![\"Traefik](\"https:\/\/accuweb.cloud\/blog\/wp-content\/uploads\/2024\/06\/Traefik-V2-Ingress-Controller.png\" "\\"Traefik")
<\/a><\/p>\nTL;DR<\/h3>\n\n- Traefik v2<\/strong> is a modern Ingress controller for Kubernetes that automatically routes and balances traffic to services.<\/li>\n
- It supports dynamic configuration<\/strong>, discovering services without manual reloads, making deployments smoother.<\/li>\n
- Traefik handles SSL\/TLS termination<\/strong>, enabling secure HTTPS traffic with Let\u2019s Encrypt integration.<\/li>\n
- Built-in load balancing<\/strong> distributes requests across multiple service pods for high availability.<\/li>\n
- Middleware features<\/strong> in Traefik allow flexible request modifications, rate limiting, retries, and redirects.<\/li>\n
- Metrics and dashboards give real-time visibility into traffic, helping monitor performance and health.<\/li>\n<\/ul>\n<\/div>\n
When deploying applications in Kubernetes, an Ingress Controller<\/b> plays a crucial role in managing external access to services. At AccuWeb.Cloud, you can choose from popular ingress controllers like NGINX, Traefik, or HAProxy<\/b>.<\/p>\n
In this blog, we\u2019ll dive into Traefik v2<\/b>, the modern version of Traefik, and explore its updates and advantages in the AccuWeb.Cloud Kubernetes Service (AK8s)<\/b>.
\n![\"Traefik](\"https:\/\/accuweb.cloud\/blog\/wp-content\/uploads\/2024\/06\/Traefik-Dashboard-min.png\" "\\"Traefik")
<\/a><\/p>\nWhy Traefik for Kubernetes?<\/h2>\n
Traefik is a cloud-native reverse proxy and load balancer<\/b> designed to integrate seamlessly with containerized environments. It automatically discovers services, handles routing, and provides advanced features like:<\/p>\n\n- Automatic HTTPS (via Let\u2019s Encrypt)<\/b><\/li>\n
- Dynamic service discovery<\/b><\/li>\n
- Native Kubernetes CRD support<\/b><\/li>\n
- Load balancing and sticky sessions<\/b><\/li>\n
- Metrics and observability integration (Prometheus, Grafana)<\/b><\/li>\n<\/ul>\n
This makes Traefik a perfect fit for modern microservices and cloud-native apps.<\/p>\n
No Frontends and Backends<\/h2>\n
The basic concepts of frontend and backend have changed to routers, services, and middleware in Traefik v2.<\/p>\n
In Traefik v1, the router replaces the frontend, and the service replaces the backend, with each router connected to a service.<\/p>\n
In Traefik v2, middleware pieces are added to routers to adjust requests before they reach the services. These middleware pieces can be linked together to handle different scenarios, and any router can connect to any middleware instance.<\/p>\n
Middleware<\/h2>\n
There are many types of middleware<\/a> available. In addition to handling traditional HTTP requests, different middleware can modify request parameters and HTTP headers, manage redirects, add authentication, and more.<\/p>\n![\"Middleware\"](\"https:\/\/accuweb.cloud\/blog\/wp-content\/uploads\/2024\/06\/Middleware.png\" "\\"Middleware\\"")
<\/a><\/p>\nThe middleware attached to a router can modify a request before it is sent to the service.<\/p>\n
Here are some examples of middleware used in request routing:<\/p>\n
\n- stripPrefix:<\/strong> Removes a prefix from the path. Use this if your backend serves the path “\/”, but needs to be accessed with a specific prefix, like “\/foo”. This middleware replaces the frontend.rule.type annotation in Traefik v1.<\/li>\n<\/ul>\n
http:\r\n\u00a0\u00a0middlewares:\r\n\u00a0\u00a0\u00a0\u00a0test-stripprefix:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0stripPrefix:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0prefixes:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \"\/foo\"<\/code><\/pre>\n![\"StripPrefix\"](\"https:\/\/accuweb.cloud\/blog\/wp-content\/uploads\/2024\/06\/StripPrefix.png\" "\\"StripPrefix\\"")
<\/a><\/p>\n\n- basicAuth<\/strong> middleware is used to set up basic authorization. For example:<\/li>\n<\/ul>\n
http:\r\n\u00a0\u00a0middlewares:\r\n\u00a0\u00a0\u00a0\u00a0test-auth:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0basicAuth:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0users:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \"user1:$apr1$Kveg6cv0$yJn5mwyfBy7luzZ9Fi1AH0\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \"user2:$apr1$w70ASLDx$1UJmrFL\/lVoltjmAz4UDH\/\"<\/code><\/pre>\nThis middleware is an alternative to using Kubernetes Secrets<\/a> for credentials and restricts access to services.<\/p>\n![\"BasicAuth\"](\"https:\/\/accuweb.cloud\/blog\/wp-content\/uploads\/2024\/06\/BasicAuth.png\" "\\"BasicAuth\\"")
<\/a><\/p>\nIt replaces the Traefik v1 annotation.<\/p>\n
\r\ntraefik.ingress.kubernetes.io\/auth-type: \"basic\".<\/code><\/pre>\n<\/div>\n\nRegister Now \u2192<\/a><\/div>\n<\/div>\n<\/div>\nUsing Multiple Middlewares<\/h2>\n
