# K3S: Traefik Dashboard activation

**URL:** <https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142>\
**Category:** k3s, k3OS, and k3d\
**Created:** [April 13, 2020, 10:07am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142 "2020-04-13T10:07:26Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![wopl](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/wopl/32/6415_2.png) [@wopl](https://forums.suse.com/u/wopl)\
**Post date:** [April 13, 2020, 10:07am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/1 "2020-04-13T10:07:26Z")

</div>

Very new to the Kubernetes world I just installed K3S. All good and running.  
As I see, Traefik was already installed. Got my first Ingress rule running.

But for hours I am not able to figure out, what steps need to be done to get the Traefik Dashboard running. Too many different guidelines that might not fit here.

with

> ` kubectl -n kube-system edit configmap traefik`

I found the configuration file and after “`traefik.toml:`” I added “`dashboard = true`”

Is this the correct location? What else needs to be done? Do I need to set Ingress rule? Kind of some “steps needed” guide would be great.

Thanks,  
Wolfram

---

<div class="post-metadata">

**Author:** ![hbokh](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/hbokh/32/27_2.png) [@hbokh](https://forums.suse.com/u/hbokh)\
**Post date:** [May 24, 2020, 10:35am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/2 "2020-05-24T10:35:34Z")

</div>

I usually edit the Helm chart directly on the master by SSH-ing into it as user `rancher`:

`sudo vi /var/lib/rancher/k3s/server/manifests/traefik.yaml`

```auto
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: traefik
  namespace: kube-system
spec:
  chart: https://%{KUBERNETES_API}%/static/charts/traefik-1.81.0.tgz
  set:
    rbac.enabled: "true"
    ssl.enabled: "true"
    metrics.prometheus.enabled: "true"
    kubernetes.ingressEndpoint.useDefaultPublishedService: "true"
    image: "rancher/library-traefik"
    dashboard.enabled: "true" # <-- add this line
    dashboard.domain: "traefik.internal" # <-- and this one with a resolvable DNS name

```

Helm will pick up the changes automagically and the dashboard will be available under `http://traefik.internal/dashboard/`.  
Keep in mind that after a reboot of the master the file will be restored without the added lines.

---

<div class="post-metadata">

**Author:** ![wopl](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/wopl/32/6415_2.png) [@wopl](https://forums.suse.com/u/wopl)\
**Post date:** [May 28, 2020, 6:28am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/3 "2020-05-28T06:28:19Z")

</div>

Thanks, got it running.

---

<div class="post-metadata">

**Author:** ![modogo2000](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/modogo2000/32/6421_2.png) [@modogo2000](https://forums.suse.com/u/modogo2000)\
**Post date:** [May 29, 2020, 6:02pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/4 "2020-05-29T18:02:16Z")

</div>

Hello,

Do you know how to keep this change persistent ?

Best regards

---

<div class="post-metadata">

**Author:** ![wopl](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/wopl/32/6415_2.png) [@wopl](https://forums.suse.com/u/wopl)\
**Post date:** [May 30, 2020, 2:28pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/5 "2020-05-30T14:28:12Z")

</div>

I did it the different way and did not use Rancher Traefik manifests at all. Regular Traefik installation into Kubernetes. This will survive reboot, BUT (in my case) only accessible via localhost (ssh tunnel to local machine). This works for me well enough.  
Wolfram

---

<div class="post-metadata">

**Author:** ![mr12](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@mr12](https://forums.suse.com/u/mr12)\
**Post date:** [June 8, 2020, 6:23pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/6 "2020-06-08T18:23:37Z")

</div>

@hbokh editing the traefik.yaml file didn’t work for me. I manually started the k3s server using the “–disable traefik” flag and deployed your yaml above and still no luck. Anything else I could try?

---

<div class="post-metadata">

**Author:** ![Kunchala\_Vikram](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/kunchala_vikram/32/6446_2.png) [@Kunchala\_Vikram](https://forums.suse.com/u/Kunchala_Vikram)\
**Post date:** [June 9, 2020, 6:51am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/7 "2020-06-09T06:51:31Z")

</div>

It worked for me. After adding dashboard enabled:true, you can use `kubectl apply -f /var/lib/rancher/k3s/server/manifests/traefik.yaml` to get the dashboard up n running

 ![image](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/4/45613c82ac220a3c0cfdc4c3bc910f3b543496cb.png)

---

<div class="post-metadata">

**Author:** ![mr12](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@mr12](https://forums.suse.com/u/mr12)\
**Post date:** [June 9, 2020, 12:20pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/8 "2020-06-09T12:20:39Z")

</div>

Thank you @Kunchala_Vikram it just worked for me without adding the “dashboard.domain” line.

