Traefik Ingress Controller

The previous lesson explained why Ingress has limitations—annotation chaos, vendor lock-in, no role separation. Gateway API solves these problems, but it introduces new abstractions: GatewayClass, Gateway, HTTPRoute, BackendTrafficPolicy. That's a lot to absorb before routing your first request.

What if you just want external traffic reaching your Task API in 5 minutes?

Traefik offers exactly that. It's a simpler ingress controller with its own CRDs (IngressRoute, Middleware) that are more intuitive than Ingress annotations. You'll understand traffic routing fundamentals faster with Traefik, which prepares you for Gateway API's more powerful—but more complex—model.

This lesson gets your Task API accessible from outside the cluster with rate limiting protection. Then you'll understand exactly what Gateway API improves upon.

---

Installing Traefik with Helm

Traefik publishes a Helm chart that handles all the complexity—Deployment, Service, ServiceAccount, RBAC, CRDs. You just run two commands.

Add the Traefik Helm repository:

Output:

Update repository information:

Output:

Install Traefik in its own namespace:

Output:

Verify the installation:

Output:

Check the Service created by Traefik:

Output:

On Docker Desktop, localhost appears as the external IP. On a cloud provider, you'd see a real public IP. Either way, Traefik now accepts traffic on ports 80 (HTTP) and 443 (HTTPS).

---

Understanding Traefik Architecture

Before creating routes, understand how Traefik processes requests:

EntryPoints: Ports where Traefik accepts connections. The Helm chart creates web (port 80) and websecure (port 443) by default.

Routers: Rules that match incoming requests. When a request matches a Router's rule (e.g., Host('api.example.com') && PathPrefix('/tasks')), Traefik sends it to the associated Service.

Middlewares: Transformations applied before reaching the backend. Rate limiting, authentication, header manipulation, path stripping—all are Middlewares.

Services: Backend targets. In Kubernetes, these point to Kubernetes Services that forward to Pods.

This is similar to Gateway API's model (Gateway, HTTPRoute, BackendTrafficPolicy) but with different terminology and simpler CRDs.

---

Creating Your First IngressRoute

Traefik's IngressRoute CRD replaces Kubernetes' Ingress resource with a cleaner syntax. No annotations required.

First, ensure your Task API is running. If you've been following along, you have it deployed:

Output:

Now create task-api-ingressroute.yaml that routes /api/v1/tasks to the Task API:

Output:

(This is the manifest—we'll apply it next)

Apply the IngressRoute:

Output:

Test the route:

Output:

Your Task API is now accessible from outside the cluster through Traefik. The request flow:

1. Request arrives at localhost:80 (Traefik's web EntryPoint)
2. Traefik matches PathPrefix('/api/v1/tasks') → task-api-route
3. Traefik forwards to task-api:8000 in the task-api namespace
4. Task API responds, Traefik returns the response

Compare this to the Ingress resource from Lesson 1. No annotations needed. The routing logic is in structured YAML fields, not string annotations.

---

Understanding the Match Rule Syntax

Traefik's match rules use a simple expression language:

Examples:

Route only POST requests to /tasks:

Route based on API version header:

This expressive matching is something standard Ingress cannot do without controller-specific annotations.

---

Adding Rate Limiting with Middleware

Your AI agent's Task API could be expensive to run. Without rate limiting, a single user could exhaust your compute budget. Traefik Middlewares handle this.

Create ratelimit-middleware.yaml:

Output:

(This is the manifest—we'll apply it next)

Apply the Middleware:

Output:

Now attach the Middleware to your IngressRoute. Create task-api-ingressroute-ratelimited.yaml:

Apply the updated IngressRoute:

Output:

Test the rate limit by sending many requests quickly:

Output:

After approximately 20 requests (the burst limit), Traefik returns 429 Too Many Requests. The rate limiter is protecting your backend.

