instruction: How do you configure advanced Kubernetes ingress patterns?
output: Traefik Kubernetes Ingress Documentation - Traefik Skip to content Initializing search Product Documentation Traefik Hub Kubernetes-Native API Management Traefik Enterprise The API Gateway Cloud Natives Trust Initializing search Traefik GitHub What is Traefik Getting Started Getting Started Overview Quick Start Quick Start Kubernetes Docker Configuration Introduction Frequently Asked Questions Setup Setup Kubernetes Docker Swarm Expose Expose Overview Kubernetes Docker Swarm Observe Observe Overview Logs & Access Logs Metrics Tracing Extend Migrate Migrate Traefik v3 Traefik v2 to v3 Traefik v2 to v3 Migration guide Configuration changes for v3 Traefik v2 Traefik v1 to v2 Configuration Discovery Configuration Discovery Overview Docker Swarm Kubernetes IngressRoute Kubernetes Ingress Kubernetes Ingress Table of contents Requirements Routing Configuration Enabling and Using the Provider LetsEncrypt Support with the Ingress Provider Provider Configuration endpoint token certAuthFilePath namespaces labelSelector ingressClass disableIngressClassLookup disableClusterScopeResources ingressEndpoint hostname ip publishedService throttleDuration allowEmptyServices allowExternalNameServices nativeLBByDefault strictPrefixMatching Further Kubernetes Ingress NGINX Kubernetes Gateway API Consul Catalog Nomad ECS File Consul Etcd ZooKeeper Redis HTTP Routing & Load Balancing Routing & Load Balancing Overview EntryPoints Routers Services Providers Providers Docker Swarm Kubernetes IngressRoute Kubernetes Ingress Kubernetes Ingress NGINX Kubernetes Gateway API Consul Catalog Nomad ECS KV HTTPS & TLS HTTPS & TLS Overview TLS Let's Encrypt Tailscale SPIFFE OCSP Middlewares Middlewares Overview HTTP HTTP Overview AddPrefix BasicAuth Buffering Chain CircuitBreaker Compress ContentType DigestAuth Errors ForwardAuth GrpcWeb Headers IPWhiteList IPAllowList InFlightReq PassTLSClientCert RateLimit RedirectRegex RedirectScheme ReplacePath ReplacePathRegex Retry StripPrefix StripPrefixRegex TCP TCP Overview InFlightConn IPWhiteList IPAllowList Plugins & Plugin Catalog Operations Operations CLI Dashboard API Ping Observability Observability Overview Logs Access Logs Metrics Metrics Overview Datadog InfluxDB2 OpenTelemetry Prometheus StatsD Tracing Tracing Overview OpenTelemetry Security Security Content-Length TLS in Multi-Tenant Kubernetes User Guides User Guides FastProxy Kubernetes and Let's Encrypt Kubernetes and cert-manager gRPC Examples WebSocket Examples Docker Docker Basic Example HTTPS with Let's Encrypt HTTPS with Let's Encrypt TLS Challenge HTTP Challenge DNS Challenge Contributing Contributing Thank You! Submitting Issues Submitting PRs Security Building and Testing Documentation Data Collection Advocating Maintainers Reference Reference Install Configuration Install Configuration Boot Environment Configuration Discovery Configuration Discovery Overview Kubernetes Kubernetes Kubernetes Gateway API Kubernetes CRD Kubernetes Ingress Kubernetes Ingress NGINX Docker Swarm Hashicorp Hashicorp Nomad Consul Consul Catalog KV Stores KV Stores Redis Consul etcd ZooKeeper Others Others File ECS HTTP EntryPoints API & Dashboard TLS TLS Certificate Resolvers Certificate Resolvers Overview ACME Tailscale SPIFFE OCSP Observability Observability Metrics Tracing Logs & AccessLogs Health Check (CLI & Ping) Routing Configuration Routing Configuration General General Configuration Methods HTTP HTTP Router Router Rules & Priority Observability Load Balancing Load Balancing Service ServersTransport TLS TLS Overview TLS Certificates TLS Options Middlewares Middlewares Overview AddPrefix APIKey BasicAuth Buffering Chain Circuit Breaker Compress ContentType DigestAuth Errors ForwardAuth GrpcWeb Headers HMAC IPAllowList InFlightReq JWT LDAP Token Introspection Client Credentials OIDC OPA PassTLSClientCert RateLimit RedirectRegex RedirectScheme ReplacePath ReplacePathRegex Retry StripPrefix StripPrefixRegex WAF TCP TCP Router Router Rules & Priority Service ServersTransport TLS Middlewares Middlewares Overview InFlightConn IPAllowList UDP UDP Router Router Rules & Priority Service Kubernetes Kubernetes Gateway API Kubernetes CRD Kubernetes CRD HTTP HTTP IngressRoute TraefikService ServersTransport Middleware TLSOption TLSStore TCP TCP IngressRouteTCP ServersTransportTCP MiddlewareTCP TLSOption