Traefik & Marathon

    See also Marathon user guide.

    Configuring Marathon & Deploying / Exposing Applications

    Enabling the marathon provider

    2.   marathon: {}

    1. --providers.marathon=true

    Attaching labels to marathon applications

    1. {
    2.     "id": "/whoami",
    3.     "container": {
    4.         "type": "DOCKER",
    5.         "docker": {
    6.             "image": "containous/whoami",
    7.             "network": "BRIDGE",
    8.             "portMappings": [
    9.                 {
    10.                     "containerPort": 80,
    11.                     "hostPort": 0,
    12.                     "protocol": "tcp"
    13.                 }
    14.             ]
    15.         }
    16.     },
    17.     "labels": {
    18.         "traefik.http.Routers.app.Rule": "PathPrefix(`/app`)"
    19.     }
    20. }

    See the dedicated section in .

    Optional

    1. [providers.marathon.basic]
    2.   httpBasicAuthUser = "foo"
    3.   httpBasicPassword = "bar"

    1. providers:
    2.   marathon:
    3.     basic:
    4.       httpBasicAuthUser: foo
    5.       httpBasicPassword: bar

    1. --providers.marathon.basic.httpbasicauthuser=foo
    2. --providers.marathon.basic.httpbasicpassword=bar

    Enables Marathon basic authentication.

    dcosToken

    Optional

    1. [providers.marathon]
    2.   dcosToken = "xxxxxx"
    3.   # ...

    1. providers:
    2.   marathon:
    3.     dcosToken: "xxxxxx"
    4.     # ...

    1. --providers.marathon.dcosToken=xxxxxx

    DCOSToken for DCOS environment.

    If set, it overrides the Authorization header.

    defaultRule

    Optional, Default=Host({{ normalize .Name }})

    1. [providers.marathon]
    2.   defaultRule = "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
    3.   # ...

    1. providers:
    2.   marathon:
    3.     defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
    4.     # ...

    1. --providers.marathon.defaultRule=Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)
    2. # ...

    For a given application if no routing rule was defined by a label, it is defined by this defaultRule instead.

    It must be a valid Go template,augmented with the .

    The app ID can be accessed as the Name identifier,and the template has access to all the labels defined on this Marathon application.

    dialerTimeout

    Optional, Default=5s

    1.   dialerTimeout = "10s"
    2.   # ...

    1. providers:
    2.   marathon:
    3.     dialerTimeout: "10s"
    4.     # ...

    1. --providers.marathon.dialerTimeout=10s

    Overrides DialerTimeout.

    Amount of time the Marathon provider should wait before timing out,when trying to open a TCP connection to a Marathon master.

    Can be provided in a format supported by ,or directly as a number of seconds.

    endpoint

    Optional, Default=

    1. [providers.marathon]
    2.   endpoint = "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
    3.   # ...

    1. providers:
    2.   marathon:
    3.     endpoint: "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
    4.     # ...

    1. --providers.marathon.endpoint=http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080

    You can optionally specify multiple endpoints:

    Optional, Default=true

    1. [providers.marathon]
    3.   # ...

    1. providers:
    2.   marathon:
    3.     exposedByDefault: false
    4.     # ...

    1. --providers.marathon.exposedByDefault=false
    2. # ...

    Exposes Marathon applications by default through Traefik.

    If set to false, applications that don't have a traefik.enable=true label will be ignored from the resulting routing configuration.

    See also Restrict the Scope of Service Discovery.

    constraints

    Optional, Default=""

    1. [providers.marathon]
    2.   constraints = "Label(`a.label.name`,`foo`)"
    3.   # ...

    1. --providers.marathon.constraints=Label(`a.label.name`,`foo`)
    2. # ...

    Constraints is an expression that Traefik matches against the application's labels to determine whether to create any route for that application.That is to say, if none of the application's labels match the expression, no route for the application is created.In addition, the expression also matched against the application's constraints, such as described in Marathon constraints.If the expression is empty, all detected applications are included.

    The expression syntax is based on the Label("key", "value"), and LabelRegex("key", "value"), as well as the usual boolean logic.In addition, to match against marathon constraints, the function MarathonConstraint("field:operator:value") can be used, where the field, operator, and value parts are joined together in a single string with the : separator.

    Constraints Expression Examples

    1. # Includes only applications having a label with key `a.label.name` and value `foo`
    2. constraints = "Label(`a.label.name`, `foo`)"
    1. # Excludes applications having any label with key `a.label.name` and value `foo`
    2. constraints = "!Label(`a.label.name`, `value`)"
    1. # With logical AND.
    2. constraints = "Label(`a.label.name`, `valueA`) && Label(`another.label.name`, `valueB`)"
    1. # With logical OR.
    2. constraints = "Label(`a.label.name`, `valueA`) || Label(`another.label.name`, `valueB`)"
    1. # With logical AND and OR, with precedence set by parentheses.
    2. constraints = "Label(`a.label.name`, `valueA`) && (Label(`another.label.name`, `valueB`) || Label(`yet.another.label.name`, `valueC`))"
    1. # Includes only applications having a label with key `a.label.name` and a value matching the `a.+` regular expression.
    2. constraints = "LabelRegex(`a.label.name`, `a.+`)"
    1. # Includes only applications having a Marathon constraint with field `A`, operator `B`, and value `C`.
    2. constraints = "MarathonConstraint(`A:B:C`)"
    1. # Uses both Marathon constraint and application label with logical operator.
    2. constraints = "MarathonConstraint(`A:B:C`) && Label(`a.label.name`, `value`)"

    See also .

    forceTaskHostname

    Optional, Default=false

    1. [providers.marathon]
    2.   forceTaskHostname = true
    3.   # ...

