Traefik & Kubernetes

    Configuring KubernetesCRD and Deploying/Exposing Services

    Resource Definition

    RBAC

    1. kind: ClusterRole
    2. apiVersion: rbac.authorization.k8s.io/v1beta1
    3. metadata:
    4.   name: traefik-ingress-controller
    6. rules:
    7.   - apiGroups:
    8.       - ""
    9.     resources:
    10.       - services
    11.       - endpoints
    12.       - secrets
    13.     verbs:
    14.       - get
    15.       - list
    16.       - watch
    17.   - apiGroups:
    18.       - extensions
    19.       - networking.k8s.io
    20.     resources:
    21.       - ingresses
    22.       - ingressclasses
    23.     verbs:
    24.       - get
    25.       - list
    26.       - watch
    27.   - apiGroups:
    28.       - extensions
    29.     resources:
    30.       - ingresses/status
    31.     verbs:
    32.       - update
    33.   - apiGroups:
    34.       - traefik.containo.us
    35.     resources:
    36.       - middlewares
    37.       - ingressroutes
    38.       - traefikservices
    39.       - ingressroutetcps
    40.       - ingressrouteudps
    41.       - tlsoptions
    42.       - tlsstores
    43.       - serverstransports
    44.     verbs:
    45.       - get
    46.       - list
    47.       - watch
    49. ---
    50. kind: ClusterRoleBinding
    51. apiVersion: rbac.authorization.k8s.io/v1beta1
    52. metadata:
    53.   name: traefik-ingress-controller
    55. roleRef:
    56.   apiGroup: rbac.authorization.k8s.io
    57.   kind: ClusterRole
    58.   name: traefik-ingress-controller
    59. subjects:
    60.   - kind: ServiceAccount
    61.     name: traefik-ingress-controller
    62.     namespace: default

    Traefik

    1. apiVersion: v1
    2. kind: ServiceAccount
    3. metadata:
    4.   name: traefik-ingress-controller
    6. ---
    7. kind: Deployment
    8. apiVersion: apps/v1
    9. metadata:
    10.   name: traefik
    11.   labels:
    12.     app: traefik
    14. spec:
    15.   replicas: 1
    16.   selector:
    17.     matchLabels:
    18.       app: traefik
    19.   template:
    20.     metadata:
    21.       labels:
    22.         app: traefik
    23.     spec:
    24.       serviceAccountName: traefik-ingress-controller
    25.       containers:
    26.         - name: traefik
    27.           image: traefik:v2.4
    28.           args:
    29.             - --log.level=DEBUG
    30.             - --api
    31.             - --api.insecure
    32.             - --entrypoints.web.address=:80
    33.             - --entrypoints.tcpep.address=:8000
    34.             - --entrypoints.udpep.address=:9000/udp
    35.             - --providers.kubernetescrd
    36.           ports:
    37.             - name: web
    38.               containerPort: 80
    39.             - name: admin
    40.               containerPort: 8080
    41.             - name: tcpep
    42.               containerPort: 8000
    43.             - name: udpep
    44.               containerPort: 9000
    46. ---
    47. apiVersion: v1
    48. kind: Service
    49. metadata:
    50.   name: traefik
    51. spec:
    52.   type: LoadBalancer
    53.   selector:
    54.     app: traefik
    55.   ports:
    56.     - protocol: TCP
    57.       port: 80
    58.       name: web
    59.       targetPort: 80
    60.     - protocol: TCP
    61.       port: 8080
    62.       name: admin
    63.       targetPort: 8080
    64.     - protocol: TCP
    65.       port: 8000
    66.       name: tcpep
    67.       targetPort: 8000
    69. ---
    70. apiVersion: v1
    71. kind: Service
    72. metadata:
    73.   name: traefikudp
    74. spec:
    75.   type: LoadBalancer
    76.   selector:
    77.     app: traefik
    78.   ports:
    79.     - protocol: UDP
    80.       port: 9000
    81.       name: udpep
    82.       targetPort: 9000

