Ingress

Welkin uses the Traefik Ingress Controller to route external traffic to Services in the Cluster. The exposure method is selected in the Welkin Apps configuration for the Infrastructure Provider. The preferred order is:

1. A Kubernetes Service of type LoadBalancer, when the provider supports a Kubernetes-managed load balancer.
2. A Service of type NodePort, when traffic arrives through a load balancer managed outside Kubernetes.
3. Host ports on the worker Nodes when neither Service-based option is available.

This order describes how to choose the configuration; Traefik does not automatically detect a provider's capabilities or switch methods at runtime. A Platform Administrator can override the selected configuration.

LoadBalancer Service

With a Kubernetes cloud integration that supports Services of type LoadBalancer, Kubernetes requests an external load balancer for Traefik. After it has been provisioned, point the public DNS records at its address.

NodePort Service

When a load balancer exists but is managed outside Kubernetes, expose Traefik through a Service of type NodePort and configure that load balancer to forward HTTP and HTTPS traffic to the Service's Node ports. Point public DNS records at the external load balancer. Check the actual Node ports assigned to the Service before configuring the external load balancer; do not assume that they are 80 and 443.

Host ports

Where neither load-balancer option is available, Traefik can listen on ports 80 and 443 on the worker Nodes through host ports. Point DNS at the reachable worker Node addresses, or at an external entry point if one is available. If DNS points at only one worker Node, that Node becomes a single point of failure.

Host ports bind ports on the Nodes, whereas hostNetwork places the Pod in the Node's network namespace. They are different Kubernetes settings. The Traefik configuration below uses useHostPort for this fallback.

Configuration

The Traefik Ingress Controller is configured and installed by welkin-apps. The relevant settings in common-config.yaml are:

traefik:
  useHostPort: ""
  service:
    enabled: ""
    type: ""

The Infrastructure Provider configuration supplies the defaults for these settings. Review its values before installation or an upgrade, especially when an external load balancer forwards to worker Nodes. Set traefik.service.type to LoadBalancer or NodePort when using a Service, and configure the external load balancer to match the resulting Service. For the host-port fallback, enable traefik.useHostPort according to the Welkin Apps configuration for that provider.

Changing the exposure method may require updates to the external load balancer and public DNS. Coordinate those changes with the Apps upgrade to avoid interrupting incoming traffic.

For other Traefik installation options, see the upstream documentation.

Ingress resource

An Ingress resource routes traffic from Traefik to the desired Service. See the Kubernetes Ingress documentation.