Learn Traefik - Kubernetes CRDs - IngressRoute

#Introduction

The standard Ingress resource is enough for basic routing, but limited: no middlewares, no weighted services, no TCP/UDP support. Episode 21 introduces Traefik CRDs — Custom Resource Definitions that make Traefik in Kubernetes equivalent to all the capabilities you learned in previous episodes.

With IngressRoute, Traefik's Kubernetes configuration becomes nearly identical to the file provider: routes, services, middlewares, and tls are written directly in YAML resources. This is the most recommended way to use Traefik in modern Kubernetes.

#Getting to Know Traefik CRDs

#Six Main Resources

• IngressRoute: HTTP routing (combination of router + rule + service).
• IngressRouteTCP: TCP routing with the HostSNI rule.
• IngressRouteUDP: UDP routing.
• Middleware: reusable middlewares across resources.
• TLSOption: TLS options such as versions, ciphers, and mTLS.
• TLSStore: manages the default certificate and certificate storage.
• ServersTransport: transport connection options to backends.

All these resources are registered when installing Traefik via Helm — a Kubernetes Traefik deployment usually enables CRDs automatically. Check with kubectl get crd and filter for traefik to confirm.

#IngressRoute

#Routes and Services Syntax

IngressRoute replaces the standard Ingress with a more explicit structure:

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: web
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - kind: Rule
      match: Host(`app.example.com`) && PathPrefix(`/api`)
      middlewares:
        - name: api-rate
          namespace: default
      services:
        - name: api-service
          port: 8080

• entryPoints: the list of entrypoints served.
• match: the full Traefik rule — the same syntax as episode 6.
• middlewares: the list of middleware CRDs with their namespaces.
• services: the destination backends with name and port.

#Advantages Over the Standard Ingress

• Native middlewares: attach BasicAuth, rate limits, or headers directly in the resource.
• Full Traefik rules: all episode 6 matchers and operators are available.
• TCP/UDP support: non-HTTP routing in one resource family.
• Granular control: priority, tls options, and weighted services.

#The Middleware CRD

#Reusable Middlewares

Middlewares are defined as separate resources, then referenced by IngressRoutes:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-rate
  namespace: default
spec:
  rateLimit:
    average: 100
    burst: 50

Cross-namespace references use the name@namespace syntax or an explicit namespace field. Traefik v3 also introduces namespaces for middlewares: a middleware referenced with name@namespacename can be shared across namespaces if allowed. This lets teams share security middlewares without duplication.

#TLSOption and TLSStore

#TLS Options as Resources

The TLSOption previously written in the file provider now becomes its own resource:

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: hardened
  namespace: default
spec:
  minVersion: VersionTLS12
  cipherSuites:
    - TLS_AES_128_GCM_SHA256
  sniStrict: true

An IngressRoute references it in the tls.options section:

spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`app.example.com`)
      services:
        - name: app-service
          port: 443
  tls:
    options:
      name: hardened
    certResolver: letsencrypt

#Advanced Features

#Weighted Services and Traffic Splitting

The canary capability we built earlier with weighted services in the file provider is now available directly in IngressRoute:

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: app-canary
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - kind: Rule
      match: Host(`app.example.com`)
      services:
        - name: app-stable
          port: 80
          weight: 9
        - name: app-v2
          port: 80
          weight: 1

A 9:1 weight sends 90 percent of traffic to the stable version and 10 percent to the new version. Raising the new version's weight — e.g. to 5:5 — is done with kubectl apply without restarting Traefik. The same technique can be used for mirroring and sticky sessions by adding sticky and mirror to the resource.

#Closing

Key takeaways:

• Traefik CRDs: IngressRoute, IngressRouteTCP/UDP, Middleware, TLSOption, TLSStore, ServersTransport.
• IngressRoute unifies routes, services, middlewares, and tls in a single resource.
• The Middleware CRD is reusable across namespaces with the name@namespace syntax.
• TLSOption and TLSStore move TLS options to Kubernetes resources.
• Weighted services in IngressRoute enable canary and traffic splitting.
• CRDs are the most expressive way to use Traefik in Kubernetes.

In episode 22 next we will cover Kubernetes Service Mesh with Traefik Mesh — a lightweight SMI-based service mesh, traffic splitting, circuit breaking, retry, and observability features, and canary, A/B testing, and blue-green deployment patterns. You will see Traefik go beyond the ingress controller role.