# Table of Contents - [Welcome to Traefik Labs documentation | Traefik Labs Docs](#welcome-to-traefik-labs-documentation-traefik-labs-docs) - [Welcome to Traefik Enterprise - Traefik Enterprise](#welcome-to-traefik-enterprise-traefik-enterprise) - [Traefik Enterprise Architecture Concepts - Traefik Enterprise](#traefik-enterprise-architecture-concepts-traefik-enterprise) - [Traefik Enterprise Features - Traefik Enterprise](#traefik-enterprise-features-traefik-enterprise) - [Traefik Enterprise Getting Started Guide - Traefik Enterprise](#traefik-enterprise-getting-started-guide-traefik-enterprise) - [Traefik Manifest File Documentation - Traefik Enterprise](#traefik-manifest-file-documentation-traefik-enterprise) - [Customizing Swarm for Traefik Enterprise - Traefik Enterprise](#customizing-swarm-for-traefik-enterprise-traefik-enterprise) - [Install Traefik Enterprise on ECS Amazon EC2 - Traefik Enterprise](#install-traefik-enterprise-on-ecs-amazon-ec2-traefik-enterprise) - [Installing Traefik Enterprise on ECS Fargate - Traefik Enterprise](#installing-traefik-enterprise-on-ecs-fargate-traefik-enterprise) - [Traefik Enterprise GitOps Flow - Traefik Enterprise](#traefik-enterprise-gitops-flow-traefik-enterprise) - [Install Traefik Enterprise with Helm Chart - Traefik Enterprise](#install-traefik-enterprise-with-helm-chart-traefik-enterprise) - [Install Traefik Enterprise Using teectl - Traefik Enterprise](#install-traefik-enterprise-using-teectl-traefik-enterprise) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Install Traefik Enterprise on HashiCorp Nomad - Traefik Enterprise](#install-traefik-enterprise-on-hashicorp-nomad-traefik-enterprise) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Redirecting...](#redirecting-) - [Install Traefik Enterprise On-Premises - Traefik Enterprise](#install-traefik-enterprise-on-premises-traefik-enterprise) - [Traefik Enterprise Installing Requirements - Traefik Enterprise](#traefik-enterprise-installing-requirements-traefik-enterprise) - [Traefik Hub | Traefik Hub Documentation](#traefik-hub-traefik-hub-documentation) - [Quick-Start Guide | Traefik Hub Documentation](#quick-start-guide-traefik-hub-documentation) - [API Management Concepts | Traefik Hub Documentation](#api-management-concepts-traefik-hub-documentation) - [Quick-Start Guide | Traefik Hub Documentation](#quick-start-guide-traefik-hub-documentation) - [Release Notes | Traefik Hub Documentation](#release-notes-traefik-hub-documentation) - [Release Notes | Traefik Hub Documentation](#release-notes-traefik-hub-documentation) - [61 docs tagged with "API Management" | Traefik Hub Documentation](#61-docs-tagged-with-api-management-traefik-hub-documentation) - [API Management Concepts | Traefik Hub Documentation](#api-management-concepts-traefik-hub-documentation) - [Gateway Dashboard | Traefik Hub Documentation](#gateway-dashboard-traefik-hub-documentation) - [Unknown](#unknown) - [Tags | Traefik Hub Documentation](#tags-traefik-hub-documentation) - [Installation | Traefik Hub Documentation](#installation-traefik-hub-documentation) - [Installation | Traefik Hub Documentation](#installation-traefik-hub-documentation) - [API Key Authentication | Traefik Hub Documentation](#api-key-authentication-traefik-hub-documentation) - [Gateway API | Traefik Hub Documentation](#gateway-api-traefik-hub-documentation) - [42 docs tagged with "API Gateway" | Traefik Hub Documentation](#42-docs-tagged-with-api-gateway-traefik-hub-documentation) - [Distributed Rate Limit | Traefik Hub Documentation](#distributed-rate-limit-traefik-hub-documentation) - [Account Settings | Traefik Hub Documentation](#account-settings-traefik-hub-documentation) - [Authentication & Authorization | Traefik Hub Documentation](#authentication-authorization-traefik-hub-documentation) - [API Plan | Traefik Hub Documentation](#api-plan-traefik-hub-documentation) - [Distributed Rate Limit | Traefik Hub Documentation](#distributed-rate-limit-traefik-hub-documentation) - [Authentication & Authorization | Traefik Hub Documentation](#authentication-authorization-traefik-hub-documentation) - [Dashboard | Traefik Hub Documentation](#dashboard-traefik-hub-documentation) - [One doc tagged with "Ingress Management" | Traefik Hub Documentation](#one-doc-tagged-with-ingress-management-traefik-hub-documentation) - [Unknown](#unknown) - [6 docs tagged with "CRD" | Traefik Hub Documentation](#6-docs-tagged-with-crd-traefik-hub-documentation) - [FAQ | Traefik Hub Documentation](#faq-traefik-hub-documentation) - [FIPS Compliant Image | Traefik Hub Documentation](#fips-compliant-image-traefik-hub-documentation) - [One doc tagged with "Quick Start" | Traefik Hub Documentation](#one-doc-tagged-with-quick-start-traefik-hub-documentation) - [One doc tagged with "Quick Start" | Traefik Hub Documentation](#one-doc-tagged-with-quick-start-traefik-hub-documentation) - [One doc tagged with "Guide" | Traefik Hub Documentation](#one-doc-tagged-with-guide-traefik-hub-documentation) - [One doc tagged with "Guide" | Traefik Hub Documentation](#one-doc-tagged-with-guide-traefik-hub-documentation) - [One doc tagged with "AccessLogs" | Traefik Hub Documentation](#one-doc-tagged-with-accesslogs-traefik-hub-documentation) - [One doc tagged with "Compliance" | Traefik Hub Documentation](#one-doc-tagged-with-compliance-traefik-hub-documentation) - [One doc tagged with "Consul Catalog" | Traefik Hub Documentation](#one-doc-tagged-with-consul-catalog-traefik-hub-documentation) - [One doc tagged with "API Key Introspection" | Traefik Hub Documentation](#one-doc-tagged-with-api-key-introspection-traefik-hub-documentation) - [5 docs tagged with "Auto Discovery" | Traefik Hub Documentation](#5-docs-tagged-with-auto-discovery-traefik-hub-documentation) - [One doc tagged with "Access" | Traefik Hub Documentation](#one-doc-tagged-with-access-traefik-hub-documentation) - [One doc tagged with "AI" | Traefik Hub Documentation](#one-doc-tagged-with-ai-traefik-hub-documentation) - [One doc tagged with "Logs" | Traefik Hub Documentation](#one-doc-tagged-with-logs-traefik-hub-documentation) - [One doc tagged with "Migration" | Traefik Hub Documentation](#one-doc-tagged-with-migration-traefik-hub-documentation) - [3 docs tagged with "Consul" | Traefik Hub Documentation](#3-docs-tagged-with-consul-traefik-hub-documentation) - [One doc tagged with "Distributed RateLimit" | Traefik Hub Documentation](#one-doc-tagged-with-distributed-ratelimit-traefik-hub-documentation) - [3 docs tagged with "Docker" | Traefik Hub Documentation](#3-docs-tagged-with-docker-traefik-hub-documentation) - [One doc tagged with "External APIs" | Traefik Hub Documentation](#one-doc-tagged-with-external-apis-traefik-hub-documentation) - [2 docs tagged with "FIPS" | Traefik Hub Documentation](#2-docs-tagged-with-fips-traefik-hub-documentation) - [2 docs tagged with "GatewayAPI" | Traefik Hub Documentation](#2-docs-tagged-with-gatewayapi-traefik-hub-documentation) - [One doc tagged with "Group" | Traefik Hub Documentation](#one-doc-tagged-with-group-traefik-hub-documentation) - [One doc tagged with "Guide" | Traefik Hub Documentation](#one-doc-tagged-with-guide-traefik-hub-documentation) - [2 docs tagged with "Hashicorp" | Traefik Hub Documentation](#2-docs-tagged-with-hashicorp-traefik-hub-documentation) - [One doc tagged with "Heathcheck" | Traefik Hub Documentation](#one-doc-tagged-with-heathcheck-traefik-hub-documentation) - [One doc tagged with "API Portal Auth" | Traefik Hub Documentation](#one-doc-tagged-with-api-portal-auth-traefik-hub-documentation) - [One doc tagged with "API Version" | Traefik Hub Documentation](#one-doc-tagged-with-api-version-traefik-hub-documentation) - [One doc tagged with "API Versioning" | Traefik Hub Documentation](#one-doc-tagged-with-api-versioning-traefik-hub-documentation) - [One doc tagged with "APIM" | Traefik Hub Documentation](#one-doc-tagged-with-apim-traefik-hub-documentation) - [One doc tagged with "Applications" | Traefik Hub Documentation](#one-doc-tagged-with-applications-traefik-hub-documentation) - [One doc tagged with "Authorization" | Traefik Hub Documentation](#one-doc-tagged-with-authorization-traefik-hub-documentation) - [One doc tagged with "Azure" | Traefik Hub Documentation](#one-doc-tagged-with-azure-traefik-hub-documentation) - [One doc tagged with "BasicAuth" | Traefik Hub Documentation](#one-doc-tagged-with-basicauth-traefik-hub-documentation) - [One doc tagged with "Caching" | Traefik Hub Documentation](#one-doc-tagged-with-caching-traefik-hub-documentation) - [One doc tagged with "Canary" | Traefik Hub Documentation](#one-doc-tagged-with-canary-traefik-hub-documentation) - [5 docs tagged with "ACME" | Traefik Hub Documentation](#5-docs-tagged-with-acme-traefik-hub-documentation) - [3 docs tagged with "API Key" | Traefik Hub Documentation](#3-docs-tagged-with-api-key-traefik-hub-documentation) - [One doc tagged with "Providers" | Traefik Hub Documentation](#one-doc-tagged-with-providers-traefik-hub-documentation) - [One doc tagged with "Router" | Traefik Hub Documentation](#one-doc-tagged-with-router-traefik-hub-documentation) - [4 docs tagged with "Routing" | Traefik Hub Documentation](#4-docs-tagged-with-routing-traefik-hub-documentation) - [One doc tagged with "SPIFFE" | Traefik Hub Documentation](#one-doc-tagged-with-spiffe-traefik-hub-documentation) - [One doc tagged with "Services" | Traefik Hub Documentation](#one-doc-tagged-with-services-traefik-hub-documentation) - [One doc tagged with "Linode Kubernetes EngineLinode Kubernetes Engine (LKE)" | Traefik Hub Documentation](#one-doc-tagged-with-linode-kubernetes-enginelinode-kubernetes-engine-lke-traefik-hub-documentation) - [One doc tagged with "Linter" | Traefik Hub Documentation](#one-doc-tagged-with-linter-traefik-hub-documentation) - [One doc tagged with "LLM" | Traefik Hub Documentation](#one-doc-tagged-with-llm-traefik-hub-documentation) - [8 docs tagged with "Load-balacing" | Traefik Hub Documentation](#8-docs-tagged-with-load-balacing-traefik-hub-documentation) - [One doc tagged with "Logging" | Traefik Hub Documentation](#one-doc-tagged-with-logging-traefik-hub-documentation) - [One doc tagged with "Managed Subscriptions" | Traefik Hub Documentation](#one-doc-tagged-with-managed-subscriptions-traefik-hub-documentation) - [One doc tagged with "Model Context Protocol" | Traefik Hub Documentation](#one-doc-tagged-with-model-context-protocol-traefik-hub-documentation) - [One doc tagged with "Oracle Kubernetes Engine (OKE)" | Traefik Hub Documentation](#one-doc-tagged-with-oracle-kubernetes-engine-oke-traefik-hub-documentation) - [One doc tagged with "Prometheus" | Traefik Hub Documentation](#one-doc-tagged-with-prometheus-traefik-hub-documentation) - [One doc tagged with "API Auth" | Traefik Hub Documentation](#one-doc-tagged-with-api-auth-traefik-hub-documentation) - [4 docs tagged with "Ingress" | Traefik Hub Documentation](#4-docs-tagged-with-ingress-traefik-hub-documentation) - [One doc tagged with "Ingress Management" | Traefik Hub Documentation](#one-doc-tagged-with-ingress-management-traefik-hub-documentation) - [2 docs tagged with "IngressRoute" | Traefik Hub Documentation](#2-docs-tagged-with-ingressroute-traefik-hub-documentation) - [One doc tagged with "JWT Authentication" | Traefik Hub Documentation](#one-doc-tagged-with-jwt-authentication-traefik-hub-documentation) - [2 docs tagged with "Dashboard" | Traefik Hub Documentation](#2-docs-tagged-with-dashboard-traefik-hub-documentation) - [One doc tagged with "Model Context Protocol (MCP)" | Traefik Hub Documentation](#one-doc-tagged-with-model-context-protocol-mcp-traefik-hub-documentation) - [One doc tagged with "Networking" | Traefik Hub Documentation](#one-doc-tagged-with-networking-traefik-hub-documentation) - [One doc tagged with "NIMs" | Traefik Hub Documentation](#one-doc-tagged-with-nims-traefik-hub-documentation) - [One doc tagged with "Nutanix Kubernetes Pltatform" | Traefik Hub Documentation](#one-doc-tagged-with-nutanix-kubernetes-pltatform-traefik-hub-documentation) - [One doc tagged with "NVIDIA" | Traefik Hub Documentation](#one-doc-tagged-with-nvidia-traefik-hub-documentation) - [One doc tagged with "OCI Kubernetes Engine" | Traefik Hub Documentation](#one-doc-tagged-with-oci-kubernetes-engine-traefik-hub-documentation) - [One doc tagged with "Offline Mode" | Traefik Hub Documentation](#one-doc-tagged-with-offline-mode-traefik-hub-documentation) - [2 docs tagged with "Nomad" | Traefik Hub Documentation](#2-docs-tagged-with-nomad-traefik-hub-documentation) - [2 docs tagged with "API Mocking" | Traefik Hub Documentation](#2-docs-tagged-with-api-mocking-traefik-hub-documentation) - [3 docs tagged with "API Access" | Traefik Hub Documentation](#3-docs-tagged-with-api-access-traefik-hub-documentation) - [One doc tagged with "Quick Start" | Traefik Hub Documentation](#one-doc-tagged-with-quick-start-traefik-hub-documentation) - [One doc tagged with "Rate Limiting" | Traefik Hub Documentation](#one-doc-tagged-with-rate-limiting-traefik-hub-documentation) - [One doc tagged with "RateLimit" | Traefik Hub Documentation](#one-doc-tagged-with-ratelimit-traefik-hub-documentation) - [One doc tagged with "SSO" | Traefik Hub Documentation](#one-doc-tagged-with-sso-traefik-hub-documentation) - [One doc tagged with "Stickiness" | Traefik Hub Documentation](#one-doc-tagged-with-stickiness-traefik-hub-documentation) - [One doc tagged with "Swagger" | Traefik Hub Documentation](#one-doc-tagged-with-swagger-traefik-hub-documentation) - [One doc tagged with "TBAC" | Traefik Hub Documentation](#one-doc-tagged-with-tbac-traefik-hub-documentation) - [One doc tagged with "Tailscale" | Traefik Hub Documentation](#one-doc-tagged-with-tailscale-traefik-hub-documentation) - [3 docs tagged with "TCP" | Traefik Hub Documentation](#3-docs-tagged-with-tcp-traefik-hub-documentation) - [One doc tagged with "Oracle IAM" | Traefik Hub Documentation](#one-doc-tagged-with-oracle-iam-traefik-hub-documentation) - [2 docs tagged with "Linux" | Traefik Hub Documentation](#2-docs-tagged-with-linux-traefik-hub-documentation) - [2 docs tagged with "Load-Balancing" | Traefik Hub Documentation](#2-docs-tagged-with-load-balancing-traefik-hub-documentation) - [5 docs tagged with "Mirroring" | Traefik Hub Documentation](#5-docs-tagged-with-mirroring-traefik-hub-documentation) - [2 docs tagged with "OpenAPI" | Traefik Hub Documentation](#2-docs-tagged-with-openapi-traefik-hub-documentation) - [2 docs tagged with "OpenTelemetry" | Traefik Hub Documentation](#2-docs-tagged-with-opentelemetry-traefik-hub-documentation) - [4 docs tagged with "Weighted Round Robin (WRR)" | Traefik Hub Documentation](#4-docs-tagged-with-weighted-round-robin-wrr-traefik-hub-documentation) - [One doc tagged with "GitOps" | Traefik Hub Documentation](#one-doc-tagged-with-gitops-traefik-hub-documentation) - [6 docs tagged with "Monitoring" | Traefik Hub Documentation](#6-docs-tagged-with-monitoring-traefik-hub-documentation) - [3 docs tagged with "OAuth" | Traefik Hub Documentation](#3-docs-tagged-with-oauth-traefik-hub-documentation) - [3 docs tagged with "Tracing" | Traefik Hub Documentation](#3-docs-tagged-with-tracing-traefik-hub-documentation) - [8 docs tagged with "TLS certificates" | Traefik Hub Documentation](#8-docs-tagged-with-tls-certificates-traefik-hub-documentation) - [2 docs tagged with "Kubernetes" | Traefik Hub Documentation](#2-docs-tagged-with-kubernetes-traefik-hub-documentation) - [2 docs tagged with "GitOps" | Traefik Hub Documentation](#2-docs-tagged-with-gitops-traefik-hub-documentation) - [One doc tagged with "Access Control" | Traefik Hub Documentation](#one-doc-tagged-with-access-control-traefik-hub-documentation) - [6 docs tagged with "Metrics" | Traefik Hub Documentation](#6-docs-tagged-with-metrics-traefik-hub-documentation) - [One doc tagged with "Rate Limiting" | Traefik Hub Documentation](#one-doc-tagged-with-rate-limiting-traefik-hub-documentation) - [4 docs tagged with "Key Authentication" | Traefik Hub Documentation](#4-docs-tagged-with-key-authentication-traefik-hub-documentation) - [7 docs tagged with "Observability" | Traefik Hub Documentation](#7-docs-tagged-with-observability-traefik-hub-documentation) - [5 docs tagged with "OIDC" | Traefik Hub Documentation](#5-docs-tagged-with-oidc-traefik-hub-documentation) - [3 docs tagged with "User" | Traefik Hub Documentation](#3-docs-tagged-with-user-traefik-hub-documentation) - [One doc tagged with "GitHub" | Traefik Hub Documentation](#one-doc-tagged-with-github-traefik-hub-documentation) - [One doc tagged with "Governance" | Traefik Hub Documentation](#one-doc-tagged-with-governance-traefik-hub-documentation) - [7 docs tagged with "TLS" | Traefik Hub Documentation](#7-docs-tagged-with-tls-traefik-hub-documentation) - [2 docs tagged with "Workspaces" | Traefik Hub Documentation](#2-docs-tagged-with-workspaces-traefik-hub-documentation) - [3 docs tagged with "Ingress Mode" | Traefik Hub Documentation](#3-docs-tagged-with-ingress-mode-traefik-hub-documentation) - [5 docs tagged with "Keycloak" | Traefik Hub Documentation](#5-docs-tagged-with-keycloak-traefik-hub-documentation) - [6 docs tagged with "Operations" | Traefik Hub Documentation](#6-docs-tagged-with-operations-traefik-hub-documentation) - [5 docs tagged with "Ingress Mode" | Traefik Hub Documentation](#5-docs-tagged-with-ingress-mode-traefik-hub-documentation) - [5 docs tagged with "Okta" | Traefik Hub Documentation](#5-docs-tagged-with-okta-traefik-hub-documentation) - [6 docs tagged with "Oracle Cloud Infrastructure (OCI)" | Traefik Hub Documentation](#6-docs-tagged-with-oracle-cloud-infrastructure-oci-traefik-hub-documentation) - [One doc tagged with "Helm" | Traefik Hub Documentation](#one-doc-tagged-with-helm-traefik-hub-documentation) - [10 docs tagged with "Authentication" | Traefik Hub Documentation](#10-docs-tagged-with-authentication-traefik-hub-documentation) - [5 docs tagged with "Security" | Traefik Hub Documentation](#5-docs-tagged-with-security-traefik-hub-documentation) - [4 docs tagged with "Kubernetes" | Traefik Hub Documentation](#4-docs-tagged-with-kubernetes-traefik-hub-documentation) - [2 docs tagged with "Install" | Traefik Hub Documentation](#2-docs-tagged-with-install-traefik-hub-documentation) - [5 docs tagged with "Ingress Mode" | Traefik Hub Documentation](#5-docs-tagged-with-ingress-mode-traefik-hub-documentation) - [7 docs tagged with "IdP" | Traefik Hub Documentation](#7-docs-tagged-with-idp-traefik-hub-documentation) - [12 docs tagged with "CRD" | Traefik Hub Documentation](#12-docs-tagged-with-crd-traefik-hub-documentation) - [3 docs tagged with "MCP Gateway" | Traefik Hub Documentation](#3-docs-tagged-with-mcp-gateway-traefik-hub-documentation) - [9 docs tagged with "JWT" | Traefik Hub Documentation](#9-docs-tagged-with-jwt-traefik-hub-documentation) - [19 docs tagged with "Kubernetes" | Traefik Hub Documentation](#19-docs-tagged-with-kubernetes-traefik-hub-documentation) - [5 docs tagged with "IdP" | Traefik Hub Documentation](#5-docs-tagged-with-idp-traefik-hub-documentation) - [5 docs tagged with "IdP" | Traefik Hub Documentation](#5-docs-tagged-with-idp-traefik-hub-documentation) - [Entrypoints | Traefik Hub Documentation](#entrypoints-traefik-hub-documentation) - [21 docs tagged with "GitOps" | Traefik Hub Documentation](#21-docs-tagged-with-gitops-traefik-hub-documentation) - [How to Use API Key Authentication | Traefik Hub Documentation](#how-to-use-api-key-authentication-traefik-hub-documentation) - [5 docs tagged with "Okta" | Traefik Hub Documentation](#5-docs-tagged-with-okta-traefik-hub-documentation) - [Static Analyzer | Traefik Hub Documentation](#static-analyzer-traefik-hub-documentation) - [How to Use API Key Authentication | Traefik Hub Documentation](#how-to-use-api-key-authentication-traefik-hub-documentation) - [57 docs tagged with "HTTP" | Traefik Hub Documentation](#57-docs-tagged-with-http-traefik-hub-documentation) - [60 docs tagged with "Middleware" | Traefik Hub Documentation](#60-docs-tagged-with-middleware-traefik-hub-documentation) - [Networking | Traefik Hub Documentation](#networking-traefik-hub-documentation) - [Networking | Traefik Hub Documentation](#networking-traefik-hub-documentation) - [Consumer Authentication | Traefik Hub Documentation](#consumer-authentication-traefik-hub-documentation) - [Consumer Authentication | Traefik Hub Documentation](#consumer-authentication-traefik-hub-documentation) - [Custom Domains | Traefik Hub Documentation](#custom-domains-traefik-hub-documentation) - [Custom Domains | Traefik Hub Documentation](#custom-domains-traefik-hub-documentation) - [Identity Providers | Traefik Hub Documentation](#identity-providers-traefik-hub-documentation) - [Identity Providers | Traefik Hub Documentation](#identity-providers-traefik-hub-documentation) - [Okta JWT Configuration | Traefik Hub Documentation](#okta-jwt-configuration-traefik-hub-documentation) - [OpenAPI | Traefik Hub Documentation](#openapi-traefik-hub-documentation) - [OpenAPI | Traefik Hub Documentation](#openapi-traefik-hub-documentation) - [Tags | Traefik Hub Documentation](#tags-traefik-hub-documentation) - [Traefik Hub Licensing | Traefik Hub Documentation](#traefik-hub-licensing-traefik-hub-documentation) - [5 docs tagged with "Okta" | Traefik Hub Documentation](#5-docs-tagged-with-okta-traefik-hub-documentation) - [5 docs tagged with "Keycloak" | Traefik Hub Documentation](#5-docs-tagged-with-keycloak-traefik-hub-documentation) - [What's new in Traefik Hub? | Traefik Hub Documentation](#what-s-new-in-traefik-hub-traefik-hub-documentation) - [Account Settings | Traefik Hub Documentation](#account-settings-traefik-hub-documentation) - [5 docs tagged with "Keycloak" | Traefik Hub Documentation](#5-docs-tagged-with-keycloak-traefik-hub-documentation) - [8 docs tagged with "JWT" | Traefik Hub Documentation](#8-docs-tagged-with-jwt-traefik-hub-documentation) - [NVIDIA NIMs Integration with Traefik Hub AI Gateway LLM Guard Middleware | Traefik Hub Documentation](#nvidia-nims-integration-with-traefik-hub-ai-gateway-llm-guard-middleware-traefik-hub-documentation) - [One doc tagged with "Access" | Traefik