Good Day, Friends!
After upgrading my Traefik installation to v3, all ingresses were broken and cluster services not available. Traefik started to serve default certificates and every page were 404.
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
name: traefik
namespace: kube-system
spec:
valuesContent: |-
image:
repository: rancher/mirrored-library-traefik
tag: 3.3.3
These errors appeared in Traefik logs
W0211 11:14:18.951161 1 reflector.go:561] k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User "system:serviceaccount:kube-system:traefik" cannot list resource "endpointslices" in API group "discovery.k8s.io" at the cluster scope
E0211 11:14:18.951285 1 reflector.go:158] "Unhandled Error" err="k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: Failed to watch *v1.EndpointSlice: failed to list *v1.EndpointSlice: endpointslices.discovery.k8s.io is forbidden: User \"system:serviceaccount:kube-system:traefik\" cannot list resource \"endpointslices\" in API group \"discovery.k8s.io\" at the cluster scope" logger="UnhandledError"
W0211 11:14:20.490855 1 reflector.go:561] k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: failed to list *v1.Node: nodes is forbidden: User "system:serviceaccount:kube-system:traefik" cannot list resource "nodes" in API group "" at the cluster scope
E0211 11:14:20.491037 1 reflector.go:158] "Unhandled Error" err="k8s.io/client-go@v0.31.1/tools/cache/reflector.go:243: Failed to watch *v1.Node: failed to list *v1.Node: nodes is forbidden: User \"system:serviceaccount:kube-system:traefik\" cannot list resource \"nodes\" in API group \"\" at the cluster scope" logger="UnhandledError"
I could fix it by adding the desired definitions into the ClusterRole of Traefik
kubectl get clusterrole traefik-kube-system -o yaml > traefik-clusterrole.yaml
sed -i '21i\ - discovery.k8s.io' traefik-clusterrole.yaml
sed -i '25i\ - endpointslices' traefik-clusterrole.yaml
sed -i '35i\ - nodes' traefik-clusterrole.yaml
traefik_pod=$(kubectl get pod -n kube-system | grep "^traefik" | awk '{print $1}')
kubectl delete pod -n kube-system $traefik_pod
The problem is, I have to do the fix everytime I do kubectl apply -f traefik-values.yaml.
I found nothing in the default values regarding this:
K3S version
k3s version v1.31.4-rc1+k3s1 (a562d090)
go version go1.22.9
Best Regards