---

Path Manipulation with Middlewares

Sometimes your backend expects a different path than what external clients use. Middlewares can transform paths.

StripPrefix Middleware

Remove a path prefix before forwarding. Create strip-prefix-middleware.yaml:

Output:

(Manifest only)

If a client requests /api/v1/tasks, Traefik forwards /tasks to the backend. Useful when your internal services don't expect version prefixes.

AddPrefix Middleware

Add a path prefix before forwarding. Create add-prefix-middleware.yaml:

Output:

(Manifest only)

A request to /tasks becomes /internal/tasks when reaching the backend.

Headers Middleware

Add or modify HTTP headers. Create headers-middleware.yaml:

Output:

(Manifest only)

Chaining Multiple Middlewares

Apply multiple Middlewares in sequence:

Middlewares execute in order. Rate limiting happens before path stripping, which happens before header modification.

---

Enabling the Traefik Dashboard

Traefik includes a web dashboard for monitoring routes, services, and middlewares. Enable it by upgrading the Helm release:

Output:

Access the dashboard via port-forward:

Output:

Open http://localhost:9000/dashboard/ in your browser. You'll see:

• HTTP Routers: Your IngressRoutes and their status
• HTTP Services: Backend services Traefik knows about
• HTTP Middlewares: All Middleware resources
• EntryPoints: Ports Traefik is listening on

The dashboard updates in real-time. Create a new IngressRoute, and it appears within seconds. This visibility is valuable for debugging routing issues.

---

When to Use Traefik vs Gateway API

Both Traefik and Gateway API solve the same problem—routing external traffic to internal services. The choice depends on your situation.

Use Traefik When:

Use Gateway API When:

Decision Table

For this book's learning path: We teach Traefik first because it's faster to understand. Once you've internalized traffic routing concepts with Traefik, Gateway API's abstractions will make more sense. Lessons 3-11 will then teach Gateway API as your production solution.

---

Exercises

Exercise 1: Install Traefik and Access Dashboard

If you haven't already:

1. Install Traefik with Helm
2. Enable the dashboard
3. Access the dashboard at localhost:9000/dashboard/

Verify you can see EntryPoints, Routers, Services, and Middlewares sections.

Exercise 2: Create IngressRoute for Task API

Create an IngressRoute that:

• Listens on EntryPoint web
• Matches path /api/v1/tasks
• Routes to the task-api Service on port 8000

Test with curl http://localhost/api/v1/tasks.

Exercise 3: Add Rate Limiting Middleware

1. Create a Middleware with:
   • average: 5 requests per second
   • burst: 10 requests
2. Attach it to your IngressRoute
3. Test by sending 15 requests quickly

Verify you see 429 responses after the burst limit.

Exercise 4: Add StripPrefix Middleware

1. Create a StripPrefix Middleware that removes /api/v1
2. Chain it with your rate limit Middleware
3. Verify the order matters: rate limiting should happen first

Check the Traefik dashboard to see both Middlewares attached to your route.

---

Reflect on Your Skill

You built a traffic-engineer skill in Lesson 0. Test and improve it based on what you learned.

Update Your Skill's Decision Logic

Your skill should now include Traefik as an option:

When should your skill recommend Traefik?

• Development/staging environments needing quick setup
• Teams already using Traefik
• Simpler configuration requirements
• Need built-in dashboard for monitoring

When should your skill recommend Gateway API?

• Production environments requiring vendor portability
• Multi-team setups needing role separation
• Advanced traffic patterns (splitting, mirroring)
• CNCF compliance requirements

What Traefik Patterns Are Worth Encoding?

Consider adding these to your skill:

1. Standard IngressRoute template with EntryPoints and match rules
2. Rate limiting Middleware with configurable average/burst
3. Middleware chaining pattern (rate limit → strip prefix → headers)
4. Dashboard enablement for development clusters

Your skill should generate the appropriate CRDs based on whether Traefik or Gateway API is chosen.