Using middleware (and other routing components) is optional. You can use multiple middleware or none at all. For example, in the Ingress below, one middleware handles authentication, and another removes a source path prefix.<\/p>\n
---\r\napiVersion: networking.k8s.io\/v1\r\nkind: Ingress\r\nmetadata:\r\n\u00a0\u00a0name: monitoring-prometheus-alertmanager\r\n\u00a0\u00a0namespace: kubernetes-monitoring\r\n\u00a0\u00a0annotations:\r\n\u00a0\u00a0\u00a0\u00a0kubernetes.io\/ingress.class: traefik\r\n\u00a0\u00a0\u00a0\u00a0traefik.ingress.kubernetes.io\/router.middlewares:\u00a0\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0kubernetes-monitoring-alert-auth@kubernetescrd,\u00a0\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0kubernetes-monitoring-alert-prefix@kubernetescrd\r\nspec:\r\n\u00a0\u00a0rules:\r\n\u00a0\u00a0- http:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0paths:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- path: \/prometheus-alert\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0pathType: Prefix\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0backend:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0service:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0name: monitoring-prometheus-alertmanager\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0port:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0number: 80\r\n\r\n---\r\napiVersion: traefik.containo.us\/v1alpha1\r\nkind: Middleware\r\nmetadata:\r\n\u00a0\u00a0name: alert-auth\r\n\u00a0\u00a0namespace: kubernetes-monitoring\r\nspec:\r\n\u00a0\u00a0basicAuth:\r\n\u00a0\u00a0\u00a0\u00a0secret: monitoring-prometheus\r\n\r\n---\r\napiVersion: traefik.containo.us\/v1alpha1\r\nkind: Middleware\r\nmetadata:\r\n\u00a0\u00a0name: alert-prefix\r\n\u00a0\u00a0namespace: kubernetes-monitoring\r\nspec:\r\n\u00a0\u00a0stripPrefix:\r\n\u00a0\u00a0\u00a0\u00a0prefixes:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \/prometheus-alert<\/code><\/pre>\nProviders<\/h2>\n
Traefik v2 introduces the concept of a provider<\/a>, which supplies routing information to Traefik. When Traefik detects changes, it automatically updates the routes. The Kubernetes Ingress<\/a> Traefik provider offers traditional Kubernetes ingress controller functionality.<\/p>\nIn addition to the standard Ingress, Accuweb.cloud KS now supports IngressRoute<\/a>, a Custom Resource Definition (CRD) for a Traefik HTTP router<\/a>. This makes it easier to access K8s clusters without needing annotations. You can see an example of how to use IngressRoute in our K8s repository.<\/p>\nServices<\/h2>\n
Traefik v2 includes specific Services that configure how to reach the actual Kubernetes services that handle incoming requests.<\/p>\n
![\"Services\"](\"https:\/\/accuweb.cloud\/blog\/wp-content\/uploads\/2024\/06\/Services.png\" "\\"Services\\"")
<\/a><\/p>\nhttp:\r\n\u00a0\u00a0services:\r\n\u00a0\u00a0\u00a0\u00a0my-service:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0loadBalancer:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0servers:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- url: \"http:\/\/<private-ip-server-1>:<private-port-server-1>\/\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- url: \"http:\/\/<private-ip-server-2>:<private-port-server-2>\/\"<\/code><\/pre>\nTraefik also includes a variety of internal services. For example, in the config file found in the AccuWeb.Cloud KS repository, there’s access to a built-in Traefik v2 dashboard service via IngressRoute.<\/p>\n
When deploying applications in Kubernetes, an Ingress Controller<\/b> plays a crucial role in managing external access to services. At AccuWeb.Cloud, you can choose from popular ingress controllers like NGINX, Traefik, or HAProxy<\/b>.<\/p>\n
In this blog, we\u2019ll dive into Traefik v2<\/b>, the modern version of Traefik, and explore its updates and advantages in the AccuWeb.Cloud Kubernetes Service (AK8s)<\/b>. Traefik is a cloud-native reverse proxy and load balancer<\/b> designed to integrate seamlessly with containerized environments. It automatically discovers services, handles routing, and provides advanced features like:<\/p>\n This makes Traefik a perfect fit for modern microservices and cloud-native apps.<\/p>\n The basic concepts of frontend and backend have changed to routers, services, and middleware in Traefik v2.<\/p>\n In Traefik v1, the router replaces the frontend, and the service replaces the backend, with each router connected to a service.<\/p>\n In Traefik v2, middleware pieces are added to routers to adjust requests before they reach the services. These middleware pieces can be linked together to handle different scenarios, and any router can connect to any middleware instance.