---

<div class="post-metadata">

**Author:** ![GeneralFox](https://avatars.discourse-cdn.com/v4/letter/g/a5b964/32.png) [@GeneralFox](https://forums.suse.com/u/GeneralFox)\
**Post date:** [June 19, 2020, 7:04am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/9 "2020-06-19T07:04:44Z")

</div>

This is what I’ve done to make change persistant.  
Edited/creted a config.yaml file under /var/lib/rancher/k3os/ folder like this:

k3os-13082 [~]$ sudo cat /var/lib/rancher/k3os/config.yaml  
k3os:  
k3s\_args:

- “server”
- “–no-deploy=traefik”  
write\_files:
- encoding: “”  
content: |  
apiVersion: [helm.cattle.io/v1](http://helm.cattle.io/v1)  
kind: HelmChart  
metadata:  
name: traefik  
namespace: kube-system  
spec:  
chart: https://%{KUBERNETES\_API}%/static/charts/traefik-1.81.0.tgz  
set:  
rbac.enabled: “true”  
ssl.enabled: “true”  
metrics.prometheus.enabled: “true”  
kubernetes.ingressEndpoint.useDefaultPublishedService: “true”  
image: “rancher/library-traefik”  
dashboard.enabled: “true”  
dashboard.domain: “YOUR\_WANTED\_DOMAIN”  
owner: root  
path: /var/lib/rancher/k3s/server/manifests/traefik.yaml  
permissions: ‘0600’

This make the change consistant after the reboot.

---

<div class="post-metadata">

**Author:** ![hbokh](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/hbokh/32/27_2.png) [@hbokh](https://forums.suse.com/u/hbokh)\
**Post date:** [August 2, 2020, 12:32pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/10 "2020-08-02T12:32:14Z")

</div>

That’s handy! But hardly readable. I’ve put it in between ````yaml <config> ````: 😇

```auto
k3os:
  k3s_args:
    - server
    - "--no-deploy=traefik"
  write_files:
  - encoding: ""
    content: |-
      apiVersion: helm.cattle.io/v1
      kind: HelmChart
      metadata:
        name: traefik
        namespace: kube-system
      spec:
        chart: https://%{KUBERNETES_API}%/static/charts/traefik-1.81.0.tgz
        set:
          rbac.enabled: "true"
          ssl.enabled: "true"
          metrics.prometheus.enabled: "true"
          kubernetes.ingressEndpoint.useDefaultPublishedService: "true"
          image: "rancher/library-traefik"
          dashboard.enabled: "true"
          dashboard.domain: "YOUR_WANTED_DOMAIN"
  owner: root
  path: /var/lib/rancher/k3s/server/manifests/traefik.yaml
  permissions: '0600'

```

---

<div class="post-metadata">

**Author:** ![iseric](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/iseric/32/7826_2.png) [@iseric](https://forums.suse.com/u/iseric)\
**Post date:** [July 28, 2021, 6:10pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/11 "2021-07-28T18:10:48Z")

</div>

Help? I’m not sure what path to take here. I don’t see the traefik configmap in use anymore and [posted this question to StackOverflow](https://stackoverflow.com/questions/68565048/where-did-the-k3d-traefik-configmap-go). I want to be able to configure enabling the dashboard outside of the cluster itself, because I am automating the setup, so modifying files in a pod isn’t a solution. I’ve heard reference to k3s configuration manifests under “/var/…rancher/k3s/…” directory, but I’m using `k3d` and can’t find any such directory.

---

<div class="post-metadata">

**Author:** ![iseric](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/iseric/32/7826_2.png) [@iseric](https://forums.suse.com/u/iseric)\
**Post date:** [July 28, 2021, 7:57pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/12 "2021-07-28T19:57:24Z")

</div>

I updated the SO question with additional details. I don’t want to disable the default traefik installation and install my own, because 1) k3d/k3s already upgraded to Traefik 2 and 2) I don’t want to have to manage “yet another thing”. There has to be a simple way to expose the dashboard…

---

<div class="post-metadata">

**Author:** ![Papyna](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/papyna/32/7955_2.png) [@Papyna](https://forums.suse.com/u/Papyna)\
**Post date:** [September 2, 2021, 11:19am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/13 "2021-09-02T11:19:20Z")

</div>

Hi,

I have similar issue, I’m using latest k3s 1.21.4+.

