Using Traefik (v3) and Postgres with TLS Ingress

Question

I am trying to add entrypoint and TCP ingressroute for my postgress, it is not working.

• I am running Postgress in non SSL mode.
• TLS termination is handled by Traefik.
• I am using beta v3 Traefik

I have defined entrypoint using traefik helm chart. (Similar setup for mongodb worked as expected)

traefik:
  ports:
    metrics:
      port: 9100
      expose: true
      exposedPort: 9100
      protocol: TCP
    web:
      port: 8000
      expose: true
      exposedPort: 80
      protocol: TCP
      redirectTo: websecure
    websecure:
      port: 8443
      expose: true
      exposedPort: 443
      protocol: TCP
      tls:
        enabled: true
        options: ""
        certResolver: ""
        domains: []
    traefik:
      port: 9000
      expose: true
      exposedPort: 9000
      protocol: TCP
    postgres:
      port: 5432
      expose: true
      exposedPort: 5432
      protocol: TCP
      tls:
        enabled: true
        options: ""
        certResolver: ""
        domains: []
    mongodb:
      port: 27017
      expose: true
      exposedPort: 27017
      protocol: TCP
      tls:
        enabled: true
        options: ""
        certResolver: ""
        domains: []

This is my ingress route

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  labels:
    argocd.argoproj.io/instance: postgresdb
  name: postgres-ingressroute-tcp
  namespace: postgresdb
spec:
  entryPoints:
    - postgres
  routes:
    - match: HostSNI(`postgres.**********`)
      services:
        - name: postgres-service
          port: 5432
  tls:
    secretName: tls-secret

Using PGAdmin to connect to DB

Getting connection timeout.

• If I portforward to postgress, it works as expected, so nothing should be wrong with DB (Note: DB is running in non SSL mode)

• Similar setup for mongodb is working as expected.

• No logs in postgres and traefik about this issue, for both I am printing logs in DEBUG mode.

Overheat

If Traefik handle TLS then PostgreSQL does not know nothing about the SSL and if you ask for require it will raise error as it is not protected by itself but it is delegated to traefik. – Hedvah