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: myingressroute
    5.   namespace: default
    7. spec:
    8.   entryPoints:
    9.     - web
    11.   routes:
    12.   - match: Host(`foo`) && PathPrefix(`/bar`)
    13.     kind: Rule
    14.     services:
    15.     - name: whoami
    16.       port: 80
    18. ---
    19. apiVersion: traefik.containo.us/v1alpha1
    20. kind: IngressRouteTCP
    21. metadata:
    22.   name: ingressroute.tcp
    23.   namespace: default
    25. spec:
    26.   entryPoints:
    27.     - tcpep
    28.   routes:
    29.   - match: HostSNI(`bar`)
    30.     kind: Rule
    31.     services:
    32.       - name: whoamitcp
    33.         port: 8080
    35. ---
    36. apiVersion: traefik.containo.us/v1alpha1
    37. kind: IngressRouteUDP
    38. metadata:
    39.   name: ingressroute.udp
    40.   namespace: default
    42. spec:
    43.   entryPoints:
    44.     - fooudp
    45.   routes:
    46.   - kind: Rule
    47.     services:
    48.       - name: whoamiudp
    49.         port: 8080

    Whoami

    1. kind: Deployment
    2. apiVersion: apps/v1
    3. metadata:
    4.   name: whoami
    5.   namespace: default
    6.   labels:
    7.     app: traefiklabs
    8.     name: whoami
    10. spec:
    11.   replicas: 2
    12.   selector:
    13.     matchLabels:
    14.       app: traefiklabs
    15.       task: whoami
    16.   template:
    17.     metadata:
    18.       labels:
    19.         app: traefiklabs
    20.         task: whoami
    21.     spec:
    22.       containers:
    23.         - name: whoami
    24.           image: traefik/whoami
    25.           ports:
    26.             - containerPort: 80
    28. ---
    29. apiVersion: v1
    30. kind: Service
    31. metadata:
    32.   name: whoami
    33.   namespace: default
    35. spec:
    36.   ports:
    37.     - name: http
    38.       port: 80
    39.   selector:
    40.     app: traefiklabs
    41.     task: whoami
    43. ---
    44. kind: Deployment
    45. apiVersion: apps/v1
    46. metadata:
    47.   name: whoamitcp
    48.   namespace: default
    49.   labels:
    50.     app: traefiklabs
    51.     name: whoamitcp
    53. spec:
    54.   replicas: 2
    55.   selector:
    56.     matchLabels:
    57.       app: traefiklabs
    58.       task: whoamitcp
    59.   template:
    60.     metadata:
    61.       labels:
    62.         app: traefiklabs
    63.         task: whoamitcp
    64.     spec:
    65.       containers:
    66.         - name: whoamitcp
    67.           image: traefik/whoamitcp
    68.           ports:
    69.             - containerPort: 8080
    71. ---
    72. apiVersion: v1
    73. kind: Service
    74. metadata:
    75.   name: whoamitcp
    76.   namespace: default
    78. spec:
    79.   ports:
    80.     - protocol: TCP
    81.       port: 8080
    82.   selector:
    83.     app: traefiklabs
    84.     task: whoamitcp
    86. ---
    87. kind: Deployment
    88. apiVersion: apps/v1
    89. metadata:
    90.   name: whoamiudp
    91.   namespace: default
    92.   labels:
    93.     app: traefiklabs
    94.     name: whoamiudp
    96. spec:
    97.   replicas: 2
    98.   selector:
    99.     matchLabels:
    100.       app: traefiklabs
    101.       task: whoamiudp
    102.   template:
    103.     metadata:
    104.       labels:
    105.         app: traefiklabs
    106.         task: whoamiudp
    107.     spec:
    108.       containers:
    109.         - name: whoamiudp
    110.           image: traefik/whoamiudp:latest
    111.           ports:
    112.             - containerPort: 8080
    114. ---
    115. apiVersion: v1
    116. kind: Service
    117. metadata:
    118.   name: whoamiudp
    119.   namespace: default
    121. spec:
    122.   ports:
    123.     - port: 8080
    124.   selector:
    125.     app: traefiklabs
    126.     task: whoamiudp
    • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
    • Validate that are fulfilled before using the Traefik custom resources.
    • Traefik CRDs are building blocks that you can assemble according to your needs.

    You can find an excerpt of the available custom resources in the table below:

    Kind: IngressRoute

    IngressRoute is the CRD implementation of a .

    Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

    IngressRoute Attributes

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: foo
    5.   namespace: bar
    6. spec:
    7.   entryPoints:                      # [1]
    8.     - foo
    9.   routes:                           # [2]
    10.   - kind: Rule
    11.     match: Host(`test.example.com`) # [3]
    12.     priority: 10                    # [4]
    13.     middlewares:                    # [5]
    14.     - name: middleware1             # [6]
    15.       namespace: default            # [7]
    16.     services:                       # [8]
    17.     - kind: Service
    18.       name: foo
    19.       namespace: default
    20.       passHostHeader: true
    21.       port: 80
    22.       responseForwarding:
    23.         flushInterval: 1ms
    24.       scheme: https
    25.       serversTransport: transport
    26.       sticky:
    27.         cookie:
    28.           httpOnly: true
    29.           name: cookie
    30.           secure: true
    31.           sameSite: none
    32.       strategy: RoundRobin
    33.       weight: 10
    34.   tls:                              # [9]
    35.     secretName: supersecret         # [10]
    36.     options:                        # [11]
    37.       name: opt                     # [12]
    38.       namespace: default            # [13]
    39.     certResolver: foo               # [14]
    40.     domains:                        # [15]
    41.     - main: example.net             # [16]
    42.       sans:                         # [17]
    43.       - a.example.net
    44.       - b.example.net
    RefAttributePurpose
    [1]entryPointsList of names
    [2]routesList of routes
    [3]routes[n].matchDefines the rule corresponding to an underlying router.
    [4]routes[n].priority rules of the same length, for route matching
    [5]routes[n].middlewaresList of reference to Middleware
    [6]middlewares[n].nameDefines the name
    [7]middlewares[n].namespaceDefines the Middleware namespace
    [8]routes[n].servicesList of any combination of and reference to a Kubernetes service (See below for ExternalName Service setup)
    [9]tlsDefines certificate configuration
    [10]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
    [11]tls.optionsDefines the reference to a
    [12]options.nameDefines the TLSOption name
    [13]options.namespaceDefines the namespace
    [14]tls.certResolverDefines the reference to a CertResolver
    [15]tls.domainsList of
    [16]domains[n].mainDefines the main domain name
    [17]domains[n].sansList of SANs (alternative domains)

    Declaring an IngressRoute

    IngressRoute

    1. # All resources definition must be declared
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: IngressRoute
    4. metadata:
    5.   name: testName
    6.   namespace: default
    7. spec:
    8.   entryPoints:
    9.     - web
    10.   routes:
    11.   - kind: Rule
    12.     match: Host(`test.example.com`)
    13.     middlewares:
    14.     - name: middleware1
    15.       namespace: default
    16.     priority: 10
    17.     services:
    18.     - kind: Service
    19.       name: foo
    20.       namespace: default
    21.       port: 80
    22.       responseForwarding:
    23.         flushInterval: 1ms
    24.       scheme: https
    25.       sticky:
    26.         cookie:
    27.           httpOnly: true
    28.           name: cookie
    29.           secure: true
    30.       strategy: RoundRobin
    31.       weight: 10
    32.   tls:
    33.     certResolver: foo
    34.     domains:
    35.     - main: example.net
    36.       sans:
    37.       - a.example.net
    38.       - b.example.net
    39.     options:
    40.       name: opt
    41.       namespace: default
    42.     secretName: supersecret

    Middlewares

    1. # All resources definition must be declared
    2. # Prefixing with /foo
    4. kind: Middleware
    5. metadata:
    6.   name: middleware1
    7.   namespace: default
    8. spec:
    9.   addPrefix:
    10.     prefix: /foo

    TLSOption

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TLSOption
    3. metadata:
    4.   name: opt
    5.   namespace: default
    7. spec:
    8.   minVersion: VersionTLS12

    Secret

    1. apiVersion: v1
    2. kind: Secret
    3. metadata:
    4.   name: supersecret
    6. data:
    7.   tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
    8.   tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

    Configuring Backend Protocol

    There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

    • Setting the scheme explicitly (http/https/h2c)
    • Configuring the name of the kubernetes service port to start with https (https)
    • Setting the kubernetes service port to use port 443 (https)

    If you do not configure the above, Traefik will assume an http connection.