The file /var/lib/rancher/k3s/server/manifests/traefik.yaml was created by k3s installer. Here is the content

```auto
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: traefik-crd
  namespace: kube-system
spec:
  chart: https://%{KUBERNETES_API}%/static/charts/traefik-crd-9.18.2.tgz
---
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: traefik
  namespace: kube-system
spec:
  chart: https://%{KUBERNETES_API}%/static/charts/traefik-9.18.2.tgz
  set:
    global.systemDefaultRegistry: ""
  valuesContent: |-
    rbac:
      enabled: true
    ports:
      websecure:
        tls:
          enabled: true
    podAnnotations:
      prometheus.io/port: "8082"
      prometheus.io/scrape: "true"
    providers:
      kubernetesIngress:
        publishedService:
          enabled: true
    priorityClassName: "system-cluster-critical"
    image:
      name: "rancher/library-traefik"
    tolerations:
    - key: "CriticalAddonsOnly"
      operator: "Exists"
    - key: "node-role.kubernetes.io/control-plane"
      operator: "Exists"
      effect: "NoSchedule"
    - key: "node-role.kubernetes.io/master"
      operator: "Exists"
      effect: "NoSchedule"

```

By command `kubectl describe pod traefik-97b124b394-rr7mm -n kube-system`, it prints

```auto
Name: traefik-97b44b794-rr7mm
Namespace: kube-system
Priority: 2000000000
Priority Class Name: system-cluster-critical
Node: ip-172-31-39-13.us-east-2.compute.internal/172.31.39.13
Start Time: Wed, 01 Sep 2021 12:17:14 +0000
Labels: app.kubernetes.io/instance=traefik
                      app.kubernetes.io/managed-by=Helm
                      app.kubernetes.io/name=traefik
                      helm.sh/chart=traefik-9.18.2
                      pod-template-hash=97b44b794
Annotations: <none>
Status: Running
IP: 10.42.0.12
IPs:
  IP: 10.42.0.12
Controlled By: ReplicaSet/traefik-97b44b794
Containers:
  traefik:
    Container ID: containerd://b57c730cce4fff965c50bd2a5d822c09fd2a91d211a33acf410f59f326595190
    Image: rancher/library-traefik:2.4.8
    Image ID: docker.io/rancher/library-traefik@sha256:343de3610780fc88b04eeb2145cbf8189e8f6278c2061de4a1e10de31711c252
    Ports: 9000/TCP, 8000/TCP, 8443/TCP
    Host Ports: 0/TCP, 0/TCP, 0/TCP
    Args:
      --global.checknewversion
      --global.sendanonymoususage
      --entryPoints.traefik.address=:9000/tcp
      --entryPoints.web.address=:8000/tcp
      --entryPoints.websecure.address=:8443/tcp
      --api.dashboard=true
      --ping=true
      --providers.kubernetescrd
      --providers.kubernetesingress
      --providers.kubernetesingress.ingressendpoint.publishedservice=kube-system/traefik
      --entrypoints.websecure.http.tls=true
    State: Running
      Started: Wed, 01 Sep 2021 12:17:19 +0000
    Ready: True
    Restart Count: 0
    Liveness: http-get http://:9000/ping delay=10s timeout=2s period=10s #success=1 #failure=3
    Readiness: http-get http://:9000/ping delay=10s timeout=2s period=10s #success=1 #failure=1
    Environment: <none>
    Mounts:
      /data from data (rw)
      /tmp from tmp (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-4zsj2 (ro)
Conditions:
  Type Status
  Initialized True 
  Ready True 
  ContainersReady True 
  PodScheduled True 
Volumes:
  data:
    Type: EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:     
    SizeLimit: <unset>
  tmp:
    Type: EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:     
    SizeLimit: <unset>
  kube-api-access-4zsj2:
    Type: Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds: 3607
    ConfigMapName: kube-root-ca.crt
    ConfigMapOptional: <nil>
    DownwardAPI: true
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: CriticalAddonsOnly op=Exists
                             node-role.kubernetes.io/control-plane:NoSchedule op=Exists
                             node-role.kubernetes.io/master:NoSchedule op=Exists
                             node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events: <none>

```

The line `--api.dashboard=true` means dashboard should have been enabled, but I couldn’t see any pod has a name `traefik-dashboard`.