TLSStore UDP UDP IngressRouteUDP Ingress Ingress NGINX Label & Tag Providers Label & Tag Providers Docker Swarm Consul Catalog Nomad ECS KV Deprecation Notices Deprecation Notices Releases Features GitHub Table of contents Requirements Routing Configuration Enabling and Using the Provider LetsEncrypt Support with the Ingress Provider Provider Configuration endpoint token certAuthFilePath namespaces labelSelector ingressClass disableIngressClassLookup disableClusterScopeResources ingressEndpoint hostname ip publishedService throttleDuration allowEmptyServices allowExternalNameServices nativeLBByDefault strictPrefixMatching Further Traefik &amp; Kubernetes &para; The Kubernetes Ingress Controller. The Traefik Kubernetes Ingress provider is a Kubernetes Ingress controller; that is to say, it manages access to cluster services by supporting the Ingress specification. Requirements &para; Traefik follows the Kubernetes support policy , and supports at least the latest three minor versions of Kubernetes. General functionality cannot be guaranteed for older versions. Routing Configuration &para; See the dedicated section in routing . Enabling and Using the Provider &para; You can enable the provider in the static configuration: File (YAML) providers: kubernetesIngress: {} File (TOML) [providers.kubernetesIngress] CLI --providers.kubernetesingress=true The provider then watches for incoming ingresses events, such as the example below, and derives the corresponding dynamic configuration from it, which in turn creates the resulting routers, services, handlers, etc. Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: foo namespace: production spec: rules: - host: example.net http: paths: - path: /bar pathType: Exact backend: service: name: service1 port: number: 80 - path: /foo pathType: Exact backend: service: name: service1 port: number: 80 LetsEncrypt Support with the Ingress Provider &para; By design, Traefik is a stateless application, meaning that it only derives its configuration from the environment it runs in, without additional configuration. For this reason, users can run multiple instances of Traefik at the same time to achieve HA, as is a common pattern in the kubernetes ecosystem. When using a single instance of Traefik Proxy with Let's Encrypt, you should encounter no issues. However, this could be a single point of failure. Unfortunately, it is not possible to run multiple instances of Traefik 2.0 with Let's Encrypt enabled, because there is no way to ensure that the correct instance of Traefik receives the challenge request, and subsequent responses. Early versions (v1.x) of Traefik used a KV store to attempt to achieve this, but due to sub-optimal performance that feature was dropped in 2.0. If you need Let's Encrypt with high availability in a Kubernetes environment, we recommend using Traefik Enterprise which includes distributed Let's Encrypt as a supported feature. If you want to keep using Traefik Proxy, LetsEncrypt HA can be achieved by using a Certificate Controller such as Cert-Manager . When using Cert-Manager to manage certificates, it creates secrets in your namespaces that can be referenced as TLS secrets in your ingress objects . Provider Configuration &para; endpoint &para; Optional, Default="" The Kubernetes server endpoint URL. When deployed into Kubernetes, Traefik reads the environment variables KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT or KUBECONFIG to construct the endpoint. The access token is looked up in /var/run/secrets/kubernetes.io/serviceaccount/token and the SSL CA certificate in /var/run/secrets/kubernetes.io/serviceaccount/ca.crt . Both are mounted automatically when deployed inside Kubernetes. The endpoint may be specified to override the environment variable values inside a cluster. When the environment variables are not found, Traefik tries to connect to the Kubernetes API server with an external-cluster client. In this case, the endpoint is required. Specifically, it may be set to the URL used by kubectl proxy to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig. File (YAML) providers: kubernetesIngress: endpoint: "http://localhost:8080" # ... File (TOML) [providers.kubernetesIngress] endpoint = "http://localhost:8080" # ... CLI --providers.kubernetesingress.endpoint=http://localhost:8080 token &para; Optional, Default="" Bearer token used for the Kubernetes client