Traefik Ingress

Traefik is the default ingress controller for K3s, handling all HTTP/HTTPS traffic routing to Kubernetes services.

Overview

How Traffic Reaches Traefik

cloudflared (Cloudflare tunnel)
    |
    v
https://localhost:32672 (noTLSVerify)
    |
    v
Traefik (kube-system)
    |
    v
IngressRoute rules match Host header
    |
    v
Backend K8s Service -> Pod

Routing

Traefik uses IngressRoute CRDs (Traefik's native routing) for hostname-based routing. Each application defines its own IngressRoute in its namespace.

# List all IngressRoutes
kubectl get ingressroute -A

# Describe a specific route
kubectl describe ingressroute <name> -n <namespace>

# Check Traefik pods
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik

# Traefik dashboard (if enabled)
kubectl port-forward -n kube-system svc/traefik-dashboard 9000:9000

TODO: expand with middleware configuration, rate limiting, TLS configuration, and dashboard access.