  <li>One floating IP that I have attached to the K8s node in my cluster</li>
  <li>No firewall while diagnosing these issues</li>
  <li>DO K8s v1.15</li>
  <li>Traefik v2.0</li>
  </ul>
  
  <h1>Problem</h1>
  
  <p>I can confirm that things are being setup as I have them in the following config declarations as far as I can tell, but am having issues accessing the services of the example "whoami" pods that Traefik uses to test functionality, or even access the Traefik Dashboard.</p>
  
  <p>When using <code>kubectl proxy</code>, I use <code>http://localhost:8001/api/v1/namespaces/default/services/http:traefik:8080/proxy/dashboard/#/</code> to try and access the Traefik Dashboard, which "responds", but only gives a blank page.</p>
  
  <p>In the logs to the Traefik pod, there is only the following:</p>
  
  <pre class="lang-sh prettyprint-override"><code>time="2019-11-04T00:44:49Z" level=info msg="Configuration loaded from flags."
  time="2019-11-04T00:44:58Z" level=error msg="Unable to obtain ACME certificate for domains \"&lt;myDomain&gt;\": unable to generate a certificate for the domains [&lt;myDomain&gt;]: acme: Error -&gt; One or more domains had a problem:\n[&lt;myDomain&gt;] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Connection refused, url: \n" rule="Host(`&lt;myDomain&gt;`) &amp;&amp; PathPrefix(`/tls`)" routerName=default-ingressroutetls-2c388d38f54b2bf1bbe2 providerName=default.acme
  </code></pre>
  
  <p>I'll be looking at the Let's Encrypt issue later on, as right now I'm focused on just getting this functional on a basic level.</p>
  
  <p>When trying to access the WhoAmI service, on <code>http://&lt;myDomain&gt;/notls</code>, I get <code>ERR_CONNECTION_REFUSED</code> (Brave/Chrome)</p>
  
  <h1>Configuration</h1>
  
  <p><code>traefik.yaml</code></p>
  
  <pre><code>apiVersion: apiextensions.k8s.io/v1beta1
  kind: CustomResourceDefinition
  metadata:
    name: ingressroutes.traefik.containo.us
  
  spec:
    group: traefik.containo.us
    version: v1alpha1
    names:
      kind: IngressRoute
      plural: ingressroutes
      singular: ingressroute
    scope: Namespaced
  
  ---
  apiVersion: apiextensions.k8s.io/v1beta1
  kind: CustomResourceDefinition
  metadata:
    name: ingressroutetcps.traefik.containo.us
  
  spec:
    group: traefik.containo.us
    version: v1alpha1
    names:
      kind: IngressRouteTCP
      plural: ingressroutetcps
      singular: ingressroutetcp
    scope: Namespaced
  
  ---
  apiVersion: apiextensions.k8s.io/v1beta1
  kind: CustomResourceDefinition
  metadata:
    name: middlewares.traefik.containo.us
  
  spec:
    group: traefik.containo.us
    version: v1alpha1
    names:
      kind: Middleware
      plural: middlewares
      singular: middleware
    scope: Namespaced
  
  ---
  apiVersion: apiextensions.k8s.io/v1beta1
  kind: CustomResourceDefinition
  metadata:
    name: tlsoptions.traefik.containo.us
  
  spec:
    group: traefik.containo.us
    version: v1alpha1
    names:
      kind: TLSOption
      plural: tlsoptions
      singular: tlsoption
    scope: Namespaced
  
  ---
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    name: traefik-ingress-controller
  
  rules:
    - apiGroups:
        - ""
      resources:
        - services
        - endpoints
        - secrets
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - extensions
      resources:
        - ingresses
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - extensions
      resources:
        - ingresses/status
      verbs:
        - update
    - apiGroups:
        - traefik.containo.us
      resources:
        - middlewares
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - traefik.containo.us
      resources:
        - ingressroutes
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - traefik.containo.us
      resources:
        - ingressroutetcps
      verbs:
        - get
        - list
        - watch
    - apiGroups:
        - traefik.containo.us
      resources:
        - tlsoptions
      verbs:
        - get
        - list
        - watch
  
  ---
  kind: ClusterRoleBinding
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    name: traefik-ingress-controller
  
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: traefik-ingress-controller
  subjects:
    - kind: ServiceAccount
      name: traefik-ingress-controller
      namespace: default
  ---
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    namespace: default
    name: traefik-ingress-controller
  ---
  kind: Deployment
  apiVersion: extensions/v1beta1
  metadata:
    namespace: default
    name: traefik
    labels:
      app: traefik
  
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: traefik
    template:
      metadata:
        labels:
          app: traefik
      spec:
        serviceAccountName: traefik-ingress-controller
        containers:
          - name: traefik
            image: traefik:v2.0
            imagePullPolicy: Always
            args:
              - --api.insecure
              - --accesslog
              - --entrypoints.web.Address=:80
              - --entrypoints.websecure.Address=:443
              - --providers.kubernetescrd
              - --certificatesresolvers.default.acme.tlschallenge
              - --certificatesresolvers.default.acme.email=&lt;myEmail&gt;
              - --certificatesresolvers.default.acme.storage=acme.json
            ports:
              - name: web
                containerPort: 80
              - name: websecure
                containerPort: 443
              - name: admin
                containerPort: 8080
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: traefik
  
  spec:
    ports:
      - protocol: TCP
        name: web
        port: 8000
      - protocol: TCP
        name: admin
        port: 8080
      - protocol: TCP
        name: websecure
        port: 4443
    selector:
      app: traefik
  </code></pre>
  
  <p><code>whoami.yaml</code></p>
  
  <pre><code>kind: Deployment
  apiVersion: extensions/v1beta1
  metadata:
    namespace: default
    name: whoami
    labels:
      app: whoami
  
  spec:
    replicas: 2
    selector:
      matchLabels:
        app: whoami
    template:
      metadata:
        labels:
          app: whoami
      spec:
        containers:
          - name: whoami
            image: containous/whoami
            ports:
              - name: web
                containerPort: 80
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: whoami
  
  spec:
    ports:
      - protocol: TCP
        name: web
        port: 80
    selector:
      app: whoami
  ---
  apiVersion: traefik.containo.us/v1alpha1
  kind: IngressRoute
  metadata:
    name: simpleingressroute
  spec:
    entryPoints:
      - web
    routes:
    - match: Host(`&lt;myDomain&gt;`) &amp;&amp; PathPrefix(`/notls`)
      kind: Rule
      services:
      - name: whoami
        port: 80
  
  ---
  apiVersion: traefik.containo.us/v1alpha1
  kind: IngressRoute
  metadata:
    name: ingressroutetls
  spec:
    entryPoints:
      - websecure
    routes:
    - match: Host(`&lt;myDomain&gt;`) &amp;&amp; PathPrefix(`/tls`)
      kind: Rule
      services:
      - name: whoami
        port: 80
    tls:
      certResolver: default
  </code></pre>
  
  <p>Any help would be greatly appreciated, thank you in advance!!</p>