---
title: "Traefik in Kubernetes | Hostman Docs"
description: "Learn how to use Traefik as an ingress controller and reverse proxy in Kubernetes for flexible traffic routing to services within the cluster. Explore our guides to learn how to deploy, configure, and optimize Traefik."
---
> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).
Traefik is an ingress controller and reverse proxy for cloud environments and Kubernetes. It automatically discovers services, provides SSL/TLS termination, and offers advanced routing capabilities. Using Traefik in Kubernetes allows flexible traffic routing to services within the cluster.
## Installation
1. Go to the **Kubernetes** section and click on the cluster.
2. Navigate to the **Addons** tab and select **Traefik**.
3. The installation wizard will open. You can upload your own `values.yaml` file for customization or keep the default settings. Start the installation by clicking the **Install** button.
4. Wait for the installation to complete. After that, make sure all pods in the **traefik** namespace are running and have the `Running` status:
```shell
kubectl get pods -n traefik
```
## Usage
By default, the installed Traefik configuration uses four entry points:
- :8000/tcp — HTTP (`web`)
- :8443/tcp — HTTPS (`websecure`)
- :8080/tcp — API Dashboard (`traefik`)
- :9100/tcp — Prometheus Metrics (`metrics`)
To work with Traefik, you need to create a `Service` that will route traffic to your application:
```yml
apiVersion: v1
kind: Service
metadata:
name: example-service
namespace: default
spec:
selector:
app: example-app
ports:
- protocol: TCP
port: 80
targetPort: 80
```
This manifest creates the `example-service` in the `default` namespace, which:
- Routes HTTP traffic (port 80).
- Directs it to pods with the label `app: example-app`.
- Forwards requests to `targetPort: 80` within the pods.
Now, you can configure routing through Traefik using `IngressRoute`:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: example-service-route
namespace: default
spec:
entryPoints:
- web
routes:
- match: Host(`service.example.com`)
kind: Rule
services:
- name: example-service
port: 80
```
In this manifest:
- `entryPoints: web` — specifies that routing occurs via HTTP (8000/tcp).
- `match: Host('service.example.com')` — defines the routing rule based on the domain name.
- Requests are directed to the `example-service` on port 80.
## Example Usage
Let's explore an example using Traefik. We will create two Nginx deployments that will work on two different domains — `service1.example.com` and `service2.example.com`. We will also configure a load balancer and routing through Traefik. Finally, we will configure SSL certificates using Traefik.
### Creating a ConfigMap
First, create the `configmap-nginx.yaml` file, which defines HTML pages for each service:
```yml
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-pages
namespace: default
data:
index1.html: |
Service 1
Service 1
index2.html: |
Service 2
Service 2
```
### Creating Deployments for Nginx
The `service1-nginx.yaml` manifest describes the deployment for the first service:
```yml
apiVersion: apps/v1
kind: Deployment
metadata:
name: service1
namespace: default
labels:
app: service1
spec:
replicas: 2
selector:
matchLabels:
app: service1
template:
metadata:
labels:
app: service1
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: html-volume
mountPath: /usr/share/nginx/html
ports:
- containerPort: 80
volumes:
- name: html-volume
configMap:
name: nginx-pages
items:
- key: index1.html
path: index.html
```
The `service2-nginx.yaml` manifest describes the deployment for the second service:
```yml
apiVersion: apps/v1
kind: Deployment
metadata:
name: service2
namespace: default
labels:
app: service2
spec:
replicas: 2
selector:
matchLabels:
app: service2
template:
metadata:
labels:
app: service2
spec:
containers:
- name: nginx
image: nginx
volumeMounts:
- name: html-volume
mountPath: /usr/share/nginx/html
ports:
- containerPort: 80
volumes:
- name: html-volume
configMap:
name: nginx-pages
items:
- key: index2.html
path: index.html
```
### Creating Services
Define the services that Traefik will route traffic to.
The `service1-service.yaml` manifest:
```yml
apiVersion: v1
kind: Service
metadata:
name: service1
namespace: default
spec:
selector:
app: service1
ports:
- protocol: TCP
port: 80
targetPort: 80
```
This manifest creates the `service1` service, which accepts HTTP requests on port 80 and redirects them to pods labeled `app: service1`.
