Traefik Proxy

Traefik Proxy is a reverse proxy and load balancer that configures itself from the platform it runs on. In Kubernetes it acts as the ingress controller: it reads Ingress, IngressRoute and Gateway API objects from the API server and turns them into live routes, so a new hostname works seconds after the object is applied. The official docs at doc.traefik.io own the full option reference.

What it is

A single Go binary, maintained by Traefik Labs, that handles HTTP, TCP and UDP. The licence is MIT. Traefik Labs also sells Traefik Hub, an API gateway and API management product that runs on the same proxy; the open-source proxy does not need it.

The current line is v3.7. v3.7.0 shipped on 2026-05-05 and the latest patch is v3.7.15 (2026-10-15), which fixed three security advisories; v3.7.14 (2026-10-06) fixed eight. The project's support table lists v3.7 as the only line with active support. v3.6 lost security support on 2026-08-16, and the v2.11 line had a security end date of 2026-09-07, though v2.11 patch releases still appeared alongside v3.7.14 and v3.7.15. The official Helm chart is at v42.0.0 (2026-10-15), a major release that requires Kubernetes v1.30 or later.

Traefik is the ingress controller that K3s installs by default. K3s ships Traefik v3 as a packaged Helm chart and lets operators change its values with a HelmChartConfig object.

Patch releases in the v3.7 line carry behaviour changes, so the migration guide matters even for patches. Recent examples:

• v3.7.15: every CONNECT request, on HTTP/1, HTTP/2 and HTTP/3, gets 501 Not Implemented. Gateway API no longer infers an HTTPS backend from port 443 or an https port name; set appProtocol: https on the Service port or attach a BackendTLSPolicy.
• v3.7.13: Upgrade: h2c and HTTP2-Settings headers are no longer forwarded (use the h2c:// backend scheme), and rootless request targets get a 400.
• v3.7.12: a new aliasHeadersStrategy entry point option replaces underscoreHeadersStrategy, which is now deprecated.
• v3.7.11: an opt-in safeNaming mode for the CRD provider changes generated names, and core.strictTLSOptions removes the fallback to default TLS options.

How it works

Traefik splits its configuration in two. Static configuration (CLI flags, a file, or Helm values) is read once at startup: entry points, providers, logging, metrics. Dynamic configuration is everything the providers discover at runtime: routers, middlewares, services and TLS settings. A change to the dynamic configuration takes effect without a restart.

A request moves through four objects:

1. An entry point is a listening port (web on 80, websecure on 443 by default in the chart).
2. A router matches the request with a rule such as Host(`app.example.com`) && PathPrefix(`/api`) and picks the TLS settings.
3. Zero or more middlewares change the request or response: redirects, headers, basic auth, forward auth, rate limits, retries, path stripping.
4. A service load-balances across the backend servers. In Kubernetes these are the pod endpoints of a Service, so Traefik sends traffic to pods directly instead of through the cluster IP (unless native load-balancing mode is set).

The providers keep that table current. In Kubernetes, four are relevant: kubernetesIngress for standard Ingress objects, kubernetesCRD for Traefik's own IngressRoute and Middleware resources, kubernetesGateway for Gateway API, and kubernetesIngressNGINX, which reads Ingress objects that use NGINX annotations as a migration path from ingress-nginx.

TLS can come from three places: certificates in Kubernetes Secrets (often issued by cert-manager), Traefik's built-in ACME client for Let's Encrypt, or an upstream proxy that terminates TLS before Traefik. The built-in ACME client stores certificates in a file, which makes it awkward with more than one replica; cert-manager is the usual choice in Kubernetes.

When to use it

Reach for it when:

• The cluster is K3s and the default ingress is good enough. It already runs, and a HelmChartConfig covers most changes.
• Routes need middlewares (redirects, headers, forward auth to an identity provider, rate limits) declared next to the app as Kubernetes objects.
• One controller should serve standard Ingress, Gateway API and legacy NGINX-annotated Ingress during a migration.
• TCP or UDP routing by SNI is needed alongside HTTP.

Skip it when:

• The platform has standardised on Envoy and its filter ecosystem.
• A cloud load balancer controller already gives what is needed (for example the AWS Load Balancer Controller with ALB features and WAF).
• A vendor-supported ingress with a support contract is a requirement and Traefik Hub is not an option.

At a glance

Core concepts

• Entry point — a port and protocol Traefik listens on, set in static configuration.
• Router — a rule plus entry points, TLS settings and middlewares.
• Middleware — a request or response transform, chained in order.
• Service — a load balancer, weighted set or mirror over backend servers.
• Provider — a source of dynamic configuration (Kubernetes, Docker, file, Consul, others).
• IngressRoute — Traefik's CRD (traefik.io/v1alpha1) for routes that need more than the Ingress spec allows.

