Photo by Towfiqu barbhuiya on Unsplash
Configuring Traefik Ingress and Clouflare in Kubernetes using Full (Strict) Encryption Mode
3 min read
If you have a Kubernetes cluster and you want to use Cloudflare this guide is for you. Cloudflare operates as a reverse proxy for the web traffic. All requests to and from the origin, will flow through Cloudflare. The benefit of this approach is that when the traffic is proxied through Cloudflare before reaching the origin server, the application gets additional security, performance, and reliability benefits. Another benefit is that we do not need to deploy Cert-Manager or Let's Encrypt. Cloudflare will handle this automatically for us.
Assuming you have created a Cloudflare account and added your domain, go to your Cloudflare Dashboard and point your domain to your Load Balancer IP. If you have used the Kubernetes on Hetzner guide, point your Hetzner Load Balancer IP address that you have just created. Under DNS add two A Record. One is for the root and one is for the subdomains:
Type Name Content Proxy status TTL A @ Your-LB-IP Proxied Auto A * Your-LB-IP Proxied Auto
Do not forget to activate proxy:
Go to the SSL/TLS menu and activate Always Use HTTPS. You can also see that there are automatically generated Edge Certificates.
Cloudflare will automatically create a TLS certificate for connections between the end user and Cloudflare. However at this point there is no encryption between our servers and Cloudflare. This setup will work without it but I definitely recommend that you configure it.
Go to SSL/TLS from the menu and click Origin Server:
Create the certificate:
Create two files called tls.crt and tls.key
touch tls.crt touch tls.key
and copy the certificates into these files.
Afterwards create a secret inside of Kubernetes. Since this will be the default certificate for the whole cluster, you can create this secret in the kube-system namespace:
kubectl create secret generic default-cloudflare-tls -n kube-system --from-file=tls.crt=tls.crt --from-file=tls.key=tls.key
Create a Traefik store for the secret, so that you can reference it from any namespace later:
apiVersion: traefik.containo.us/v1alpha1 kind: TLSStore metadata: name: default-cloudflare-tls namespace: kube-system spec: defaultCertificate: secretName: default-cloudflare-tls
Under the SSL/TLS menu, do not forget to enable the encryption mode to Full (Strict)
Expose the Traefik Dashboard using IngressRoute
Now we will expose Traefik dashboard using an Ingressroute. Optionally you can also create a middleware for securing the Traefik Dashboard with a password. You can find more information here.
Create the ingressroute:
apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: traefik-dashboard namespace: traefik annotations: kubernetes.io/ingress.class: traefik-external spec: entryPoints: - web - websecure routes: - match: Host(`traefik.yourdomain.com`) kind: Rule services: - name: api@internal kind: TraefikService ##middlewares: ##- name: auth tls: store: name: default-cloudflare-tls
We have added our Cloudflare Origin certificate in the Traefik Secret Store here:
tls: store: name: default-cloudflare-tls
Note: If you wish to use another Origin Certificate (for another domain etc.) you can follow the steps above, create the secret in the same namespace where your application is in, and simply add your secret like this:
tls: secretName: your-other-origin-secret
Now go to traefik.yourdomain.com, you should see a page like this:
Did you find this article valuable?
Support Alper Cicek by becoming a sponsor. Any amount is appreciated!