Hub Documentation](#one-doc-tagged-with-access-traefik-hub-documentation) - [Keycloak JWT Configuration | Traefik Hub Documentation](#keycloak-jwt-configuration-traefik-hub-documentation) - [One doc tagged with "API Versioning" | Traefik Hub Documentation](#one-doc-tagged-with-api-versioning-traefik-hub-documentation) - [One doc tagged with "API Collection" | Traefik Hub Documentation](#one-doc-tagged-with-api-collection-traefik-hub-documentation) - [One doc tagged with "Ingress Management" | Traefik Hub Documentation](#one-doc-tagged-with-ingress-management-traefik-hub-documentation) - [3 docs tagged with "User" | Traefik Hub Documentation](#3-docs-tagged-with-user-traefik-hub-documentation) - [One doc tagged with "Custom Certificates" | Traefik Hub Documentation](#one-doc-tagged-with-custom-certificates-traefik-hub-documentation) - [One doc tagged with "Swagger" | Traefik Hub Documentation](#one-doc-tagged-with-swagger-traefik-hub-documentation) - [One doc tagged with "Group" | Traefik Hub Documentation](#one-doc-tagged-with-group-traefik-hub-documentation) - [30 docs tagged with "HTTP" | Traefik Hub Documentation](#30-docs-tagged-with-http-traefik-hub-documentation) - [Unknown](#unknown) - [Unknown](#unknown) - [4 docs tagged with "Authentication" | Traefik Hub Documentation](#4-docs-tagged-with-authentication-traefik-hub-documentation) - [One doc tagged with "API Key Introspection" | Traefik Hub Documentation](#one-doc-tagged-with-api-key-introspection-traefik-hub-documentation) - [One doc tagged with "API Key" | Traefik Hub Documentation](#one-doc-tagged-with-api-key-traefik-hub-documentation) - [One doc tagged with "OIDC" | Traefik Hub Documentation](#one-doc-tagged-with-oidc-traefik-hub-documentation) - [3 docs tagged with "TCP" | Traefik Hub Documentation](#3-docs-tagged-with-tcp-traefik-hub-documentation) - [4 docs tagged with "Authentication" | Traefik Hub Documentation](#4-docs-tagged-with-authentication-traefik-hub-documentation) - [One doc tagged with "Tutorial" | Traefik Hub Documentation](#one-doc-tagged-with-tutorial-traefik-hub-documentation) - [One doc tagged with "Group" | Traefik Hub Documentation](#one-doc-tagged-with-group-traefik-hub-documentation) - [One doc tagged with "Custom Certificates" | Traefik Hub Documentation](#one-doc-tagged-with-custom-certificates-traefik-hub-documentation) - [One doc tagged with "Prometheus" | Traefik Hub Documentation](#one-doc-tagged-with-prometheus-traefik-hub-documentation) - [Networking | Traefik Hub Documentation](#networking-traefik-hub-documentation) - [33 docs tagged with "Middleware" | Traefik Hub Documentation](#33-docs-tagged-with-middleware-traefik-hub-documentation) - [30 docs tagged with "HTTP" | Traefik Hub Documentation](#30-docs-tagged-with-http-traefik-hub-documentation) - [One doc tagged with "API Versioning" | Traefik Hub Documentation](#one-doc-tagged-with-api-versioning-traefik-hub-documentation) --- # Welcome to Traefik Labs documentation | Traefik Labs Docs ![](https://doc.traefik.io/assets/bg-shape-top.png) ![](https://doc.traefik.io/assets/bg-shape-bottom.png) Welcome to Traefik Labs documentation ===================================== Find documentation, guides, configurations, and references you need to use the Traefik Labs products. ![](https://doc.traefik.io/assets/proxy-image@3x.png) Traefik Proxy ------------- The Cloud Native Application Proxy [![download icon](https://doc.traefik.io/assets/icons-system-download@3x.png) Installation](https://doc.traefik.io/traefik/getting-started/install-traefik/) [![quickstart icon](https://doc.traefik.io/assets/icons-system-rocket@3x.png) Get Started](https://doc.traefik.io/traefik/getting-started/quick-start/) [![read icon](https://doc.traefik.io/assets/icons-system-read@3x.png) Documentation](https://doc.traefik.io/traefik/) [![contribute icon](https://doc.traefik.io/assets/icons-system-contribute@3x.png) Contribute](https://github.com/traefik/traefik) ![](https://doc.traefik.io/assets/gateway-image@3x.png) Traefik API Gateway ------------------- Developer’s #1 Cloud Native API Gateway [![download icon](https://doc.traefik.io/assets/icons-system-download@3x.png) Installation](https://doc.traefik.io/traefik-hub/api-gateway/setup/setup-overview) [![quickstart icon](https://doc.traefik.io/assets/icons-system-rocket@3x.png) Get Started](https://doc.traefik.io/traefik-hub/api-gateway/getting-started) [![read icon](https://doc.traefik.io/assets/icons-system-read@3x.png) Documentation](https://doc.traefik.io/traefik-hub/api-gateway/intro) [![quickstart icon](https://doc.traefik.io/assets/icons-system-quickstart@3x.png) Free Trial](https://info.traefik.io/try-traefik-api-gateway) ![](https://doc.traefik.io/assets/management-image@3x.png) Traefik API Management ---------------------- Manage & Govern Your APIs the GitOps Way [![download icon](https://doc.traefik.io/assets/icons-system-download@3x.png) Installation](https://doc.traefik.io/traefik-hub/operations/installation) [![quickstart icon](https://doc.traefik.io/assets/icons-system-rocket@3x.png) Get Started](https://doc.traefik.io/traefik-hub/api-management/quick-start-guide) [![read icon](https://doc.traefik.io/assets/icons-system-read@3x.png) Documentation](https://doc.traefik.io/traefik-hub/introduction/overview) [![quickstart icon](https://doc.traefik.io/assets/icons-system-quickstart@3x.png) Free Trial](https://info.traefik.io/traefik-hub-signup) Traefik Enterprise ------------------ Multi-Orchestrator API Gateway [![download icon](https://doc.traefik.io/assets/icons-system-download@3x.png) Installation](https://doc.traefik.io/traefik-enterprise/installing/requirements/) [![read icon](https://doc.traefik.io/assets/icons-system-read@3x.png) Documentation](https://doc.traefik.io/traefik-enterprise/) [![quickstart icon](https://doc.traefik.io/assets/icons-system-rocket@3x.png) Get Started](https://doc.traefik.io/traefik-enterprise/getting-started/) ![community icon](https://doc.traefik.io/assets/icon-community.png) Find us on the Community Forum ------------------------------ Ask Questions, Discuss, Learn, and Connect with the Traefik Community [Visit Forum](https://community.traefik.io/) ![community icon](https://doc.traefik.io/assets/icon-github.svg) Join the Traefik Community -------------------------- Get started, Contribute, and Submit Issues on GitHub [View GitHub](https://github.com/traefik/traefik) Get Started today ----------------- [Get a demo](https://info.traefik.io/en/request-demo) [Speak with an expert](https://info.traefik.io/speak-with-an-expert) ![](https://doc.traefik.io/assets/bg-cta.png) Traefik Labs uses cookies to improve your experience. By continuing to browse the site you are agreeing to our use of cookies. Find out more in the [Cookie Policy](https://traefik.io/legal/privacy-and-cookie-policy/) . OK --- # Welcome to Traefik Enterprise - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/#welcome-to-traefik-enterprise) Initializing search Welcome to Traefik Enterprise![¶](https://doc.traefik.io/traefik-enterprise/#welcome-to-traefik-enterprise "Permanent link") ============================================================================================================================= ![Traefik Enterprise Architecture](https://doc.traefik.io/traefik-enterprise/assets/img/traefikee-arch-overview-white.png) Traefik Enterprise runs on the edge of your platform to route traffic to your applications. By splitting responsibilities between two planes, Traefik Enterprise follows the principle of "separation of concerns." To ensure that sensitive information only runs on a closed and safe environment, the control plane is not exposed to the outside. As a result, any malicious action from external traffic stays within the data plane and your platform stays safe. Moreover, Traefik Enterprise only relies on encrypted communications between nodes, to add an extra layer of security. This distributed architecture is the cornerstone of Traefik Enterprise’s strengths: natively **highly available**, **scalable**, and **secure**. **New.** Traefik Enterprise 2.2 introduces optional service mesh capabilities that support the latest [Service Mesh Interface (SMI)](https://smi-spec.io/) specification, offering integrated management of inter-process communications between services. Learn more about Traefik Enterprise features in the [Features section](https://doc.traefik.io/traefik-enterprise/features/) . Smooth Operations[¶](https://doc.traefik.io/traefik-enterprise/#smooth-operations "Permanent link") ---------------------------------------------------------------------------------------------------- Traefik Enterprise is based on the [Raft consensus algorithm](https://raft.github.io/) . Installing and managing a Raft-based application is usually a painful experience. Because Traefik Proxy's popularity is due to its usability and refreshing user experience, however, we have extended those benefits to Traefik Enterprise for you. Traefik Enterprise comes with an additional command-line tool called `teectl` (pronounced _"teakettle"_) that can deploy and operate a cluster with several nodes in only one command line. We hope you will love using this time-saving tool. Dashboard[¶](https://doc.traefik.io/traefik-enterprise/#dashboard "Permanent link") ------------------------------------------------------------------------------------ Traefik Enterprise's dashboard shows all the relevant information about your cluster at a glance, including enabled features, providers, entry points, and routers. In addition, it enables easy inspection and error reporting for the optional service mesh. Distributed Features[¶](https://doc.traefik.io/traefik-enterprise/#distributed-features "Permanent link") ---------------------------------------------------------------------------------------------------------- Traefik Enterprise improves Traefik Proxy features by making them distributed throughout your cluster. ### Distributed Rate Limiting[¶](https://doc.traefik.io/traefik-enterprise/#distributed-rate-limiting "Permanent link") Centralize the rate limiting process of all of your proxies, for services with standard [rate limiting configuration](https://doc.traefik.io/traefik/v2.11/middlewares/http/ratelimit/) , just like in Traefik Proxy. ### Distributed In-Flight Request Limiting[¶](https://doc.traefik.io/traefik-enterprise/#distributed-in-flight-request-limiting "Permanent link") Centralize the in-flight request limiting process of all of your proxies, for services with standard [in-flight request limiting configuration](https://doc.traefik.io/traefik/v2.11/middlewares/http/inflightreq/) , just like in Traefik Proxy v2. Service Mesh[¶](https://doc.traefik.io/traefik-enterprise/#service-mesh "Permanent link") ------------------------------------------------------------------------------------------ Enabling Traefik Enterprise's service mesh capabilities provides a straightforward, easy-to-use way to manage inter-process communication between microservices on a cluster. Features include [access control](https://doc.traefik.io/traefik-mesh/configuration/#access-control) , [traffic splitting](https://doc.traefik.io/traefik-mesh/configuration/#traffic-splitting) , and support for the [circuit breaker pattern](https://doc.traefik.io/traefik-mesh/configuration/#circuit-breaker) . Support[¶](https://doc.traefik.io/traefik-enterprise/#support "Permanent link") -------------------------------------------------------------------------------- Traefik Enterprise licenses come with built-in support: contact our team of engineers at [support.traefik.io](https://support.traefik.io/) . What's Next? If you want to learn more about Traefik Enterprise concepts, please visit the [Concepts section](https://doc.traefik.io/traefik-enterprise/concepts/) . If you are interested in getting started with Traefik Enterprise right away, please have a look at the ["Getting Started" page](https://doc.traefik.io/traefik-enterprise/getting-started/) . You might also want to check the other sections on Installing, Operating, and Integrating Traefik Enterprise, or [contact support](https://support.traefik.io/) . --- # Traefik Enterprise Architecture Concepts - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/concepts/#concepts) Initializing search Concepts[¶](https://doc.traefik.io/traefik-enterprise/concepts/#concepts "Permanent link") =========================================================================================== Architecture Overview[¶](https://doc.traefik.io/traefik-enterprise/concepts/#architecture-overview "Permanent link") --------------------------------------------------------------------------------------------------------------------- ![Traefik Enterprise Architecture](https://doc.traefik.io/traefik-enterprise/assets/img/traefikee-arch-overview-white.png) Traefik Enterprise's architecture consists of nodes spread into two different planes: the **control plane** and the **data plane**. The notions of [control plane](https://en.wikipedia.org/wiki/Control_plane) and [data plane](https://en.wikipedia.org/wiki/Data_plane) are well-known patterns and are not specific to Traefik Enterprise. **New.** In addition, Traefik Enterprise 2.2 introduces optional **service mesh** capabilities when running on a Kubernetes cluster. As mentioned in the [introduction](https://doc.traefik.io/traefik-enterprise/) : * The **data plane** hosts horizontally scalable nodes that forward ingress traffic to your services. * The **control plane** hosts distributed nodes that watch your platform and its services to configure the data plane. * The **service mesh** facilitates and controls inter-process communication between services running on your cluster. This distributed architecture is the cornerstone of Traefik Enterprise’s strengths: natively **highly available**, **scalable**, and **secure**. Of course, every (non-deprecated) feature that is available for Traefik Proxy is also available for Traefik Enterprise. ### Cluster and Nodes[¶](https://doc.traefik.io/traefik-enterprise/concepts/#cluster-and-nodes "Permanent link") Traefik Enterprise consists of a cluster of nodes communicating with one another. Each node is independent and belongs to either the control plane, the data plane, or the service mesh. #### Nodes in the Data Plane[¶](https://doc.traefik.io/traefik-enterprise/concepts/#nodes-in-the-data-plane "Permanent link") ![The Data Plane](https://doc.traefik.io/traefik-enterprise/assets/img/traefikee-arch-ingress-white.png) These nodes are the workers that route the incoming requests. You may view these nodes as regular Traefik Proxy instances that are automatically configured by other nodes from the control plane. These nodes know nothing about your other infrastructure components and won't need to communicate with them. #### Nodes in the Control Plane[¶](https://doc.traefik.io/traefik-enterprise/concepts/#nodes-in-the-control-plane "Permanent link") ![The Control Plane](https://doc.traefik.io/traefik-enterprise/assets/img/traefikee-arch-controller-white.png) These nodes are responsible for querying your infrastructure components, creating the resulting configuration, and sending the routing instructions to the nodes in the data plane. These nodes will not handle incoming traffic. Their main responsibilities are: * Storing the data of the cluster, including events, certificates, and Traefik Proxy configuration. * Sharing the data of the cluster as a distributed key-value store with all other nodes in the control plane. * Propagating the latest configuration to the nodes in the data plane. * Providing an API to configure the cluster and to query its state. * Managing the [dynamic configuration](https://doc.traefik.io/traefik-enterprise/references/configuration/dynamic/file/) . ### Service Mesh[¶](https://doc.traefik.io/traefik-enterprise/concepts/#service-mesh "Permanent link") **New.** When running on a Kubernetes cluster, in addition to managing incoming external traffic to services, Traefik Enterprise can also provide service mesh capabilities based on the [Service Mesh Interface (SMI)](https://smi-spec.io/) specification. The services mesh facilitates and manages inter-process communication between services. Available features include access control, rate limiting, traffic splitting, and support for the [circuit breaker pattern](https://doc.traefik.io/traefik-mesh/configuration/#circuit-breaker) . ![The Service Mesh](https://doc.traefik.io/traefik-enterprise/assets/img/traefikee-arch-mesh-white.png) Traefik Enterprise's service mesh is based on the Kubernetes concept of a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) , which ensures that a [service mesh proxy](https://doc.traefik.io/traefik-enterprise/kb/glossary/#proxy) runs on each node of a cluster to handle communincation between services. The service mesh is designed to be [non-invasive](https://doc.traefik.io/traefik-mesh/#non-invasive-service-mesh) , meaning it requires no sidecar containers, does not modify your Kubernetes objects, is opt-in by default, and does not modify your traffic without your knowledge. High Availability[¶](https://doc.traefik.io/traefik-enterprise/concepts/#high-availability "Permanent link") ------------------------------------------------------------------------------------------------------------- Traefik Enterprise nodes work together to form a high-availability cluster, which Traefik Enterprise manages using the [Raft algorithm](https://raft.github.io/) . (For a visual explanation of Raft, [see here](http://thesecretlivesofdata.com/raft/) .) Nodes in the cluster can have three different roles: * **Agent**: a node that accepts requests on behalf of the leader. * **Controller**: an agent responsible for querying your infrastructure components. Controllers form a _quorum_ to assume cluster HA. * **Leader**: a controller responsible for updating/querying the state of the cluster. When a leader node becomes unavailable, if the quorum is not broken, the other controllers elect a new leader among the healthy controllers. When a controller node becomes unavailable, if the number of healthy controllers (including the leader) is not sufficient, the quorum is broken and the cluster is down. When an agent node becomes unavailable, the cluster state doesn't change and it does not need to react. If a new healthy node wants to join the cluster, it will participate as an agent or controller. ### HA in the Data Plane[¶](https://doc.traefik.io/traefik-enterprise/concepts/#ha-in-the-data-plane "Permanent link") A node in the data plane is an agent. In Traefik Enterprise we call these nodes [ingress proxies](https://doc.traefik.io/traefik-enterprise/kb/glossary/#proxy) . Each node in the data plane can handle the routing for every configured request that arrives in your cluster. If a node becomes unavailable, the other nodes will take over and accept more incoming requests. The data plane only needs one healthy agent to be functional. ### HA in the Control Plane[¶](https://doc.traefik.io/traefik-enterprise/concepts/#ha-in-the-control-plane "Permanent link") Nodes in the control plane are responsible for the routing configuration and applying changes to the state of the cluster. In Traefik Enterprise we call those nodes [controllers](https://doc.traefik.io/traefik-enterprise/kb/glossary/#controller) . One of the controllers will be elected as the leader of the cluster. A controller will send the configuration change requests to the leader who will then update the cluster state. ### Common Questions[¶](https://doc.traefik.io/traefik-enterprise/concepts/#common-questions "Permanent link") #### How Many Nodes Do You Need in the Control Plane?[¶](https://doc.traefik.io/traefik-enterprise/concepts/#how-many-nodes-do-you-need-in-the-control-plane "Permanent link") The cluster is healthy as long as the nodes in the control plane can reach a quorum to elect a new leader in case of failure. The quorum is `(N/2)+1` where `N` is the initial number of nodes in the control plane. If the number of healthy nodes goes below this number, the cluster must [be recovered](https://doc.traefik.io/traefik-enterprise/operations/disaster-recovery/) before it resumes normal operations. #### What Happens if the Control Plane is Unhealthy?[¶](https://doc.traefik.io/traefik-enterprise/concepts/#what-happens-if-the-control-plane-is-unhealthy "Permanent link") The data plane will continue to route the requests based on the latest known configuration. Scalability[¶](https://doc.traefik.io/traefik-enterprise/concepts/#scalability "Permanent link") ------------------------------------------------------------------------------------------------- [Proxies](https://doc.traefik.io/traefik-enterprise/kb/glossary/#proxy) and [controllers](https://doc.traefik.io/traefik-enterprise/kb/glossary/#controller) can both be scaled horizontally by deploying more nodes. Load balancing the incoming requests between Traefik Enterprise proxies is achieved by your infrastructure components (e.g., using Services in Kubernetes). **New.