The `service2-service.yaml` manifest:
```yml
apiVersion: v1
kind: Service
metadata:
name: service2
namespace: default
spec:
selector:
app: service2
ports:
- protocol: TCP
port: 80
targetPort: 80
```
### Creating Routes in Traefik
The `service1-ingressroute.yaml` manifest describes the route for the first service:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: service1-route
namespace: default
spec:
entryPoints:
- web
routes:
- match: Host(`service1.example.com`)
kind: Rule
services:
- name: service1
port: 80
```
This manifest defines an `IngressRoute` for `service1.example.com`. Let's break down its components:
- `entryPoints: web` — the route is available via HTTP (port 80, specified in the Traefik load balancer).
- `match: Host('service1.example.com')` — this route is triggered when accessing `service1.example.com`.
- `name: service1` — the route forwards traffic to the `service1` service.
- `port: 80` — traffic is sent to port 80 inside the `service1` Kubernetes service.
The `service2-ingressroute.yaml` manifest describes the route for the second service:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: service2-route
namespace: default
spec:
entryPoints:
- web
routes:
- match: Host(`service2.example.com`)
kind: Rule
services:
- name: service2
port: 80
```
### Configuring the Load Balancer
Define the load balancer for Traefik in `traefik-loadbalancer.yaml`:
```yml
apiVersion: v1
kind: Service
metadata:
name: traefik
namespace: traefik
spec:
type: LoadBalancer
selector:
app.kubernetes.io/name: traefik
ports:
- name: web
port: 80
targetPort: 8000
- name: websecure
port: 443
targetPort: 8443
```
### Applying the Configuration
Apply all manifests:
```shell
kubectl apply -f ./
```
After creating the load balancer, set its IP address as the A records for the domains. Now, the services are accessible at:
- `http://service1.example.com`
- `http://service2.example.com`
We have configured two services in Kubernetes using Traefik, ensuring routing and load balancing.
## Configuring SSL
Traefik allows obtaining SSL certificates in two ways:
- Using built-in Traefik features.
- Using [cert-manager](https://hostman.com/docs/kubernetes/addons/cert-manager/).
The choice depends on the cluster configuration. If other Ingress controllers are used, `cert-manager` is recommended for centralized certificate management. If only Traefik is used in the cluster, you can utilize its built-in certificate retrieval feature.
### Updating Traefik Configuration
To enable Let's Encrypt support, modify the Traefik configuration:
1. Go to the cluster management panel → **Addons** → select **Traefik**.
2. Enable the **Advanced setup** mode.
3. Adjust the configuration:
```yml
image:
registry: docker.io
deployment:
kind: Deployment
updateStrategy:
rollingUpdate:
maxUnavailable: 1
maxSurge: 0
additionalArguments:
- "--certificatesresolvers.le.acme.email=admin@example.com"
- "--certificatesresolvers.le.acme.storage=/data/acme.json"
- "--certificatesresolvers.le.acme.tlschallenge=true"
```
Changes made:
- - By default, Traefik is installed as a `DaemonSet`. In this mode, it cannot obtain certificates using Traefik. Therefore, the deployment type is changed to `Deployment`.
- Added the `additionalArguments` segment. Set your email for Let's Encrypt registration in `--certificatesresolvers.le.acme.email`.
4. Save the changes and wait for the update to complete.
### Verifying Configuration
After updating, ensure the configuration is correctly applied:
```shell
kubectl get pod -n traefik
```
Then, check for ACME parameters:
```shell
kubectl get pod -n traefik -o yaml | grep acme
```
The output should contain lines like:
```shell
- --certificatesresolvers.le.acme.email=admin@example.com
- --certificatesresolvers.le.acme.storage=/data/acme.json
- --certificatesresolvers.le.acme.tlschallenge=true
```
### Automatic Redirect from HTTP to HTTPS
Create a middleware for automatic redirection from HTTP to HTTPS.
**redirect-https.yaml**:
```yml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: redirect-to-https
namespace: default
spec:
redirectScheme:
scheme: https
permanent: true
```
Apply the manifest:
```shell
kubectl apply -f redirect-https.yaml
```
### Updating IngressRoute
Update `IngressRoute` to add middleware for redirecting HTTP to HTTPS.
