try ingress for traefik

external/ingress.yaml

@@ -0,0 +1,41 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-internal-tls
+  namespace: kube-system
+  annotations:
+    kubernetes.io/ingress.class: traefik-internal
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    certResolver: myresolver
+    domains:
+    - main: "*.ducoterra.net"
+  routes:
+  - match: Host(`traefik-internal.ducoterra.net`)
+    kind: Rule
+    services:
+    - name: traefik-external-admin
+      port: 8000
+
+---
+
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-internal-web
+  namespace: kube-system
+  annotations:
+    kubernetes.io/ingress.class: traefik-internal
+spec:
+  entryPoints:
+    - web
+  routes:
+  - match: Host(`traefik-internal.ducoterra.net`)
+    kind: Rule
+    services:
+    - name: traefik-external-admin
+      port: 8000
+    middlewares:
+      - name: httpsredirect

external/service.yaml

@@ -15,4 +15,18 @@ spec:
     - protocol: TCP
       port: 9443
       name: websecure
-      targetPort: 9443
+      targetPort: 9443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-external-admin
+  namespace: kube-system
+spec:
+  selector:
+    app: traefik-external-controller
+  ports:
+    - protocol: TCP
+      port: 8080
+      name: admin
+      targetPort: 8080