Teleport cluster ingress 502

[FishyFishPat]

Hi there so I have managed to get teleport cluster up, but now when I want to use ingress I get a Bad Gateway 502. In the proxy logs I get next message:

2024-07-11T13:23:13Z DEBU [MX:PROXY:] Detected an HTTP request. If this is for a health check, use an HTTPS request instead. dst_addr:10.42.5.127:3080 src_addr:10.42.9.30:33050 multiplexer/multiplexer.go:363 2024-07-11T13:23:13Z DEBU [MX:PROXY:] Closing HTTP connection: HTTP listener is disabled. dst_addr:10.42.5.127:3080 src_addr:10.42.9.30:33050 multiplexer/multiplexer.go:368

Here is my teleport.yaml:

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: teleport
  namespace: sx-x
spec:
  serviceAccountName: sx-x
  targetNamespace: sx-x
  releaseName:  teleport
  install:
    crds: Skip
  chart:
    spec:
      chart: ./examples/chart/teleport-cluster
      sourceRef:
        kind: GitRepository
        name: teleport-helm
  interval: 10m
  values:
    chartMode: standalone
    clusterName: teleport.dev.example.net
    installCRDs: false
    auth:
      teleportConfig:
        # put any teleport.yaml auth configuration overrides here
        teleport:
          log:
            output: stderr
            severity: DEBUG

        auth_service:
          enabled: true
          web_idle_timeout: 1h
          authentication:
            locking_mode: best_effort

    proxy:
      teleportConfig:
        # put any teleport.yaml proxy configuration overrides here
        teleport:
          log:
            output: stderr
            severity: DEBUG
        proxy_service:
          public_addr: teleport.dev.example.net:443
          https_keypairs_reload_interval: 0s #12h
          https_keypairs: []
            #- cert_file: /etc/teleport/ssl/tls.crt
            #  key_file: /etc/teleport/ssl/tls.key

    operator:
      enabled: false
      installCRDs: never

    rbac:
      create: false

    log:
      level: DEBUG

    proxyListenerMode: "multiplex"

    # serviceAccount:
    #   create: false
    #   name: solve-x

    tls:
      existingSecretName: wildcard-dev-example-net-tls

    service:
      type: ClusterIP

    ingress:
      enabled: true
      suppressAutomaticWildcards: true
      spec:
        ingressClassName: nginx

    annotations:
      ingress:
        nginx.ingress.kubernetes.io/proxy-buffer-size: 512k
        nginx.ingress.kubernetes.io/proxy-buffering: 'on'
        nginx.ingress.kubernetes.io/proxy-buffers-number: '4'

    # If you are running Kubernetes 1.23 or above, disable PodSecurityPolicies
    podSecurityPolicy:
      enabled: false
    

How could I solve this isse?

Thank you for your help
Patrik

[webvictim]

Take a look at https://goteleport.com/docs/management/admin/troubleshooting/#ssh-overflow-reading-version-string-andor-502-bad-gateway-errors

annotations:
  ingress:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

This also appears if you search "502 Bad Gateway" in our docs :)

[webvictim]

No worries - glad it worked for you!

[Giannischri]

i have the exact same problem....my yaml is the same as fishyfishpat...i get 502 on cloudflare...my pod service when i portforward the ui works only with https....i am trying to add the UI to a domain.Is this a cloudflare related problem(ssl option on full)?

[FishyFishPat]

If you want to add a domain on cloudflare and you are using full ssl then I would first check the certificates. For the solution was adding the https. Check if you can reach the cluster from cloudflare domain.

[webvictim]

If Cloudflare itself is showing the 502 error, it usually means that it can't connect to the backend itself. How are you configuring the traffic to get from Cloudflare to your cluster?

[Giannischri]

ok guys thank you very much...problem was: weblisten adress of proxy should be 3080(helm chart version)...and cloudflare proxy handles the tls...Problem fixed