The `service1-ingressroute.yaml` manifest:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: service1-route
namespace: default
spec:
entryPoints:
- web
routes:
- match: Host(`service1.example.com`)
kind: Rule
middlewares:
- name: redirect-to-https
services:
- name: service1
port: 80
```
The `service2-ingressroute.yaml` manifest:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: service2-route
namespace: default
spec:
entryPoints:
- web
routes:
- match: Host(`service2.example.com`)
kind: Rule
middlewares:
- name: redirect-to-https
services:
- name: service2
port: 80
```
We have added the middleware `redirect-to-https` to the routing manifests `service1-ingressroute.yaml`, which automatically redirects HTTP requests to HTTPS.
Update the manifests:
```shell
kubectl apply -f service1-ingressroute.yaml
kubectl apply -f service2-ingressroute.yaml
```
### Configuring HTTPS IngressRoute
Now we need to create separate `IngressRoute` resources for HTTPS since standard HTTP routes do not handle TLS. For HTTPS to work, we need to specify a `certResolver`, which will use Let's Encrypt to automatically obtain certificates.
In the new `IngressRoute`, we specify the `entryPoints: websecure` and the `tls` parameter, which enables encryption support.
The `service1-ingressroute-https.yaml` manifest:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: service1-route-https
namespace: default
spec:
entryPoints:
- websecure
routes:
- match: Host(`service1.example.com`)
kind: Rule
services:
- name: service1
port: 80
tls:
certResolver: le
```
The `service2-ingressroute-https.yaml` manifest:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: service2-route-https
namespace: default
spec:
entryPoints:
- websecure
routes:
- match: Host(`service2.example.com`)
kind: Rule
services:
- name: service2
port: 80
tls:
certResolver: le
```
Apply the manifests for the new routes:
```shell
kubectl apply -f service1-ingressroute-https.yaml
kubectl apply -f service2-ingressroute-https.yaml
```
### Checking Certificate Issuance
Verify certificate issuance with:
```shell
kubectl logs -n traefik -l app.kubernetes.io/name=traefik | grep acme
```
Now, services are accessible via HTTPS:
- `https://service1.example.com`
- `https://service2.example.com`
We have configured automatic SSL certificate issuance with Let's Encrypt in Traefik, ensuring secure connections to services.
## Configuring the Dashboard
Traefik provides a web interface that allows you to monitor the status of routes, services, middleware, and other resources managed by the Traefik instance. The dashboard helps diagnose issues, analyze traffic routing, and manage configuration.
By default, the Traefik dashboard is accessible without authentication, which poses a security risk since any user can view information about running services. To secure access, we will configure basic authentication using `middleware`.
1. Generate a password hash:
```shell
mkpasswd -m bcrypt "password"
```
2. Encode the credentials in base64:
```shell
echo -n 'username:generated_hash' | base64
```
3. Define a secret in `dashboard-secret.yaml`:
```yml
apiVersion: v1
kind: Secret
metadata:
name: dashboard-auth-secret
namespace: traefik
type: Opaque
data:
users: |
login:base64_encoded_password
```
4. Apply the manifest:
```shell
kubectl apply -f dashboard-secret.yaml
```
5. Define middleware in `dashboard-auth.yaml`:
```yml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: dashboard-auth
namespace: traefik
spec:
basicAuth:
secret: dashboard-auth-secret
```
6. Apply the manifest:
```shell
kubectl apply -f dashboard-auth.yaml
```
7. Finally, define `IngressRoute` for the dashboard in `dashboard-ingress.yaml`:
```yml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard
namespace: traefik
spec:
entryPoints:
- websecure
routes:
- match: Host(`dashboard.example.com`)
kind: Rule
middlewares:
- name: dashboard-auth
services:
- kind: TraefikService
name: api@internal
tls:
certResolver: le
```
This manifest defines a route for accessing the Traefik dashboard via HTTPS, applying basic authentication.
Parameters description:
- - `entryPoints: websecure` — specifies that the route will only be accessible via HTTPS.
- `match: Host(dashboard.example.com)` — directs requests received for `dashboard.example.com` to the dashboard.
- `middlewares` — applies the previously created `dashboard-auth` middleware, which enables basic HTTP authentication.
- `services` — directs requests to the built-in `api@internal` service, responsible for displaying the dashboard.
- `tls.certResolver: le` — enables automatic SSL certificate issuance via Let's Encrypt.
8. Apply the manifest:
```shell
kubectl apply -f dashboard-ingress.yaml
```
9. Now, visit `https://dashboard.example.com`. After authentication, you will see the Traefik dashboard.