Dashboard with Traefik header rewrite not working

[WLun001]

Bug Report

What is the issue?

Hitting this error when accessing dashboard, with Traefik following Exposing the Dashboard docs

It appears that you are trying to reach this service with a host of 'linkerd.example.com'.
This does not match /^(localhost|127\.0\.0\.1|linkerd-web\.linkerd\.svc\.cluster\.local|linkerd-web\.linkerd\.svc|\[::1\])(:\d+)?$/ and has been denied for security reasons.
Please see https://linkerd.io/dns-rebinding for an explanation of what is happening and how to fix it.

How can it be reproduced?

Traefik IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingress-route
spec:
  entryPoints: ["websecure"]
  routes:
    - kind: Rule
      match: Host(`linkerd.example.com`)
      middlewares:
        - name: 15d-header-mw
          namespace: linkerd
      services:
          name: linkerd-web
          namespace: linkerd
          port: 8084
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: 15d-header-mw
  namespace: linkerd
spec:
  headers:
    customRequestHeaders:
      l5d-dst-override: linkerd-web.linkerd.svc.cluster.local:8084

Logs, error output, etc

Shown on above

linkerd check output

kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

kubernetes-version
------------------
√ is running the minimum Kubernetes API version
√ is running the minimum kubectl version

linkerd-existence
-----------------
√ 'linkerd-config' config map exists
√ heartbeat ServiceAccount exist
√ control plane replica sets are ready
√ no unschedulable pods
√ controller pod is running
√ can initialize the client
√ can query the control plane API

linkerd-config
--------------
√ control plane Namespace exists
√ control plane ClusterRoles exist
√ control plane ClusterRoleBindings exist
√ control plane ServiceAccounts exist
√ control plane CustomResourceDefinitions exist
√ control plane MutatingWebhookConfigurations exist
√ control plane ValidatingWebhookConfigurations exist
√ control plane PodSecurityPolicies exist

linkerd-identity
----------------
√ certificate config is valid
√ trust anchors are using supported crypto algorithm
√ trust anchors are within their validity period
√ trust anchors are valid for at least 60 days
√ issuer cert is using supported crypto algorithm
√ issuer cert is within its validity period
√ issuer cert is valid for at least 60 days
√ issuer cert is issued by the trust anchor

linkerd-api
-----------
√ control plane pods are ready
√ control plane self-check
√ [kubernetes] control plane can talk to Kubernetes
√ [prometheus] control plane can talk to Prometheus
√ tap api service is running

linkerd-version
---------------
√ can determine the latest version
‼ cli is up-to-date
    is running version 2.8.1 but the latest stable version is 2.9.0
    see https://linkerd.io/checks/#l5d-version-cli for hints

control-plane-version
---------------------
‼ control plane is up-to-date
    is running version 2.8.1 but the latest stable version is 2.9.0
    see https://linkerd.io/checks/#l5d-version-control for hints
√ control plane and cli versions match

linkerd-addons
--------------
√ 'linkerd-config-addons' config map exists

linkerd-grafana
---------------
√ grafana add-on service account exists
√ grafana add-on config map exists
√ grafana pod is running

Status check results are √

Environment

• Kubernetes Version: 1.17.12-gke.1504
• Cluster Environment: GKE
• Host OS: MasOS 10.15.7
• Linkerd version:

Client version: stable-2.8.1
Server version: stable-2.8.1

Possible solution

as suggest from https://linkerd.io/dns-rebinding, set enforced-host to empty string, -enforced-host=

Additional context

Traefik version: 2.3.1

[grampelberg]

Setting l5d-dst-override just fixes discovery, it doesn't solve the host header problem. You'll either need to rewrite the host header in traefik or follow the instructions in dns-rebinding and enforce your specific hosts.