How to setup ingress controler to access Numaflow Server UI

[ladislav-dolezal]

I am trying to setup ingress route to access numaflow server UI. If I am using port forwarding it is working properly.
But if I try to go through ingress controller I got a message:

Client sent an HTTP request to an HTTPS server.

There must be some issue with Numaflow self-signed certificate, but I do not know how to setup my ingress controller.
My IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: numaflow-ingressroute
  namespace: inqu-analytics
  annotations:
    traefik.ingress.kubernetes.io/redirect-entry-point: "https"
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`numaflow.analytics.local`)
    kind: Rule
    services:
    - name: numaflow-server
      port: 8443
    tls:
      secretName: tls

Can anybody help me how to achive this? Or is there any way how to tell Numaflow server to use my certificate for the tls communication?

[ladislav-dolezal]

I have found a solution that works, but it is not yet perfect. I am still unable to trust the Numaflow certificate for TLS communication with the backend service.

Currently, when accessing the Kubernetes cluster externally, the ingress controller uses the certificate from the tls secret for HTTPS communication. The communication between the ingress controller and the backend service is also over HTTPS, but certificate verification is skipped with insecureSkipVerify: true.

It would be nice to configure numaflow ui server to use my own certificate for tls communication. For example the issued certificate from cert-manager.

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: numaflow
  namespace: your-namespace
spec:
  entryPoints:    
    - websecure
  tls:
    secretName: tls
  routes:
    - match: Host(`your.domain.com`) 
      priority: 10
      kind: Rule
      services:
      - name: numaflow-server
        port: 8443      
        serversTransport: numaflow
        scheme: https

apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
  name: numaflow
  namespace: your-namespace
spec:
  serverName: numaflow-server
  insecureSkipVerify: true

[whynowy]

@ladislav-dolezal - I'm not familiar with Traefic, is there a LB sitting on top (for IngressRoute)? The CERT in the Numaflow server Pod is a self-signed one, which is supposed to be used for encryption purpose only between your LB and the pod. Usually there's another layer of TLS termination on the LB (for the ingress traffic from external).

[whynowy]

Based on your description above, it seems to be exactly the case, this should be good enough to my understanding.