** On Kubernetes clusters, Traefik Enterprise's service mesh DaemonSet ensures that a [service mesh proxy](https://doc.traefik.io/traefik-enterprise/kb/glossary/#proxy) runs as a pod on each node. A new service mesh proxy instance will automatically be created on each new node that is added to the cluster. About Auto Scaling Depending on your infrastructure components, you may benefit from auto-scaling tools that will help you automatically scale up/down your nodes as needed. For instance, for Kubernetes, here is a guide to set up a [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/) . Security[¶](https://doc.traefik.io/traefik-enterprise/concepts/#security "Permanent link") ------------------------------------------------------------------------------------------- Having two separate planes for handling different responsibilities improves the resilience of your cluster and also makes it more secure: nodes in the control plane are not exposed to the outside, making an attack against your infrastructure more difficult. What's Next? Now that you have a basic overview of Traefik Enterprise's concepts, to further familiarize yourself with the vocabulary, have a look at the [glossary](https://doc.traefik.io/traefik-enterprise/kb/glossary/) . --- # Traefik Enterprise Features - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/features/#features) Initializing search Features[¶](https://doc.traefik.io/traefik-enterprise/features/#features "Permanent link") =========================================================================================== High Availability[¶](https://doc.traefik.io/traefik-enterprise/features/#high-availability "Permanent link") ------------------------------------------------------------------------------------------------------------- The control plane is a key component of Traefik Enterprise. It is responsible for storing all cluster data, including events, TLS certificates, and the Traefik Proxy configuration. It is also in charge of connecting to the orchestrator to generate the data plane routing configuration and manage the [service mesh](https://doc.traefik.io/traefik-enterprise/features/#service-mesh) . Since it is such a critical part of your system, Traefik Enterprise is designed from the ground up to be fault tolerant: the control plane runs natively in cluster mode without any extra configuration or external key-value store. It ensures your data is always available and safe by using an internal distributed store, implemented with [Raft](https://raft.github.io/) . You can find more information on high availability by visiting [Concepts -> High Availability](https://doc.traefik.io/traefik-enterprise/concepts/#high-availability) . Scalability[¶](https://doc.traefik.io/traefik-enterprise/features/#scalability "Permanent link") ------------------------------------------------------------------------------------------------- The data plane is in charge of forwarding the incoming requests to the backend applications running inside your infrastructure. It is designed to scale horizontally in order to face irregular network loads. Traefik Enterprise handles high loads easily: just add more nodes to the data plane to handle the additional requests. When the peak is gone, shrink the number of nodes to save resources. Of course, this process can be handled automatically using auto-scaling tools. Security[¶](https://doc.traefik.io/traefik-enterprise/features/#security "Permanent link") ------------------------------------------------------------------------------------------- By splitting responsibilities between two planes, Traefik Enterprise follows the principle of "separation of concerns." To ensure that sensitive information only runs within a closed and safe environment, the control plane is not exposed to the outside. As a result, any malicious action from external traffic stays within the data plane and your platform stays safe. Moreover, Traefik Enterprise only relies on encrypted communications between nodes, to add an extra layer of security. Service Mesh[¶](https://doc.traefik.io/traefik-enterprise/features/#service-mesh "Permanent link") --------------------------------------------------------------------------------------------------- **New.** Traefik Enterprise 2.2 introduces an optional integrated service mesh -- a feature not provided by Traefik Proxy. While Traefik Enterprise ingress nodes control how external traffic can access your services, Traefik Enterprise service mesh nodes manage internal traffic between multiple microservices that make up an application on your cluster. The service mesh takes advantage of Traefik Enterprise's architecture and is integrated with its control plane. It conforms to the current [Service Mesh Interface (SMI)](https://smi-spec.io/) specification and supports such features as traffic access control, traffic splitting, and the [circuit breaker pattern](https://doc.traefik.io/traefik-mesh/configuration/#circuit-breaker) . Smooth Operations[¶](https://doc.traefik.io/traefik-enterprise/features/#smooth-operations "Permanent link") ------------------------------------------------------------------------------------------------------------- Installing and managing a Raft-based application is usually a painful experience. Because Traefik Proxy's popularity is due to its usability and refreshing user experience, however, we have extended those benefits to Traefik Enterprise for you. Traefik Enterprise comes with an additional command-line tool called `teectl` (pronounced "teakettle") that can deploy and operate a cluster with several nodes with a single command line. We hope you will love using this time-saving tool. Dashboard[¶](https://doc.traefik.io/traefik-enterprise/features/#dashboard "Permanent link") --------------------------------------------------------------------------------------------- The Traefik Enterprise dashboard shows you all the relevant information about your cluster at a glance. * Monitor and view error reporting for your cluster: ![Dashboard Overview](https://doc.traefik.io/traefik-enterprise/assets/img/dashboard-overview.png) * Visualize the nodes of your cluster: ![Dashboard Cluster Overview](https://doc.traefik.io/traefik-enterprise/assets/img/dashboard-cluster-overview.png) * Monitor and view error reporting for your ingress: ![Dashboard Ingress Overview](https://doc.traefik.io/traefik-enterprise/assets/img/dashboard-ingress-overview.png) * Monitor and view error reporting for your service mesh: ![Dashboard Mesh Overview](https://doc.traefik.io/traefik-enterprise/assets/img/dashboard-mesh-overview.png) Support[¶](https://doc.traefik.io/traefik-enterprise/features/#support "Permanent link") ----------------------------------------------------------------------------------------- Traefik Enterprise licenses come with built-in support: contact our team of engineers at [support.traefik.io](https://support.traefik.io/) . Compare[¶](https://doc.traefik.io/traefik-enterprise/features/#compare "Permanent link") ----------------------------------------------------------------------------------------- | Feature | Traefik Proxy | Traefik Enterprise | | --- | --- | --- | | Websockets, HTTP/2, TCP, GRPC ready | ✓ | ✓ | | Dynamic Configuration | ✓ | ✓ | | Static Configuration Auto Reload | | ✓ | | Metrics | ✓ | ✓ | | Tracing | ✓ | ✓ | | Let's Encrypt | ✓ | ✓ | | Public Plugin Support | ✓ | ✓ | | Private Plugin Support | | ✓ | | Vault PKI | | ✓ | | Vault K/V (TLS cert store) | | ✓ | | Integrated Service Mesh | | ✓ | | Multi-cluster ACME | | ✓ | | LDAP Authentication | | ✓ | | JWT Authentication | | ✓ | | HMAC Authentication | | ✓ | | OAuth Token Introspection | | ✓ | | OpenID Connect authentication | | ✓ | | Open Policy Agent Support | | ✓ | | Vault AppRole Authentication | | ✓ | | Distributed Let's Encrypt | | ✓ | | Distributed Rate Limit | | ✓ | | Distributed In Flight Request | | ✓ | | High Availability | | ✓ | | Encrypted Cluster Communication | | ✓ | | Cluster-Wide Dashboard | | ✓ | | Remote CLI | | ✓ | | HTTP Cache | | ✓ | | API Portal | | ✓ | | Built-In Commercial Support | | ✓ | | FIPS compliance | | ✓ | What's Next? Now that you have a basic overview of Traefik Enterprise's features, you might want to go straight to the installation phase and read the [Quick Start](https://doc.traefik.io/traefik-enterprise/getting-started/) . Or maybe you'd like to familiarize yourself even more with the vocabulary and take a look at the [glossary](https://doc.traefik.io/traefik-enterprise/kb/glossary/) ? --- # Traefik Enterprise Getting Started Guide - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/getting-started/#traefik-enterprise-installation-quick-start) Initializing search Traefik Enterprise Installation Quick Start[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#traefik-enterprise-installation-quick-start "Permanent link") ======================================================================================================================================================================== Installing the `teectl` Command-Line Tool[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#installing-the-teectl-command-line-tool "Permanent link") ------------------------------------------------------------------------------------------------------------------------------------------------------------------ ### Downloading[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#downloading "Permanent link") First, download `teectl`, a tool that will help you install and is required to operate your cluster, using one of the following links: * `teectl` for [Linux (Intel) 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/teectl_v2.12.5_linux_amd64.tar.gz) * `teectl` for [Linux (ARM) v6](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/teectl_v2.12.5_linux_armv6.tar.gz) * `teectl` for [Linux (ARM) v7](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/teectl_v2.12.5_linux_armv7.tar.gz) * `teectl` for [macOS (Intel) 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/teectl_v2.12.5_darwin_amd64.tar.gz) * `teectl` for [macOS (ARM) 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/teectl_v2.12.5_darwin_arm64.tar.gz) * `teectl` for [Windows (Intel) 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/teectl_v2.12.5_windows_amd64.zip) Check the integrity of the downloaded file Use the sha256 checksums of the binaries that can be found [here](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_checksums.txt) to verify the binaries: Linux # Compare this value to the one found in traefikee_checksums.txt sha256sum ./teectl_v2.12.5_linux_amd64.tar.gz macOS # Compare this value to the one found in traefikee_checksums.txt shasum -a256 ./teectl_v2.12.5_darwin_amd64.tar.gz Windows PowerShell # Compare this value to the one found in traefikee_checksums.txt Get-FileHash teectl_v2.12.5_windows_amd64.zip -Algorithm SHA256 Extract the downloaded archive Linux # Compare this value to the one found in traefikee_checksums.txt tar -zxvf teectl_v2.12.5_linux_amd64.tar.gz macOS # Compare this value to the one found in traefikee_checksums.txt tar -zxvf ./teectl_v2.12.5_darwin_amd64.tar.gz Windows PowerShell # Compare this value to the one found in traefikee_checksums.txt Expand-Archive teectl_v2.12.5_windows_amd64.zip ### Installing[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#installing "Permanent link") Copy the `teectl` binary to your `PATH` or add its location to your environment (`$PATH` or `%PATH%` depending on your OS) and make sure it's executable: Linux/macOS # Example with /usr/local/bin # These command may need sudo rights cp ./teectl /usr/local/bin/teectl # Should print "/usr/local/bin/teectl" command -v teectl Windows PowerShell # Example with C:\Program Files Copy-Item "teectl.exe" -Destination "C:\Program Files\teectl.exe" # Should print "C:\Program Files\teectl.exe" where teectl ### Verifying[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#verifying "Permanent link") You can now test your installation by executing the command-line `teectl` with the `help` option, it should return the help: Command teectl --help Result teectl teectl is a controller for Traefik Enterprise (Enterprise Edition). Complete documentation is available at https://doc.traefik.io. Usage: teectl [command] [resource] [flags] Use "teectl [command] --help" for help on any command. Commands: apply Apply configuration to a cluster get Get resources create Create resources delete Delete resources recover Recovers a cluster that has lost quorum setup Setup a cluster to manage support-dump Gather data from the cluster to assist in support backup Backs up the configuration of a running Traefik Enterprise cluster restore Restore a previously backed up cluster configuration version Print version Resources: acme-certs, ac nodes, n tls-certs, tc static-config, s Install Traefik Enterprise with `teectl`[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#install-traefik-enterprise-with-teectl "Permanent link") ---------------------------------------------------------------------------------------------------------------------------------------------------------------- Install your Traefik Enterprise cluster on Kubernetes or Docker Swarm with the following commands: Kubernetes teectl setup --kubernetes && \ # Generates ./bundle.zip teectl setup gen \ --license=.... \ --controllers=1 \ --proxies=2 \ --mesh | kubectl apply -f - && \ # Generate and apply controllers, ingress proxies and mesh proxies teectl setup patch-dns # Patch DNS server Docker Swarm # Generates ./bundle.zip teectl setup --swarm # Deploy controllers teectl setup gen \ --license=.... --controllers=1 | docker stack deploy -c - traefikee # Wait for controllers initialization while [ $(docker config ls -qf name==default-proxy) -lt 1 ]; do sleep 1; done # Deploy proxies teectl setup gen \ --license=.... --proxies=2 | docker stack deploy -c - traefikee If you want to customize the default settings, please check the following guides: * [Installing Traefik Enterprise on Kubernetes using the CLI](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/) * [Installing Traefik Enterprise on Kubernetes using GitOps tools](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/) * [Installing Traefik Enterprise on Docker Swarm](https://doc.traefik.io/traefik-enterprise/installing/swarm/) On-Premise Installation If you plan to install Traefik Enterprise On-Premise (on VMs, bare-metal machines or unsupported platforms), you will not be able to use the previous command for installation. Learn about [Traefik Enterprise's On-Premise installation](https://doc.traefik.io/traefik-enterprise/installing/on-premise/) . However, you will be able to perform other operations by using `teectl` on the same machine as `traefikee`. To verify that your Traefik Enterprise installation is ready, use the following command to print all of the nodes in the cluster: Command teectl get nodes Output Example ID NAME STATUS ROLE 7022qjifgp2srv3tq6rxyjhdm default-proxy-d55569575-n8mmb Ready Proxy q01yagt5suwv2tooy8amm248k default-controller-0 Ready Controller (Leader) s4eg90svby3aty5r6o9xkcpeh default-proxy-d55569575-kzn82 Ready Proxy Apply a Static Configuration[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#apply-a-static-configuration "Permanent link") ------------------------------------------------------------------------------------------------------------------------------------------ In order to allow proxies to receive connections a static configuration needs to be applied to the cluster with entry-points and at least one provider. A static configuration can be applied on your Traefik Enterprise cluster using `teectl`. Below is an example static configuration: Kubernetes (YAML) entryPoints: web: address: ":80" websecure: address: ":443" providers: kubernetesCRD: {} mesh: {} Kubernetes (TOML) [entryPoints] [entryPoints.web] address = ":80" [entryPoints.websecure] address = ":443" [providers.kubernetesCRD] [mesh] Docker Swarm (YAML) entryPoints: web: address: ":80" websecure: address: ":443" providers: docker: swarmMode: true Docker Swarm (TOML) [entryPoints] [entryPoints.web] address = ":80" [entryPoints.websecure] address = ":443" [providers.docker] swarmMode: true Apply the configuration using the following command: Command (YAML) teectl apply --file=static.yaml Command (TOML) teectl apply --file=static.toml Congratulations! Your Traefik Enterprise cluster is ready. Access the Dashboard[¶](https://doc.traefik.io/traefik-enterprise/getting-started/#access-the-dashboard "Permanent link") -------------------------------------------------------------------------------------------------------------------------- To learn how to enable and access the dashboard, please refer to the [dashboard operating guide](https://doc.traefik.io/traefik-enterprise/operations/dashboard/) What's Next? Now that you have installed a Traefik Enterprise cluster, you can: * Learn about [Traefik Enterprise's architecture and concepts](https://doc.traefik.io/traefik-enterprise/concepts/#architecture-overview) * Get more information about `teectl` and read the full [`teectl` Command Line Reference](https://doc.traefik.io/traefik-enterprise/references/cli/teectl/) --- # Traefik Manifest File Documentation - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/#customizing-the-manifest-file) Initializing search Customizing the Manifest File[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/#customizing-the-manifest-file "Permanent link") ============================================================================================================================================================== Once the manifest file is generated, it can be reviewed and customized if necessary. The following aspects should be taken into account: * **[Resource Requests and Limits](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container) **. Controllers and proxies both come with enforced resource limits. The defaults are voluntarily kept large to fit most use cases. They can be adjusted to better fit the targeted installation. * **Network Configuration and Exposed Ports**. By default, the proxy deployment is configured to expose ports `80` and `443`. However, if other ports are required, they should be changed to match the proxy deployment and the associated service. * **[Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes) **. The proxy deployment comes with readiness probes disabled by default, as it is related to the [entry points](https://doc.traefik.io/traefik/v2.11/routing/entrypoints/) configured on the cluster. The probes should be configured accordingly and enabled to avoid sending traffic to non-configured proxies. * **Environment variables**. To use [Datadog](https://doc.traefik.io/traefik-enterprise/operations/metrics/datadog/) or ACME [DNS Challenge](https://doc.traefik.io/traefik-enterprise/tls/acme/) , for instance, environment variables should be configured on proxies or controllers. Common Scenarios Requiring Customization[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/#common-scenarios-requiring-customization "Permanent link") ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ### External Load Balancer[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/#external-load-balancer "Permanent link") By default, the manifest files generated by `teectl setup gen` include a service definition with a [LoadBalancer type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) for the proxies. This service type relies on the cloud provider's ability to create an external load balancer, while automatically creating a ClusterIP and NodePort that will be targeted by it. While this is fine for most use cases, it's also common to not want to dynamically create load balancers but instead use an external load balancer to route to Kubernetes services via ClusterIP or NodePort. To achieve this, the service type must be changed in the manifest file before applying it to the cluster: NodePort apiVersion: v1 kind: Service #[...] spec: type: NodePort ports: - name: http port: 80 targetPort: http - name: https port: 443 targetPort: https #[...] ClusterIP apiVersion: v1 kind: Service #[...] spec: type: ClusterIp ports: - name: http port: 80 targetPort: http - name: https port: 443 targetPort: https #[...] With this configuration, the load balancer can target either the address of individual nodes running the proxy service or the cluster IP address. Port management when using NodePort When setting the [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport) field to a fixed port, the management of port conflicts is the cluster operator's responsibility. ### Custom Cluster Domain[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/#custom-cluster-domain "Permanent link") If your Kubernetes cluster does not use the default `cluster.local` domain name, you need to update the `initContainers` section for the proxies and the controllers. Below is an example of customization with `my-custom.domain` as cluster domain value: #[...] initContainers: - name: wait-dns image: busybox:1.31.1 command: ['sh', '-c', 'until nslookup -type=a default-ctrl-svc.traefikee.svc.my-custom.domain; do echo waiting for published dns records; sleep 1; done;'] resources: requests: memory: "10Mi" cpu: "100m" limits: memory: "100Mi" cpu: "1000m" #[...] ### Using KubeDNS with service mesh enabled[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/#using-kubedns-with-service-mesh-enabled "Permanent link") If Traefik Enterprise is installed with service mesh enabled and the Kubernetes cluster is using KubeDNS, the `CoreDNS` section in the manifest needs to be updated. Below is an example with the custom domain `example.org`: ```yaml #[...] Corefile: | .:53 { errors health kubernetes example.org in-addr.arpa ip6.arpa { pods insecure upstream fallthrough in-addr.arpa ip6.arpa } #[...] ``` --- # Customizing Swarm for Traefik Enterprise - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/customizing/swarm/#customizing-the-docker-compose-files) Initializing search Customizing the Docker Compose Files[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/swarm/#customizing-the-docker-compose-files "Permanent link") ======================================================================================================================================================================= Once the compose files are generated, they can be reviewed and if necessary customized. The following aspects should be taken in account: * **[Memory/CPU Resevations and Limits](https://docs.docker.com/compose/compose-file/#resources) **: Both controllers and proxies come with enforced resource limits. The defaults are voluntarily kept large to fit most of use cases. They can be adjusted to better fit the targeted installation. * **Network Configuration and Exposed Ports**: By default, the `proxies` service is configured to expose the ports `80` and `443` to the swarm ingress network. This setting has to be adjusted according to the target installation. If network performance is needed, please consider [bypassing the routing mesh](https://docs.docker.com/engine/swarm/ingress/#bypass-the-routing-mesh) . * **Volumes**: Local volumes are