Traefik Ingress: Overview & Concepts
This section covers how to expose your applications to the internet using Traefik as your ingress controller. All examples use the public-traefik IngressClass.
Standard Kubernetes Ingress
The simplest way to expose your application is using a standard Kubernetes Ingress resource with ingressClassName: public-traefik. This uses the Helm chart's built-in ingress configuration — no customResources needed.
Basic IngressRoute
The simplest Traefik IngressRoute — route all traffic for a hostname to a single service.
Path-Based Routing
Route different URL paths to the same or different services using Traefik's PathPrefix matcher.
Multiple IngressRoutes
Create multiple IngressRoutes to expose the same service under different subdomains — for example, an API endpoint and a web frontend endpoint.
Middleware: Security Headers
Add security headers (CORS, HSTS, X-Frame-Options, etc.) to all responses using a Traefik headers Middleware.
Middleware: IP Allow List
Restrict access to your application by IP address or CIDR range using Traefik's ipAllowList Middleware.
Middleware: Rate Limiting
Protect your application from excessive requests using Traefik's rateLimit Middleware.
Middleware: Basic Auth
Protect your application with HTTP Basic Authentication using Traefik's basicAuth Middleware.
Middleware: Login with GitHub (Forward Auth)
Put a GitHub login in front of any application using your own OAuth App, oauth2-proxy, and Traefik forwardAuth.
Cookie-Based Canary Routing
Route traffic between two versions of your application based on a cookie value. This enables testing a new version with specific users before rolling out to everyone.
Sticky Sessions (IngressRoute)
Pin a user to the same backend pod using cookie-based session affinity, configured directly on the IngressRoute service reference. Useful when running multiple replicas and your app maintains in-memory session state.
Canary Routing with Sticky Sessions
Combine cookie-based canary routing with sticky sessions so that users are both routed to the correct version and pinned to a specific pod within that version. This is useful when canary backends run multiple replicas and maintain in-memory state.
TLS & HTTPS Redirect
Force all HTTP traffic to redirect to HTTPS and configure TLS version enforcement using Traefik's redirectScheme Middleware and TLSOption CRDs.
Let's Encrypt Certificates (IngressRoute)
Issue free, auto-renewing TLS certificates from Let's Encrypt using cert-manager's HTTP-01 challenge solver, with traffic routed through a Traefik IngressRoute.
Let's Encrypt Certificates (Standard Ingress)
The simplest way to get free, auto-renewing TLS certificates from Let's Encrypt — add a single annotation to your standard Kubernetes Ingress and cert-manager handles the rest.
IngressRouteTCP
Route raw TCP traffic to your service using Traefik's IngressRouteTCP CRD. This is useful for non-HTTP protocols like databases, MQTT, or custom TCP services.
IngressRouteTCP: PostgreSQL
Route PostgreSQL traffic through Traefik using an IngressRouteTCP with TLS termination. Traefik terminates TLS using the cluster's wildcard certificate and forwards plain TCP to the PostgreSQL pod — no SSL configuration needed on the backend.