    Using Kubernetes ExternalName Service

    Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

    • only on IngressRoute service
    • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

    Thus, in case of two sides port definition, Traefik expects a match between ports.

    Examples

    IngressRoute

    1. ---
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: IngressRoute
    4. metadata:
    5.   name: test.route
    6.   namespace: default
    8. spec:
    9.   entryPoints:
    10.     - foo
    12.   routes:
    13.   - match: Host(`example.net`)
    14.     kind: Rule
    15.     services:
    16.     - name: external-svc
    17.       port: 80
    19. ---
    20. apiVersion: v1
    21. kind: Service
    22. metadata:
    23.   name: external-svc
    24.   namespace: default
    25. spec:
    26.   externalName: external.domain
    27.   type: ExternalName

    ExternalName Service

    1. ---
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: IngressRoute
    4. metadata:
    5.   name: test.route
    6.   namespace: default
    8. spec:
    9.   entryPoints:
    10.     - foo
    12.   routes:
    13.   - match: Host(`example.net`)
    14.     kind: Rule
    15.     services:
    16.     - name: external-svc
    18. ---
    19. apiVersion: v1
    20. kind: Service
    21. metadata:
    22.   name: external-svc
    23.   namespace: default
    24. spec:
    25.   externalName: external.domain
    26.   type: ExternalName
    27.   ports:
    28.     - port: 80

    Both sides

    1. ---
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: IngressRoute
    4. metadata:
    5.   name: test.route
    6.   namespace: default
    8. spec:
    9.   entryPoints:
    10.     - foo
    12.   routes:
    13.   - match: Host(`example.net`)
    14.     kind: Rule
    15.     services:
    16.     - name: external-svc
    17.       port: 80
    19. ---
    20. apiVersion: v1
    21. kind: Service
    22. metadata:
    23.   name: external-svc
    24.   namespace: default
    25. spec:
    26.   externalName: external.domain
    27.   type: ExternalName
    28.   ports:
    29.     - port: 80

    Kind: Middleware

    Middleware is the CRD implementation of a Traefik middleware.

    Register the Middleware in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

    Declaring and Referencing a Middleware

    Middleware

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: stripprefix
    5.   namespace: foo
    7. spec:
    8.   stripPrefix:
    9.     prefixes:
    10.       - /stripit

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: ingressroutebar
    6. spec:
    7.   entryPoints:
    8.     - web
    9.   routes:
    10.   - match: Host(`example.com`) && PathPrefix(`/stripit`)
    11.     kind: Rule
    12.     services:
    13.     - name: whoami
    14.       port: 80
    15.     middlewares:
    16.     - name: stripprefix
    17.       namespace: foo

    Cross-provider namespace

    As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the , when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

    More information about available middlewares in the dedicated middlewares section.

    TraefikService is the CRD implementation of a .

    Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the objects, or recursively in others TraefikService objects.

    Disambiguate Traefik and Kubernetes Services

    As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

    • Service (default value): to reference a Kubernetes Service
    • TraefikService: to reference another

    TraefikService object allows to use any (valid) combinations of:

    Server Load Balancing

    More information in the dedicated server load balancing section.

    Declaring and Using Server Load Balancing

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: ingressroutebar
    5.   namespace: default
    7. spec:
    8.   entryPoints:
    9.     - web
    10.   routes:
    11.   - match: Host(`example.com`) && PathPrefix(`/foo`)
    12.     kind: Rule
    13.     services:
    14.     - name: svc1
    15.       namespace: default
    16.     - name: svc2
    17.       namespace: default

    K8s Service

    Weighted Round Robin

    More information in the dedicated Weighted Round Robin service load balancing section.

