Ingress-Controller Migration

This section describes the procedure for migrating an existing Infoworks deployment from ingress-nginx to Traefik, including deployment, application configuration changes, validation, and rollback steps.

Step 1: Download the Traefik Helm Charts

Add the Traefik Helm repository and update the local Helm repository cache.

Command: helm repo add traefik https://traefik.github.io/charts

helm repo update

Step 2: Create a Traefik Values File

Create a custom values file for Traefik deployment in $IW_HOME. The values file should contain all environment-specific configurations.

values.yaml file template:

xxxxxxxxxx

image:

  registry: <registry-name>

  repository: <repository-path>/traefik

  tag: v3.7.1

deployment:

  imagePullSecrets:

    - name: <secret-name> (if any)

providers:

  kubernetesCRD:

    enabled: true

    allowCrossNamespace: true

  kubernetesIngress:

    enabled: true

service:

  spec:

    externalTrafficPolicy: Local

  annotations:

    service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: "/healthz"

Step 3: Deploy Traefik in a Separate Namespace

Create the Traefik namespace and any required imagePullSecrets manually. Then run the below command to deploy traefik

Command:

helm install traefik traefik/traefik -n traefik -f <path_to_traefik-values.yaml>

NOTE: After deployment completes, the Traefik service is expected to remain in a Pending state because ports 80 and 443 are still owned by ingress-nginx. This is expected behavior and will be resolved after the Infoworks Helm upgrade.

Step 4: Update Infoworks Configuration

Edit the $IW_HOME/iw-k8s-installer/infoworks/values.yaml

Apply the following changes:

A. Update ingress-nginx internal service ports under ingress-nginx.

controller.service.interal section

ports:

http: 8080

https: 8443

B. Allow Traefik namespace in networkPolicy.namespaceValue section. The block should look as below

networkPolicy:

enabled: true

namespaceValue:

• kube-system

- traefik

C. Enable Traefik and configure middleware annotations. The block should look as below

traefik:

enabled: true

traefikIngressClassName: traefik

traefikAnnotations:

traefik.ingress.kubernetes.io/router.middlewares: "<namespace>-cors@kubernetescrd,<namespace>-proxy-timeout@kubernetescrd"

corsURLs:

- <environment URL>

- https://www.google.com

D. Configure common service annotations. The final block is as below

commonServiceAnnotations:

traefik.ingress.kubernetes.io/service.serverstransport: <namespace>-custom-timeouts@kubernetescr_d

Step 5: Upgrade the Infoworks Release

Run the Helm upgrade from $IW_HOME/iw-k8s-installer. This run will free the ports 80 and 443 which the traefik service will bind to and the loadbalancer IP will be assigned to traefik service. Also this will create the traefik ingress object which will redirect the network traffic.

Command:

helm upgrade -i <release-name> ./infoworks -n <namespace> -f ./infoworks/values.yaml

Rollback

Procedure: Traefik to Ingress-NGINX

Step 1: Move Traefik Away from Ports 80/443

Update the Traefik service ports to 8080 and 8443 in the values.yaml created for traefik deployment. Add the below block given below.

ports:

web:

port: 8080

exposedPort: 8080

websecure:

port: 8443

exposedPort: 8443

Step 2: Implement the Changes

Run helm upgrade so that the changes can take effect.

Command:

helm upgrade -i traefik traefik/traefik -n traefik -f <path-to-traefik-values.yaml>

Step 3: Validation

Run kubectl get svc -n traefik . The output should show ports changed from 80 and 443 to 8080 and 8443.

Output:

k get svc -n traefik

NAME: traefik _ _

TYPE: LoadBalancer

CLUSTER-IP: x.x.x.x

EXTERNAL-IP: x.x.x.x

PORT(S): 8080:30766/TCP,8443:30153/TCP

Step 4: Check Ingress-Nginx Ports

Run kubectl get svc -n <iwx-env-namespace> . The output should show ports changed from 8080 and 4843 to 80 and 443.