being used by default in order to fit most installations. If a global volume driver is available on the targeted swarm cluster, it can be used instead. This would remove the placement constraints on the controllers, providing more flexibility. However, be careful with the I/O performance of these volumes as it is critical for the stability of the cluster. * **Placement constraints**: By default, proxy services are configured to be deployed on workers only. If the workload is allowed on manager nodes or only certain swarm nodes are exposed to the internet then the placement constraint can be adjusted. However, unless a global volume is being used for the controller volumes, please do not remove the placement constraints on the controller services. * **Labels**: To expose the [dashboard](https://doc.traefik.io/traefik-enterprise/operations/dashboard/) , labels on the `proxies` service is required. However, please make sure not to remove the `com.containous.traefikee.component` label. * **Environment variables**: To use [Datadog](https://doc.traefik.io/traefik-enterprise/operations/metrics/datadog/) or ACME [DNS Challenge](https://doc.traefik.io/traefik-enterprise/tls/acme/) for instance, environment variables should be configured either on proxies or controllers. Healthcheck We don't provide a swarm compliant health check at this moment. Common Scenarios Requiring Customization[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/swarm/#common-scenarios-requiring-customization "Permanent link") ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### External Load Balancer[¶](https://doc.traefik.io/traefik-enterprise/installing/customizing/swarm/#external-load-balancer "Permanent link") By default, the manifest files generated by `teectl setup gen` include a service definition with default port mode for the proxies, which means they will use the [Swarm routing mesh](https://docs.docker.com/engine/swarm/ingress/) . While this routing mesh can be convenient, it does have some disadvantages such as reduced performance and overall network stability perception. When using an external load balancer, it's possible to bypass the routing mesh and expose the proxy service ports directly to the host machine. To achieve this the port mode must be changed in the compose file before deploying it to the cluster. And as the host mode will determine that only one container of a service can run on each docker node, because of the binded port, it's also recommended to add a placement constraint and set the service deploy mode to global: services: proxies: #[...] deploy: mode: global placement: constraints: - node.role != manager - node.labels.traefikee-enabled == true #[...] ports: - target: 80 published: 80 protocol: tcp mode: host - target: 443 published: 443 protocol: tcp mode: host #[...] With this configuration the load balancer can target the address of individual nodes running the proxy service. Client IP address When using host mode, the real client ip address is shown on request headers and Traefik Enterprise logs instead of the Docker internal overlay address. Port management in host mode When using host mode, the management of port conflicts is the cluster operator's responsibility. --- # Install Traefik Enterprise on ECS Amazon EC2 - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#installing-traefik-enterprise-ecs) Initializing search Installing Traefik Enterprise ECS[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#installing-traefik-enterprise-ecs "Permanent link") ======================================================================================================================================================= This page guides you through the installation of Traefik Enterprise on [AWS Elastic Container Service](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html) . AWS Knowledge Assistance with configuring or setting up AWS services is not included in this guide. If you need more information about any of the components referenced in this guide, start with the following resources: * [Service Discovery](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-service-discovery.html) * [Secret Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html) * [Security Groups](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html) * [IAM Policies and Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) * [CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html) Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#requirements "Permanent link") ------------------------------------------------------------------------------------------------------------- * An ECS cluster * The `aws` CLI tool properly configured to communicate with the cluster * Enough permissions on the ECS instance role to access any integrated AWS service * All [required ports](https://doc.traefik.io/traefik-enterprise/installing/requirements/#networking "Link to docs about required ports") are open on the associated security group of the container instances * SSH access to your EC2 container instances * Controller containers can reach `https://v4.license.containous.cloud` * The [`teectl`](https://doc.traefik.io/traefik-enterprise/installing/teectl-cli/ "Link to teectl docs") CLI tool, for cluster management Installation[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#installation "Permanent link") ------------------------------------------------------------------------------------------------------------- This guide only focuses on the [EC2 launch type](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html#launch-type-ec2) , it may be possible to run with the [Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html#launch-type-fargate) with some customization. Altough some external AWS resources are referenced in the `logConfiguration` and `secrets` sections, they are optional and you can just remove or customize them in the task definition, otherwise you must create those resources manually with the AWS Console or CLI tool which is not covered in this guide as well. Since `teectl setup gen` does not provide support for ECS manifest files, this guide demonstrates how to write your own task and service definitions, using JSON syntax, to define the necessary resources and deploy a Traefik Enteprise cluster of one controller and two proxies. ### Plugin Registry Token[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#plugin-registry-token "Permanent link") The plugin registry needs a token to secure its communications with the controller. This token is set on the controller and plugin registry task definition. Here is an example of how to create it: Command openssl rand -base64 10 Expected output MvXVeX3qDylxJQ== ### Controllers[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#controllers "Permanent link") Create a file named `controller-task.json` with the following task definition: { "family": "traefikee-controller", "taskRoleArn": "arn:aws:iam::aws_account_id:role/ecsTaskTraefikee", "executionRoleArn": "arn:aws:iam::aws_account_id:role/ecsTaskTraefikee", "networkMode": "host", "containerDefinitions": [ \ {\ "name": "controller-0",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "memory": 1024,\ "memoryReservation": 256,\ "essential": true,\ "hostname": "traefikee-controller-0",\ "disableNetworking": false,\ "privileged": false,\ "readonlyRootFilesystem": true,\ "interactive": false,\ "pseudoTerminal": false,\ "secrets": [\ {\ "name": "TRAEFIKEE_LICENSE",\ "valueFrom": "arn:aws:secretsmanager:aws_region:aws_account_id:secret:traefikee-license-03vFNy:key::"\ }\ ], \ "portMappings": [\ {\ "containerPort": 55055,\ "hostPort": 55055,\ "protocol": "tcp"\ }\ ], \ "command": [\ "controller",\ "--name=controller-0",\ "--advertise=controller-0:4242",\ "--discovery.static.peers=",\ "--license=$TRAEFIKEE_LICENSE",\ "--log.level=",\ "--log.filepath=",\ "--log.format=",\ "--statedir=/data/state",\ "--jointoken.file.path=/data/tokens",\ "--api.socket=/data/run/teectl-controller-0.sock",\ "--socket=/data/run/controller-0.sock",\ "--api.autocerts",\ "--plugin.url=https://[my-plugin-registry-ip]:443",\ "--plugin.token=[my-plugin-registry-token]"\ ],\ "mountPoints": [\ {\ "sourceVolume": "traefikee-data",\ "containerPath": "/data",\ "readOnly": false\ }\ ], \ "linuxParameters": {\ "capabilities": {\ "add": [\ "NET_BIND_SERVICE"\ ],\ "drop": [\ "ALL"\ ]\ } \ },\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "traefikee",\ "awslogs-region": "aws_region",\ "awslogs-stream-prefix": "controller-0"\ }\ }, \ "dockerLabels": {\ "com.traefik.traefikee.component": "controllers"\ } \ }\ ], "volumes": [\ {\ "name": "traefikee-data", \ "dockerVolumeConfiguration": {\ "scope": "shared",\ "autoprovision": true,\ "driver": "local" \ } \ }\ ], "requiresCompatibilities": [\ "EC2"\ ] } Controller Storage To keep things simple this guide is using a docker volume configuration with a `local` driver. This is fine for a single controller cluster but not suited for a multi controller cluster, because tasks would be spread across different ECS instances. Refer to the [official ECS docs](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_data_volumes.html) for all supported volume drivers. Customize the file, then register the task definition on ECS: Command aws ecs register-task-definition --cli-input-json file://controller-task.json --region $AWS_REGION Now create a file named `controller-svc.json` with the service definition: { "serviceName": "traefikee-controllers", "taskDefinition": "traefikee-controller", "desiredCount": 1, "launchType": "EC2", "enableECSManagedTags": true, "propagateTags": "SERVICE", "placementConstraints": [\ {\ "type": "distinctInstance"\ }\ ], "schedulingStrategy": "REPLICA", "deploymentController": { "type": "ECS" } } Customize the file and deploy it to the ECS cluster: aws ecs create-service --cli-input-json file://controller-svc.json --cluster mycluster --region $AWS_REGION Check the service status to ensure the service was started: Command aws ecs describe-services --services traefikee-controllers --cluster mycluster --region $AWS_REGION Expected output { "services": [\ {\ "status": "ACTIVE",\ "serviceRegistries": [],\ "pendingCount": 0,\ "launchType": "EC2",\ "enableECSManagedTags": true,\ "schedulingStrategy": "REPLICA",\ "loadBalancers": [],\ "placementConstraints": [\ {\ "type": "distinctInstance"\ }\ ],\ "createdAt": 1605815767.081,\ "desiredCount": 1,\ "serviceName": "traefikee-controllers",\ "clusterArn": "arn:aws:ecs:aws_region:aws_account_id:cluster/traefikee-ecs",\ "createdBy": "arn:aws:iam::aws_account_id:user/aws_user",\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-controller:7",\ "serviceArn": "arn:aws:ecs:aws_region:aws_account_id:service/traefikee-ecs/traefikee-controllers",\ "propagateTags": "SERVICE",\ "deploymentConfiguration": {\ "maximumPercent": 200,\ "minimumHealthyPercent": 100\ },\ "deployments": [\ {\ "status": "PRIMARY",\ "pendingCount": 0,\ "launchType": "EC2",\ "createdAt": 1605815767.081,\ "desiredCount": 1,\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-controller:7",\ "updatedAt": 1605815785.903,\ "id": "ecs-svc/4291651818662396701",\ "runningCount": 1\ }\ ],\ "events": [\ {\ "message": "(service traefikee-controllers) has reached a steady state.",\ "id": "2ae7ae80-11bc-48fa-bd1c-ec6235521928",\ "createdAt": 1605815785.907\ },\ {\ "message": "(service traefikee-controllers) has started 1 tasks: (task fe932a1e5690403eacd5d3b4f8221b18).",\ "id": "901615c4-8e67-4ed2-91f6-b52fcc88d147",\ "createdAt": 1605815774.564\ }\ ],\ "runningCount": 1,\ "placementStrategy": []\ }\ ], "failures": [] } Wait until the controllers are up and running before proceeding to the next steps. ### Get the Proxy Join Token[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#get-the-proxy-join-token "Permanent link") Fetch the proxy join token by connecting to the container instance and executing the following commands: Command # Get the controller container id CONTAINER_ID=$(docker ps | grep traefikee | cut -f 1 -d " ") # Get the tokens docker exec -it $CONTAINER_ID /traefikee tokens --socket /data/run/controller-0.sock Expected output export TRAEFIKEE_CONTROLLER_TOKEN=5531644e5645744f4c5445744e47706f4e7a5a3261574a765a485274616a55345a57526f4d7a566f65444e6f4e544e70616d4a6d615459314e5464684f48526f4d6e6c735933466e4e33686a6348417459544e6c4e5451314e475a70616d4e304e484e796432466f4e445a796447707859673d3d3a303a97b42afa416f0df94d7c453bd4c55fcddd339ec4570068eac2c5cc5504c158d42521e9852615ab95049e2b3296b67c4a export TRAEFIKEE_PROXY_TOKEN=5531644e5645744f4c5445744e47706f4e7a5a3261574a765a485274616a55345a57526f4d7a566f65444e6f4e544e70616d4a6d615459314e5464684f48526f4d6e6c735933466e4e33686a634841744e47397563484d31636a4d354d7a42354e5463785933557762546b774e7a55794f413d3d3a313a97b42afa416f0df94d7c453bd4c55fcddd339ec4570068eac2c5cc5504c158d42194b3059e6861761121966a44f964d3 Write down the proxy token as it is required for the next step, the proxies task definition. ### Proxies[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#proxies "Permanent link") Create a file named `proxies-task.json` with the following task definition: { "family": "traefikee-proxies", "taskRoleArn": "arn:aws:iam::aws_account_id:role/ecsTaskTraefikee", "networkMode": "host", "containerDefinitions": [ \ {\ "name": "proxy",\ "image": "traefik/traefikee:v2.12.0",\ "disableNetworking": false,\ "privileged": false,\ "readonlyRootFilesystem": true,\ "interactive": true,\ "pseudoTerminal": true,\ "essential": true,\ "cpu": 500,\ "memory": 1024,\ "memoryReservation": 256, \ "portMappings": [\ {\ "containerPort": 80,\ "hostPort": 80,\ "protocol": "tcp"\ },\ {\ "containerPort": 443,\ "hostPort": 443,\ "protocol": "tcp"\ },\ {\ "containerPort": 8484,\ "hostPort": 8484,\ "protocol": "tcp"\ }\ ], \ "command": [\ "traefikee",\ "proxy",\ "--role=ingress",\ "--discovery.static.peers=[my-controller-ip]:4242",\ "--jointoken.value=[my-proxy-join-token]",\ "--log.level=",\ "--log.filepath=",\ "--log.format="\ ],\ "linuxParameters": {\ "capabilities": {\ "add": [\ "NET_BIND_SERVICE"\ ],\ "drop": [\ "ALL"\ ]\ } \ },\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "traefikee",\ "awslogs-region": "aws_region",\ "awslogs-stream-prefix": "proxies"\ }\ },\ "dockerLabels": {\ "com.containous.traefikee.component": "proxies"\ } \ }\ ], "requiresCompatibilities": [\ "EC2"\ ] } Customize the file then register the task definition on ECS: aws ecs register-task-definition --cli-input-json file://proxies-task.json --region $AWS_REGION Now create a file named `proxies-svc.json` with the service definition: { "serviceName": "traefikee-proxies", "taskDefinition": "traefikee-proxies", "desiredCount": 2, "launchType": "EC2", "enableECSManagedTags": true, "propagateTags": "SERVICE", "placementConstraints": [\ {\ "type": "distinctInstance"\ }\ ], "schedulingStrategy": "REPLICA", "deploymentController": { "type": "ECS" } } Customize the file and deploy it to the ECS cluster: aws ecs create-service --cli-input-json file://proxies-svc.json --cluster mycluster --region $AWS_REGION Check the service status to ensure the service was started: Command aws ecs describe-services --services traefikee-proxies --cluster mycluster --region $AWS_REGION Expected output { "services": [\ {\ "status": "ACTIVE",\ "serviceRegistries": [],\ "pendingCount": 0,\ "launchType": "EC2",\ "enableECSManagedTags": true,\ "schedulingStrategy": "REPLICA",\ "loadBalancers": [],\ "placementConstraints": [\ {\ "type": "distinctInstance"\ }\ ],\ "createdAt": 1605879947.392,\ "desiredCount": 2,\ "serviceName": "traefikee-proxies",\ "clusterArn": "arn:aws:ecs:aws_region:aws_account_id:cluster/traefikee-ecs",\ "createdBy": "arn:aws:iam::aws_account_id:user/aws_user",\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-proxies:5",\ "serviceArn": "arn:aws:ecs:aws_region:aws_account_id:service/traefikee-ecs/traefikee-proxies",\ "propagateTags": "SERVICE",\ "deploymentConfiguration": {\ "maximumPercent": 200,\ "minimumHealthyPercent": 100\ },\ "deployments": [\ {\ "status": "PRIMARY",\ "pendingCount": 0,\ "launchType": "EC2",\ "createdAt": 1605880984.365,\ "desiredCount": 2,\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-proxies:5",\ "updatedAt": 1605881208.064,\ "id": "ecs-svc/4529007424825088897",\ "runningCount": 2\ }\ ],\ "events": [\ {\ "message": "(service traefikee-proxies) has reached a steady state.",\ "id": "51e07037-3595-40fa-a394-c489561fcd11",\ "createdAt": 1605881208.068\ },\ {\ "message": "(service traefikee-proxies) has started 1 tasks: (task 11ad2458e5624330955dc97f6ce41d41).",\ "id": "7e74652c-f88c-4e0f-b922-446ac8a7a114",\ "createdAt": 1605881197.123\ },\ {\ "message": "(service traefikee-proxies) has reached a steady state.",\ "id": "2d857d41-658a-452b-b7d6-c1c3bb4a2944",\ "createdAt": 1605881165.664\ },\ {\ "message": "(service traefikee-proxies) has started 1 tasks: (task b94de86d3664413081c045ed25f9b326).",\ "id": "74bb63a2-bbf8-45a2-bc22-a5a266b4289e",\ "createdAt": 1605881153.114\ }, \ ],\ "runningCount": 2,\ "placementStrategy": []\ }\ ], "failures": [] } ### Plugin Registry[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#plugin-registry "Permanent link") Create a file named `registry-task.json` with the following task definition: { "executionRoleArn": "arn:aws:iam::aws_account_id:role/ecsTaskExecutionRole", "containerDefinitions": [\ {\ "portMappings": [\ {\ "hostPort": 443,\ "protocol": "tcp",\ "containerPort": 443\ }\ ],\ "command": [\ "plugin-registry",\ "--name=registry",\ "--plugindir=/var/lib/plugins",\ "--token=[my-plugin-registry-token]",\ "--log.level=debug",\ "--log.filepath=",\ "--log.format=",\ "--discovery.static.peers=[my-controller-ip]:4242",\ "--jointoken.file.path=/data/tokens"\ ],\ "cpu": 500,\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/data",\ "sourceVolume": "traefikee-data"\ }\ ],\ "memory": 128,\ "image": "traefik/traefikee:v2.12.0",\ "name": "registry"\ }\ ], "taskRoleArn": "arn:aws:iam::aws_account_id:role/ecsTaskExecutionRole", "family": "registry", "requiresCompatibilities": [\ "EC2"\ ], "volumes": [\ {\ "name": "traefikee-data",\ "dockerVolumeConfiguration": {\ "autoprovision": false,\ "scope": "shared",\ "driver": "local"\ }\ }\ ] } Customize the file then register the task definition on ECS: aws ecs register-task-definition --cli-input-json file://registry-task.json --region $AWS_REGION Now create a file named `registry-svc.json` with the service definition: { "serviceName": "registry", "taskDefinition": "registry", "desiredCount": 2, "launchType": "EC2", "enableECSManagedTags": true, "propagateTags": "SERVICE", "placementConstraints": [\ {\ "type": "distinctInstance"\ }\ ], "schedulingStrategy": "REPLICA", "deploymentController": { "type": "ECS" } } Customize the file and deploy it to the ECS cluster: aws ecs create-service --cli-input-json file://registry-svc.json --cluster mycluster --region $AWS_REGION Check the service status to ensure the service was started: Command aws ecs describe-services --services registry --cluster mycluster --region $AWS_REGION Expected output { "services": [\ {\ "serviceArn": "arn:aws:ecs:eu-north-1:114072598128:service/rc2/registry",\ "serviceName": "registry",\ "clusterArn": "arn:aws:ecs:eu-north-1:114072598128:cluster/rc2",\ "loadBalancers": [],\ "serviceRegistries": [],\ "status": "ACTIVE",\ "desiredCount": 1,\ "runningCount": 1,\ "pendingCount": 0,\ "launchType": "EC2",\ "taskDefinition": "arn:aws:ecs:eu-north-1:114072598128:task-definition/registry:2",\ "deploymentConfiguration": {\ "deploymentCircuitBreaker": {\ "enable": false,\ "rollback": false\ },\ "maximumPercent": 200,\ "minimumHealthyPercent": 100\ },\ "deployments": [\ {\ "id": "ecs-svc/5244500742569760246",\ "status": "PRIMARY",\ "taskDefinition": "arn:aws:ecs:eu-north-1:114072598128:task-definition/registry:2",\ "desiredCount": 1,\ "pendingCount": 0,\ "runningCount": 1,\ "failedTasks": 0,\ "createdAt": 1610097942.755,\ "updatedAt": 1610097977.375,\ "launchType": "EC2",\ "rolloutState": "COMPLETED",\ "rolloutStateReason": "ECS deployment ecs-svc/5244500742569760246 completed."\ }\ ],\ "events": [\ {\ "id": "9b8f4549-e972-4506-848a-8050084f57f0",\ "createdAt": 1610097977.381,\ "message": "(service registry) has reached a steady state."\ },\ {\ "id": "adee0f69-5ceb-4f11-8fd9-47effc1b39c2",\ "createdAt": 1610097977.38,\ "message": "(service registry) (deployment ecs-svc/5244500742569760246) deployment completed."\ },\ {\ "id": "6b070094-8686-4ab7-9886-82c248203698",\ "createdAt": 1610097966.485,\ "message": "(service registry) has started 1 tasks: (task 65e57cd8504346da8a8d654917919c7b)."