Paul Payne
4d983819c9
feat(synapse): update ingress to use traefik ingress class and bump version feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration fix(taiga): update liveness and readiness probes to use tcpSocket for health checks fix(taiga): change PVC access mode to ReadWriteMany for media and static storage feat(traefik): add icon and ignore rules for traefik service docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments feat(ushahidi): implement dedicated Redis deployment for Ushahidi fix(vllm): update deployment strategy and readiness/liveness probes for improved stability fix(writefreely): pin writefreely image version to v0.15.1 for consistency docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior
48 lines
1.9 KiB
Markdown
48 lines
1.9 KiB
Markdown
# Traefik
|
|
|
|
## "No available server" after redeploy `[WC-SEL]`
|
|
|
|
If a Deployment was originally created without kustomize labels in its selector, re-deploying cannot fix it — `spec.selector` is immutable once set. The Service selector updates (it's mutable) but pods won't match it, leaving the Service with no endpoints.
|
|
|
|
**Symptom**: Traefik returns "No available server" even though pods are Running.
|
|
|
|
**Diagnosis**:
|
|
```bash
|
|
kubectl get endpoints <app> -n <namespace>
|
|
# shows <none> — pods aren't matching the service
|
|
kubectl get pods -n <namespace> --show-labels
|
|
# pod labels don't include app: <name> / managedBy: kustomize / partOf: wild-cloud
|
|
```
|
|
|
|
**Fix**: delete the Deployment and re-deploy:
|
|
```bash
|
|
kubectl delete deployment <name> -n <ns>
|
|
wild app deploy <app>
|
|
```
|
|
|
|
## Same-origin iframes
|
|
|
|
The global Traefik `security-headers` middleware sets `X-Frame-Options: SAMEORIGIN`. Apps that embed their own sub-pages in iframes (e.g. Etherpad's pad editor) work correctly with this setting.
|
|
|
|
`DENY` was the previous setting and broke same-origin iframes. If you see:
|
|
```
|
|
Blocked a frame with origin "https://..." from accessing a cross-origin frame
|
|
```
|
|
the app is likely creating a same-origin iframe that a stale `DENY` header is blocking. Verify the cluster's Traefik middleware is using `SAMEORIGIN`.
|
|
|
|
**Note**: route-level Traefik middlewares run before entrypoint middlewares on the response path. A per-app middleware cannot override the global one.
|
|
|
|
## TLS-terminating reverse proxy (DISABLE_HTTPS)
|
|
|
|
Some apps (e.g. Zulip) redirect port 80 → HTTPS internally. When Traefik terminates TLS and forwards plain HTTP, this causes an infinite redirect loop.
|
|
|
|
Set these env vars to disable the internal redirect and trust the forwarded proto:
|
|
```yaml
|
|
- name: DISABLE_HTTPS
|
|
value: "true"
|
|
- name: LOADBALANCER_IPS
|
|
value: "10.244.0.0/16" # Kubernetes pod CIDR (Flannel default)
|
|
```
|
|
|
|
Also update liveness/readiness probes from HTTPS port 443 to HTTP port 80.
|