<\/p>\n There are many types of middleware<\/a> available. In addition to handling traditional HTTP requests, different middleware can modify request parameters and HTTP headers, manage redirects, add authentication, and more.<\/p>\n The middleware attached to a router can modify a request before it is sent to the service.<\/p>\n Here are some examples of middleware used in request routing:<\/p>\n This middleware is an alternative to using Kubernetes Secrets<\/a> for credentials and restricts access to services.<\/p>\n It replaces the Traefik v1 annotation.<\/p>\n Using middleware (and other routing components) is optional. You can use multiple middleware or none at all. For example, in the Ingress below, one middleware handles authentication, and another removes a source path prefix.<\/p>\n Traefik v2 introduces the concept of a provider<\/a>, which supplies routing information to Traefik. When Traefik detects changes, it automatically updates the routes. The Kubernetes Ingress<\/a> Traefik provider offers traditional Kubernetes ingress controller functionality.<\/p>\n In addition to the standard Ingress, Accuweb.cloud KS now supports IngressRoute<\/a>, a Custom Resource Definition (CRD) for a Traefik HTTP router<\/a>. This makes it easier to access K8s clusters without needing annotations. You can see an example of how to use IngressRoute in our K8s repository.<\/p>\n Traefik v2 includes specific Services that configure how to reach the actual Kubernetes services that handle incoming requests.<\/p>\n Traefik also includes a variety of internal services. For example, in the config file found in the AccuWeb.Cloud KS repository, there’s access to a built-in Traefik v2 dashboard service via IngressRoute.<\/p>\n
\n<\/a><\/p>\nWhy Traefik for Kubernetes?<\/h2>\n
\n
No Frontends and Backends<\/h2>\n
Middleware<\/h2>\n
<\/a><\/p>\n\n
http:\r\n\u00a0\u00a0middlewares:\r\n\u00a0\u00a0\u00a0\u00a0test-stripprefix:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0stripPrefix:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0prefixes:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \"\/foo\"<\/code><\/pre>\n<\/a><\/p>\n\n
http:\r\n\u00a0\u00a0middlewares:\r\n\u00a0\u00a0\u00a0\u00a0test-auth:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0basicAuth:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0users:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \"user1:$apr1$Kveg6cv0$yJn5mwyfBy7luzZ9Fi1AH0\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \"user2:$apr1$w70ASLDx$1UJmrFL\/lVoltjmAz4UDH\/\"<\/code><\/pre>\n<\/a><\/p>\n\r\ntraefik.ingress.kubernetes.io\/auth-type: \"basic\".<\/code><\/pre>\nUsing Multiple Middlewares<\/h2>\n
---\r\napiVersion: networking.k8s.io\/v1\r\nkind: Ingress\r\nmetadata:\r\n\u00a0\u00a0name: monitoring-prometheus-alertmanager\r\n\u00a0\u00a0namespace: kubernetes-monitoring\r\n\u00a0\u00a0annotations:\r\n\u00a0\u00a0\u00a0\u00a0kubernetes.io\/ingress.class: traefik\r\n\u00a0\u00a0\u00a0\u00a0traefik.ingress.kubernetes.io\/router.middlewares:\u00a0\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0kubernetes-monitoring-alert-auth@kubernetescrd,\u00a0\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0kubernetes-monitoring-alert-prefix@kubernetescrd\r\nspec:\r\n\u00a0\u00a0rules:\r\n\u00a0\u00a0- http:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0paths:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- path: \/prometheus-alert\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0pathType: Prefix\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0backend:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0service:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0name: monitoring-prometheus-alertmanager\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0port:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0number: 80\r\n\r\n---\r\napiVersion: traefik.containo.us\/v1alpha1\r\nkind: Middleware\r\nmetadata:\r\n\u00a0\u00a0name: alert-auth\r\n\u00a0\u00a0namespace: kubernetes-monitoring\r\nspec:\r\n\u00a0\u00a0basicAuth:\r\n\u00a0\u00a0\u00a0\u00a0secret: monitoring-prometheus\r\n\r\n---\r\napiVersion: traefik.containo.us\/v1alpha1\r\nkind: Middleware\r\nmetadata:\r\n\u00a0\u00a0name: alert-prefix\r\n\u00a0\u00a0namespace: kubernetes-monitoring\r\nspec:\r\n\u00a0\u00a0stripPrefix:\r\n\u00a0\u00a0\u00a0\u00a0prefixes:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- \/prometheus-alert<\/code><\/pre>\nProviders<\/h2>\n
Services<\/h2>\n
<\/a><\/p>\nhttp:\r\n\u00a0\u00a0services:\r\n\u00a0\u00a0\u00a0\u00a0my-service:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0loadBalancer:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0servers:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- url: \"http:\/\/<private-ip-server-1>:<private-port-server-1>\/\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0- url: \"http:\/\/<private-ip-server-2>:<private-port-server-2>\/\"<\/code><\/pre>\n