Ingress Gateway TLS Termination defaults: preventing accidental public access

Answer

To guarantee that the Traefik Mesh ingress gateway accepts only HTTPS traffic, you must ensure that no HTTP entrypoint is exposed or that any HTTP entrypoint redirects to HTTPS.

Confirmed facts

• Traefik Proxy (and thus the Mesh ingress gateway) does not enable TLS by default; an HTTP entrypoint is active unless explicitly removed or disabled.
• There is no built‑in flag that automatically turns on TLS termination when a TLS block is missing.

Likely explanation

The Mesh gateway inherits the same entrypoint behavior as Traefik Proxy: HTTP remains reachable until the operator explicitly restricts entrypoints or adds a redirect middleware.

Steps to enforce HTTPS‑only

1. Edit the static configuration (e.g., traefik.yml) of the ingress gateway:
• Option A – Remove the HTTP entrypoint entirely:

entrypoints:
  websecure:
    address: ":443"

• Option B – Keep the HTTP entrypoint but add a redirect to HTTPS:

entrypoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
http:
  middlewares:
    - redirect-to-https
middlewares:
  redirect-to-https:
    redirectScheme:
      scheme: https
      permanent: true

2. Define routers that use only the websecure entrypoint and attach a TLS configuration (either via tls: block or certResolver).
3. Reload the gateway (e.g., kubectl rollout restart deployment/traefik-mesh-ingress or send SIGHUP).

Verification without firewall changes

• Check which ports the gateway process is listening on: ss -tlnp | grep traefik or netstat -tlnp. Expect only port 443.
• From an external host, send an HTTP request: curl -I http://your-gateway-host. You should see either a connection refused/error or a 308 redirect to HTTPS with no backend response.
• Send an HTTPS request: curl -k -I https://your-gateway-host and verify a 2xx/3xx response from the intended service.
• Inspect Traefik access logs for any entries with HTTP scheme reaching backends; there should be none after the change.