How to define ingress / ingressRoute to UI Console?

[ahgraber]

I am using the gitops tool flux to manage my kubernetes cluster. I have installed the cockroach operator and deployed a cluster based on the example manifest.

I am trying to create an ingress (specifically, a traefik ingressRoute) to the UI console, but the addition of the ability to declare an ingress seems undocumented.

How can I create an ingress to the console UI?

[Lamercho]

Its not cockroach specific, just read the docs of your ingress controller and add ingress rule that points to cockroachdb-public svc. Don`t forget to secure it :-)

[ahgraber]

I have tried with this ingressRoute, which does not work. Am I missing something?

I can access the Console UI if I port forward, but that's a hacky/temporary solution.

[ahgraber]

If I build my cluster in insecure mode, with tlsEnabled: false, the ingressRoute works fine and I can access the console. It seems like the ssl cert for the Ingress is conflicting with the cert for the cluster

[ahgraber]

Alternatively, I can use the cluster's TLS certification with an ingressRouteTCP, although this faces the "this is insecure" warning from the browser

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: route-cockroachdb
  namespace: networking
  # namespace: cockroach-operator-system
spec:
  entryPoints:
    - websecure
  routes:
    - match: HostSNI(`roachdb.${SECRET_DOMAIN}`)
      services:
        - name: cockroachdb-public
          namespace: cockroach-operator-system
          port: 8080
  tls:
    passthrough: true  # let the endpoint handle tls termination

[joerocklin]

@ahgraber I don't know if you're still looking for an answer, but this is what I have deployed that works for me:

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: crdb-core
spec:
  entryPoints:
    - websecure
    - web
  routes:
    - kind: Rule
      match: Host(`<host>`)
      services:
      - kind: Service
        name: crdb-core-public
        passHostHeader: false
        port: 8080
        serversTransport: cockroachdb
        scheme: https
      middlewares:
        - name: traefik-v2-allowlist@kubernetescrd
  tls: {}
---
apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
  name: cockroachdb
spec:
  insecureSkipVerify: true

I included the web entrypoint because it is configured to handle http->https redirects for me.