\ },\ ],\ "createdAt": 1610096466.659,\ "placementConstraints": [],\ "placementStrategy": [\ {\ "type": "spread",\ "field": "attribute:ecs.availability-zone"\ },\ {\ "type": "spread",\ "field": "instanceId"\ }\ ],\ "schedulingStrategy": "REPLICA",\ "createdBy": "arn:aws:iam::114072598128:user/xxx",\ "enableECSManagedTags": true,\ "propagateTags": "NONE"\ }\ ], "failures": [] } Remote Access Through `teectl`[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#remote-access-through-teectl "Permanent link") ----------------------------------------------------------------------------------------------------------------------------------------------- Once your cluster is ready, if you want to operate the cluster remotely using the `teectl` tool, you will need to generate credentials from your cluster using `traefikee generate credentials` on one of your controllers and use `teectl` to import the cluster credentials. First connect to a container instance running a controller task, then run: Command # Get the controller container id CONTAINER_ID=$(docker ps | grep traefikee | cut -f 1 -d " ") # Get a teectl config with credentials docker exec -it $CONTAINER_ID /traefikee generate c --onpremise.hosts="[Container-Instance-Public-IP]" --cluster ecs --socket /data/run/teectl-controller-0.sock Expected output cluster_name: default tls: cert: | -----BEGIN CERTIFICATE----- MIIB+jCCAaCgAwIBAgIQKHgQX14LGetAsD8wSEta5jAKBggqhkjOPQQDAjAuMRUw EwYDVQQKEwxUcmFlZmlrIExhYnMxFTATBgNVBAMTDFRyYWVmaWtFRSBDQTAgFw0y MDExMTkyMDAwMDNaGA8yMTIwMTAyNjIwMDAwM1owFTETMBEGA1UEAxMKY2xpZW50 LmVjczBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKcFJkSGRxbfAnQx2JtYpEnA knHdqukFWF8Sbvht30Ge/EnBrTe37ilzJ0KlY11UQK/KlGPMoqVSrjAnqZz10nGj gbYwgbMwDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAwGA1Ud EwEB/wQCMAAwKQYDVR0OBCIEIKh1ygHajrADFcxpfv4p/ff7FH4lDULi0uqcDp7j qaylMCsGA1UdIwQkMCKAILoCK8uf89Yveb/uZN+Vs+gfvz05Y6NHB2/hd3T6ix3T MCYGA1UdEQQfMB2CCmNsaWVudC5lY3OCCWxvY2FsaG9zdIcEfwAAATAKBggqhkjO PQQDAgNIADBFAiEAiXT09co8egGQ0Y6hJ/lgIzCGC0I9GiFfvrxCGKl15l8CICYY E6ig/k2D4coprOclVF5QVkqHCcx2EL0HA/zK05eI -----END CERTIFICATE----- key: | -----BEGIN EC PRIVATE KEY----- MHcCAQEEIC8CsJ/B115S+JtR1/l3ZQwKA3XdXt9zLqusF1VXc/KloAoGCCqGSM49 AwEHoUQDQgAEpwUmRIZHFt8CdDHYm1ikScCScd2q6QVYXxJu+G3fQZ78ScGtN7fu KXMnQqVjXVRAr8qUY8yipVKuMCepnPXScQ== -----END EC PRIVATE KEY----- ca: | -----BEGIN CERTIFICATE----- MIIB2DCCAX2gAwIBAgIQDEHgiwDfaIX3wS1EHF800DAKBggqhkjOPQQDAjAuMRUw EwYDVQQKEwxUcmFlZmlrIExhYnMxFTATBgNVBAMTDFRyYWVmaWtFRSBDQTAgFw0y MDExMTkxOTU2MjBaGA8yMTIwMTAyNjE5NTYyMFowLjEVMBMGA1UEChMMVHJhZWZp ayBMYWJzMRUwEwYDVQQDEwxUcmFlZmlrRUUgQ0EwWTATBgcqhkjOPQIBBggqhkjO PQMBBwNCAATe+gM99l/nAAeNIy/kn8vbrcSNORhbWGBUp+j1CtL2ADqLYIel/acB B3ssLPnbAZLoKJefrQS/CNJOdZpRZBnfo3sweTAOBgNVHQ8BAf8EBAMCAYYwDwYD VR0TAQH/BAUwAwEB/zApBgNVHQ4EIgQgugIry5/z1i95v+5k35Wz6B+/PTljo0cH b+F3dPqLHdMwKwYDVR0jBCQwIoAgugIry5/z1i95v+5k35Wz6B+/PTljo0cHb+F3 dPqLHdMwCgYIKoZIzj0EAwIDSQAwRgIhAMRjpKzzAZr5wT5IXMaBWv0OUvy6wxFn kyZApTzhcbr9AiEAtaJZ7DN+xLeA0/RUljK0uDKuZALix30VSx4U2aaYdc4= -----END CERTIFICATE----- onPremise: hosts: - ec2-18-223-125-157.us-east-1.compute.amazonaws.com port: 55055 Save the output of the last command above to a file named `teectl-config.yaml`, then from your machine run: teectl cluster import --file="teectl-config.yaml" You can now use `teectl` to operate your cluster. Command teectl get nodes Expected output ID NAME STATUS ROLE hlx1b3gu8bb5n1lg8qtiy5nvv controller-0 Ready Controller (Leader) jm5wv9kdmp9imspqx39n300b3 ip-10-0-0-130.us-east-1.compute.internal Ready Proxy / Ingress y0l2me7zjalidnzqf3fqanuxk ip-10-0-0-178.us-east-1.compute.internal Ready Proxy / Ingress What's Next? Learn more about the [features](https://doc.traefik.io/traefik-enterprise/operations/introduction/ "Link to feature overview of Traefik Enterprise") that Traefik Enterprise provides. License Monitoring[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/ec2/#license-monitoring "Permanent link") ------------------------------------------------------------------------------------------------------------------------- When a Traefik Enterprise controller starts for the first time, it checks the license validity. If the license is valid, another check is done once every 24 hours. If the controller can't communicate with the license server, a 72-day grace period starts to recover from this situation. Once the grace period is over, the controller stops updating the proxies configuration. Please look at the [FAQ](https://doc.traefik.io/traefik-enterprise/kb/faq/) to know how to implement the license monitoring. --- # Installing Traefik Enterprise on ECS Fargate - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#installing-traefik-enterprise-on-ecs-fargate) Initializing search Installing Traefik Enterprise on ECS Fargate[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#installing-traefik-enterprise-on-ecs-fargate "Permanent link") ================================================================================================================================================================================= This page guides you through the installation of Traefik Enterprise on [AWS ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) . AWS Knowledge Information about setting up AWS services is not included in this guide. If you want to know more about any of the components referenced in this guide, start with the following resources: * [Service Discovery](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-service-discovery.html) * [Secret Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html) * [Security Groups](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html) * [IAM Policies and Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) * [CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html) In this guide all examples surrounded by angle brackets `<>`, must be replaced accordingly. Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#requirements "Permanent link") ----------------------------------------------------------------------------------------------------------------- * An ECS Fargate cluster * The [`aws` CLI tool](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-version.html) properly configured to communicate with the cluster * Enough permissions on the ECS Fargate instance role to access any integrated AWS service * All [required ports](https://doc.traefik.io/traefik-enterprise/installing/requirements/#networking) are open on the associated security group of the container instances * Controller containers can reach `https://v4.license.containous.cloud` * The [`teectl`](https://doc.traefik.io/traefik-enterprise/installing/teectl-cli/) CLI tool, for cluster management Installation[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#installation "Permanent link") ----------------------------------------------------------------------------------------------------------------- Although some external AWS resources are referenced in the `logConfiguration` and `secrets` sections, they are optional. You can just remove or customize them in the task definition. Otherwise, you must create those resources manually with the AWS Console or CLI tool which is not covered in this guide as well. Since `teectl setup gen` does not provide support for ECS Fargate manifest files, this guide demonstrates how to write your own task and service definitions, using JSON syntax, to define the necessary resources and deploy a Traefik Enterprise cluster of one controller and two proxies. Note that flags used in each task definitions are referenced here: [Traefikee Command-Line Reference](https://doc.traefik.io/traefik-enterprise/references/cli/traefikee/) ### IAM Roles and Policy[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#iam-roles-and-policy "Permanent link") Traefik Enterprise requires the 2 different roles to run, one for the task execution and one when the task is running. Roles needs will map policies, so we gonna need to create the policies first. #### Execution role[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#execution-role "Permanent link") AWS already have a built in policy for the execution policy named **AmazonECSTaskExecutionRolePolicy**. We can then create the role and attach the policy to it. Let's create a trust relashionships definition in a file named trust-policy.json, and put it this content: { "Version": "2012-10-17", "Statement": [\ {\ "Sid": "",\ "Effect": "Allow",\ "Principal": {\ "Service": "ecs-tasks.amazonaws.com"\ },\ "Action": "sts:AssumeRole"\ }\ ] } We create the role that we could name **ecsTaskExecutionRole** with this aws cli command: aws iam create-role --role-name ecsTaskExecutionRole --assume-role-policy-document file://trust-policy.json And we associate the policy: aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AmazonECSTaskExecutionRolePolicy --role-name ecsTaskExecutionRole ##### Use of Secret[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#use-of-secret "Permanent link") If you want to use secret to pass your license, and the token as environement variables you need to add a policy to the **ecsTaskExecutionRole** in order to let the task be able to read the secret. Here's an example for the secret read policy, that you only need to associate with the execution role: { "Version": "2012-10-17", "Statement": [\ {\ "Effect": "Allow",\ "Action": [\ "secretsmanager:GetSecretValue"\ ],\ "Resource": [\ ""\ ]\ }\ ] } #### Running role[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#running-role "Permanent link") As traefik need to access the ECS API for the service discovery, we will need to create a specific policy. To create the policy in AWS you could create a json file with the content below: { "Version": "2012-10-17", "Statement": [\ {\ "Sid": "TraefikECSReadAccess",\ "Effect": "Allow",\ "Action": [\ "ecs:ListClusters",\ "ecs:DescribeClusters",\ "ecs:ListTasks",\ "ecs:DescribeTasks",\ "ecs:DescribeContainerInstances",\ "ecs:DescribeTaskDefinition",\ "ec2:DescribeInstances",\ "logs:CreateLogGroup",\ "logs:CreateLogStream",\ "logs:PutLogEvents",\ "logs:DescribeLogStreams"\ ],\ "Resource": [\ "*"\ ]\ },\ {\ "Sid": "TraefikECSContainerExec",\ "Effect": "Allow",\ "Action": [\ "ssmmessages:CreateControlChannel",\ "ssmmessages:CreateDataChannel",\ "ssmmessages:OpenControlChannel",\ "ssmmessages:OpenDataChannel"\ ],\ "Resource": [\ "*"\ ]\ }\ ] } Then create the policy with this command(change the name of the policy and file accordingly): aws iam create-policy --policy-name TraefikECSReadAccessRolePolicy --policy-document file://TraefikECSReadAccessRolePolicy.json Apply the same process as above to create a new role and associate the policy. ### Service Discovery[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#service-discovery "Permanent link") This deployment use AWS Service discovery to manage internal DNS name for Traefik Enterprise component. As stated before the AWS Service discovery is documented by AWS and will not be described here in details, this section will just give you the command to create a Service Discovery namespace to deploy Traefik Enterprise. #### Create a Service Discovery namespace[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#create-a-service-discovery-namespace "Permanent link") aws servicediscovery create-private-dns-namespace --name traefikee --vpc #### Create a Service Discovery Service for Traefik Enterprise controller[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#create-a-service-discovery-service-for-traefik-enterprise-controller "Permanent link") aws servicediscovery create-service --name controller-0 --dns-config 'NamespaceId="",DnsRecords=[{Type="A",TTL="60"}]' --health-check-custom-config FailureThreshold=1 #### Create a Service Discovery Service for Traefik Enterprise registry[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#create-a-service-discovery-service-for-traefik-enterprise-registry "Permanent link") aws servicediscovery create-service --name registry --dns-config 'NamespaceId="",DnsRecords=[{Type="A",TTL="60"}]' --health-check-custom-config FailureThreshold=1 In case of many controllers, you will need to set up new services for each controller name accordingly. ### Use of Secret[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#use-of-secret_1 "Permanent link") If you want to use secret to pass your license, and the token as environement variables you need to add a policy to the **ecsTaskExecutionRole** in order to let the task be able to read the secret. here's an example for this policy: { "Version": "2012-10-17", "Statement": [\ {\ "Effect": "Allow",\ "Action": [\ "secretsmanager:GetSecretValue"\ ],\ "Resource": [\ ""\ ]\ }\ ] } Traefik Enterprise will look for specific environment variable during startup, including for its license key and cluster tokens as follows: * TRAEFIKEE\_LICENSE * TRAEFIKEE\_JOIN\_TOKEN * TRAEFIKEE\_PLUGIN\_TOKEN However in ECS Fargate environment variables are not expanded at the container startup, which means you can't set command flags with environment variables. In the task definition in order to use the secret as environment varialbe we only will need to remove flags defining those values. ### Plugin Registry Token[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#plugin-registry-token "Permanent link") The plugin registry needs a token to secure its communications with the controller. This token is set on the controller and plugin registry task definition. Here is an example of how to create it: Command openssl rand -base64 10 Expected output MvXVeX3qDylxJQ== ### Controllers[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#controllers "Permanent link") #### Mono controller installation[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#mono-controller-installation "Permanent link") Controller Storage Fargate by default assign non-persistent storage to the container, in order to keep state, certificate, and necessary data, if the controller container needs to be recreated you need to add an EFS volume as described on the task definition below. Create a file named `controller-task.json` with the following task definition: Without Secret { "family": "traefikee-controller", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name": "controller-0",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "containerPort": 55055,\ "hostPort": 55055,\ "protocol": "tcp"\ }\ ],\ "essential": true,\ "command": [\ "controller",\ "--name=controller-0",\ "--advertise=controller-0.traefikee:4242",\ "--license=",\ "--statedir=/data/state",\ "--jointoken.file.path=/data/tokens",\ "--api.socket=/var/run/traefikee/teectl-controller-0.sock",\ "--socket=/var/run/traefikee/controller-0.sock",\ "--api.autocerts",\ "--plugin.url=https://registry.traefikee:443",\ "--plugin.token="\ ],\ "linuxParameters": {\ "initProcessEnabled": true\ },\ "environment": [],\ "secrets": [],\ "volumesFrom": [],\ "dockerLabels": {\ "com.traefik.traefikee.component": "controller"\ },\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/data",\ "sourceVolume": "traefikee-data"\ }\ ],\ "readonlyRootFilesystem": false,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-controller"\ }\ }\ }\ ], "volumes": [\ {\ "name": "traefikee-data",\ "efsVolumeConfiguration": {\ "fileSystemId": "",\ "transitEncryption": "DISABLED",\ "rootDirectory": "/"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } With Secret { "family": "traefikee-controller", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name": "controller-0",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "containerPort": 55055,\ "hostPort": 55055,\ "protocol": "tcp"\ }\ ],\ "essential": true,\ "command": [\ "controller",\ "--name=controller-0",\ "--advertise=controller-0.traefikee:4242",\ "--statedir=/data/state",\ "--jointoken.file.path=/data/tokens",\ "--api.socket=/var/run/traefikee/teectl-controller-0.sock",\ "--socket=/var/run/traefikee/controller-0.sock",\ "--api.autocerts",\ "--plugin.url=https://registry.traefikee:443"\ ],\ "linuxParameters": {\ "initProcessEnabled": true\ },\ "environment": [],\ "secrets": [\ {\ "name": "TRAEFIKEE_LICENSE",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_PLUGIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ }\ ],\ "volumesFrom": [],\ "dockerLabels": {\ "com.traefik.traefikee.component": "controller"\ },\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/data",\ "sourceVolume": "traefikee-data"\ }\ ],\ "readonlyRootFilesystem": false,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-controller"\ }\ }\ }\ ], "volumes": [\ {\ "name": "traefikee-data",\ "efsVolumeConfiguration": {\ "fileSystemId": "",\ "transitEncryption": "DISABLED",\ "rootDirectory": "/"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } Customize the file, then register the task definition on ECS Fargate: Command aws ecs register-task-definition --cli-input-json file://controller-task.json --region Now create a file named `controller-svc.json` with the service definition: { "serviceName": "traefikee-controller", "taskDefinition": "traefikee-controller", "desiredCount": 1, "launchType": "FARGATE", "schedulingStrategy": "REPLICA", "serviceRegistries": [\ {\ "registryArn": ""\ }\ ], "networkConfiguration": { "awsvpcConfiguration": { "subnets": [\ "",\ "",\ ""\ ], "securityGroups": [\ ""\ ], "assignPublicIp": "ENABLED" } } } Customize the file and deploy it to the ECS Fargate cluster: aws ecs create-service --cli-input-json file://controller-svc.json --cluster --region --enable-execute-command Check the service status to ensure the service was started: Command aws ecs describe-services --services traefikee-controller --cluster --region Expected output { "services": [\ {\ "status": "ACTIVE",\ "serviceRegistries": [],\ "pendingCount": 0,\ "launchType": "FARGATE",\ "enableECSManagedTags": true,\ "schedulingStrategy": "REPLICA",\ "loadBalancers": [],\ "placementConstraints": [\ {\ "type": "distinctInstance"\ }\ ],\ "createdAt": 1605815767.081,\ "desiredCount": 1,\ "serviceName": "traefikee-controller",\ "clusterArn": "arn:aws:ecs:aws_region:aws_account_id:cluster/traefikee-ecs",\ "createdBy": "arn:aws:iam::aws_account_id:user/aws_user",\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-controller:7",\ "serviceArn": "arn:aws:ecs:aws_region:aws_account_id:service/traefikee-ecs/traefikee-controller",\ "propagateTags": "SERVICE",\ "deploymentConfiguration": {\ "maximumPercent": 200,\ "minimumHealthyPercent": 100\ },\ "deployments": [\ {\ "status": "PRIMARY",\ "pendingCount": 0,\ "launchType": "EC2",\ "createdAt": 1605815767.081,\ "desiredCount": 1,\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-controller:7",\ "updatedAt": 1605815785.903,\ "id": "ecs-svc/4291651818662396701",\ "runningCount": 1\ }\ ],\ "events": [\ {\ "message": "(service traefikee-controller) has reached a steady state.",\ "id": "2ae7ae80-11bc-48fa-bd1c-ec6235521928",\ "createdAt": 1605815785.907\ },\ {\ "message": "(service traefikee-controller) has started 1 tasks: (task fe932a1e5690403eacd5d3b4f8221b18).",\ "id": "901615c4-8e67-4ed2-91f6-b52fcc88d147",\ "createdAt": 1605815774.564\ }\ ],\ "runningCount": 1,\ "placementStrategy": []\ }\ ], "failures": [] } Wait until the controllers are up and running before proceeding to the next steps. ### Get the Proxy Join Token[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#get-the-proxy-join-token "Permanent link") Fetch the proxy join token by connecting to the container instance and executing the following commands: Command # Get the tokens aws ecs execute-command --cluster --container controller-0 --task --interactive --command "/traefikee tokens --socket /var/run/traefikee/controller-0.sock" Expected output export TRAEFIKEE_CONTROLLER_TOKEN=5531644e5645744f4c5445744e47706f4e7a5a3261574a765a485274616a55345a57526f4d7a566f65444e6f4e544e70616d4a6d615459314e5464684f48526f4d6e6c735933466e4e33686a6348417459544e6c4e5451314e475a70616d4e304e484e796432466f4e445a796447707859673d3d3a303a97b42afa416f0df94d7c453bd4c55fcddd339ec4570068eac2c5cc5504c158d42521e9852615ab95049e2b3296b67c4a export TRAEFIKEE_PROXY_TOKEN=5531644e5645744f4c5445744e47706f4e7a5a3261574a765a485274616a55345a57526f4d7a566f65444e6f4e544e70616d4a6d615459314e5464684f48526f4d6e6c735933466e4e33686a634841744e47397563484d31636a4d354d7a42354e5463785933557762546b774e7a55794f413d3d3a313a97b42afa416f0df94d7c453bd4c55fcddd339ec4570068eac2c5cc5504c158d42194b3059e6861761121966a44f964d3 Write down the proxy token as it is required for the next step, the proxies task definition. #### Multi controller Installation[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#multi-controller-installation "Permanent link") Controller Storage Fargate by default assign non-persistent storage to the container, in order to keep state, certificate, and necessary data, if the controllers needs to be recreated you need to add an EFS volume for each controller as described on the tasks definitions below. Note that multi controller should not be deployed without secret, each controller will need the a join token if it is recreated or restarted. The environment variable that will be checked by the controller at bootstrap is TRAEFIKEE\_JOIN\_TOKEN. In order to manage each controller independently in case of maintenance, it is recommended to create each and every controller as separated tasks. After deploying the first controller get the join token and update secret accordingly. Here is the example of the configuration for a 3 nodes controller cluster: Controller-0 { "family": "traefikee-controller-0", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name": "controller-0",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "containerPort": 55055,\ "hostPort": 55055,\ "protocol": "tcp"\ }\ ],\ "essential": true,\ "command": [\ "controller",\ "--name=controller-0",\ "--advertise=controller-0.traefikee:4242",\ "--discovery.static.peers=controller-1.traefikee:4242,controller-2.traefikee:4242",\ "--statedir=/data/state",\ "--jointoken.file.path=/data/tokens",\ "--api.socket=/var/run/traefikee/teectl-controller-0.sock",\ "--socket=/var/run/traefikee/controller-0.sock",\ "--api.autocerts",\ "--plugin.url=https://registry.traefikee:443"\ ],\ "linuxParameters": {\ "initProcessEnabled": true\ },\ "environment": [],\ "secrets": [\ {\ "name": "TRAEFIKEE_LICENSE",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_PLUGIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_JOIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ }\ ],\ "volumesFrom": [],\ "dockerLabels": {\ "com.traefik.traefikee.component": "controller-0"\ },\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/data",\ "sourceVolume": "traefikee-data"\ }\ ],\ "readonlyRootFilesystem": false,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-controller-0"\ }\ }\ }\ ], "volumes": [\ {\ "name": "traefikee-data",\ "efsVolumeConfiguration": {\ "fileSystemId": "",\ "transitEncryption": "DISABLED",\ "rootDirectory": "/"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } Controller-1 { "family": "traefikee-controller-1", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name": "controller-1",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "containerPort": 55055,\ "hostPort": 55055,\ "protocol": "tcp"\ }\ ],\ "essential": true,\ "command": [\ "controller",\ "--name=controller-1",\ "--advertise=controller-1.traefikee:4242",\ "--discovery.static.peers=controller-0.traefikee:4242,controller-2.traefikee:4242",\ "--statedir=/data/state",\ "--jointoken.file.path=/data/tokens",\ "--api.socket=/var/run/traefikee/teectl-controller-1.sock",\ "--socket=/var/run/traefikee/controller-1.sock",\ "--api.autocerts",\ "--plugin.url=https://registry.traefikee:443"\ ],\ "linuxParameters": {\ "initProcessEnabled": true\ },\ "environment": [],\ "secrets": [\ {\ "name": "TRAEFIKEE_LICENSE",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_PLUGIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_JOIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ }\ ],\ "volumesFrom": [],\ "dockerLabels": {\ "com.traefik.traefikee.component": "controller-1"\ },\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/data",\ "sourceVolume": "traefikee-data"\ }\ ],\ "readonlyRootFilesystem": false,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-controller-1"\ }\ }\ }\ ], "volumes": [\ {\ "name": "traefikee-data",\ "efsVolumeConfiguration": {\ "fileSystemId": "",\ "transitEncryption": "DISABLED",\ "rootDirectory": "/"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } Controller-2 { "family": "traefikee-controller-2", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name": "controller-2",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "containerPort": 55055,\ "hostPort": 55055,\ "protocol": "tcp"\ }\ ],\ "essential": true,\ "command": [\ "controller",\ "--name=controller-2",\ "--advertise=controller-2.traefikee:4242",\ "--discovery.static.peers=controller-0.traefikee:4242,controller-1.traefikee:4242",\ "--statedir=/data/state",\ "--jointoken.file.path=/data/tokens",\ "--api.socket=/var/run/traefikee/teectl-controller-2.sock",\ "--socket=/var/run/traefikee/controller-2.sock",\ "--api.autocerts",\ "--plugin.url=https://registry.traefikee:443"\ ],\ "linuxParameters": {\ "initProcessEnabled": true\ },\ "environment": [],\ "secrets": [\ {\ "name": "TRAEFIKEE_LICENSE",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_PLUGIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_JOIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ }\ ],\ "volumesFrom": [],\ "dockerLabels": {\ "com.traefik.traefikee.component": "controller-2"\ },\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/data",\ "sourceVolume": "traefikee-data"\ }\ ],\ "readonlyRootFilesystem": false,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-region": "",\ "awslogs-stream-prefix": "traefikee-controller-2"\ }\ }\ }\ ], "volumes": [\ {\ "name": "traefikee-data",\ "efsVolumeConfiguration": {\ "fileSystemId": "",\ "transitEncryption": "DISABLED",\ "rootDirectory": "/"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } Create a service for each task as described in the mono controller section and deploy. ### Proxies[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#proxies "Permanent link") Create a file named `proxies-task.json` with the following task definition: Without Secret { "family": "traefikee-proxies", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name": "proxy",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "containerPort": 80,\ "hostPort": 80,\ "protocol": "tcp"\ },\ {\ "containerPort": 443,\ "hostPort": 443,\ "protocol": "tcp"\ },\ {\ "containerPort": 8484,\ "hostPort": 8484,\ "protocol": "tcp"\ }\ ],\ "essential": true,\ "command": [\ "proxy",\ "--role=ingress",\ "--discovery.static.peers=controller-0.traefikee:4242",\ "--jointoken.value="\ ],\ "linuxParameters": {},\ "environment": [],\ "volumesFrom": [],\ "secrets": [],\ "dockerLabels": {\ "com.traefik.traefikee.component": "proxies"\ },\ "mountPoints": [],\ "readonlyRootFilesystem": true,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-proxies"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } With Secret { "family": "traefikee-proxies", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name": "proxy",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "containerPort": 80,\ "hostPort": 80,\ "protocol": "tcp"\ },\ {\ "containerPort": 443,\ "hostPort": 443,\ "protocol": "tcp"\ },\ {\ "containerPort": 8484,\ "hostPort": 8484,\ "protocol": "tcp"\ }\ ],\ "essential": true,\ "command": [\ "proxy",\ "--role=ingress",\ "--discovery.static.peers=controller-0.traefikee:4242"\ ],\ "linuxParameters": {},\ "environment": [],\ "volumesFrom": [],\ "secrets": [\ {\ "name": "TRAEFIKEE_JOIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ }\ ],\ "dockerLabels": {\ "com.traefik.traefikee.component": "proxies"\ },\ "mountPoints": [],\ "readonlyRootFilesystem": true,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-proxies"\ }\ }\ \ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } Proxies In case of multi controller installation you should add all the controller in the static.discovery.peers field. Customize the file then register the task definition in Fargate: aws ecs register-task-definition --cli-input-json file://proxies-task.json --region Now create a file named `proxies-svc.json` with the service definition: { "serviceName": "traefikee-proxies", "taskDefinition": "traefikee-proxies", "desiredCount": 2, "launchType": "FARGATE", "schedulingStrategy": "REPLICA", "networkConfiguration": { "awsvpcConfiguration": { "subnets": [\ "",\ "",\ ""\ ], "securityGroups": [\ ""\ ], "assignPublicIp": "ENABLED" } } } Customize the file and deploy it to the Fargate cluster: aws ecs create-service --cli-input-json file://proxies-svc.json --cluster --region Check the service status to ensure the service was started: Command aws ecs describe-services --services traefikee-proxies --cluster --region Expected output { "services": [\ {\ "status": "ACTIVE",\ "serviceRegistries": [],\ "pendingCount": 0,\ "launchType": "EC2",\ "enableECSManagedTags": true,\ "schedulingStrategy": "REPLICA",\ "loadBalancers": [],\ "placementConstraints": [\ {\ "type": "distinctInstance"\ }\ ],\ "createdAt": 1605879947.392,\ "desiredCount": 2,\ "serviceName": "traefikee-proxies",\ "clusterArn": "arn:aws:ecs:aws_region:aws_account_id:cluster/traefikee-ecs",\ "createdBy": "arn:aws:iam::aws_account_id:user/aws_user",\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-proxies:5",\ "serviceArn": "arn:aws:ecs:aws_region:aws_account_id:service/traefikee-ecs/traefikee-proxies",\ "propagateTags": "SERVICE",\ "deploymentConfiguration": {\ "maximumPercent": 200,\ "minimumHealthyPercent": 100\ },\ "deployments": [\ {\ "status": "PRIMARY",\ "pendingCount": 0,\ "launchType": "EC2",\ "createdAt": 1605880984.365,\ "desiredCount": 2,\ "taskDefinition": "arn:aws:ecs:aws_region:aws_account_id:task-definition/traefikee-proxies:5",\ "updatedAt": 1605881208.064,\ "id": "ecs-svc/4529007424825088897",\ "runningCount": 2\ }\ ],\ "events": [\ {\ "message": "(service traefikee-proxies) has reached a steady state.",\ "id": "51e07037-3595-40fa-a394-c489561fcd11",\ "createdAt": 1605881208.068\ },\ {\ "message": "(service traefikee-proxies) has started 1 tasks: (task 11ad2458e5624330955dc97f6ce41d41).",\ "id": "7e74652c-f88c-4e0f-b922-446ac8a7a114",\ "createdAt": 1605881197.123\ },\ {\ "message": "(service traefikee-proxies) has reached a steady state.",\ "id": "2d857d41-658a-452b-b7d6-c1c3bb4a2944",\ "createdAt": 1605881165.664\ },\ {\ "message": "(service traefikee-proxies) has started 1 tasks: (task b94de86d3664413081c045ed25f9b326).",\ "id": "74bb63a2-bbf8-45a2-bc22-a5a266b4289e",\ "createdAt": 1605881153.114\ }\ ],\ "runningCount": 2,\ "placementStrategy": []\ }\ ], "failures": [] } ### Plugin Registry[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#plugin-registry "Permanent link") Create a file named `registry-task.json` with the following task definition: Registry Storage Fargate by default assign non-persistent storage to the container, in order to keep your custom plugins, if the registry container needs to be recreated you need to add an EFS volume as described on the task definition below. Without Secret { "family": "traefikee-registry", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name" : "registry",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "hostPort": 443,\ "protocol": "tcp",\ "containerPort": 443\ }\ ],\ "essential": true,\ "command": [\ "plugin-registry",\ "--name=registry",\ "--discovery.static.peers=controller-0.traefikee",\ "--plugindir=/var/lib/plugins",\ "--token=",\ "--jointoken.value="\ ],\ "linuxParameters": {},\ "environment": [],\ "volumesFrom": [],\ "secrets": [],\ "dockerLabels": {\ "com.traefik.traefikee.component": "registry"\ },\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/var/lib/plugins",\ "sourceVolume": "traefikee-plugins"\ }\ ],\ "readonlyRootFilesystem": false,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-registry"\ }\ }\ }\ ], "volumes": [\ {\ "name": "traefikee-plugins",\ "efsVolumeConfiguration": {\ "fileSystemId": "",\ "transitEncryption": "DISABLED",\ "rootDirectory": "/"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } With Secret { "family": "traefikee-registry", "taskRoleArn": "arn:aws:iam:::role/RoleTraefikECSReadAccess", "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole", "cpu": "512", "memory": "1024", "containerDefinitions": [\ {\ "name" : "registry",\ "image": "traefik/traefikee:v2.12.0",\ "cpu": 500,\ "portMappings": [\ {\ "hostPort": 443,\ "protocol": "tcp",\ "containerPort": 443\ }\ ],\ "essential": true,\ "command": [\ "plugin-registry",\ "--name=registry",\ "--discovery.dns.domain=controller-0.traefikee",\ "--plugindir=/var/lib/plugins"\ ],\ "linuxParameters": {},\ "environment": [],\ "volumesFrom": [],\ "secrets": [\ {\ "name": "TRAEFIKEE_PLUGIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ },\ {\ "name": "TRAEFIKEE_JOIN_TOKEN",\ "valueFrom": "arn:aws:secretsmanager:::secret::::"\ }\ ],\ "dockerLabels": {\ "com.traefik.traefikee.component": "registry"\ },\ "mountPoints": [\ {\ "readOnly": false,\ "containerPath": "/var/lib/plugins",\ "sourceVolume": "traefikee-plugins"\ }\ ],\ "readonlyRootFilesystem": false,\ "privileged": false,\ "logConfiguration": {\ "logDriver": "awslogs",\ "options": {\ "awslogs-group": "",\ "awslogs-stream-prefix": "traefikee-registry"\ }\ }\ }\ ], "volumes": [\ {\ "name": "traefikee-plugins",\ "efsVolumeConfiguration": {\ "fileSystemId": "",\ "transitEncryption": "DISABLED",\ "rootDirectory": "/"\ }\ }\ ], "networkMode": "awsvpc", "runtimePlatform": { "cpuArchitecture": "X86_64", "operatingSystemFamily": "LINUX" }, "requiresCompatibilities": [\ "FARGATE"\ ] } Registry with Multi controller In case of multi controller installation, you should add all the controller in the static.discovery.peers field. Customize the file, then register the task definition in Fargate: aws ecs register-task-definition --cli-input-json file://registry-task.json --region Now create a file named `registry-svc.json` with the service definition: { "serviceName": "traefikee-registry", "taskDefinition": "traefikee-registry", "desiredCount": 1, "launchType": "FARGATE", "schedulingStrategy": "REPLICA", "serviceRegistries": [\ {\ "registryArn": ""\ }\ ], "networkConfiguration": { "awsvpcConfiguration": { "subnets": [\ "",\ "",\ ""\ ], "securityGroups": [\ ""\ ], "assignPublicIp": "ENABLED" } } } Customize the file and deploy it to the Fargate cluster: aws ecs create-service --cli-input-json file://registry-svc.json --cluster --region Check the service status to ensure the service was started: Command aws ecs describe-services --services registry --cluster --region Expected output { "services": [\ {\ "serviceArn": "arn:aws:ecs:eu-north-1:114072598128:service/traefikee-ecs/traefikee-registry",\ "serviceName": "traefikee-registry",\ "clusterArn": "arn:aws:ecs:eu-north-1:114072598128:cluster/traefikee-ecs",\ "loadBalancers": [],\ "serviceRegistries": [],\ "status": "ACTIVE",\ "desiredCount": 1,\ "runningCount": 1,\ "pendingCount": 0,\ "launchType": "EC2",\ "taskDefinition": "arn:aws:ecs:eu-north-1:114072598128:task-definition/traefikee-registry:2",\ "deploymentConfiguration": {\ "deploymentCircuitBreaker": {\ "enable": false,\ "rollback": false\ },\ "maximumPercent": 200,\ "minimumHealthyPercent": 100\ },\ "deployments": [\ {\ "id": "ecs-svc/5244500742569760246",\ "status": "PRIMARY",\ "taskDefinition": "arn:aws:ecs:eu-north-1:114072598128:task-definition/traefikee-registry:2",\ "desiredCount": 1,\ "pendingCount": 0,\ "runningCount": 1,\ "failedTasks": 0,\ "createdAt": 1610097942.755,\ "updatedAt": 1610097977.375,\ "launchType": "EC2",\ "rolloutState": "COMPLETED",\ "rolloutStateReason": "ECS deployment ecs-svc/5244500742569760246 completed."\ }\ ],\ "events": [\ {\ "id": "9b8f4549-e972-4506-848a-8050084f57f0",\ "createdAt": 1610097977.381,\ "message": "(service registry) has reached a steady state."\ },\ {\ "id": "adee0f69-5ceb-4f11-8fd9-47effc1b39c2",\ "createdAt": 1610097977.38,\ "message": "(service registry) (deployment ecs-svc/5244500742569760246) deployment completed."\ },\ {\ "id": "6b070094-8686-4ab7-9886-82c248203698",\ "createdAt": 1610097966.485,\ "message": "(service registry) has started 1 tasks: (task 65e57cd8504346da8a8d654917919c7b)."\ },\ ],\ "createdAt": 1610096466.659,\ "placementConstraints": [],\ "placementStrategy": [\ {\ "type": "spread",\ "field": "attribute:ecs.availability-zone"\ },\ {\ "type": "spread",\ "field": "instanceId"\ }\ ],\ "schedulingStrategy": "REPLICA",\ "createdBy": "arn:aws:iam::114072598128:user/xxx",\ "enableECSManagedTags": true,\ "propagateTags": "NONE"\ }\ ], "failures": [] } Remote Access Through `teectl`[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#remote-access-through-teectl "Permanent link") --------------------------------------------------------------------------------------------------------------------------------------------------- Once your cluster is ready, if you want to operate the cluster remotely using the `teectl` tool, you will need to generate credentials from your cluster using `traefikee generate credentials` on one of your controllers and use `teectl` to import the cluster credentials. First connect to a container instance running a controller task, then run: Command # Get a teectl config with credentials aws ecs execute-command --cluster --container controller-0 --task --interactive --command "/traefikee generate credentials --cluster --onpremise.hosts --socket /var/run/teectl-controller-0.sock" Expected output cluster_name: tls: cert: | -----BEGIN CERTIFICATE----- MIIB+jCCAaCgAwIBAgIQKHgQX14LGetAsD8wSEta5jAKBggqhkjOPQQDAjAuMRUw EwYDVQQKEwxUcmFlZmlrIExhYnMxFTATBgNVBAMTDFRyYWVmaWtFRSBDQTAgFw0y MDExMTkyMDAwMDNaGA8yMTIwMTAyNjIwMDAwM1owFTETMBEGA1UEAxMKY2xpZW50 LmVjczBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKcFJkSGRxbfAnQx2JtYpEnA knHdqukFWF8Sbvht30Ge/EnBrTe37ilzJ0KlY11UQK/KlGPMoqVSrjAnqZz10nGj gbYwgbMwDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAwGA1Ud EwEB/wQCMAAwKQYDVR0OBCIEIKh1ygHajrADFcxpfv4p/ff7FH4lDULi0uqcDp7j qaylMCsGA1UdIwQkMCKAILoCK8uf89Yveb/uZN+Vs+gfvz05Y6NHB2/hd3T6ix3T MCYGA1UdEQQfMB2CCmNsaWVudC5lY3OCCWxvY2FsaG9zdIcEfwAAATAKBggqhkjO PQQDAgNIADBFAiEAiXT09co8egGQ0Y6hJ/lgIzCGC0I9GiFfvrxCGKl15l8CICYY E6ig/k2D4coprOclVF5QVkqHCcx2EL0HA/zK05eI -----END CERTIFICATE----- key: | -----BEGIN EC PRIVATE KEY----- MHcCAQEEIC8CsJ/B115S+JtR1/l3ZQwKA3XdXt9zLqusF1VXc/KloAoGCCqGSM49 AwEHoUQDQgAEpwUmRIZHFt8CdDHYm1ikScCScd2q6QVYXxJu+G3fQZ78ScGtN7fu KXMnQqVjXVRAr8qUY8yipVKuMCepnPXScQ== -----END EC PRIVATE KEY----- ca: | -----BEGIN CERTIFICATE----- MIIB2DCCAX2gAwIBAgIQDEHgiwDfaIX3wS1EHF800DAKBggqhkjOPQQDAjAuMRUw EwYDVQQKEwxUcmFlZmlrIExhYnMxFTATBgNVBAMTDFRyYWVmaWtFRSBDQTAgFw0y MDExMTkxOTU2MjBaGA8yMTIwMTAyNjE5NTYyMFowLjEVMBMGA1UEChMMVHJhZWZp ayBMYWJzMRUwEwYDVQQDEwxUcmFlZmlrRUUgQ0EwWTATBgcqhkjOPQIBBggqhkjO PQMBBwNCAATe+gM99l/nAAeNIy/kn8vbrcSNORhbWGBUp+j1CtL2ADqLYIel/acB B3ssLPnbAZLoKJefrQS/CNJOdZpRZBnfo3sweTAOBgNVHQ8BAf8EBAMCAYYwDwYD VR0TAQH/BAUwAwEB/zApBgNVHQ4EIgQgugIry5/z1i95v+5k35Wz6B+/PTljo0cH b+F3dPqLHdMwKwYDVR0jBCQwIoAgugIry5/z1i95v+5k35Wz6B+/PTljo0cHb+F3 dPqLHdMwCgYIKoZIzj0EAwIDSQAwRgIhAMRjpKzzAZr5wT5IXMaBWv0OUvy6wxFn kyZApTzhcbr9AiEAtaJZ7DN+xLeA0/RUljK0uDKuZALix30VSx4U2aaYdc4= -----END CERTIFICATE----- onPremise: hosts: - port: 55055 Save the output of the last command above to a file named `teectl-config.yaml`, and then run: teectl cluster import --file="teectl-config.yaml" teectl cluster use --name You can now use `teectl` to operate your cluster. Command teectl get nodes Expected output ID NAME STATUS ROLE hlx1b3gu8bb5n1lg8qtiy5nvv controller-0 Ready Controller (Leader) jm5wv9kdmp9imspqx39n300b3 ip-10-0-0-130.us-east-1.compute.internal Ready Proxy / Ingress y0l2me7zjalidnzqf3fqanuxk ip-10-0-0-178.us-east-1.compute.internal Ready Proxy / Ingress odxyyk3l7pkwiab8rtwvhflgs registry Ready Plugin Registry Going further Now that the cluster is ready, we recommend reading the various [operating guides](https://doc.traefik.io/traefik-enterprise/operations/introduction/) to dive into all the features that Traefik Enterprise provides. License Monitoring[¶](https://doc.traefik.io/traefik-enterprise/installing/ecs/fargate/#license-monitoring "Permanent link") ----------------------------------------------------------------------------------------------------------------------------- When a Traefik Enterprise controller starts for the first time, it checks the license validity. If the license is valid, another check is done once every 24 hours. If the controller can't communicate with the license server, a 72-day grace period starts to recover from this situation. Once the grace period is over, the controller stops updating the proxies configuration. Please look at the [FAQ](https://doc.traefik.io/traefik-enterprise/kb/faq/) to know how to implement the license monitoring. --- # Traefik Enterprise GitOps Flow - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#installing-with-the-gitops-endpoint) Initializing search Installing with the GitOps endpoint[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#installing-with-the-gitops-endpoint "Permanent link") ===================================================================================================================================================================== [GitOps practices](https://www.weave.works/technologies/gitops/) are a set of workflows and practices that make Git the source of truth for infrastructure configuration management. Kubernetes only For now, Traefik Enterprise can be only be installed using GitOps practices on Kubernetes. Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#requirements "Permanent link") ----------------------------------------------------------------------------------------------------------------------- * Kubernetes version `1.23` or greater Installation[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#installation "Permanent link") ----------------------------------------------------------------------------------------------------------------------- To install Traefik Enterprise without the `teectl` CLI, an HTTP request can be made to generate the required installation manifests, which can then be applied directly to a Kubernetes cluster. First, your Traefik Enterprise license needs to be specified in a Kubernetes [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) , in the namespace in which you plan to install Traefik Enteprise. kubectl create namespace traefikee kubectl create secret generic $CLUSTERNAME-license --from-literal=license="$TRAEFIKEE_LICENSE" -n traefikee As a convenience, a sample declarative file that can be used with `kubectl apply` has been provided below: apiVersion: v1 kind: Namespace metadata: name: traefikee namespace: traefikee --- apiVersion: v1 kind: Secret type: Opaque metadata: name: default-license namespace: traefikee stringData: license: myLicenseString The next step is to create a [ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/) containing your Traefik Enterprise [static configuration](https://doc.traefik.io/traefik-enterprise/references/configuration/static/) . Traefik Enterprise will watch this configuration and automatically update all of its proxies whenever the ConfigMap's data is edited. kubectl create configmap --from-file=static.yaml $CLUSTERNAME-static-config -n traefikee As a convenience, a sample declarative file that can be used with `kubectl apply` has been provided below: apiVersion: v1 kind: ConfigMap metadata: namespace: traefikee name: default-static-config data: static.yaml: | entryPoints: http: address: ":80" https: address: ":443" providers: kubernetesCRD: {} api: dashboard: true Now that your license has been applied and your static configuration is in a ConfigMap, you can query the installer service to generate an installation manifest, which you should review and make any changes that are needed: Applying the installation manifest curl "https://install.enterprise.traefik.io/v2.12" --output manifest.yaml Once you have reviewed the manifest, the next step is to apply it using `kubectl`: kubectl apply -f manifest.yaml The installation service supports [multiple options to customize your installation](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#custom-installation-parameters) (namespace, cluster name, etc.). ### Custom Installation Parameters[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#custom-installation-parameters "Permanent link") Here are the options that can be specified using query parameters to customize the generated install manifest: * `cluster` _string_ (default: `default`) : The cluster name * `namespace` _string_ (default: `traefikee`) : The namespace in which to install * `clusterdomain` _string_ (default: `cluster.local`) : The cluster domain (required for service mesh) * `controllers` _integer_ (default: `1`) : The number of controllers * `proxies` _integer_ (default: `2`) : The number of proxies * `mesh` _boolean_ (default: `false`) : Enable service mesh * `kubedns` _boolean_ (default: `false`) : The cluster has KubeDNS installed * `withoutcrds` _boolean_ (default: `false`) : Do not output the CRD part of the manifest * `withoutresources` _boolean_ (default: `false`) : Do not output the Resources part of the manifest * `staticconfig` _string_ (default: `static.yaml`) : The name of the static configuration file in the ConfigMap * `loglevel` _string_ (default: "") : The controller and proxies log level * `logformat` _string_ (default: "") : The controller and proxies log format * `logfilepath` _string_ (default: "") : The controller and proxies log filepath The following command gets an installation manifest that has service mesh enabled, for a cluster that uses