[Support]: 502 Bad Gateway in Kubernetes with Traefik ingress but working as NodePort

[muhlba91]

Describe the problem you are having

I am trying to install Frigate on my Kubernetes cluster with a minimal configuration.

I can successfully access Frigate if I expose the Kubernetes Service as a NodePort service. Frigate works without any issues at all.

However, I cannot access Frigate through a Kubernetes Ingress resource. When browsing to the URL, on the first access I receive some HTML assets (fonts, CSS, ...) but after this one request all others return 502 Bad Gateway. I can still access Frigate successfully through the NodePort but not at all through the Ingress.

I have enabled debug logging but nothing at all sticks out. Interestingly, I can always load the favicon and see the request being logged. All requests afterwards are not even logged in Frigate.

It looks like the Traefik serving as the ingress controller to my cluster already shuts down the request and returns 502 but I don't see any relevant logs in Traefik either.
My Traefik configuration is pretty default with the exception of enabling forwarded headers:

forwardedHeaders:
  trustedIPs:
    - 10.0.0.0/8
  insecure: true

Even weirder is that with the same configuration I can put a Traefik proxy running on my local machine in front of the NodePort service and Frigate works as well.
So it seems like there's something happening inside the cluster.

Does anyone have an idea on why this could happen and what configuration I need to change for this to work?

Version

0.16.0

What browser(s) are you using?

No response

Frigate config file

# default configuration
tls:
  enabled: false
mqtt:
  enabled: false

Relevant Frigate log output

N/A

Relevant go2rtc log output

N/A

FFprobe output from your camera

N/A

Frigate stats

No response

Install method

Docker Compose

docker-compose file or Docker CLI command

using Helm chart

Object Detector

Coral

Network connection

Wired

Camera make and model

N/A

Screenshots of the Frigate UI's System metrics pages

No response

Any other information that may be helpful

No response

[inkeep-ai-assistant[bot]]

A 502 Bad Gateway when using Traefik as an ingress for Frigate, but not when using NodePort, suggests an issue with how the reverse proxy is set up to forward requests to Frigate. Frigate expects to be accessed on its authenticated UI/API port (default: 8971) when behind a reverse proxy(1)(2). You should ensure that:

• Your Traefik ingress forwards requests to port 8971 of the Frigate service, not 5000, since 5000 is intended for internal, unauthenticated use and should not be exposed externally(1)(2).
• TLS should be terminated at the proxy, and TLS must be disabled in Frigate if the proxy is handling encryption, otherwise you may see HTTP 400 or 502 errors. To disable TLS in Frigate, use:

  tls:
    enabled: false

  (2)
• If you are using authentication, verify trusted proxies are configured so Frigate sees the correct client IP, not the proxy’s IP(1). For Traefik, this may involve adding the Traefik pod subnet to trusted_proxies in the auth section of your config:

  auth:
    trusted_proxies:
      - <traefik_pod_subnet>

  (1)
• Make sure your ingress and service definitions preserve WebSocket upgrades required for Frigate’s UI (e.g., /ws and /live/ endpoints)(2).
• If Frigate is being accessed at a path (e.g., /frigate/), Frigate does not natively support subpaths and must be exposed at a subdomain or root path(2).

You can find more details and example proxy configurations (including for Traefik) in the official guide: Setting up a reverse proxy(2).

📚 Sources:

1. Authentication
2. Setting up a reverse proxy

---

Have another question? Just tag @inkeep.

[muhlba91]

tls is disabled and adding trusted_proxies did not resolve this either.

the Kubernetes Ingress uses port 8971 as its target but I also tried port 5000 already. Both behave the same.

[muhlba91]

In case someone stumbles upon the same error: I have a dual-stack enabled cluster and the ipFamilyPolicy is set to PreferDualStack for most of my services. Frigate does not support IPv6 out of the box. Setting this to SingleStack resolves the issue!

If I want to enable IPv6, I need to overwrite the entire listen.gotmpl file as per https://docs.frigate.video/configuration/advanced/#enabling-ipv6, right?

[hawkeye217]

If I want to enable IPv6, I need to overwrite the entire listen.gotmpl file as per https://docs.frigate.video/configuration/advanced/#enabling-ipv6, right?

Yes.

IPv6 support was merged into the dev branch last week with this PR: #19602

It will be a part of Frigate 0.17.

[muhlba91]

awesome, that means with ´0.17.0` it's just a config flag and overwriting the template file is not needed anymore?

[NickM-27]

correct