Can not login with traefik ingress

[archmagece]

It works fine with service port forward.
but not working with ingress.

with this error

browser
Unauthorized (401): Invalid credentials provided

console
http://dashboard.internal/api/v1/me
401 Unauthorized
{
    "ErrStatus": {
        "metadata": {},
        "status": "Failure",
        "message": "MSG_LOGIN_UNAUTHORIZED_ERROR",
        "reason": "Unauthorized",
        "code": 401
    }
}

and auth module log
handler.go:33] "Could not get user" err="MSG_LOGIN_UNAUTHORIZED_ERROR"

I don't know Why?

installed it by helm

helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
helm install kubernetes-dashboard --values value-kubedashboard.yaml --namespace kubernetes-dashboard

value-kubedashboard.yaml

app:
  mode: 'dashboard'
  image:
    pullPolicy: IfNotPresent
    pullSecrets: []
    networkPolicy:
      enabled: false
      ingressDenyAll: false
      # Raw network policy spec that overrides predefined spec
      # Example:
      # spec:
      #   egress:
      #     - ports:
      #         - port: 123
      spec: {}

  # Common labels & annotations shared across all deployed resources
  labels: {}
  annotations: {}
  ingress:
    enabled: true
    hosts:
      - dashboard.internal
    ingressClassName: traefik
    useDefaultIngressClass: false
    useDefaultAnnotations: false
    pathType: Prefix
    path: /
    issuer:
      name: selfsigned
      # Scope determines what kind of issuer annotation will be used on ingress resource
      # - default - adds 'cert-manager.io/issuer'
      # - cluster - adds 'cert-manager.io/cluster-issuer'
      # - disabled - disables cert-manager annotations
      scope: disabled
    tls:
      enabled: false
      # If provided it will override autogenerated secret name
      secretName: ""
    labels: {}
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: web
      traefik.ingress.kubernetes.io/whitelist-source-range: "192.168.0.0/16"
      traefik.ingress.kubernetes.io/router.tls: "false"
  tolerations: []
  affinity: {}

auth:
  role: auth
  image:
    repository: docker.io/kubernetesui/dashboard-auth
    tag: 1.2.2
  scaling:
    replicas: 1
    revisionHistoryLimit: 1
  automountServiceAccountToken: true

# API deployment configuration
api:
  role: api
  image:
    repository: docker.io/kubernetesui/dashboard-api
    tag: 1.10.1
  scaling:
    replicas: 1
    revisionHistoryLimit: 1
  automountServiceAccountToken: true

# WEB UI deployment configuration
web:
  role: web
  image:
    repository: docker.io/kubernetesui/dashboard-web
    tag: 1.6.0
  scaling:
    replicas: 1
    revisionHistoryLimit: 1
  automountServiceAccountToken: true

### Metrics Scraper
### Container to scrape, store, and retrieve a window of time from the Metrics Server.
### refs: https://github.com/kubernetes/dashboard/tree/master/modules/metrics-scraper
metricsScraper:
  enabled: true
  role: metrics-scraper
  image:
    repository: docker.io/kubernetesui/dashboard-metrics-scraper
    tag: 1.2.1
  scaling:
    replicas: 1
    revisionHistoryLimit: 1
  automountServiceAccountToken: true

## Optional Metrics Server sub-chart configuration
## Enable this if you don't already have metrics-server enabled on your cluster and
## want to use it with dashboard metrics-scraper
## refs:
##  - https://github.com/kubernetes-sigs/metrics-server
##  - https://github.com/kubernetes-sigs/metrics-server/tree/master/charts/metrics-server
metrics-server:
  enabled: false
  args:
    - --enable-skip-login=false
    - --kubelet-preferred-address-types=InternalIP
    - --kubelet-insecure-tls
    - --enable-insecure-login=true

## Required Kong sub-chart with DBless configuration to act as a gateway
## for our all containers.
kong:
  enabled: true
  ## Configuration reference: https://docs.konghq.com/gateway/3.6.x/reference/configuration
  env:
    dns_order: LAST,A,CNAME,AAAA,SRV
    #    dns_order: AAAA,A,CNAME,LAST,SRV
    plugins: 'off'
    nginx_worker_processes: 1
  ingressController:
    enabled: false
  manager:
    enabled: false
  dblessConfig:
    configMap: kong-dbless-config
  proxy:
    type: ClusterIP
    http:
      enabled: true
    tls:
      enabled: false
      servicePort: 80
#      servicePort: 443

cert-manager:
  enabled: false
  installCRDs: true
nginx:
  enabled: false

## Extra configurations:
## - manifests
## - predefined roles
## - prometheus
## - etc...
extras:
  manifests: []
  serviceMonitor:
    # Whether to create a Prometheus Operator service monitor.
    enabled: true
    # Here labels can be added to the serviceMonitor
    labels: {}
    # Here annotations can be added to the serviceMonitor
    annotations: {}
    # metrics.serviceMonitor.metricRelabelings Specify Metric Relabelings to add to the scrape endpoint
    # ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig
    metricRelabelings: []
    # metrics.serviceMonitor.relabelings [array] Prometheus relabeling rules
    relabelings: []
    # ServiceMonitor connection scheme. Defaults to HTTPS.
    scheme: https
    # ServiceMonitor connection tlsConfig. Defaults to {insecureSkipVerify:true}.
    tlsConfig:
      insecureSkipVerify: true

Use admin-user token to login

https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md

I've create service account as shown in the article above

kubectl -n kubernetes-dashboard create token admin-user

[floreks]

traefik.ingress.kubernetes.io/router.entrypoints: web IIUC this tries to passthrough the traffic directly to the web container. That's the reason it won't work. You should pass it to the kong gateway or completely reconfigure the ingress to match its behavior and configuration.

[archmagece]

Thank for your response. but my Ingress link to kong service.

I use

• Traefik 3.2.1
• Client Version: v1.31.1
• Kustomize Version: v5.4.2
• Server Version: v1.30.3+k3s1

My ingress

kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  labels:
    helm.sh/chart: kubernetes-dashboard-7.10.0
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: kubernetes-dashboard
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: "redirect-to-web@file"
    traefik.ingress.kubernetes.io/router.entrypoints: web, websecure
    traefik.ingress.kubernetes.io/whitelist-source-range: "192.168.0.0/16"
    traefik.ingress.kubernetes.io/router.tls: "false"
  name: kubernetes-dashboard
spec:
  ingressClassName: traefik
  rules:
    - host: dashboard.internal
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: kubernetes-dashboard-kong-proxy
                port:
                  number: 80

Login Result

When I login through Ingress

error like below

• /api/v1/csrftoken/login GET 200 OK
• /api/v1/login POST 200 OK
• /api/v1/me GET 401 Unauthorized

{
    "ErrStatus": {
        "metadata": {},
        "status": "Failure",
        "message": "MSG_LOGIN_UNAUTHORIZED_ERROR",
        "reason": "Unauthorized",
        "code": 401
    }
}

When I login directly to kubernetes-dashboard-kong-proxy with same token

http://localhost:43859/#/login

• /api/v1/csrftoken/login GET 200 OK
• /api/v1/login POST 200 OK
• /api/v1/me GET 200 OK

{"name":"admin-user","authenticated":true}

---

Is it still same?