KubeDNS, and will install a cluster named `staging` in the `traefikee-staging` namespace: Example kubectl apply -f "https://install.enterprise.traefik.io/v2.12?cluster=staging&namespace=traefikee-staging&mesh&kubedns" Using a TOML static configuration instead of YAML If you use a TOML-formatted configuration, you need to specify the `staticconfig` option with the file name, including the TOML extension. Custom cluster name The names for the license Secret and ConfigMap used to hold the static configuration are dependent on the cluster name, and should be formatted like such: `${CLUSTERNAME}-license` for the license secret and `${CLUSTERNAME}-static-config` for the ConfigMap that holds the static configuration. Two-step Install to Split CRDs and Resources By using the `withoutcrds` and `withoutresources` options, you can split your installation into two steps, in order to manage them separately and avoid deleting the CRDs by accident after a blue/green deployment. Remote static configuration management If you wish to use `teectl` to deploy or update your static configuration, instead of letting Traefik Enterprise watch it automatically from a ConfigMap, you can do so by removing the following lines: ... - name: staticconfig mountPath: /var/run/traefikee/config ... - "--configFile=/var/run/traefikee/config/static.yaml" ... - name: staticconfig configMap: name: default-static-config ... Remote Access Through `teectl`[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#remote-access-through-teectl "Permanent link") --------------------------------------------------------------------------------------------------------------------------------------------------------- Once your cluster is ready, if you want to operate the cluster remotely using the `teectl` tool, you will need to generate credentials from your cluster using `traefikee generate credentials` on one of your controllers and use `teectl` to import the cluster credentials. kubectl exec -n traefikee default-controller-0 -- /traefikee generate credentials --kubernetes.kubeconfig="${KUBECONFIG}" --cluster=default > config.yaml teectl cluster import --file="config.yaml" You can now use `teectl` to operate your cluster. Command teectl get nodes Expected output ID NAME STATUS ROLE 3l5xt87fkc2ztlqlkwcpavuev default-proxy-6f488c84c5-cx9wj Ready Proxy / Ingress 52sje29l1zreu1h319vabtzmx default-controller-1 Ready Controller c5j53krue2avv77ajr8h5bcoz default-controller-0 Ready Controller (Leader) yjtz8kvnsgmqmuycup69vx180 default-proxy-6f488c84c5-2zwb7 Ready Proxy / Ingress yo4cycxshnuazwvmrfjtowugw default-proxy-6f488c84c5-b2c9d Ready Proxy / Ingress yqz838gxifzoh0czugxju2r4p default-controller-2 Ready Controller License Monitoring[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops/#license-monitoring "Permanent link") ----------------------------------------------------------------------------------------------------------------------------------- When a Traefik Enterprise controller starts for the first time, it checks the license validity. If the license is valid, another check is done once every 24 hours. If the controller can't communicate with the license server, a 72-day grace period starts to recover from this situation. Once the grace period is over, the controller stops updating the proxies configuration. Please look at the [FAQ](https://doc.traefik.io/traefik-enterprise/kb/faq/) to know how to implement the license monitoring. --- # Install Traefik Enterprise with Helm Chart - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#installing-with-the-helm-chart) Initializing search Installing with the Helm Chart[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#installing-with-the-helm-chart "Permanent link") ========================================================================================================================================================= Deployment Only The Traefik Enterprise Helm Chart provides support for deploying and upgrading core components such as the Controllers, Proxies and Plugin Registry, without applying any runtime configuration by default. Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#requirements "Permanent link") --------------------------------------------------------------------------------------------------------------------- * Helm version 3 [installed](https://helm.sh/docs/intro/install/) * Kubernetes version `1.23` or greater Adding the Traefik Enterprise repository[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#adding-the-traefik-enterprise-repository "Permanent link") ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Run the following command to add the repository: helm repo add traefik https://traefik.github.io/charts Run the following command to update the repository: helm repo update Deploy the cluster[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#deploy-the-cluster "Permanent link") --------------------------------------------------------------------------------------------------------------------------------- To deploy Traefik Enterprise in the default Kubernetes namespace: helm install traefikee traefik/traefikee Although, it is recommended to deploy Traefik Enterprise in a separate namespace: helm install traefikee traefik/traefikee --namespace traefikee --create-namespace The next step is to create the Kubernetes secret that will hold the Traefik Enterprise license key. kubectl create secret generic $CLUSTERNAME-license --from-literal=license="$TRAEFIKEE_LICENSE" -n traefikee The command above assumes two environment variables named `$CLUSTERNAME` and `$TRAEFIKEE_LICENSE` are already defined. By default, the expected value for `$CLUSTERNAME` is `default`. Setting cluster name The cluster name can customized with the `cluster` key on your deployment values file or directly as a flag: helm install traefikee traefik/traefikee --set "cluster=mycluster" --namespace traefikee --create-namespace ### Custom deploy parameters[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#custom-deploy-parameters "Permanent link") The following command will display all available configuration parameters that can be changed according to the needs. helm show values traefik/traefikee The output of the command can be redirected to a file e.g. `values.yaml` and then modified accordingly and used with the Helm install command. helm install traefikee traefik/traefikee -f values.yaml #### HA Values[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#ha-values "Permanent link") This chart provides an example of a high-availability set of defaults. curl -L https://raw.githubusercontent.com/traefik/traefikee-helm-chart/master/traefikee/values-ha.yaml One can apply it as custom values: curl -O https://raw.githubusercontent.com/traefik/traefikee-helm-chart/master/traefikee/values-ha.yaml # Update HA values accordingly to your needs helm install traefikee traefik/traefikee -f values-ha.yaml ### Applying a static configuration[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#applying-a-static-configuration "Permanent link") After deploying, the cluster will be up and running, with a simple static configuration, set in values: controller: [...] staticConfig: # configMap: # name: traefik-config # key: "static.yml" content: | entrypoints: web: address: ":7000" websecure: tls: {} address: ":7443" ping: {} providers: kubernetesIngress: allowEmptyServices: true kubernetesCRD: allowEmptyServices: true This configuration allows to run Traefik Enterprise securely, without using a privileged port, with liveness and readyness using `/ping`. There are two main approaches for applying a static configuration to the cluster at this point: * by updating the static configuration set with values of Helm Chart * by creating another Kubernetes ConfigMap with its content, outside of the Helm Chart #### Creating another Kubernetes ConfigMap[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#creating-another-kubernetes-configmap "Permanent link") Create the config map by executing the following command: kubectl create configmap --from-file=static.yaml $CLUSTERNAME-static-config -n traefikee Once the `ConfigMap` is created, it must be mounted on the controllers with the `proxy.staticConfig.configMap` and `proxy.staticConfig.configMapKey` flags: helm upgrade --install traefikee traefik/traefikee --set "cluster=$CLUSTERNAME,controller.staticConfig.content=null,controller.staticConfig.configMap.name=$CLUSTERNAME-static-config,controller.staticConfig.configMap.key=static.yaml" --namespace traefikee --create-namespace Reloading the static configuration Each time the config map is updated Traefik Enterprise will reload the changes automatically. ### Static volume provisioning[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#static-volume-provisioning "Permanent link") Setting status PV name There are cases where static PV name may require to match the following format: `${PVC_TEMPLATE_NAME}-${STATEFULSET_NAME}-${REPLICA_INDEX}` Below, examples for Traefik Enterprise using the [local path provisioner](https://github.com/rancher/local-path-provisioner) or the [EFS CSI driver](https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html) as static provisioner: Local path provisioner # pv.yaml --- apiVersion: v1 kind: PersistentVolume metadata: name: pv-controller-0 spec: accessModes: - ReadWriteOnce capacity: storage: 10Gi claimRef: apiVersion: v1 kind: PersistentVolumeClaim name: data-default-controller-0 namespace: traefikee persistentVolumeReclaimPolicy: Delete storageClassName: standard volumeMode: Filesystem hostPath: path: /var/local-path-provisioner/pvc-controller-0_traefikee_data-default-controller-0 type: DirectoryOrCreate --- apiVersion: v1 kind: PersistentVolume metadata: name: pv-registry-0 spec: accessModes: - ReadWriteOnce capacity: storage: 5Gi claimRef: apiVersion: v1 kind: PersistentVolumeClaim name: plugin-data-default-plugin-registry-0 namespace: traefikee persistentVolumeReclaimPolicy: Delete storageClassName: standard volumeMode: Filesystem hostPath: path: /var/local-path-provisioner/pvc-registry-0_traefikee_plugin-data-default-plugin-registry-0 type: DirectoryOrCreate EFS CSI driver # pv.yaml --- apiVersion: v1 kind: PersistentVolume metadata: name: pv-controller-0 spec: capacity: storage: 10Gi volumeMode: Filesystem accessModes: - ReadWriteOnce persistentVolumeReclaimPolicy: Retain storageClassName: efs-sc csi: driver: efs.csi.aws.com volumeHandle: fs-0dae47308e4b64b6c claimRef: name: data-default-controller-0 namespace: traefikee --- apiVersion: v1 kind: PersistentVolume metadata: name: pv-registry-0 namespace: traefikee spec: capacity: storage: 5Gi volumeMode: Filesystem accessModes: - ReadWriteOnce storageClassName: efs-sc persistentVolumeReclaimPolicy: Retain csi: driver: efs.csi.aws.com volumeHandle: fs-0723cab9644700873 claimRef: name: plugin-data-default-plugin-registry-0 namespace: traefikee Namespace and claimRef values The namespace must be the same as the one defined in Helm release (by default `traefikee`). `spec.claimRef` must match the `volumeClaimTemplates` value defined in the Helm chart. EKS Fargate and persistent storage EKS Fargate support only EFS for persistent storage provisioner, as detailed [here](https://repost.aws/articles/ARvp6j-8c4Q4W9Zg7Zw3o_4g/demystifying-efs-claim-not-bound-on-aws-fargate-with-amazon-eks) . To run Traefik Enterprise pod on EKS Fargate, you should create the PV before deploying. EFS provisioning EFS provisioning need the EFS volume ID (in `spec.csi.volumeHandle`) to be declared in the PV definition. EFS volume ID is set when creating the volume and can be found in the AWS EFS dashboard or by aws CLI as detailed [here](https://docs.aws.amazon.com/cli/latest/reference/efs/describe-file-systems.html) . Apply the YAML file described below to your cluster: kubectl apply -f pv.yaml Install Traefik Enterprise and the volumes will be automatically bound: helm upgrade --install traefikee traefik/traefikee --namespace traefikee --create-namespace Remote Access Through `teectl`[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#remote-access-through-teectl "Permanent link") ------------------------------------------------------------------------------------------------------------------------------------------------------- Once your cluster is ready, if you want to operate the cluster remotely using the `teectl` tool, you will need to generate credentials from your cluster using `traefikee generate credentials` on one of your controllers and use `teectl` to import the cluster credentials. kubectl exec -n traefikee default-controller-0 -- /traefikee generate credentials --kubernetes.kubeconfig="${KUBECONFIG}" --cluster=default > config.yaml teectl cluster import --file="config.yaml" You can now use `teectl` to operate your cluster. Command teectl get nodes Expected output ID NAME STATUS ROLE 3l5xt87fkc2ztlqlkwcpavuev default-proxy-6f488c84c5-cx9wj Ready Proxy / Ingress 52sje29l1zreu1h319vabtzmx default-controller-1 Ready Controller c5j53krue2avv77ajr8h5bcoz default-controller-0 Ready Controller (Leader) yjtz8kvnsgmqmuycup69vx180 default-proxy-6f488c84c5-2zwb7 Ready Proxy / Ingress yo4cycxshnuazwvmrfjtowugw default-proxy-6f488c84c5-b2c9d Ready Proxy / Ingress yqz838gxifzoh0czugxju2r4p default-controller-2 Ready Controller Next steps[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#next-steps "Permanent link") ----------------------------------------------------------------------------------------------------------------- * Take a look at the Operations guide for instructions on setting up the Traefik [Dashboard](https://doc.traefik.io/traefik-enterprise/operations/dashboard/) and [API](https://doc.traefik.io/traefik-enterprise/operations/api/) * Deploy a sample application with an Ingress by following [this guide](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#deploying-an-ingress-test-service) License Monitoring[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/helm/#license-monitoring "Permanent link") --------------------------------------------------------------------------------------------------------------------------------- When a Traefik Enterprise controller starts for the first time, it checks the license validity. If the license is valid, another check is done once every 24 hours. If the controller can't communicate with the license server, a 72-day grace period starts to recover from this situation. Once the grace period is over, the controller stops updating the proxies configuration. Please look at the [FAQ](https://doc.traefik.io/traefik-enterprise/kb/faq/) to know how to implement the license monitoring. --- # Install Traefik Enterprise Using teectl - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#installing-with-the-cli) Initializing search Installing with the CLI[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#installing-with-the-cli "Permanent link") ============================================================================================================================================= Kubernetes Knowledge Assistance with configuring or setting up a Kubernetes cluster are not included in this guide. If you need more information about Kubernetes, start with the following resources: * [Kubernetes Concepts](https://kubernetes.io/docs/concepts/) * [Kubernetes Basics](https://kubernetes.io/docs/tutorials/kubernetes-basics/) * [Learning Kubernetes with Tutorials](https://kubernetes.io/docs/tutorials/) * [Setting Up Kubernetes](https://kubernetes.io/docs/setup/) Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#requirements "Permanent link") ----------------------------------------------------------------------------------------------------------------------- * A Kubernetes cluster: * Traefik Enterprise follows the [Kubernetes support policy](https://kubernetes.io/releases/version-skew-policy/#supported-versions) , and supports at least the latest three minor versions of Kubernetes (v1.23 or greater for the current version of Traefik Enterprise). General functionality cannot be guaranteed for versions older than that. * `kubectl` properly configured, with the ability to create and manage namespaces and their resources. * A default StorageClass configured. Traefik Enterprise uses [StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) with persistent volumes enabled and we rely on the default StorageClass of the cluster by default. Instructions to setup a default StorageClass can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/#changing-the-default-storageclass) . * Controller pods can reach `https://v4.license.containous.cloud`. * The [`teectl` binary is installed](https://doc.traefik.io/traefik-enterprise/installing/teectl-cli/) , for cluster management. Installing[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#installing "Permanent link") ------------------------------------------------------------------------------------------------------------------- This guide provides a detailed explanation of the install process. For a lighter approach, please refer to the [getting started](https://doc.traefik.io/traefik-enterprise/getting-started/#install-traefik-enterprise-with-teectl) guide. ### Generating the `teectl` Configuration[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#generating-the-teectl-configuration "Permanent link") To start the installation, `teectl` must first be configured: Command teectl setup --kubernetes This command creates a new `teectl` configuration under `~/.config/traefikee/default.yaml` and generates a `bundle.zip` which carries a set of needed assets for the installation. To further configure the `teectl` setup, please refer to the [reference documentation](https://doc.traefik.io/traefik-enterprise/references/cli/teectl/#setup-a-cluster-connection-setup) . Sensitive Information The generated `bundle.zip` carries sensitive information and is required to generate installation manifests. It should be stored in a secure place. Managing Multiple Clusters from a Single Workstation To manage multiple clusters from a single workstation, please refer to the [Managing Multiple Clusters guide](https://doc.traefik.io/traefik-enterprise/operations/teectl-cluster-mgt/) Writing the Bundle at a Different Path `teectl setup` comes with an `--output` option that specifies the output path in which to create the bundle. ### Generating the Installation Manifest[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#generating-the-installation-manifest "Permanent link") Installing with Service Mesh Option The service mesh is not installed by default. Enabling it requires commands in addition to those described in this section. For more information, see the [Service Mesh](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#service-mesh) section. The next step is to generate the installation manifest based on the bundle generated previously: Command # In this example, we generate a manifest for an installation with 3 controllers and 3 ingress proxies. teectl setup gen --controllers=3 --proxies=3 --license="your-traefikee-license" > traefikee-manifest.yaml The generated manifest describes all the resources required to run a cluster in Kubernetes, including: * A `traefikee` [namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) where all resources are created * Traefik Proxy [custom resource definitions](https://doc.traefik.io/traefik/v2.11/providers/kubernetes-crd/#resource-configuration) to create IngressRoutes and related resources. * Controller [StatefulSet](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) * Ingress proxy [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) * Controller [headless Service](https://kubernetes.io/docs/concepts/services-networking/service/#headless-services) * Ingress proxy [LoadBalancer Service](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer) To further configure the generated manifest, please refer to the [reference documentation](https://doc.traefik.io/traefik-enterprise/references/cli/teectl/#generate-platform-manifest-files-setup-gen) . Sensitive Information The generated manifest carries sensitive information. It should be stored in a secure place or deleted after installing, as it can be regenerated. Using a Bundle in a Different Path If the generated bundle is located in a different path, use the `--bundle` option with `teectl setup gen`. One-Line Installation To directly install your cluster without writing the generated manifest to a file, please use: teectl setup gen --controllers=3 --proxies=3 --license="your-traefikee-license" | kubectl apply -f - #### Customizing the Manifest (Optional)[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#customizing-the-manifest-optional "Permanent link") There is a section dedicated to [customizing](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/) the manifest file, with some [common scenarios](https://doc.traefik.io/traefik-enterprise/installing/customizing/kubernetes/#common-scenarios-requiring-customization) that require it. Rootless Image A rootless image is available. For more information, please refer to this [section](https://doc.traefik.io/traefik-enterprise/operations/rootless-image/) . ### Service Mesh[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#service-mesh "Permanent link") The service mesh is not enabled by default. To generate a manifest that includes the [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) for the mesh proxies, you must provide the `--mesh` flag to `teectl setup gen`, like so: Command # In this example, we generate a manifest for an installation with 3 controllers, 3 ingress proxies and a mesh proxy per node. teectl setup gen --controllers=3 --proxies=3 --mesh --license="your-traefikee-license" > traefikee-manifest.yaml KubeDNS If your cluster is using KubeDNS – which is the default in GKE, for example – you **must** pass the `--mesh.kubedns` option to `teectl setup gen` if you wish to enable the service mesh. This option generates Kubernetes objects to install CoreDNS in the Traefik Enterprise namespace. The KubeDNS ConfigMap will then be [patched](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#dns-patching) using `stubDomains` to delegate service mesh resolution to CoreDNS. #### DNS Patching[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#dns-patching "Permanent link") The service mesh provided by Traefik Enterprise is opt-in by default. A service will use the mesh only if it chooses to. To do so, it has to contact other services using an URL that follows the pattern `{service}.