---
id: ingress-controllers-traefik-tls-passthrough
name: "Traefik TLS passthrough"
description: "Installs Traefik, configures IngressRouteTCP with tls.passthrough=true, and verifies the backend's TLS certificate is served untouched through the proxy."
labels: {customer: any, profile: tls}
cluster:
  provider: kind
  k8s_version: v1.30.0
  preinstall:
    - kind: helm
      chart: traefik/traefik
      version: v28.3.0
      release: traefik
      namespace: traefik
      repo:
        name: traefik
        url: "https://traefik.github.io/charts"
      values:
        image:
          registry: ghcr.io
          repository: traefik/traefik
        ingressClass:
          enabled: true
          isDefaultClass: false
        ingressRoute:
          dashboard:
            enabled: false
        ports:
          web:
            exposedPort: 80
          websecure:
            exposedPort: 443
        service:
          type: NodePort
        providers:
          kubernetesIngress:
            enabled: true
          kubernetesCRD:
            enabled: true
      wait: pods-ready
      wait_timeout: 3m
    - kind: raw_manifest
      path: ./fixtures/traefik-tls-passthrough-ingressroutetcp.yaml
      namespace: sample
    - kind: raw_manifest
      path: ./fixtures/manual-tls-basic-secret.yaml
      namespace: sample
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    image.repository: "public.ecr.aws/nginx/nginx"
    image.tag: "1.27-alpine"
    ingress.enabled: "false"
    tls.enabled: "true"
    tls.secretName: "manual-tls-basic"
    tls.servicePort: "443"
    tls.initContainerImage: "public.ecr.aws/docker/library/busybox:1.36"
asserts:
  - type: helm-status-deployed
    release: sample
    namespace: sample
  - type: pods-ready
    namespace: sample
    timeout: 5m
  - type: pods-ready
    namespace: traefik
    timeout: 3m
  - type: smoke-script
    path: chart-test/assertions/traefik-tls-passthrough.sh
tags: [nightly]
mechanisms: ['addon:traefik']
category: networking
integration: traefik
tier: live