    Declaring and Using Weighted Round Robin

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: ingressroutebar
    5.   namespace: default
    7. spec:
    8.   entryPoints:
    9.     - web
    10.   routes:
    11.   - match: Host(`example.com`) && PathPrefix(`/foo`)
    12.     kind: Rule
    13.     services:
    14.     - name: wrr1
    15.       namespace: default
    16.       kind: TraefikService

    Weighted Round Robin

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TraefikService
    3. metadata:
    4.   name: wrr1
    5.   namespace: default
    7. spec:
    8.   weighted:
    9.     services:
    10.       - name: svc1
    11.         port: 80
    12.         weight: 1
    13.       - name: wrr2
    14.         kind: TraefikService
    15.         weight: 1
    16.       - name: mirror1
    17.         kind: TraefikService
    18.         weight: 1
    20. ---
    21. apiVersion: traefik.containo.us/v1alpha1
    22. kind: TraefikService
    23. metadata:
    24.   name: wrr2
    25.   namespace: default
    27. spec:
    28.   weighted:
    29.     services:
    30.       - name: svc2
    31.         port: 80
    32.         weight: 1
    33.       - name: svc3
    34.         port: 80
    35.         weight: 1

    K8s Service

    1. apiVersion: v1
    2. kind: Service
    3. metadata:
    4.   name: svc1
    5.   namespace: default
    7. spec:
    8.   ports:
    9.     - name: http
    10.       port: 80
    11.   selector:
    12.     app: traefiklabs
    13.     task: app1
    14. ---
    15. apiVersion: v1
    16. kind: Service
    17. metadata:
    18.   name: svc2
    19.   namespace: default
    21. spec:
    22.   ports:
    23.     - name: http
    24.       port: 80
    25.   selector:
    26.     app: traefiklabs
    27.     task: app2
    28. ---
    29. apiVersion: v1
    30. kind: Service
    31. metadata:
    32.   name: svc3
    33.   namespace: default
    35. spec:
    36.   ports:
    37.     - name: http
    38.       port: 80
    39.   selector:
    40.     app: traefiklabs
    41.     task: app3

    Mirroring

    More information in the dedicated mirroring service section.

    Declaring and Using Mirroring

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: ingressroutebar
    5.   namespace: default
    7. spec:
    8.   entryPoints:
    9.     - web
    10.   routes:
    11.   - match: Host(`example.com`) && PathPrefix(`/foo`)
    12.     kind: Rule
    13.     services:
    14.     - name: mirror1
    15.       namespace: default
    16.       kind: TraefikService

    Mirroring k8s Service

    1. # Mirroring from a k8s Service
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: TraefikService
    4. metadata:
    5.   name: mirror1
    6.   namespace: default
    8. spec:
    9.   mirroring:
    10.     name: svc1
    11.     port: 80
    12.     mirrors:
    13.       - name: svc2
    14.         port: 80
    15.         percent: 20
    16.       - name: svc3
    17.         kind: TraefikService
    18.         percent: 20

    Mirroring Traefik Service

    1. # Mirroring from a Traefik Service
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: TraefikService
    4. metadata:
    5.   name: mirror1
    6.   namespace: default
    8. spec:
    9.   mirroring:
    10.     name: wrr1
    11.     kind: TraefikService
    12.      mirrors:
    13.        - name: svc2
    14.          port: 80
    15.          percent: 20
    16.        - name: svc3
    17.          kind: TraefikService
    18.          percent: 20

    K8s Service

    1. apiVersion: v1
    2. kind: Service
    3. metadata:
    4.   name: svc1
    5.   namespace: default
    7. spec:
    8.   ports:
    9.     - name: http
    10.       port: 80
    11.   selector:
    12.     app: traefiklabs
    13.     task: app1
    14. ---
    15. apiVersion: v1
    16. kind: Service
    17. metadata:
    18.   name: svc2
    19.   namespace: default
    21. spec:
    22.   ports:
    23.     - name: http
    24.       port: 80
    25.   selector:
    26.     app: traefiklabs
    27.     task: app2

    References and namespaces

    If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

    Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax (service@provider) should be used to refer to the TraefikService, just as in the middleware case.

    Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

    Stickiness and load-balancing

    As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

    For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

    Stickiness on two load-balancing levels

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: ingressroutebar
    5.   namespace: default
    7. spec:
    8.   entryPoints:
    9.     - web
    10.   routes:
    11.   - match: Host(`example.com`) && PathPrefix(`/foo`)
    12.     kind: Rule
    13.     services:
    14.     - name: wrr1
    15.       namespace: default
    16.       kind: TraefikService

    Weighted Round Robin

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TraefikService
    3. metadata:
    4.   name: wrr1
    5.   namespace: default
    7. spec:
    8.   weighted:
    9.     services:
    10.       - name: whoami1
    11.         kind: Service
    12.         port: 80
    13.         weight: 1
    14.         sticky:
    15.           cookie:
    16.             name: lvl2
    17.       - name: whoami2
    18.         kind: Service
    19.         weight: 1
    20.         port: 80
    21.         sticky:
    22.           cookie:
    23.             name: lvl2
    24.     sticky:
    25.       cookie:
    26.         name: lvl1

    K8s Service

    1. apiVersion: v1
    2. kind: Service
    3. metadata:
    5. spec:
    6.   ports:
    7.     - protocol: TCP
    8.       name: web
    9.       port: 80
    10.   selector:
    11.     app: whoami1
    13. ---
    14. apiVersion: v1
    15. kind: Service
    16. metadata:
    17.   name: whoami2
    19. spec:
    20.   ports:
    21.     - protocol: TCP
    22.       name: web
    23.       port: 80
    24.   selector:
    25.     app: whoami2

    Deployment (to illustrate replicas)

    1. kind: Deployment
    2. apiVersion: apps/v1
    3. metadata:
    4.   namespace: default
    5.   name: whoami1
    6.   labels:
    7.     app: whoami1
    9. spec:
    10.   replicas: 2
    11.   selector:
    12.     matchLabels:
    13.       app: whoami1
    14.   template:
    15.     metadata:
    16.       labels:
    17.         app: whoami1
    18.     spec:
    19.       containers:
    20.         - name: whoami1
    21.           image: traefik/whoami
    22.           ports:
    24.               containerPort: 80
    26. ---
    27. kind: Deployment
    28. apiVersion: apps/v1
    29. metadata:
    30.   namespace: default
    31.   name: whoami2
    32.   labels:
    33.     app: whoami2
    35. spec:
    36.   replicas: 2
    37.   selector:
    38.     matchLabels:
    39.       app: whoami2
    40.   template:
    41.     metadata:
    42.       labels:
    43.         app: whoami2
    44.     spec:
    45.       containers:
    46.         - name: whoami2
    47.           image: traefik/whoami
    48.           ports:
    49.             - name: web
    50.               containerPort: 80

    To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

    1. curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

    assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

    Kind IngressRouteTCP

    IngressRouteTCP is the CRD implementation of a Traefik TCP router.

    Register the IngressRouteTCP in the Kubernetes cluster before creating IngressRouteTCP objects.

    IngressRouteTCP Attributes

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRouteTCP
    3. metadata:
    4.   name: ingressroutetcpfoo
    6. spec:
    7.   entryPoints:                  # [1]
    8.     - footcp
    9.   routes:                       # [2]
    10.   - match: HostSNI(`*`)         # [3]
    11.     services:                   # [4]
    12.     - name: foo                 # [5]
    13.       port: 8080                # [6]
    14.       weight: 10                # [7]
    15.       terminationDelay: 400     # [8]
    16.       proxyProtocol:            # [9]
    17.         version: 1              # [10]
    18.   tls:                          # [11]
    19.     secretName: supersecret     # [12]
    20.     options:                    # [13]
    21.       name: opt                 # [14]
    22.       namespace: default        # [15]
    23.     certResolver: foo           # [16]
    24.     domains:                    # [17]
    25.     - main: example.net         # [18]
    26.       sans:                     # [19]
    27.       - a.example.net
    28.       - b.example.net
    29.     passthrough: false          # [20]

    Declaring an IngressRouteTCP

    IngressRouteTCP

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRouteTCP
    3. metadata:
    4.   name: ingressroutetcpfoo
    6. spec:
    7.   entryPoints:
    8.     - footcp
    9.   routes:
    10.   # Match is the rule corresponding to an underlying router.
    11.   - match: HostSNI(`*`)
    12.     services:
    13.     - name: foo
    14.       port: 8080
    15.       terminationDelay: 400
    16.       weight: 10
    17.     - name: bar
    18.       port: 8081
    19.       terminationDelay: 500
    20.       weight: 10
    21.   tls:
    22.     certResolver: foo
    23.     domains:
    24.     - main: example.net
    25.       sans:
    26.       - a.example.net
    27.       - b.example.net
    28.     options:
    29.       name: opt
    30.       namespace: default
    31.     secretName: supersecret
    32.     passthrough: false

    TLSOption

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TLSOption
    3. metadata:
    4.   name: opt
    5.   namespace: default
    7. spec:
    8.   minVersion: VersionTLS12

    Secret

    Using Kubernetes ExternalName Service

    • only on IngressRouteTCP service
    • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

    Thus, in case of two sides port definition, Traefik expects a match between ports.