Key facts

Item	Value
Current line	v3.7 (v3.7.15, 2026-10-15)
Licence	MIT
Helm chart	traefik/traefik v42.0.0, Kubernetes v1.30+
Default chart ports	web 8000 exposed as 80, websecure 8443 exposed as 443
Rule syntax	v3 syntax; single-level wildcards like *.example.com in Host since v3.7.0
Gateway API	Supported; v3.7.10 added Gateway API v1.6.1
Paid tier	Traefik Hub (API gateway and management)

Compared with other Kubernetes ingress options

Aspect	Traefik Proxy	ingress-nginx	Envoy Gateway
Config model	Ingress, own CRDs, Gateway API	Ingress plus annotations	Gateway API
Reloads on change	No	Config reload in NGINX	No (xDS)
Status	Active, v3.7	Retired March 2026 per Traefik's docs	Active
Licence	MIT	Apache 2.0	Apache 2.0

How to integrate

On K3s, do not edit the packaged traefik.yaml manifest; K3s overwrites it at startup. Put a HelmChartConfig next to it in the server manifests directory, or apply it with kubectl:

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    ports:
      web:
        http:
          redirections:
            entryPoint:
              to: websecure
              scheme: https
              permanent: true
      websecure:
        exposedPort: 443
        forwardedHeaders:
          trustedIPs:
            - 10.42.0.0/16   # only trust X-Forwarded-* from the pod network
    providers:
      kubernetesGateway:
        enabled: true

On any other cluster, install the chart directly:

helm repo add traefik https://traefik.github.io/charts
helm upgrade --install traefik traefik/traefik \
  --namespace traefik --create-namespace -f values.yaml

A route with a middleware, using the CRDs:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
  namespace: app
spec:
  headers:
    stsSeconds: 31536000
    contentTypeNosniff: true
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: app
  namespace: app
spec:
  entryPoints: [websecure]
  routes:
    - match: Host(`app.example.com`)
      kind: Rule
      middlewares:
        - name: security-headers
      services:
        - name: app
          port: 80
  tls:
    secretName: app-tls

To attach the same middleware to a standard Ingress, use the annotation traefik.ingress.kubernetes.io/router.middlewares: app-security-headers@kubernetescrd (namespace, a dash, the name, then the provider).

In the GL stack

Traefik v3.7.13 runs on every cluster as the ingress that K3s bundles. Each cluster's settings live in a HelmChartConfig, so the packaged chart stays as K3s ships it and the changes survive K3s restarts and upgrades.

On the management cluster, the websecure entry point is exposed on port 8444, because ports 443 and 8443 on the Mac host were already taken. Traefik serves Rancher's own ingress and the ingresses of the products, such as paiddaily.io and sagedaily.io.

No cluster opens a public port. Public traffic comes in through a Cloudflare Tunnel: the connector makes an outbound connection to Cloudflare and forwards requests to Traefik inside the cluster. Traefik then does the host and path routing as for any other request.

The running version is two patches behind v3.7.15, and both newer patches fix security advisories. The bundled Traefik version follows the K3s release, so the normal upgrade path is a K3s upgrade, not a separate chart bump.

Gotchas

• Patch releases change behaviour. v3.7.11 through v3.7.15 each carry migration notes: renamed generated routers and services, rejected CONNECT, dropped h2c upgrade headers. Read the migration guide before every patch bump, and check dashboards and alerts that key on router or service names.
• K3s overwrites its own manifest. Changes to traefik.yaml in the K3s manifests directory are lost at startup. Use HelmChartConfig.
• ServiceLB takes ports 80 and 443 on every node. On K3s, the Traefik LoadBalancer Service holds those ports on all nodes by default, so HostPort or NodePort pods cannot use them. Restrict it with the ServiceLB enablelb node label.
• Forwarded headers are not trusted by default. Behind a proxy or tunnel, client IPs in X-Forwarded-For are only kept when the sending address is in forwardedHeaders.trustedIPs. Do not set insecure: true in production.
• Cross-namespace references are off. IngressRoutes cannot use a Middleware or Service from another namespace unless providers.kubernetesCRD.allowCrossNamespace is enabled. Since v3.6.14 the Chain middleware enforces this too.
• safeNaming changes reference strings. With it enabled (v3.7.11+), @kubernetescrd references must use the namespace_name form, which breaks existing annotations.
• Gateway API CRD channel must match. Standard-channel CRDs plus experimentalChannel: true stop the Gateway provider from starting with no error logged (v3.7.10 notes).
• ACME storage and replicas. The built-in Let's Encrypt client writes certificates to a file; with several replicas, use cert-manager instead.

Risks

• Licence. MIT. The commercial features sit in Traefik Hub, a separate product, so the open-source proxy has no feature gate.
• Project health. Active: patch releases every few weeks and a published support table. The flip side is a short support window; each minor line loses active support when the next one ships, so staying current is part of the cost.
• Lock-in. IngressRoute and Middleware CRDs, plus traefik.ingress.kubernetes.io/* annotations, are Traefik-specific. Standard Ingress and Gateway API objects keep the move to another controller cheap.
• Security. The proxy is the front door, and recent patches fixed eleven advisories in two releases. Track the GitHub security advisories and keep the dashboard off public entry points.

Alternatives

• Envoy Gateway — pick it for a Gateway API-only setup built on Envoy and its filters.
• HAProxy Kubernetes Ingress Controller — pick it for HAProxy's performance profile and long-standing load-balancing features.
• Caddy — pick it outside Kubernetes for a single host with automatic HTTPS and a short config file.
• Cloud load balancer controllers — pick them when the cluster runs on a cloud and managed L7 features matter more than portability.

Related

• K3s — the distro that installs Traefik as its default ingress.
• Rancher — its UI reaches operators through a Traefik ingress on the management cluster.
• Cloudflare — the tunnel that carries public traffic to Traefik.
• cert-manager — the usual source of TLS Secrets for Traefik routes.
• Lima — the VMs the clusters run in, and the reason for the port remap on the Mac host.
• Prometheus and Grafana — where Traefik's entry point and router metrics go.
• Official: Traefik Proxy docs, v3 migration guide, Releases, K3s networking services.