instruction: How do you configure advanced Kubernetes ingress patterns?
output: Kubernetes Ingress Routing Configuration - Traefik Skip to content Initializing search Product Documentation Traefik Hub Kubernetes-Native API Management Traefik Enterprise The API Gateway Cloud Natives Trust Initializing search Traefik GitHub What is Traefik Getting Started Getting Started Overview Quick Start Quick Start Kubernetes Docker Configuration Introduction Frequently Asked Questions Setup Setup Kubernetes Docker Swarm Expose Expose Overview Kubernetes Docker Swarm Observe Observe Overview Logs & Access Logs Metrics Tracing Extend Migrate Migrate Traefik v3 Traefik v2 to v3 Traefik v2 to v3 Migration guide Configuration changes for v3 Traefik v2 Traefik v1 to v2 Configuration Discovery Configuration Discovery Overview Docker Swarm Kubernetes IngressRoute Kubernetes Ingress Kubernetes Ingress NGINX Kubernetes Gateway API Consul Catalog Nomad ECS File Consul Etcd ZooKeeper Redis HTTP Routing & Load Balancing Routing & Load Balancing Overview EntryPoints Routers Services Providers Providers Docker Swarm Kubernetes IngressRoute Kubernetes Ingress Kubernetes Ingress Table of contents Routing Configuration Configuration Example Annotations On Ingress On Service Stickiness and load-balancing Path Types on Kubernetes 1.18+ TLS Enabling TLS via HTTP Options on Entrypoint Enabling TLS via Annotations Certificates Management Communication Between Traefik and Pods Global Default Backend Ingresses Kubernetes Ingress NGINX Kubernetes Gateway API Consul Catalog Nomad ECS KV HTTPS & TLS HTTPS & TLS Overview TLS Let's Encrypt Tailscale SPIFFE OCSP Middlewares Middlewares Overview HTTP HTTP Overview AddPrefix BasicAuth Buffering Chain CircuitBreaker Compress ContentType DigestAuth Errors ForwardAuth GrpcWeb Headers IPWhiteList IPAllowList InFlightReq PassTLSClientCert RateLimit RedirectRegex RedirectScheme ReplacePath ReplacePathRegex Retry StripPrefix StripPrefixRegex TCP TCP Overview InFlightConn IPWhiteList IPAllowList Plugins & Plugin Catalog Operations Operations CLI Dashboard API Ping Observability Observability Overview Logs Access Logs Metrics Metrics Overview Datadog InfluxDB2 OpenTelemetry Prometheus StatsD Tracing Tracing Overview OpenTelemetry Security Security Content-Length TLS in Multi-Tenant Kubernetes User Guides User Guides FastProxy Kubernetes and Let's Encrypt Kubernetes and cert-manager gRPC Examples WebSocket Examples Docker Docker Basic Example HTTPS with Let's Encrypt HTTPS with Let's Encrypt TLS Challenge HTTP Challenge DNS Challenge Contributing Contributing Thank You! Submitting Issues Submitting PRs Security Building and Testing Documentation Data Collection Advocating Maintainers Reference Reference Install Configuration Install Configuration Boot Environment Configuration Discovery Configuration Discovery Overview Kubernetes Kubernetes Kubernetes Gateway API Kubernetes CRD Kubernetes Ingress Kubernetes Ingress NGINX Docker Swarm Hashicorp Hashicorp Nomad Consul Consul Catalog KV Stores KV Stores Redis Consul etcd ZooKeeper Others Others File ECS HTTP EntryPoints API & Dashboard TLS TLS Certificate Resolvers Certificate Resolvers Overview ACME Tailscale SPIFFE OCSP Observability Observability Metrics Tracing Logs & AccessLogs Health Check (CLI & Ping) Routing Configuration Routing Configuration General General Configuration Methods HTTP HTTP Router Router Rules & Priority Observability Load Balancing Load Balancing Service ServersTransport TLS TLS Overview TLS Certificates TLS Options Middlewares Middlewares Overview AddPrefix APIKey BasicAuth Buffering Chain Circuit Breaker Compress ContentType DigestAuth Errors ForwardAuth GrpcWeb Headers HMAC IPAllowList InFlightReq JWT LDAP Token Introspection Client Credentials OIDC OPA PassTLSClientCert RateLimit RedirectRegex RedirectScheme ReplacePath ReplacePathRegex Retry StripPrefix StripPrefixRegex WAF TCP TCP Router Router Rules & Priority Service ServersTransport TLS Middlewares Middlewares Overview InFlightConn IPAllowList UDP UDP Router Router Rules & Priority Service Kubernetes Kubernetes Gateway API Kubernetes CRD Kubernetes CRD HTTP HTTP IngressRoute TraefikService ServersTransport Middleware TLSOption TLSStore TCP TCP IngressRouteTCP ServersTransportTCP