Any suggestion is welcomed.

---

<div class="post-metadata">

**Author:** ![jdvjdv](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/jdvjdv/32/7960_2.png) [@jdvjdv](https://forums.suse.com/u/jdvjdv)\
**Post date:** [September 4, 2021, 3:52am UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/14 "2021-09-04T03:52:22Z")

</div>

I found a solution and hopefully someone find a better one soon

1. you need to control your k3s cluster from your pc and not to ssh into master node, so add `/etc/rancher/k3s/k3s.yaml` into your local `~/.kube/config` (in order to port forward in last step into your pc)
2. now get your pod name as follows:

> `kubectl get pod -n kube-system`

and seach for `traefik-something-somethingElse` mine was `traefik-97b44b794-bsvjn`

1. now this part is needed from your local pc

> `kubectl port-forward traefik-97b44b794-bsvjn -n kube-system 9000:9000`

1. get `http://localhost:9000/dashboard/` in your favorite browser and don’t forget the second slash
2. enjoy the dashboard

please note you have to enable the dashboard first in `/var/lib/rancher/k3s/server/manifests/traefik.yaml` by adding

```auto
dashboard:
  enabled: true

```

---

<div class="post-metadata">

**Author:** ![dynamowku](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/dynamowku/32/8001_2.png) [@dynamowku](https://forums.suse.com/u/dynamowku)\
**Post date:** [September 11, 2021, 7:33pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/15 "2021-09-11T19:33:55Z")

</div>

Alternatively, you can also add the following to the `traefik.yaml` file referenced above:

```auto
valuesContent: |-
  dashboard:
    enabled: true
  ports:
    traefik:
      expose: true

```

Be warned, there’s a note in the traefik helm chart that suggests not exposing the dashboard in a production environment. For my personal lab this works fine. Reference: [traefik-helm-chart/values.yaml at v9.18.2 · traefik/traefik-helm-chart · GitHub](https://github.com/traefik/traefik-helm-chart/blob/v9.18.2/traefik/values.yaml#L240-L242)

---

<div class="post-metadata">

**Author:** ![reefland](https://avatars.discourse-cdn.com/v4/letter/r/58956e/32.png) [@reefland](https://forums.suse.com/u/reefland)\
**Post date:** [March 6, 2022, 3:51pm UTC](https://forums.suse.com/t/k3s-traefik-dashboard-activation/17142/16 "2022-03-06T15:51:00Z")

</div>

Maybe things have changed, running:

```nohighlight
$ k3s --version
k3s version v1.23.3+k3s1 (5fb370e5)
go version go1.17.5

```

When I describe the Traefik pod, it shows API is enabled and which entrypoints its listening on:

```nohighlight
    Args:
      --global.checknewversion
      --global.sendanonymoususage
      --entryPoints.metrics.address=:9100/tcp
      --entryPoints.traefik.address=:9000/tcp
      --entryPoints.web.address=:8000/tcp
      --entryPoints.websecure.address=:8443/tcp
      --api.dashboard=true
      --ping=true
      --metrics.prometheus=true
      --metrics.prometheus.entrypoint=metrics
      --providers.kubernetescrd
      --providers.kubernetesingress
      --providers.kubernetesingress.ingressendpoint.publishedservice=kube-system/traefik
      --entrypoints.websecure.http.tls=true

```

Being Traefik is an ingress router, all I did was create an Ingress rule to access the Dashboard in name space “kube-system”. I used entrypoint `websecure` since I already have LetsEncrypt working, you can change to just `web`.

```nohighlight
$ cat traefik_ingress.yaml 
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: dashboard-ingressroute
  namespace: kube-system
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`PUT_your_domain_name_HERE`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
      kind: Rule
      services:
        - name: api@internal
          kind: TraefikService

```

Apply the yaml file:

```nohighlight
$ kubectl apply -f traefik_ingress.yaml 
ingressroute.traefik.containo.us/dashboard-ingressroute created

```

And then point my web browser to `https://mydomain/dashboard` and the dashboard comes right up.