configuration. File (YAML) providers: kubernetesIngress: token: "mytoken" # ... File (TOML) [providers.kubernetesIngress] token = "mytoken" # ... CLI --providers.kubernetesingress.token=mytoken certAuthFilePath &para; Optional, Default="" Path to the certificate authority file. Used for the Kubernetes client configuration. File (YAML) providers: kubernetesIngress: certAuthFilePath: "/my/ca.crt" # ... File (TOML) [providers.kubernetesIngress] certAuthFilePath = "/my/ca.crt" # ... CLI --providers.kubernetesingress.certauthfilepath=/my/ca.crt namespaces &para; Optional, Default: [] Array of namespaces to watch. If left empty, Traefik watches all namespaces. File (YAML) providers: kubernetesIngress: namespaces: - "default" - "production" # ... File (TOML) [providers.kubernetesIngress] namespaces = ["default", "production"] # ... CLI --providers.kubernetesingress.namespaces=default,production labelSelector &para; Optional, Default: "" A label selector can be defined to filter on specific Ingress objects only. If left empty, Traefik processes all Ingress objects in the configured namespaces. See label-selectors for details. File (YAML) providers: kubernetesIngress: labelSelector: "app=traefik" # ... File (TOML) [providers.kubernetesIngress] labelSelector = "app=traefik" # ... CLI --providers.kubernetesingress.labelselector="app=traefik" ingressClass &para; Optional, Default: "" Value of kubernetes.io/ingress.class annotation that identifies Ingress objects to be processed. If the parameter is set, only Ingresses containing an annotation with the same value are processed. Otherwise, Ingresses missing the annotation, having an empty value, or the value traefik are processed. Example IngressClass apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: name: traefik-lb spec: controller: traefik.io/ingress-controller Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: example-ingress spec: ingressClassName: traefik-lb rules: - host: "*.example.com" http: paths: - path: /example pathType: Exact backend: service: name: example-service port: number: 80 File (YAML) providers: kubernetesIngress: ingressClass: "traefik-internal" # ... File (TOML) [providers.kubernetesIngress] ingressClass = "traefik-internal" # ... CLI --providers.kubernetesingress.ingressclass=traefik-internal disableIngressClassLookup &para; Optional, Default: false Deprecated The Kubernetes Ingress provider option disableIngressClassLookup has been deprecated in v3.1, and will be removed in the next major version. Please use the disableClusterScopeResources option instead. If the parameter is set to true , Traefik will not discover IngressClasses in the cluster. By doing so, it alleviates the requirement of giving Traefik the rights to look IngressClasses up. Furthermore, when this option is set to true , Traefik is not able to handle Ingresses with IngressClass references, therefore such Ingresses will be ignored. Please note that annotations are not affected by this option. File (YAML) providers: kubernetesIngress: disableIngressClassLookup: true # ... File (TOML) [providers.kubernetesIngress] disableIngressClassLookup = true # ... CLI --providers.kubernetesingress.disableingressclasslookup=true disableClusterScopeResources &para; Optional, Default: false When this parameter is set to true , Traefik will not discover cluster scope resources ( IngressClass and Nodes ). By doing so, it alleviates the requirement of giving Traefik the rights to look up for cluster resources. Furthermore, Traefik will not handle Ingresses with IngressClass references, therefore such Ingresses will be ignored (please note that annotations are not affected by this option). This will also prevent from using the NodePortLB options on services. File (YAML) providers: kubernetesIngress: disableClusterScopeResources: true # ... File (TOML) [providers.kubernetesIngress] disableClusterScopeResources = true # ... CLI --providers.kubernetesingress.disableClusterScopeResources=true ingressEndpoint &para; hostname &para; Optional, Default: "" Hostname used for Kubernetes Ingress endpoints. File (YAML) providers: kubernetesIngress: ingressEndpoint: hostname: "example.net" # ... File (TOML) [providers.kubernetesIngress.ingressEndpoint] hostname = "example.net" # ... CLI --providers.kubernetesingress.ingressendpoint.hostname=example.net ip &para; Optional, Default: "" This IP will get copied to Ingress