Traefik: duplicate Ingress TLS option names drop mTLS client-certificate enforcement

Impact

Traefik derived the generated TLS option name from the Ingress namespace and name, so two Ingress objects serving the same host with the same client CA secret and the same verify mode produced two different option names for one host. Traefik reads that as a TLS options conflict and silently falls back to the entry point's default TLS config, which does not request a client certificate. A route annotated auth-tls-verify-client: "on" is then reachable with no client certificate at all. On a GPU cluster this is usually the only authentication in front of internal inference endpoints, model registries and control APIs published through the ingress, and nothing in the route's configuration looks wrong - the enforcement is gone but the annotation is still there.

Who can reach it

Anyone who can reach the Traefik entry point. No credentials and no client certificate required. Preconditions are in the cluster's own config: two Ingress objects for the same host carrying the same auth-tls-secret and client-auth mode, which is what you get when routes for one hostname are split per path or per team.

What to do

Upgrade Traefik to v3.7.11; only the v3.7 line is affected. This is a rolling restart of the Traefik deployment - no node drain, no GPU workload disruption. Before the upgrade lands, list Ingress objects grouped by host and collapse duplicate auth-tls-annotated Ingresses for a host into one, and verify from outside the cluster that the route actually rejects a connection without a client certificate rather than trusting the annotation.

References

Related entries

• Kubernetes (kube-apiserver): Cluster-scoped custom resources reachable through namespaced requests, so namespace-scopedCVE-2019-11247 · Kubernetes (kube-apiserver)High
• Slurm: Race condition in message aggregation allows launching a process as another userCVE-2020-12693 · SlurmHigh
• Envoy: Escaped slash sequences %2F and %5C not decodedCVE-2021-29492 · EnvoyHigh
• Istio: Host header with a port bypasses AuthorizationPolicy host matchingCVE-2021-39156 · IstioHigh
• Envoy: Request properties are not escaped when generating request headersCVE-2023-27493 · EnvoyHigh
• Kubernetes (kubelet): Arbitrary command execution on the node via a gitRepo volumeCVE-2024-10220 · Kubernetes (kubelet)High