Native Coraza WAF integration: Secure APIs with the Coraza Web Application Firewall (endorsed by OWASP). The native WAF integration in Traefik Hub provides more than 23x performance improvement over Traefik Proxy's WASM-based WAF plugin.
Distributed ACME on all platforms using Vault: Simplify certificate management and ensure that certificates are always up-to-date by automatically obtaining and renewing TLS certificates with ACME from Certificate Authorities like Let's Encrypt. The Hub-exclusive distributed ACME is more efficient for large-scale or high-availability setups, as it reduces duplication and ensures consistency across all Gateway instances by leveraging HashiCorp Vault as shared secure certificate storage. Now available for all supported installation platforms.
Vault Public Key Infrastructure: Create your own private certificate authority (CA) with the HashiCorp Vault PKI secret engine to issue, manage, and revoke digital certificates. Combine it with the gateway's ACME resolvers for automated certificate management, even in a distributed way.
LDAP middleware: Secure your APIs by delegating the authentication to an external LDAP server with the LDAP middleware.
OPA middleware: The Open Policy Agent middleware restricts access to your APIs and allows you to enrich request headers with data extracted from policies.
Cache middleware: Add cache middleware to your routers and improve the performance of your infrastructure by reducing latency, network traffic, and the time needed to interact with an API.
FIPS-compliant Docker image: Traefik Hub is now compliant with FIPS 140-2, a U.S. Federal Government security standard used to approve cryptographic modules.
Multi-platform install snippets: A newly added platform selector helps you in the new gateway creation wizard to get tailored installation snippets for Kubernetes, Docker Compose, Docker Swarm, HashiCorp Nomad, and Systemd for Linux-based virtual machines, bare-metal hardware or cloud computing instances like AWS EC2.
The embedded Traefik Proxy version has been updated to bring the latest open-source improvements for Hub.
Add any third-party Identity Provider with OIDC: User management has never been easier. Secure your API Developer Portals and API Gateways with any third-party Identity Provider you already have, such as Okta or Azure Entra ID, using enterprise-grade OIDC. Check the documentation about how to configure it on the online Hub dashboard.
Metrics overview in the online dashboard: The Hub online dashboard gives you an overview of your APIs' overall consumption and health. You can also filter for every API, user, and API Management-enabled gateway. Fine-grained metrics are still available on the gateway with OpenTelemetry.
Traefik Hub now embeds all Traefik Proxy v3.0 features (compatible with Traefik v2).
Capacity to install Traefik Hub as a drop-in replacement of Traefik Proxy, with additional Enterprise features such as authentication, authorization, distributed rate limit, and more.
Traefik Hub provides robust API management capabilities for API publishers and consumers. The features include API versioning, user and fine-grained access management, rate limiting, declarative configuration linting, API developer portals, API observability metrics, and many more.
Promote any Ingress or IngressRoute to become a managed API. This means one can now attach any built-in gateway middleware or plugins to APIs, unlocking Traefik's entire network power for APIs.
Extend Traefik Hub with your custom WebAssembly (WASM) plugins.
Leverage the new Coraza Web Application Firewall, a plugin Traefik Labs supports.
OpenTelemetry (OTel) metrics are now available on both ingresses and managed APIs.
Operate API Gateways fully offline without reliance on any SaaS platform.
We've added a new filtering concept in the APIAccess CRD that enables you to select sets of OpenAPI operations defined on APIs or APIVersions.
You can find more information in the API CRD reference.
All-new API Portal. We've refreshed the API Portal UI to create a better user experience.
It is now possible to turn off the generation and usage of traefikhub.io domains for your API Gateways and Portals.
Error logs generated by the Traefik Hub agent are now transmitted to the Traefik Hub platform and stored for 24 hours to assist in resolving support requests quickly.
You can turn off sending error logs by adjusting the default configuration.
We've enhanced the API and the APIVersion CRDs.
Both CRDs support now naming of the API Service port service.port.name.
You can now publish APIs without an OpenAPI specification.
We've published a complete Traefik Hub GitOps demo.
Follow the tutorial to learn how to deploy and manage APIs on a local Kubernetes cluster with Flux.
We've updated the dashboard to make it more effortless for you to get an overview about configured access policies and rate limits.
This information is now displayed in the API details page, as in the user and groups details pages.
We've enhanced our OpenTelemetry metrics by adding support for API versions.
The dashboard now shows a warning sign when a Traefik Hub agent faces a connectivity issue.
We've released a new version of the Traefik Hub agent v2.4.2 and of the Helm chart v2.5.1v2.5.1 Changelog.
Please upgrade the Traefik Hub agent to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the Ingress Controller or the Sidecar Mode installation.
We enhanced workspace management. You can now assign roles to workspace members.
Every role, Viewer, Editor and Admin has a different set of permissions.
Traefik Hub now supports CORS (Cross-Origin Resource Sharing) configuration via CRDs.
We've improved the dashboard to provide a better experience when you select Services. You can now better identify if you use an internal or external (API) Service.
The dashboard shows now a warning sign when the user's initial password reset has not been performed yet.
We've released a new version of the Traefik Hub Helm chart with an update of the Traefik Hub agent. Please find the changelog for v2.2.0 on GitHub.
Please upgrade to version v2.2.0 to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the Ingress Controller or the Sidecar Mode installation.
You can now manage external APIs, hosted outside your Kubernetes cluster, for example on Virtual Machines (VMs) or third party APIs.
Starting today, you're able to use rate limiting for APIs.
We strengthened security. The Traefik Hub token is now provided as a Secret during installation.
If you deal with large clusters, we made your life easier with filtering Services by namespace in the dashboard, to quickly find what you look for.
The dashboard provide more guidance, with clear indications of which fields are required and more descriptions.
We've updated the dashboard to put key information right at your fingertips: information on APIs and API Collections, the API Developer Portal and Users. Corresponding screens have been updated for better clarity.
We’ve improved the API Developer Portal responsiveness by adding HTTP cache control headers.
For you to more quickly see how to perform given tasks, we've restructured the documentation, added more tutorials and improved the content overall.
Based on your feedback, we've tinkered with the internal workings and polished some rough edges.