First use - getting 502

[davidt-gh]

I've just installed caddy ingress controller in my cluster, and tried to use it with one ingress.
My cluster already was running with nginx, and for research purpose (we had bad experience with NGINX, and we looking for others) I've installed this ingress controller aside.

My external DNS updated DNS with new NLB address, and my ingress also used the certificate from my cert-manager which provided as a secret. While trying to reach my DNS I'm getting error 502, but not sure why.
Chart version: 1.3.0
Here is my values:

loadBalancer:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-name: eks-prod-nlb-caddy
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
    service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"

My ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: caddy
  name: alpha-server
  namespace: alpha
spec:
 rules:
    - host: alpha.domain.com
      http:
        paths:
          - backend:
              service:
                name: alpha-server
                port:
                  name: http
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - alpha.domain.com
      secretName: doamin-com-tls-certificate

In caddy logs I can see it detect my ingress, but when I'm trying to use my url I'm getting this error log:

{
  "level": "error",
  "ts": 1747889976.4533792,
  "logger": "http.log.error",
  "msg": "dial tcp 172.20.80.203:0: i/o timeout",
  "request": {
    "remote_ip": "10.1.2.17",
    "remote_port": "37413",
    "client_ip": "10.1.2.17",
    "proto": "HTTP/2.0",
    "method": "GET",
    "host": "alpha.domain.com",
    "uri": "/",
    "headers": {
      "Pragma": [
        "no-cache"
      ],
      "Cache-Control": [
        "no-cache"
      ],
      "Upgrade-Insecure-Requests": [
        "1"
      ],
      "User-Agent": [
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36"
      ],
      "Sec-Fetch-Mode": [
        "navigate"
      ],
      "Accept-Encoding": [
        "gzip, deflate, br, zstd"
      ],
      "Priority": [
        "u=0, i"
      ],
      "Accept": [
        "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
      ],
      "Sec-Fetch-Site": [
        "none"
      ],
      "Sec-Fetch-User": [
        "?1"
      ],
      "Sec-Fetch-Dest": [
        "document"
      ]
    },
    "tls": {
      "resumed": false,
      "version": 772,
      "cipher_suite": 4865,
      "proto": "h2",
      "server_name": "alpha.domain.com"
    }
  },
  "duration": 3.000494569,
  "status": 502,
  "err_id": "s1ysdi8s3",
  "err_trace": "reverseproxy.statusError (reverseproxy.go:1265)"
}

hope to learn some more in here.

[joshmanders]

Here's how I do it and have no problem, yours differs a bit from mine, so idk if you wanna try to change some stuff.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: primcloud-production
  annotations:
    kubernetes.io/ingress.class: caddy
spec:
  rules:
    - host: primcloud.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: primcloud-production
                port:
                  number: 8080
    - host: www.primcloud.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: primcloud-production
                port:
                  number: 8080

[davidt-gh]

@joshmanders thank you for sharing you ingress, but I don't see anything different between mean and yours.
Your example also not implement with TLS at all, hope to understand some more

@mavimo Maybe you can help in here?

[joshmanders]

@davidt-gh caddy handles tls automatically, no need to define it.

[davidt-gh]

@davidt-gh caddy handles tls automatically, no need to define it.

I have cert-manager installed, so it provide the certificate secret

[kosmoz]

Just in case anyone else ends up here with the same problem: The caddy ingress controller currently doesn't seem to support a service backend specified with a port name. You have to change it to a port number.