MiddlewareTCP TLSOption TLSStore UDP UDP IngressRouteUDP Ingress Ingress NGINX Label & Tag Providers Label & Tag Providers Docker Swarm Consul Catalog Nomad ECS KV Deprecation Notices Deprecation Notices Releases Features GitHub Table of contents Routing Configuration Configuration Example Annotations On Ingress On Service Stickiness and load-balancing Path Types on Kubernetes 1.18+ TLS Enabling TLS via HTTP Options on Entrypoint Enabling TLS via Annotations Certificates Management Communication Between Traefik and Pods Global Default Backend Ingresses Traefik &amp; Kubernetes &para; The Kubernetes Ingress Controller. Routing Configuration &para; The provider then watches for incoming ingresses events, such as the example below, and derives the corresponding dynamic configuration from it, which in turn will create the resulting routers, services, handlers, etc. Configuration Example &para; Configuring Kubernetes Ingress Controller RBAC --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: traefik-ingress-controller rules: - apiGroups: - "" resources: - services - secrets verbs: - get - list - watch - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses - ingressclasses verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses/status verbs: - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: traefik-ingress-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controller subjects: - kind: ServiceAccount name: traefik-ingress-controller namespace: default Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: myingress annotations: traefik.ingress.kubernetes.io/router.entrypoints: web spec: rules: - host: example.com http: paths: - path: /bar pathType: Exact backend: service: name: whoami port: number: 80 - path: /foo pathType: Exact backend: service: name: whoami port: number: 80 Traefik apiVersion: v1 kind: ServiceAccount metadata: name: traefik-ingress-controller --- apiVersion: apps/v1 kind: Deployment metadata: name: traefik labels: app: traefik spec: replicas: 1 selector: matchLabels: app: traefik template: metadata: labels: app: traefik spec: serviceAccountName: traefik-ingress-controller containers: - name: traefik image: traefik:v3.5 args: - --entryPoints.web.address=:80 - --providers.kubernetesingress ports: - name: web containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: traefik spec: type: LoadBalancer selector: app: traefik ports: - protocol: TCP port: 80 name: web targetPort: 80 Whoami apiVersion: apps/v1 kind: Deployment metadata: name: whoami labels: app: traefiklabs name: whoami spec: replicas: 2 selector: matchLabels: app: traefiklabs task: whoami template: metadata: labels: app: traefiklabs task: whoami spec: containers: - name: whoami image: traefik/whoami ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: whoami spec: ports: - name: http port: 80 selector: app: traefiklabs task: whoami Annotations &para; Referencing resources in annotations In an annotation, when referencing a resource defined by another provider, the provider namespace syntax must be used. On Ingress &para; traefik.ingress.kubernetes.io/router.entrypoints See entry points for more information. traefik.ingress.kubernetes.io/router.entrypoints: ep1,ep2 traefik.ingress.kubernetes.io/router.middlewares See middlewares and middlewares overview for more information. traefik.ingress.kubernetes.io/router.middlewares: auth@file,default-prefix@kubernetescrd traefik.ingress.kubernetes.io/router.priority See priority for more information. traefik.ingress.kubernetes.io/router.priority: "42" traefik.ingress.kubernetes.io/router.rulesyntax Warning RuleSyntax option is deprecated and will be removed in the next major version. Please do not use this field and rewrite the router rules to use the v3 syntax. See rule syntax for more information. traefik.ingress.kubernetes.io/router.rulesyntax: "v2" traefik.ingress.kubernetes.io/router.pathmatcher Overrides the default router rule type used for a path. Only path-related matcher name should be specified: Path , PathPrefix or PathRegexp . Default PathPrefix traefik.ingress.kubernetes.io/router.pathmatcher: Path traefik.ingress.kubernetes.io/router.tls See tls for more information. traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.tls.certresolver See