# Temporal cli cannot connect to frontend service via Ingress

**URL:** <https://community.temporal.io/t/temporal-cli-cannot-connect-to-frontend-service-via-ingress/8213>\
**Category:** Server Deployment\
**Tags:** cli, kubernetes\
**Created:** [May 10, 2023, 12:27pm UTC](https://community.temporal.io/t/temporal-cli-cannot-connect-to-frontend-service-via-ingress/8213 "2023-05-10T12:27:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrei-Moiseev](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/andrei-moiseev/32/3898_2.png) [@Andrei-Moiseev](https://community.temporal.io/u/Andrei-Moiseev)\
**Post date:** [May 10, 2023, 12:27pm UTC](https://community.temporal.io/t/temporal-cli-cannot-connect-to-frontend-service-via-ingress/8213/1 "2023-05-10T12:27:49Z")

</div>

I deployed Temporal Cluster on on-prem K8s. My deployment is based on Helm Chart with some modifications.  
I created Ingress for exposing frontend service outside of K8s, but Temporal cli tool fails to connect. All works like a charm if I expose service with port forwarding.

Ingress config:

```auto
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/backend-protocol: GRPC
    nginx.ingress.kubernetes.io/force-ssl-redirect: 'false'
    nginx.ingress.kubernetes.io/proxy-body-size: 50m
    nginx.ingress.kubernetes.io/proxy-connect-timeout: '60'
    nginx.ingress.kubernetes.io/proxy-read-timeout: '60'
    nginx.ingress.kubernetes.io/proxy-send-timeout: '60'
    nginx.ingress.kubernetes.io/ssl-passthrough: 'false'
    nginx.ingress.kubernetes.io/ssl-redirect: 'false'
    nginx.org/grpc-services: temporal-frontend
  name: temporal-frontend
  namespace: temporal-stage
spec:
  rules:
    - host: api.temporal.stage.stellar-dev.detmir-infra.ru
      http:
        paths:
          - backend:
              service:
                name: temporal-frontend
                port:
                  name: grpc-rpc
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - api.temporal.stage.stellar-dev.detmir-infra.ru
      secretName: temporal-frontend-cert

```

I was able to connect to external address using grpcurl:

```auto
 grpcurl api.temporal.stage.stellar-dev.detmir-infra.ru:443 list

grpc.health.v1.Health
grpc.reflection.v1alpha.ServerReflection
temporal.api.operatorservice.v1.OperatorService
temporal.api.workflowservice.v1.WorkflowService
temporal.server.api.adminservice.v1.AdminService

```

But when I triyng to connect with temporal cli I got an error:

```auto
 temporal workflow list --env stage

 FATAL Failed to create SDK client {"error": "failed reaching server: last connection error: connection error: desc = \"error reading server preface: http2: frame too large\"", "logging-call-at": "factory.go:141"}

```

```auto
 temporal env get stage

address api.temporal.stage.stellar-dev.detmir-infra.ru:443

```

---

<div class="post-metadata">

**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\
**Post date:** [May 19, 2023, 10:43pm UTC](https://community.temporal.io/t/temporal-cli-cannot-connect-to-frontend-service-via-ingress/8213/2 "2023-05-19T22:43:53Z")

</div>

Were you able to get to the bottom of this issue? Can you tell from service\_requests server metric if operation ListWorkflowExecutions was received by frontend? If not maybe was blocked with this error by nginx?

---

<div class="post-metadata">

**Author:** ![jackban](https://avatars.discourse-cdn.com/v4/letter/j/c4cdca/32.png) [@jackban](https://community.temporal.io/u/jackban)\
**Post date:** [July 3, 2023, 4:17am UTC](https://community.temporal.io/t/temporal-cli-cannot-connect-to-frontend-service-via-ingress/8213/3 "2023-07-03T04:17:00Z")

</div>

+1, same problem

---

<div class="post-metadata">

**Author:** ![Andrei-Moiseev](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/andrei-moiseev/32/3898_2.png) [@Andrei-Moiseev](https://community.temporal.io/u/Andrei-Moiseev)\
**Post date:** [July 3, 2023, 6:29am UTC](https://community.temporal.io/t/temporal-cli-cannot-connect-to-frontend-service-via-ingress/8213/4 "2023-07-03T06:29:30Z")

</div>

Yes, sorry for long delay.  
The issue was with LetsEncrypt certificate which is not recognized as valid certificate authority by CLI tool.  
Solved by adding parameter --tls-ca-path referencing the .pem file with root LetsEncrypt certificate. It turns out that this certificate is also required to connect with Java SDK.