status.loadbalancer.ip , and currently only supports one IP value (IPv4 or IPv6). File (YAML) providers: kubernetesIngress: ingressEndpoint: ip: "1.2.3.4" # ... File (TOML) [providers.kubernetesIngress.ingressEndpoint] ip = "1.2.3.4" # ... CLI --providers.kubernetesingress.ingressendpoint.ip=1.2.3.4 publishedService &para; Optional, Default: "" Format: namespace/servicename . The Kubernetes service to copy status from, depending on the service type: ClusterIP: The ExternalIPs of the service will be propagated to the ingress status. NodePort: The ExternalIP addresses of the nodes in the cluster will be propagated to the ingress status. LoadBalancer: The IPs from the service's loadBalancer.status field (which contains the endpoints provided by the load balancer) will be propagated to the ingress status. When using third-party tools such as External-DNS, this option enables the copying of external service IPs to the ingress resources. File (YAML) providers: kubernetesIngress: ingressEndpoint: publishedService: "namespace/foo-service" # ... File (TOML) [providers.kubernetesIngress.ingressEndpoint] publishedService = "namespace/foo-service" # ... CLI --providers.kubernetesingress.ingressendpoint.publishedservice=namespace/foo-service throttleDuration &para; Optional, Default: 0 The throttleDuration option defines how often the provider is allowed to handle events from Kubernetes. This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration. If left empty, the provider does not apply any throttling and does not drop any Kubernetes events. The value of throttleDuration should be provided in seconds or as a valid duration format, see time.ParseDuration . File (YAML) providers: kubernetesIngress: throttleDuration: "10s" # ... File (TOML) [providers.kubernetesIngress] throttleDuration = "10s" # ... CLI --providers.kubernetesingress.throttleDuration=10s allowEmptyServices &para; Optional, Default: false If the parameter is set to true , it allows the creation of an empty servers load balancer if the targeted Kubernetes service has no endpoints available. This results in 503 HTTP responses instead of 404 ones. File (YAML) providers: kubernetesIngress: allowEmptyServices: true # ... File (TOML) [providers.kubernetesIngress] allowEmptyServices = true # ... CLI --providers.kubernetesingress.allowEmptyServices=true allowExternalNameServices &para; Optional, Default: false If the parameter is set to true , Ingresses are able to reference ExternalName services. File (YAML) providers: kubernetesIngress: allowExternalNameServices: true # ... File (TOML) [providers.kubernetesIngress] allowExternalNameServices = true # ... CLI --providers.kubernetesingress.allowexternalnameservices=true nativeLBByDefault &para; Optional, Default: false Defines whether to use Native Kubernetes load-balancing mode by default. For more information, please check out the traefik.ingress.kubernetes.io/service.nativelb service annotation documentation . File (YAML) providers: kubernetesIngress: nativeLBByDefault: true # ... File (TOML) [providers.kubernetesIngress] nativeLBByDefault = true # ... CLI --providers.kubernetesingress.nativeLBByDefault=true strictPrefixMatching &para; Optional, Default: false Make prefix matching strictly comply with the Kubernetes Ingress specification (path-element-wise matching instead of character-by-character string matching). For example, a PathPrefix of /foo will match /foo , /foo/ , and /foo/bar but not /foobar . File (YAML) providers: kubernetesIngress: strictPrefixMatching: true # ... File (TOML) [providers.kubernetesIngress] strictPrefixMatching = true # ... CLI --providers.kubernetesingress.strictPrefixMatching=true Further &para; To learn more about the various aspects of the Ingress specification that Traefik supports, many examples of Ingresses definitions are located in the test examples of the Traefik repository. Using Traefik OSS in Production? If you are using Traefik at work, consider adding enterprise-grade API gateway capabilities or commercial support for Traefik OSS. Watch our API Gateway Demo Video Request 24/7/365 OSS Support Adding API Gateway capabilities to Traefik OSS is fast and seamless. There's no rip and replace and all configurations remain intact. See it in action via this short video . Previous Kubernetes IngressRoute Next Kubernetes Ingress NGINX Traefik Labs • Copyright &copy; 2016-2025 Made with Material for MkDocs