certResolver for more information. traefik.ingress.kubernetes.io/router.tls.certresolver: myresolver traefik.ingress.kubernetes.io/router.tls.domains.n.main See domains for more information. traefik.ingress.kubernetes.io/router.tls.domains.0.main: example.org traefik.ingress.kubernetes.io/router.tls.domains.n.sans See domains for more information. traefik.ingress.kubernetes.io/router.tls.domains.0.sans: test.example.org,dev.example.org traefik.ingress.kubernetes.io/router.tls.options See options for more information. traefik.ingress.kubernetes.io/router.tls.options: foobar@file traefik.ingress.kubernetes.io/router.observability.accesslogs See accesslogs option for more information. traefik.ingress.kubernetes.io/router.observability.accesslogs: true traefik.ingress.kubernetes.io/router.observability.metrics See metrics option for more information. traefik.ingress.kubernetes.io/router.observability.metrics: true traefik.ingress.kubernetes.io/router.observability.tracing See tracing option for more information. traefik.ingress.kubernetes.io/router.observability.tracing: true On Service &para; traefik.ingress.kubernetes.io/service.nativelb Controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. The Kubernetes Service itself does load-balance to the pods. Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set. By default, NativeLB is false. traefik.ingress.kubernetes.io/service.nativelb: "true" traefik.ingress.kubernetes.io/service.nodeportlb Controls, when creating the load-balancer, whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. By default, NodePortLB is false. traefik.ingress.kubernetes.io/service.nodeportlb: "true" traefik.ingress.kubernetes.io/service.serversscheme Overrides the default scheme. traefik.ingress.kubernetes.io/service.serversscheme: h2c traefik.ingress.kubernetes.io/service.serverstransport See ServersTransport for more information. traefik.ingress.kubernetes.io/service.serverstransport: foobar@file traefik.ingress.kubernetes.io/service.passhostheader See pass Host header for more information. traefik.ingress.kubernetes.io/service.passhostheader: "true" traefik.ingress.kubernetes.io/service.sticky.cookie See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie: "true" traefik.ingress.kubernetes.io/service.sticky.cookie.name See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie.name: foobar traefik.ingress.kubernetes.io/service.sticky.cookie.secure See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie.secure: "true" traefik.ingress.kubernetes.io/service.sticky.cookie.samesite See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie.samesite: "none" traefik.ingress.kubernetes.io/service.sticky.cookie.domain See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie.domain: "foo.com" traefik.ingress.kubernetes.io/service.sticky.cookie.httponly See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie.httponly: "true" traefik.ingress.kubernetes.io/service.sticky.cookie.maxage See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie.maxage: 42 traefik.ingress.kubernetes.io/service.sticky.cookie.path See sticky sessions for more information. traefik.ingress.kubernetes.io/service.sticky.cookie.path: /foobar Stickiness and load-balancing &para; When stickiness is enabled, Traefik uses Kubernetes serving endpoints status to detect and mark servers as fenced. Fenced servers can still process requests tied to sticky cookies, while they are terminating. Path Types on Kubernetes 1.18+ &para; If the Kubernetes cluster version is 1.18+, the new pathType property can be leveraged to define the rules matchers: Exact : This path type forces the rule matcher to Path Prefix : This path type forces the rule matcher to PathPrefix . Note that if you want the matching behavior to strictly comply with Kubernetes Ingress specification (request path is matched on an element-by-element basis), consider enabling strictPrefixMatching in the Ingress Provider configuration. Please see this documentation for more information. Multiple Matches In the case of multiple matches, Traefik will not ensure the priority of a Path matcher over a PathPrefix matcher, as stated in this documentation . TLS &para; Enabling TLS via HTTP Options on Entrypoint &para; TLS can be enabled through the HTTP