How do I setup Traefik Proxy on K3s to allow connections to my gRPC pod over HTTP/1.1(h2c)

Question

I am trying to connect and make grpc calls from a web browser that has to connect to my k3s cluster over an IP Address that will potentially be changed from time to time. Because of this I am unable to use TLS for reasons I won't dive into here.

The web browser connects using @protobuf-ts/grpcweb-transport. Client code here:

const url = 'http://172.16.6.81:8081';

const transport = new GrpcWebFetchTransport({
  baseUrl: url,
});

Then for my pod and the corresponding service/ingressroutes:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: product-connector
spec:
  selector:
    matchLabels:
      app: product-connector
  template:
    metadata:
      labels:
        app: product-connector
    spec:
      hostname: product-connector
      hostNetwork: true
      containers:
      - name: product-connector
        image: mph_product_connector
        imagePullPolicy: Never
        ports:
        - containerPort: 50054
---
apiVersion: v1
kind: Service
metadata:
  name: product-connector
  annotations:
    traefik.ingress.kubernetes.io/service.serversscheme: h2c
spec:
  type: ClusterIP
  selector:
    app: product-connector
  ports:
  - port: 8081
    targetPort: 50054
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: product-grpc-secure
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`product-grpc.company.app`)
      kind: Rule
      services:
        - name: product-connector
          namespace: default
          port: 8081
          scheme: h2c
          passHostHeader: true
  tls:
    secretName: frontend-crt
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: product-grpc
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`172.16.6.81`) # IP of the Traefik server, needs to be dynamic.
      kind: Rule
      services:
        - name: product-connector
          namespace: default
          port: 8081
          scheme: h2c

I've tried changing the match rule to several different things including a couple "catch-alls" but every time I just receive net::ERR_CONNECTION_REFUSED

note: The connection does work over TLS when I am connecting from https

Answer 1

You can use HostRegexp that will match any host, for testing I used IngressRoute shown below

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: grpc
spec:
  entryPoints:
    - web
  routes:
  - kind: Rule
    match: HostRegexp(`{any:.+}`)
    services:
    - name: grpc
      scheme: h2c
      port: 10000

Everything works