    1. providers:
    2.   marathon:
    3.     forceTaskHostname: true
    4.     # ...

    1. --providers.marathon.forceTaskHostname=true
    2. # ...

    By default, a task's IP address (as returned by the Marathon API) is used as backend server if an IP-per-task configuration can be found;otherwise, the name of the host running the task is used.The latter behavior can be enforced by enabling this switch.

    keepAlive

    Optional, Default=10s

    1. [providers.marathon]
    2.   keepAlive = "30s"
    3.   # ...

    1. providers:
    2.   marathon:
    3.     keepAlive: "30s"
    4.     # ...

    1. --providers.marathon.keepAlive=30s
    2. # ...

    Set the TCP Keep Alive interval for the Marathon HTTP Client.Can be provided in a format supported by time.ParseDuration,or directly as a number of seconds.

    respectReadinessChecks

    Optional, Default=false

    1. [providers.marathon]
    2.   respectReadinessChecks = true
    3.   # ...

    1. providers:
    2.   marathon:
    3.     respectReadinessChecks: true
    4.     # ...

    1. --providers.marathon.respectReadinessChecks=true
    2. # ...

    Applications may define readiness checks which are probed by Marathon during deployments periodically, and these check results are exposed via the API.Enabling respectReadinessChecks causes Traefik to filter out tasks whose readiness checks have not succeeded.Note that the checks are only valid at deployment times.

    See the Marathon guide for details.

    Optional, Default=60s

    1. [providers.marathon]
    2.   # ...

    1. providers:
    2.   marathon:
    3.     responseHeaderTimeout: "66s"
    4.     # ...

    1. --providers.marathon.responseHeaderTimeout=66s

    Overrides ResponseHeaderTimeout.Amount of time the Marathon provider should wait before timing out,when waiting for the first response header from a Marathon master.

    tls

    Optional

    tls.ca

    Certificate Authority used for the secured connection to Marathon.

    1. [providers.marathon.tls]
    2.   ca = "path/to/ca.crt"

    1. --providers.marathon.tls.ca=path/to/ca.crt

    tls.caOptional

    Policy followed for the secured connection to Marathon with TLS Client Authentication.Requires tls.ca to be defined.

    • true: VerifyClientCertIfGiven
    • false: RequireAndVerifyClientCert
    • if tls.ca is undefined NoClientCert

    1. [providers.marathon.tls]
    2.   caOptional = true

    1. providers:
    2.   marathon:
    3.     tls:
    4.       caOptional: true

    1. --providers.marathon.tls.caOptional=true

    tls.cert

    Public certificate used for the secured connection to Marathon.

    1. [providers.marathon.tls]
    2.   cert = "path/to/foo.cert"
    3.   key = "path/to/foo.key"

    1. providers:
    2.   marathon:
    3.     tls:
    4.       cert: path/to/foo.cert
    5.       key: path/to/foo.key

    1. --providers.marathon.tls.cert=path/to/foo.cert
    2. --providers.marathon.tls.key=path/to/foo.key

    tls.key

    Private certificate used for the secured connection to Marathon.

    1. [providers.marathon.tls]
    2.   cert = "path/to/foo.cert"
    3.   key = "path/to/foo.key"

    1. providers:
    2.   marathon:
    3.     tls:
    4.       cert: path/to/foo.cert
    5.       key: path/to/foo.key

    1. --providers.marathon.tls.cert=path/to/foo.cert
    2. --providers.marathon.tls.key=path/to/foo.key

    tls.insecureSkipVerify

    If insecureSkipVerify is true, TLS for the connection to Marathon accepts any certificate presented by the server and any host name in that certificate.

    1. [providers.marathon.tls]
    2.   insecureSkipVerify = true

    1. providers:
    2.   marathon:
    3.     tls:
    4.       insecureSkipVerify: true

    1. --providers.marathon.tls.insecureSkipVerify=true

    tlsHandshakeTimeout

    Optional, Default=5s

    1. [providers.marathon]
    2.   responseHeaderTimeout = "10s"
    3.   # ...

    1. providers:
    2.   marathon:
    3.     responseHeaderTimeout: "10s"
    4.     # ...

    1. --providers.marathon.responseHeaderTimeout=10s
    2. # ...

    Overrides TLSHandshakeTimeout.

    Amount of time the Marathon provider should wait before timing out,when waiting for the TLS handshake to complete.Can be provided in a format supported by ,or directly as a number of seconds.

    trace

    Optional, Default=false

    1. [providers.marathon]
    2.   trace = true
    3.   # ...

    1. providers:
    2.   marathon:
    3.     trace: true
    4.     # ...

    1. --providers.marathon.trace=true
    2. # ...

    Displays additional provider logs (if available).

    watch

    Optional, Default=true

    1. [providers.marathon]
    2.   watch = false
    3.   # ...

    1. providers:
    2.   marathon:
    3.     watch: false
    4.     # ...

    Enables watching for Marathon changes.