    Examples

    IngressRouteTCP

    1. ---
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: IngressRouteTCP
    4. metadata:
    5.   name: test.route
    6.   namespace: default
    8. spec:
    9.   entryPoints:
    10.     - foo
    12.   routes:
    13.   - match: HostSNI(`*`)
    14.     kind: Rule
    15.     services:
    16.     - name: external-svc
    17.       port: 80
    19. ---
    20. apiVersion: v1
    21. kind: Service
    22. metadata:
    23.   name: external-svc
    24.   namespace: default
    25. spec:
    26.   externalName: external.domain
    27.   type: ExternalName

    ExternalName Service

    1. ---
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: IngressRouteTCP
    4. metadata:
    5.   name: test.route
    6.   namespace: default
    8. spec:
    9.   entryPoints:
    10.     - foo
    12.   routes:
    13.   - match: HostSNI(`*`)
    14.     kind: Rule
    15.     services:
    16.     - name: external-svc
    18. ---
    19. apiVersion: v1
    20. kind: Service
    21. metadata:
    22.   name: external-svc
    23.   namespace: default
    24. spec:
    25.   externalName: external.domain
    26.   type: ExternalName
    27.   ports:
    28.     - port: 80

    Both sides

    1. ---
    2. apiVersion: traefik.containo.us/v1alpha1
    3. kind: IngressRouteTCP
    4. metadata:
    5.   name: test.route
    6.   namespace: default
    8. spec:
    9.   entryPoints:
    10.     - foo
    12.   routes:
    13.   - match: HostSNI(`*`)
    14.     kind: Rule
    15.     services:
    16.     - name: external-svc
    17.       port: 80
    19. ---
    20. apiVersion: v1
    21. kind: Service
    22. metadata:
    23.   name: external-svc
    24.   namespace: default
    25. spec:
    26.   externalName: external.domain
    27.   type: ExternalName
    28.   ports:
    29.     - port: 80

    Kind IngressRouteUDP

    IngressRouteUDP is the CRD implementation of a .

    Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

    IngressRouteUDP Attributes

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRouteUDP
    3. metadata:
    4.   name: ingressrouteudpfoo
    6. spec:
    7.   entryPoints:                  # [1]
    8.     - fooudp
    9.   routes:                       # [2]
    10.   - services:                   # [3]
    11.     - name: foo                 # [4]
    12.       port: 8080                # [5]
    13.       weight: 10                # [6]
    RefAttributePurpose
    [1]entryPointsList of names
    [2]routesList of routes
    [3]routes[n].servicesList of Kubernetes service definitions
    [4]services[n].nameDefines the name of a
    [6]services[n].portDefines the port of a Kubernetes service
    [7]services[n].weightDefines the weight to apply to the server load balancing

    Declaring an IngressRouteUDP

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRouteUDP
    3. metadata:
    4.   name: ingressrouteudpfoo
    6. spec:
    7.   entryPoints:
    8.     - fooudp
    9.   routes:
    10.   - services:
    11.     - name: foo
    12.       port: 8080
    13.       weight: 10
    14.     - name: bar
    15.       port: 8081
    16.       weight: 10

    TLSOption is the CRD implementation of a .

    Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the / IngressRouteTCP objects.