options of an Entrypoint: CLI # Static configuration --entryPoints.websecure.address=:443 --entryPoints.websecure.http.tls File (YAML) # Static configuration entryPoints: websecure: address: ':443' http: tls: {} File (TOML) # Static configuration [entryPoints.websecure] address = ":443" [entryPoints.websecure.http.tls] This way, any Ingress attached to this Entrypoint will have TLS termination by default. Configuring Kubernetes Ingress Controller with TLS on Entrypoint RBAC --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: traefik-ingress-controller rules: - apiGroups: - "" resources: - services - secrets verbs: - get - list - watch - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses - ingressclasses verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses/status verbs: - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: traefik-ingress-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controller subjects: - kind: ServiceAccount name: traefik-ingress-controller namespace: default Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: myingress annotations: traefik.ingress.kubernetes.io/router.entrypoints: websecure spec: rules: - host: example.com http: paths: - path: /bar pathType: Exact backend: service: name: whoami port: number: 80 - path: /foo pathType: Exact backend: service: name: whoami port: number: 80 Traefik apiVersion: v1 kind: ServiceAccount metadata: name: traefik-ingress-controller --- apiVersion: apps/v1 kind: Deployment metadata: name: traefik labels: app: traefik spec: replicas: 1 selector: matchLabels: app: traefik template: metadata: labels: app: traefik spec: serviceAccountName: traefik-ingress-controller containers: - name: traefik image: traefik:v3.5 args: - --entryPoints.websecure.address=:443 - --entryPoints.websecure.http.tls - --providers.kubernetesingress ports: - name: websecure containerPort: 443 --- apiVersion: v1 kind: Service metadata: name: traefik spec: type: LoadBalancer selector: app: traefik ports: - protocol: TCP port: 443 name: websecure targetPort: 443 Whoami apiVersion: apps/v1 kind: Deployment metadata: name: whoami labels: app: traefiklabs name: whoami spec: replicas: 2 selector: matchLabels: app: traefiklabs task: whoami template: metadata: labels: app: traefiklabs task: whoami spec: containers: - name: whoami image: traefik/whoami ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: whoami spec: ports: - name: http port: 80 selector: app: traefiklabs task: whoami Enabling TLS via Annotations &para; To enable TLS on the underlying router created from an Ingress, one should configure it through annotations: traefik.ingress.kubernetes.io/router.tls: "true" For more options, please refer to the available annotations . Configuring Kubernetes Ingress Controller with TLS RBAC --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: traefik-ingress-controller rules: - apiGroups: - "" resources: - services - secrets verbs: - get - list - watch - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses - ingressclasses verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses/status verbs: - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: traefik-ingress-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: traefik-ingress-controller subjects: - kind: ServiceAccount name: traefik-ingress-controller namespace: default Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: myingress annotations: traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.tls: true spec: rules: - host: example.com http: paths: - path: /bar pathType: Exact backend: service: name: whoami port: number: 80 - path: /foo pathType: Exact backend: service: name: whoami port: number: 80 Traefik apiVersion: v1 kind: ServiceAccount metadata: name: traefik-ingress-controller --- apiVersion: apps/v1 kind: Deployment metadata: name: traefik labels: app: traefik spec: replicas: 1 selector: matchLabels: app: traefik template: metadata: labels: app: traefik spec: serviceAccountName: traefik-ingress-controller containers: - name: traefik image: traefik:v3.5 args: - --entryPoints.websecure.address=:443 - --providers.kubernetesingress ports: - name: websecure containerPort: 443 --- apiVersion: v1 kind: Service metadata: name: traefik spec: type: LoadBalancer selector: app: