Learn Traefik - Kubernetes Provider - Ingress

#Introduction

In a Kubernetes cluster, Traefik changes roles: from an edge router watched over by Docker to an Ingress Controller. Episode 20 covers the kubernetesingress provider — how Traefik reads the standard Kubernetes Ingress resource, IngressClass, annotations, and TLS. Episode 21 will take you further into the Traefik-exclusive IngressRoute CRD.

The conceptual difference from Docker is fundamental: instead of per-container labels, configuration comes from Kubernetes API resources managed via kubectl. After this episode, you will understand why Traefik is one of the most popular ingress controllers in the Kubernetes world.

#Setting Up the Kubernetes Provider

#IngressClass and Enabling

The provider is enabled in static config, and Traefik waits for resources pointing to the configured IngressClass name:

providers:
  kubernetesIngress:
    ingressClass: traefik
    namespaces:
      - default
      - app-team
    allowEmptyServices: true

• ingressClass: traefik: only processes Ingresses with ingressClassName: traefik.
• namespaces: limits the watched namespaces; empty means all.
• allowEmptyServices: allows empty backend endpoints.

The IngressClass itself is defined as a resource:

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: traefik
spec:
  controller: traefik.io/ingress-controller

#The Ingress Resource

#Host and Path-Based Routing

The standard Ingress resource uses rules to define hosts and paths to route per path:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  namespace: default
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
    traefik.ingress.kubernetes.io/router.middlewares: default-auth@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 8080
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-service
                port:
                  number: 80

Path /api/* is forwarded to api-service, all other paths to web-service. Annotations determine the entrypoints used and the middlewares attached. The default-auth@kubernetescrd template references a middleware CRD — we dissect it in episode 21.

#Traefik Annotations

#Controlling a Router from Annotations

The traefik.ingress.kubernetes.io/* annotations map nearly all of Traefik's router capabilities:

• router.entrypoints: the list of entrypoints served.
• router.middlewares: the middleware chain used.
• router.tls: enables TLS on the router.
• router.certresolver: the certificate resolver for automatic certificates.
• router.priority: the manual priority value.

Example annotations for an HTTPS entrypoint with a certificate resolver:

annotations:
  traefik.ingress.kubernetes.io/router.entrypoints: websecure
  traefik.ingress.kubernetes.io/router.tls: "true"
  traefik.ingress.kubernetes.io/router.certresolver: letsencrypt

The router.tls annotation turns on TLS on the router, and router.certresolver connects it to the resolver defined in static config. The combination makes Traefik issue and serve certificates automatically.

#TLS in Kubernetes

#Secrets and Cert-Manager

Two common certificate paths in Kubernetes:

1. Secret-based: you create a Secret containing tls.crt and tls.key, then reference it in the Ingress tls section.
2. Cert-manager: cert-manager issues certificates automatically and writes them to a Secret; the cert-manager.io/cluster-issuer annotation activates it.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-tls
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - app.example.com
      secretName: app-tls-secret
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: app-service
                port:
                  number: 80

Cert-manager creates the certificate, writes the app-tls-secret Secret, and Traefik reads that Secret to serve HTTPS. This combination is the golden standard of TLS automation in Kubernetes.

#Service Types and Service Discovery

#ClusterIP, NodePort, LoadBalancer, ExternalName

Traefik finds backends through the Service resource:

• ClusterIP: the default type; Traefik forwards directly to the service IP. This is the most common.
• NodePort: the service is exposed on a node port; Traefik can forward to the node.
• LoadBalancer: usually filled by a cloud controller; Traefik still points to backends according to endpoints.
• ExternalName: references an external service outside the cluster.

Traefik reads the Endpoints of a service, not just the virtual IP — if pods are scaled, the endpoint list changes and load balancing follows. Exactly like the Docker auto-discovery you already know.

#Closing

Key takeaways:

• The kubernetesIngress provider reads Ingress resources with a matching ingressClassName.
• Host and path routing is defined in the rules and http.paths sections.
• traefik.ingress.kubernetes.io/* annotations configure entrypoints, middlewares, and TLS.
• Certificates come from Secrets, and can be automated with cert-manager.
• Backends are found via Services and Endpoints, changing as they scale.
• Check Endpoints when a router does not appear.

In episode 21 next we will cover kubernetes CRDs IngressRoute — Traefik's exclusive, far more expressive resources: middlewares, weighted services, traffic splitting, sticky sessions, TCP/UDP support, and cross-namespace references. This is where Traefik truly feels "native" in Kubernetes.