Kubernetes Ingress
The Traefik Hub API Gateway Kubernetes Ingress provider is a Kubernetes Ingress controller; that is to say, it manages access to cluster services by supporting the Ingress specification.
When Traefik Hub API Gateway is installed using the Helm Chart, by default, the provider KubernetesIngress is enabled.
If you need to use Traefik Custom resources (like Middlewares),
you need to enable the provider kubernetesCRD,
and install the required CRDs and RBACs too.
Configuration Example
- Static Configuration
- Helm Chart Values
## YAML file
providers:
kubernetesIngress:
allowEmptyServices: true
nativeLBByDefault: true
throttleDuration: 2s
## Values file
providers:
kubernetesIngress:
enabled: true
allowEmptyServices: true
nativeLBByDefault: true
throttleDuration: 2s
Configuration Options
| Field | Description | Default | Required |
|---|---|---|---|
providers.providersThrottleDuration | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event. If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded. This option cannot be set per provider, but the throttling algorithm applies to each of them independently. | 2s | No |
providers.kubernetesIngress.endpoint | Server endpoint URL. More information here. | "" | No |
providers.kubernetesIngress.token | Bearer token used for the Kubernetes client configuration. | "" | No |
providers.kubernetesIngress.certAuthFilePath | Path to the certificate authority file. Used for the Kubernetes client configuration. | "" | No |
providers.kubernetesCRD.namespaces | Array of namespaces to watch. If left empty, watch all namespaces. | No | |
providers.kubernetesIngress.labelselector | Allow filtering on Ingress objects using label selectors. No effect on Kubernetes Secrets, EndpointSlices and Services.See label-selectors for details. | "" | No |
providers.kubernetesIngress.ingressClass | Value of kubernetes.io/ingress.class annotation that identifies resource objects to be processed.If empty, resources missing the annotation, having an empty value, or the value traefik are processed. | "" | No |
providers.kubernetesIngress.disableIngressClassLookup | Prevent to discover IngressClasses in the cluster. It alleviates the requirement of giving Traefik Hub API Gateway the rights to look IngressClasses up. Ignore Ingresses with IngressClass. Annotations are not affected by this option. | false | No |
providers.kubernetesIngress.ingressEndpoint.hostname | Hostname used for Kubernetes Ingress endpoints. | "" | No |
providers.kubernetesIngress.ingressEndpoint.ip | This IP will get copied to the Ingress status.loadbalancer.ip, and currently only supports one IP value (IPv4 or IPv6). | "" | No |
providers.kubernetesIngress.ingressEndpoint.publishedService | The Kubernetes service to copy status from. When using third parties tools like External-DNS, this option can be used to copy the service loadbalancer.status (containing the service's endpoints IPs) to the ingresses. | "" | No |
providers.kubernetesIngress.throttleDuration | Minimum amount of time to wait between two Kubernetes events before producing a new configuration. This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration. If empty, every event is caught. | 0s | No |
providers.kubernetesIngress.allowEmptyServices | Allows creating a route to reach a service that has no endpoint available. It allows Traefik Hub API Gateway to handle the requests and responses targeting this service (applying middleware or observability operations) before returning a 503 HTTP Status. | false | No |
providers.kubernetesIngress.allowCrossNamespace | Allows the Ingress to reference resources in namespaces other than theirs. | false | No |
providers.kubernetesIngress.allowExternalNameServices | Allows the Ingress to reference ExternalName services. | false | No |
providers.kubernetesIngress.nativeLBByDefault | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik Hub API Gateway for every Ingress by default.It can br overriden in the ServerTransport. | false | No |
providers.kubernetesIngress.disableClusterScopeResources | Prevent from discovering cluster scope resources (IngressClass and Nodes).By doing so, it alleviates the requirement of giving Traefik Hub API Gateway the rights to look up for cluster resources. Furthermore, Traefik Hub API Gateway will not handle Ingresses with IngressClass references, therefore such Ingresses will be ignored (please note that annotations are not affected by this option). This will also prevent from using the NodePortLB options on services. | false | No |
endpoint
The Kubernetes server endpoint URL.
When deployed into Kubernetes, Traefik reads the environment variables KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT or KUBECONFIG to construct the endpoint.
The access token is looked up in /var/run/secrets/kubernetes.io/serviceaccount/token and the SSL CA certificate in /var/run/secrets/kubernetes.io/serviceaccount/ca.crt.
Both are mounted automatically when deployed inside Kubernetes.
The endpoint may be specified to override the environment variable values inside a cluster.
When the environment variables are not found, Traefik tries to connect to the Kubernetes API server with an external-cluster client.
In this case, the endpoint is required.
Specifically, it may be set to the URL used by kubectl proxy to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig.
Related Content
- Learn more about the various aspects of the Ingress specification that Traefik supports, many examples of Ingresses definitions are located in the test examples of the Traefik repository.