    TLSOption Attributes

    TLSOption

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TLSOption
    3. metadata:
    4.   name: mytlsoption
    5.   namespace: default
    7. spec:
    8.   minVersion: VersionTLS12                      # [1]
    9.   maxVersion: VersionTLS13                      # [1]
    10.   curvePreferences:                             # [3]
    11.     - CurveP521
    12.     - CurveP384
    13.   cipherSuites:                                 # [4]
    14.     - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    15.     - TLS_RSA_WITH_AES_256_GCM_SHA384
    16.   clientAuth:                                   # [5]
    17.     secretNames:                                # [6]
    18.       - secretCA1
    19.       - secretCA2
    20.     clientAuthType: VerifyClientCertIfGiven     # [7]
    21.   sniStrict: true                               # [8]

    Declaring and referencing a TLSOption

    TLSOption

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TLSOption
    3. metadata:
    4.   name: mytlsoption
    5.   namespace: default
    7. spec:
    8.   minVersion: VersionTLS12
    9.   sniStrict: true
    10.   cipherSuites:
    11.     - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    12.     - TLS_RSA_WITH_AES_256_GCM_SHA384
    13.   clientAuth:
    14.     secretNames:
    15.       - secretCA1
    16.       - secretCA2
    17.     clientAuthType: VerifyClientCertIfGiven

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: ingressroutebar
    6. spec:
    7.   entryPoints:
    8.     - web
    9.   routes:
    10.   - match: Host(`example.com`) && PathPrefix(`/stripit`)
    11.     kind: Rule
    12.     services:
    13.     - name: whoami
    14.       port: 80
    15.   tls:
    16.     options: 
    17.       name: mytlsoption
    18.       namespace: default

    Secrets

    1. apiVersion: v1
    2. kind: Secret
    3. metadata:
    4.   name: secretCA1
    5.   namespace: default
    7. data:
    8.   tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
    10. ---
    11. apiVersion: v1
    12. kind: Secret
    13. metadata:
    14.   name: secretCA2
    15.   namespace: default
    17. data:
    18.   tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

    References and namespaces

    If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

    Additionally, when the definition of the TLS option is from another provider, the cross-provider (middlewarename@provider) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

    Kind: TLSStore

    TLSStore is the CRD implementation of a .

    Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects or referencing TLS stores in the IngressRoute / objects.

    Default TLS Store

    Traefik currently only uses the TLS Store named “default”. This means that if you have two stores that are named default in different kubernetes namespaces, they may be randomly chosen. For the time being, please only configure one TLSSTore named default.

    TLSStore Attributes

    TLSStore

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TLSStore
    3. metadata:
    4.   name: default
    5.   namespace: default
    7. spec:
    8.   defaultCertificate:
    9.     secretName: mySecret                      # [1]
    RefAttributePurpose
    [1]secretNameThe name of the referenced Kubernetes that holds the default certificate for the store.

    Declaring and referencing a TLSStore

    TLSStore

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: TLSStore
    3. metadata:
    4.   name: default
    5.   namespace: default
    7. spec:
    8.   defaultCertificate:
    9.     secretName:  supersecret

    IngressRoute

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: ingressroutebar
    6. spec:
    7.   entryPoints:
    8.     - web
    9.   routes:
    10.   - match: Host(`example.com`) && PathPrefix(`/stripit`)
    11.     kind: Rule
    12.     services:
    13.     - name: whoami
    14.       port: 80
    15.   tls:
    16.     store: 
    17.       name: default

    Secret

    1. apiVersion: v1
    2. kind: Secret
    3. metadata:
    4.   name: supersecret
    6. data:
    7.   tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
    8.   tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

    Kind: ServersTransport

    ServersTransport is the CRD implementation of a .

    Default serversTransport

    If no serversTransport is specified, the default@internal will be used. The default@internal serversTransport is created from the static configuration.

    ServersTransport Attributes

    TLSStore

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: ServersTransport
    3. metadata:
    4.   name: mytransport
    5.   namespace: default
    7. spec:
    8.   serverName: foobar               # [1]
    9.   insecureSkipVerify: true         # [2]
    10.   rootCAsSecrets:                  # [3]
    11.     - foobar
    12.     - foobar
    13.   certificatesSecrets:             # [4]
    14.     - foobar
    15.     - foobar
    16.   maxIdleConnsPerHost: 1           # [5]
    17.   forwardingTimeouts:              # [6]
    18.     dialTimeout: 42s               # [7]
    19.     responseHeaderTimeout: 42s     # [8]
    20.     idleConnTimeout: 42s           # [9]

    Declaring and referencing a ServersTransport

    ServersTransport

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: ServersTransport
    3. metadata:
    4.   name: mytransport
    5.   namespace: default
    7. spec:

    Also see the with Let’s Encrypt.