The path a request takes¶

graph LR
    U[Client] -->|443/tcp| HAP[HAProxy on core-1]
    HAP -->|31344/tcp nodeport| TR[Traefik]
    TR --> DE[DE services]
    TR --> KC[Keycloak]
    TR --> UP[User Portal]
    NG[ingress-nginx] --> VICE[VICE app ingresses]
    HAP --> NG

Three pieces, each with a distinct job:

• HAProxy is the public entry point on the host, listening on 80 and 443.
• Traefik is the in-cluster ingress controller, reached through node ports (31343 HTTP, 31344 HTTPS by default).
• ingress-nginx still handles VICE app ingresses and is being retired.

Traefik¶

ansible-playbook -i /path/to/inventory --tags traefik kubernetes.yml

Install it after cert-manager, so routes can reference the certificates they need at creation time.

The node ports are configurable. If you change them, change the HAProxy back end to match, and reopen the firewall on the new ports — see network requirements.

Verify:

kubectl get svc -A | grep -i traefik
kubectl get ingressroute -A

ingress-nginx (transitional)¶

ingress-nginx gives VICE apps their per-analysis ingresses. Traefik is intended to take this over, and the deployment tag remains only until that migration completes.

ansible-playbook -i /path/to/inventory --tags ingress-nginx kubernetes.yml

The kustomize manifests are in the cluster resources repository. If you deploy into a namespace other than prod, the default backend argument has to follow:

- --default-backend-service=prod/vice-default-backend
+ --default-backend-service=<NAMESPACE>/vice-default-backend

Applying the overlay creates the ingress-nginx namespace.

DNS and certificates¶

The wildcard is what forces DNS-01 certificate challenges; see cert-manager.

Related¶

• HAProxy
• VICE deployment
• Namespaces