Kubernetes Overview

Deploy Traefik in Kubernetes using Ingress, Custom Resource Definitions (CRD), or Gateway API for advanced routing.

Kubernetes Overview

The Kubernetes Ingress Controller - Three Ways to Route

Traefik integrates seamlessly with Kubernetes through three different providers, each offering different levels of features and complexity.

Three Provider Options

CRD Provider

Most Powerful

Custom Resources for advanced routing, TCP/UDP, middleware, and more.

Provider name: kubernetescrd

Gateway API

Future Standard

Kubernetes SIG standard with role-based configuration and advanced features.

Provider name: kubernetesgateway

Ingress

Most Compatible

Standard Kubernetes Ingress with annotation-based configuration.

Provider name: kubernetes

Quick Comparison

Feature	Ingress	CRD	Gateway API
HTTP Routing	✅	✅	✅
HTTPS/TLS	✅	✅	✅
TCP Routing	❌	✅	✅
UDP Routing	❌	✅	❌
Middleware	Via Annotations	Native CRDs	Limited
Configuration Method	Annotations	Custom Resources	Gateway API Resources
Learning Curve	Low	Medium	Medium
Kubernetes Standard	✅	❌	✅ (Future)

Which Provider Should I Use?

CRD Provider

Choose CRD when you need:

✅ Full Traefik feature set (TCP, UDP, middleware)
✅ Type-safe Kubernetes resources
✅ Advanced routing capabilities
✅ IngressRoute abstraction

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-route
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`example.com`)
      kind: Rule
      services:
        - name: whoami
          port: 80
      middlewares:
        - name: auth

Gateway API

Choose Gateway API when you need:

✅ Kubernetes-native standard (future-proof)
✅ Role-based configuration (platform vs. app teams)
✅ Portable configuration across providers
✅ Modern routing features

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-route
spec:
  parentRefs:
    - name: my-gateway
  hostnames:
    - "example.com"
  rules:
    - backendRefs:
        - name: whoami
          port: 80

Ingress

Choose Ingress when you need:

✅ Standard Kubernetes resources only
✅ Compatibility with other ingress controllers
✅ Simple HTTP/HTTPS routing
✅ Minimal learning curve

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: whoami
                port:
                  number: 80

Installation

Using Helm (Recommended)

1. Add Traefik Helm Repository

   helm repo add traefik https://traefik.github.io/charts
   helm repo update
   
2. Create values.yaml

   values.yaml

   # Enable providers
   providers:
     kubernetesCRD:
       enabled: true
     kubernetesIngress:
       enabled: true
     kubernetesGateway:
       enabled: true
   
   # Create IngressClass
   ingressClass:
     enabled: true
     isDefaultClass: true
   
   # Ports configuration
   ports:
     web:
       port: 80
     websecure:
       port: 443
   
3. Install Traefik

   helm install traefik traefik/traefik \
     --namespace traefik \
     --create-namespace \
     --values values.yaml
   

Manual Installation

1. Apply CRDs and RBAC

   # For CRD Provider
   kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
   kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
   
   # For Gateway API
   kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
   kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
   
2. Deploy Traefik

   traefik-deployment.yaml

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: traefik
     namespace: traefik
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: traefik
     template:
       metadata:
         labels:
           app: traefik
       spec:
         serviceAccountName: traefik
         containers:
           - name: traefik
             image: traefik:v3.6
             args:
               - --entrypoints.web.address=:80
               - --entrypoints.websecure.address=:443
               - --providers.kubernetescrd
               - --providers.kubernetesingress
             ports:
               - name: web
                 containerPort: 80
               - name: websecure
                 containerPort: 443
   

Common Configuration

Enable Multiple Providers

providers:
  kubernetesCRD:
    enabled: true
    namespaces:
      - default
      - production
  
  kubernetesIngress:
    enabled: true
    
  kubernetesGateway:
    enabled: true
    experimentalChannel: true

Namespace Filtering

Limit which namespaces Traefik watches:

providers:
  kubernetesCRD:
    namespaces:
      - production
      - staging

Label Selector

Filter resources by labels:

providers:
  kubernetesCRD:
    labelSelector: "app=traefik"

Example: Complete Application Deployment

CRD

apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  selector:
    app: whoami
  ports:
    - port: 80
      targetPort: 80

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
spec:
  replicas: 3
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: whoami
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`whoami.example.com`)
      kind: Rule
      services:
        - name: whoami
          port: 80
  tls:
    certResolver: letsencrypt

Migration Paths

From Ingress to CRD

1. Enable CRD Provider

   Keep Ingress provider enabled during migration.

2. Convert Resources

   Gradually convert Ingress resources to IngressRoute.

3. Test and Verify

   Ensure all routes work correctly.

4. Disable Ingress Provider

   Once migration is complete, disable if desired.

From CRD to Gateway API

Similar process - enable both providers during migration.

Provider-Specific Documentation

CRD Provider

IngressRoute, Middleware, and other custom resources

Gateway API

Gateway, HTTPRoute, and Gateway API configuration

Ingress

Standard Kubernetes Ingress with Traefik annotations

Common Issues

CRDs Not Found

# Ensure CRDs are installed
kubectl get crd | grep traefik

RBAC Permissions

# Verify service account has correct permissions
kubectl get clusterrole traefik -o yaml

Provider Not Watching Namespace

# Add namespace to watch list
providers:
  kubernetesCRD:
    namespaces:
      - your-namespace