traefik ports: - protocol: TCP port: 443 name: websecure targetPort: 443 Whoami apiVersion: apps/v1 kind: Deployment metadata: name: whoami labels: app: traefiklabs name: whoami spec: replicas: 2 selector: matchLabels: app: traefiklabs task: whoami template: metadata: labels: app: traefiklabs task: whoami spec: containers: - name: whoami image: traefik/whoami ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: whoami spec: ports: - name: http port: 80 selector: app: traefiklabs task: whoami Certificates Management &para; Using a secret Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: foo namespace: production spec: rules: - host: example.net http: paths: - path: /bar pathType: Exact backend: service: name: service1 port: number: 80 # Only selects which certificate(s) should be loaded from the secret, in order to terminate TLS. # Doesn't enable TLS for that ingress (hence for the underlying router). # Please see the TLS annotations on ingress made for that purpose. tls: - secretName: supersecret Secret apiVersion: v1 kind: Secret metadata: name: supersecret data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0= tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0= TLS certificates can be managed in Secrets objects. Info Only TLS certificates provided by users can be stored in Kubernetes Secrets. Let's Encrypt certificates cannot be managed in Kubernetes Secrets yet. Communication Between Traefik and Pods &para; Routing directly to Kubernetes services To route directly to the Kubernetes service, one can use the traefik.ingress.kubernetes.io/service.nativelb annotation on the Kubernetes service. It controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. One alternative is to use an ExternalName service to forward requests to the Kubernetes service through DNS. To do so, one must allow external name services . Traefik automatically requests endpoint information based on the service provided in the ingress spec. Although Traefik will connect directly to the endpoints (pods), it still checks the service port to see if TLS communication is required. There are 3 ways to configure Traefik to use HTTPS to communicate with pods: If the service port defined in the ingress spec is 443 (note that you can still use targetPort to use a different port on your pod). If the service port defined in the ingress spec has a name that starts with https (such as https-api , https-web or just https ). If the service spec includes the annotation traefik.ingress.kubernetes.io/service.serversscheme: https . If either of those configuration options exist, then the backend communication protocol is assumed to be TLS, and will connect via TLS automatically. Info Please note that by enabling TLS communication between traefik and your pods, you will have to have trusted certificates that have the proper trust chain and IP subject name. If this is not an option, you may need to skip TLS certificate verification. See the insecureSkipVerify setting for more details. Global Default Backend Ingresses &para; Ingresses can be created that look like the following: Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: cheese spec: defaultBackend: service: name: stilton port: number: 80 This ingress follows the Global Default Backend property of ingresses. This will allow users to create a "default router" that will match all unmatched requests. Info Due to Traefik's use of priorities, you may have to set this ingress priority lower than other ingresses in your environment, to avoid this global ingress from satisfying requests that could match other ingresses. To do this, use the traefik.ingress.kubernetes.io/router.priority annotation (as seen in Annotations on Ingress ) on your ingresses accordingly. Using Traefik OSS in Production? If you are using Traefik at work, consider adding enterprise-grade API gateway capabilities or commercial support for Traefik OSS. Watch our API Gateway Demo Video Request 24/7/365 OSS Support Adding API Gateway capabilities to Traefik OSS is fast and seamless. There's no rip and replace and all configurations remain intact. See it in action via this short video . Previous Kubernetes IngressRoute Next Kubernetes Ingress NGINX Traefik Labs • Copyright &copy; 2016-2025 Made with Material for MkDocs