K3s/traefik ingress tls redirect breaks remote exec runner

[thejimnicholson (Jim Nicholson)]

I’m very new to this, so I’m not sure if I’ve hit a bug or I just misunderstand things.

My drone server is running in a k3s cluster (on arm64 hardware.) I have a build I need to run on amd64 arch for “reasons.” After looking over the options, it seemed like the most expedient way to do this was to use drone-runner-exec on the amd64 system. My drone server is using gitea for oauth, and the gitea instance is also on the k3s cluster. Both of them sit behind traefik, and have tls enabled via letsencrypt.

I want to enforce https, so the ingress for my drone server has this annotation:
traefik.ingress.kubernetes.io/redirect-entry-point: https
with this in place, my exec runner loops at startup with
msg=“cannot ping the remote server” error=“Temporary Redirect”

When I remove the annotation, the runner can connect.

If this is a bug, I’ll report it. If it’s not a bug, but I have things misconfigured (or I’ve misunderstood it), I’d like to fix that bug in me as well.

[ashwilliams1 (Ash Williams)]

@thejimnicholson

I want to enforce https, so the ingress for my drone server has this annotation:
traefik.ingress.kubernetes.io/redirect-entry-point: https
with this in place, my exec runner loops at startup with
msg=“cannot ping the remote server” error=“Temporary Redirect”

This is a misconfiguration issue, not a bug. It looks like you configured the runner to use http instead of https, and as a result traefik is returning 307 redirects when the runner is trying to connect with the server. Using the correct protocol [1] will resolve this particular error message.

[1] https://docs.drone.io/runner/exec/installation/linux/#configuration