IngressRoute unable to route to service in another Kubernetes namespace

[crhuber]

Do you want to request a feature or report a bug?

Bug

What did you do?

Im unable to route to service in another Kubernetes namespace that differs from where the IngressRoute was created.
For example I create an IngressRoute in the traefik namespace but the service lives in another k8s namespace foo

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: sampleapp
  namespace: traefik
spec:
  entryPoints:
    - web
  routes:
  - match: PathPrefix(`/sampleapp`)
    kind: Rule
    services:
    - name: sampleapp
      port: 8000

I get the following errors in the logs

msg="Cannot create service: service not found traefik/sampleapp" providerName=kubernetescrd ingress=sampleapp namespace=traefik serviceName=sampleapp servicePort=8000

I tried to add the namespace to the service but it didnt work ie:

    services:
    - name: sampleapp
       namespace: foo
       port: 8000

What did you expect to see?

Traffic should be able to route to services in different namespace from IngressRoute

What did you see instead?

msg="Cannot create service: service not found traefik/sampleapp" providerName=kubernetescrd ingress=sampleapp namespace=traefik serviceName=sampleapp servicePort=8000

Output of traefik version: (What version of Traefik are you using?)

Version:      2.0.4
Codename:     montdor
Go version:   go1.13.3
Built:        2019-10-28T20:23:57Z
OS/Arch:      linux/amd64

What is your environment & configuration (arguments, toml, provider, platform, ...)?

Helm, Kubernetes 

If applicable, please paste the log output in DEBUG level (--log.level=DEBUG switch)

[crhuber]

I believe it may be caused by this line:
https://github.com/containous/traefik/blob/4e9166759dca1a2e7bdba1780c6a08b655d20522/pkg/provider/kubernetes/crd/kubernetes_tcp.go#L61

[dduportal]

Hi @crhuber , thanks for your interest.

This is not a use case that will be supported for security reason.
Even if Traefik uses the custom resources for the IngressRoute, the object model in Kubernetes API follows the standard Ingress model. As underlined in the official Kubernetes issue tracker (ref. kubernetes/kubernetes#17088), Ingress objects must resides in the same namespace as the services it addresses: it is the same for IngressRoute.
You can see the IngressRoute as part of the web application, and not part of Traefik itself. It is only a ruleset definition.

Please note that there is no problem to have the Traefik Deployment (and its associated Service) in a namespaces, while your web applications (with their IngressRoute) resides in other namespaces: Traefik watches the Kubernetes API and is able to route requests accordingly as any Ingress Controller.

Is there anything blocking you in creating the IngressRoute objects in the same namespace as the applications it serves?

[crhuber]

Okay that makes sense I will close it