{namespace}.maesh`. In order to resolve URLs, the DNS server configuration has to be patched using the following command: Command teectl setup patch-dns Expected Output ... DNS patched successfully Cluster DNS Requirements DNS patching is supported on CoreDNS and KubeDNS when installed as [Cluster DNS Provider](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/) (versions 1.3+). ### Deploying the Cluster[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#deploying-the-cluster "Permanent link") Once the manifest is reviewed and ready, the next step is to deploy the cluster: Command kubectl apply -f traefikee-manifest.yaml Expected Output (Mesh Disabled) customresourcedefinition.apiextensions.k8s.io/ingressroutes.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/middlewares.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/ingressroutetcps.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/ingressrouteudps.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/tlsoptions.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/tlsstores.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/traefikservices.traefik.containo.us created namespace/traefikee created serviceaccount/default-svc-acc created clusterrole.rbac.authorization.k8s.io/default-svc-acc-role created clusterrolebinding.rbac.authorization.k8s.io/default-svc-acc created role.rbac.authorization.k8s.io/default-svc-acc-role-traefikee created rolebinding.rbac.authorization.k8s.io/default-svc-acc-traefikee created secret/default-mtls created service/default-ctrl-svc created statefulset.apps/default-controller created service/default-proxy-svc created deployment.apps/default-proxy created Expected Output (Mesh Enabled) customresourcedefinition.apiextensions.k8s.io/ingressroutes.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/middlewares.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/ingressroutetcps.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/ingressrouteudps.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/tlsoptions.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/tlsstores.traefik.containo.us created customresourcedefinition.apiextensions.k8s.io/traefikservices.traefik.containo.us created namespace/traefikee created serviceaccount/default-svc-acc created clusterrole.rbac.authorization.k8s.io/default-svc-acc-role created clusterrolebinding.rbac.authorization.k8s.io/default-svc-acc created role.rbac.authorization.k8s.io/default-svc-acc-role-traefikee created rolebinding.rbac.authorization.k8s.io/default-svc-acc-traefikee created secret/default-mtls created service/default-ctrl-svc created statefulset.apps/default-controller created service/default-proxy-svc created deployment.apps/default-proxy created configmap/tcp-state-table created configmap/udp-state-table created daemonset.apps/default-mesh-proxy created poddisruptionbudget.policy/default-mesh-proxy created serviceaccount/default-maesh-proxy created customresourcedefinition.apiextensions.k8s.io/traffictargets.access.smi-spec.io created customresourcedefinition.apiextensions.k8s.io/httproutegroups.specs.smi-spec.io created customresourcedefinition.apiextensions.k8s.io/tcproutes.specs.smi-spec.io created customresourcedefinition.apiextensions.k8s.io/trafficsplits.split.smi-spec.io created Monitor the installation progress using `kubectl`: Command kubectl -n traefikee get pods Expected Output (Mesh Disabled) NAME READY STATUS RESTARTS AGE default-controller-1 1/1 Running 0 44s default-controller-0 1/1 Running 0 44s default-controller-2 1/1 Running 0 44s default-proxy-6f488c84c5-cx9wj 1/1 Running 0 44s default-proxy-6f488c84c5-b2c9d 1/1 Running 0 44s default-proxy-6f488c84c5-2zwb7 1/1 Running 0 44s Expected Output (Mesh Enabled) NAME READY STATUS RESTARTS AGE svclb-default-proxy-svc-xqjjj 2/2 Running 0 44s default-controller-1 1/1 Running 0 44s default-controller-0 1/1 Running 0 44s default-controller-2 1/1 Running 0 44s default-mesh-proxy-rqd64 1/1 Running 0 44s default-proxy-6f488c84c5-cx9wj 1/1 Running 0 44s default-proxy-6f488c84c5-b2c9d 1/1 Running 0 44s default-proxy-6f488c84c5-2zwb7 1/1 Running 0 44s When all the pods are running, ensure that the cluster is properly installed using `teectl get nodes`: Command teectl get nodes Expected Output (Mesh Disabled) ID NAME STATUS ROLE 3l5xt87fkc2ztlqlkwcpavuev default-proxy-6f488c84c5-cx9wj Ready Proxy / Ingress 52sje29l1zreu1h319vabtzmx default-controller-1 Ready Controller c5j53krue2avv77ajr8h5bcoz default-controller-0 Ready Controller (Leader) yjtz8kvnsgmqmuycup69vx180 default-proxy-6f488c84c5-2zwb7 Ready Proxy / Ingress yo4cycxshnuazwvmrfjtowugw default-proxy-6f488c84c5-b2c9d Ready Proxy / Ingress yqz838gxifzoh0czugxju2r4p default-controller-2 Ready Controller Expected Output (Mesh Enabled) ID NAME STATUS ROLE 3l5xt87fkc2ztlqlkwcpavuev default-proxy-6f488c84c5-cx9wj Ready Proxy / Ingress 52sje29l1zreu1h319vabtzmx default-controller-1 Ready Controller c5j53krue2avv77ajr8h5bcoz default-controller-0 Ready Controller (Leader) kegs3jdet7g08ckxjb3jxgi32 default-mesh-proxy-rqd64 Ready Proxy / Mesh yjtz8kvnsgmqmuycup69vx180 default-proxy-6f488c84c5-2zwb7 Ready Proxy / Ingress yo4cycxshnuazwvmrfjtowugw default-proxy-6f488c84c5-b2c9d Ready Proxy / Ingress yqz838gxifzoh0czugxju2r4p default-controller-2 Ready Controller ### Applying a Static Configuration[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#applying-a-static-configuration "Permanent link") A cluster is created without any default configuration. To allow the controller to listen to a provider and proxies to manage incoming traffic, it is necessary to apply a [static configuration](https://doc.traefik.io/traefik-enterprise/operations/static-configuration/) . The following example defines two entry points (listening on ports 80 and 443), enables the [Kubernetes IngressRoute provider](https://doc.traefik.io/traefik/v2.11/providers/kubernetes-crd/) . File (YAML) --- providers: kubernetesCRD: {} entryPoints: web: address: ":80" websecure: address: ":443" # Uncomment the following value to enable the service mesh #mesh: {} File (TOML) [providers.kubernetesCRD] [entryPoints] [entryPoints.web] address = ":80" [entryPoints.websecure] address = ":443" # Uncomment the following value to enable the service mesh #[mesh] Apply the configuration using the following command: With YAML teectl apply --file="./static.yaml" With TOML teectl apply --file="./static.toml" At any time, it is possible to get the currently applied static configuration of a cluster using: Command teectl get static-config Expected Output --- configuration: global: checkNewVersion: true serversTransport: maxIdleConnsPerHost: 200 entryPoints: web: address: :80 transport: lifeCycle: graceTimeOut: 10s respondingTimeouts: idleTimeout: 3m0s forwardedHeaders: {} websecure: address: :443 transport: lifeCycle: graceTimeOut: 10s respondingTimeouts: idleTimeout: 3m0s forwardedHeaders: {} providers: providersThrottleDuration: 2s kubernetesCRD: {} cluster: cleanup: gracePeriod: 1h0m0s mesh: defaultMode: http httpPortLimit: 10 tcpPortLimit: 25 udpPortLimit: 25 Deploying an Ingress Test Service[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#deploying-an-ingress-test-service "Permanent link") ----------------------------------------------------------------------------------------------------------------------------------------------------------------- To validate your setup, it is possible to deploy a test application using the following manifests: whoami.yaml --- apiVersion: apps/v1 kind: Deployment metadata: name: whoami spec: replicas: 1 selector: matchLabels: app: whoami template: metadata: labels: app: whoami spec: containers: - name: whoami image: traefik/whoami:v1.6.1 --- apiVersion: v1 kind: Service metadata: name: whoami labels: app: whoami spec: type: ClusterIP ports: - port: 80 name: whoami selector: app: whoami --- apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: name: whoami spec: entryPoints: - http routes: - match: Path(`/whoami`) kind: Rule services: - name: whoami namespace: default port: 80 client.yaml --- apiVersion: v1 kind: Pod metadata: name: client spec: containers: - name: client image: giantswarm/tiny-tools:3.9 command: - "sleep" - "36000" Then access the application using the following command: Command curl /whoami Expected Output Hostname: whoami-57bcbf7487-bkls7 IP: 127.0.0.1 IP: ::1 IP: 10.42.0.17 IP: fe80::cc09:6cff:fe1b:678d RemoteAddr: 10.42.0.14:45778 GET /whoami HTTP/1.1 Host: 172.18.0.2 User-Agent: curl/7.65.3 Accept: */* Accept-Encoding: gzip X-Forwarded-For: 10.42.0.1 X-Forwarded-Host: 172.18.0.2 X-Forwarded-Port: 80 X-Forwarded-Proto: http X-Forwarded-Server: default-proxy-6f488c84c5-b2c9d X-Real-Ip: 10.42.0.1 Access the application inside the cluster using the service mesh: Command kubectl exec -it pod/client -- curl whoami.default.maesh Expected Output Hostname: whoami-57bcbf7487-bkls7 IP: 127.0.0.1 IP: ::1 IP: 10.42.0.17 IP: fe80::cc09:6cff:fe1b:678d RemoteAddr: 10.42.0.15:48300 GET / HTTP/1.1 Host: whoami.default.maesh User-Agent: curl/7.64.0 Accept: */* Accept-Encoding: gzip X-Forwarded-For: 10.42.0.18 X-Forwarded-Host: whoami.default.maesh X-Forwarded-Port: 80 X-Forwarded-Proto: http X-Forwarded-Server: default-mesh-proxy-rqd64 X-Real-Ip: 10.42.0.18 Congratulations! Your Traefik Enterprise cluster is ready. What's Next? Now that the cluster is ready, we recommend reading the various [operating guides](https://doc.traefik.io/traefik-enterprise/operations/introduction/) to dive into all features that Traefik Enterprise provides. We also recommend getting familiar with the various [concepts](https://doc.traefik.io/traefik-enterprise/concepts/) of Traefik Enterprise. Installing on Openshift[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#installing-on-openshift "Permanent link") --------------------------------------------------------------------------------------------------------------------------------------------- ### Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#requirements_1 "Permanent link") * OpenShift: 4.1.7, with the `oc` admin tools from [openshift-client](https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/) * `cluster-admin` privileges to manage Security Context Constraint ### Security Context Constraints[¶](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#security-context-constraints "Permanent link") From OpenShift version 3.0 onwards, [security context constraints](https://blog.openshift.com/understanding-service-accounts-sccs/) give the cluster admin the ability to control permissions for pods. However, because the default security context constraints do not allow binding privileged ports (below port 1024), a custom one is required in order to install Traefik Enterprise. Here is an example of a security context constraint a cluster admin can set to a user/service account/group: traefikee-scc.yaml --- apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: annotations: kubernetes.io/description: traefikee-scc provides all features of the restricted SCC but allows users to run with any UID and any GID. name: traefikee-scc priority: 10 allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: true allowPrivilegedContainer: false allowedCapabilities: - NET_BIND_SERVICE defaultAddCapabilities: null fsGroup: type: RunAsAny groups: - system:authenticated readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD runAsUser: type: RunAsAny seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny users: [] volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClaim - projected - secret To declare the security context constraint in the OpenShift cluster: Command kubectl apply -f ./traefikee-scc.yaml Then, associate the security context constraint to the user `default` of the destination namespace (here `traefikee`) with: oc adm policy add-scc-to-user traefikee-scc -z default -n traefikee And then follow the usual [installation procedure for Kubernetes](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#installing) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/overview/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/tailscale/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-certificates/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/addprefix/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/buffering/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/compress/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/contenttype/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/digestauth/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/errorpages/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/forwardauth/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/headers/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/chain/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/circuitbreaker/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ipallowlist/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ipallowlist/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/ratelimit/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/redirectregex/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/redirectscheme/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/tls/spiffe/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/grpcweb/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/inflightreq/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/replacepathregex/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/overview/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/passtlsclientcert/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/retry/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/replacepath/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/stripprefix/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/overview/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/stripprefixregex/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/tcp/middlewares/ipallowlist/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/tcp/middlewares/inflightconn/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/tcp/middlewares/ipallowlist/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/tcp/middlewares/overview/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/migrate/v3/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/migrate/v1-to-v2/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/migrate/v2-to-v3-details/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/metrics/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/metrics/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/metrics/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/metrics/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/migrate/v2-to-v3/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/observe/overview/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/metrics/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/metrics/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/hashicorp/consul-catalog/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/kv/consul/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/kv/etcd/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/others/file/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/others/ecs/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/others/http/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-gateway/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/hashicorp/nomad/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/kv/redis/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/kv/zk/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/http/ingressroute/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-crd/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/api-dashboard/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/healthcheck/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/extend/extend-traefik/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/api-dashboard/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/observability/healthcheck/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/docker/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/overview/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/providers/swarm/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/consul-catalog/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/docker/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/ecs/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/file/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/gateway-api/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/kv/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/nomad/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/http/ingressroute/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/configuration-options/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/http/load-balancing/service/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/configuration-options/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/configuration-options/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/configuration-options/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/dynamic-configuration-methods/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/consul-catalog/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/docker/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/ecs/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/gateway-api/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/kv/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/swarm/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/reference/routing-configuration/other-providers/nomad/) . --- # Install Traefik Enterprise on HashiCorp Nomad - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/nomad/#installing-traefik-enterprise-on-hashicorp-nomad) Initializing search Installing Traefik Enterprise on HashiCorp Nomad[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#installing-traefik-enterprise-on-hashicorp-nomad "Permanent link") =================================================================================================================================================================================== This page guides you through the installation of Traefik Enterprise on [HashiCorp Nomad](https://www.nomadproject.io/) . Nomad Knowledge Assistance with configuring or setting up a Nomad cluster is not included in this guide. If you need more information about Nomad, Consul, Vault, or any other components referenced in this guide, start with the following resources: * [Nomad installation overview](https://www.nomadproject.io/) * [Consul](https://www.consul.io/) * [Vault](https://www.vaultproject.io/) Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#requirements "Permanent link") ----------------------------------------------------------------------------------------------------------- * A Nomad cluster * Version 0.12.7 or greater * A persistent storage volume for the controllers * The `nomad` CLI tool properly configured to communicate with the cluster * [Consul integration](https://www.nomadproject.io/docs/integrations/consul-integration) for service discovery * [Vault integration](https://www.nomadproject.io/docs/integrations/vault-integration) for secrets * Controller containers can reach `https://v4.license.containous.cloud` * The [`teectl`](https://doc.traefik.io/traefik-enterprise/installing/teectl-cli/) CLI tool, for cluster management Installation[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#installation "Permanent link") ----------------------------------------------------------------------------------------------------------- This guide will only focus on the [Docker task driver](https://www.nomadproject.io/docs/drivers/docker) , although it is also possible to run with [Fork/Exec](https://www.nomadproject.io/docs/drivers/raw_exec) with a few changes that can be derived from our [On-Premise guide](https://doc.traefik.io/traefik-enterprise/installing/on-premise/) ### Nomad Preparation[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#nomad-preparation "Permanent link") #### Persistent Volume[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#persistent-volume "Permanent link") Create a persistent volume, either by relying on a [CSI storage plugin](https://www.nomadproject.io/docs/internals/plugins/csi) or by preselecting the nodes that will run controller tasks and binding a directory from the host as a volume. For simplicity's sake, this guide will use the host volume approach. In this case, the directory must be present before you can expose it. # Execute on each Nomad node that will run a controller instance mkdir -p /opt/traefikee After creating the directory, add a `host_volume` bind on the Nomad client configuration of each node: client { host_volume "traefikee-data" { path = "/opt/traefikee" } } #### Service Discovery[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#service-discovery "Permanent link") To avoid specifying the Consul address manually on each Task network block, you can add it to the DNS resolution configuration on each Nomad host. Head to the [DNS forwarding guide](https://learn.hashicorp.com/tutorials/consul/dns-forwarding) for Consul for more information. #### License Secret[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#license-secret "Permanent link") Create a secret in [Hashicorp Vault](https://www.vaultproject.io/docs/secrets) with your license key: vault kv put secret/traefikee/license license_key=$TRAEFIKEE_LICENSE ### Generating the `teectl` Configuration[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#generating-the-teectl-configuration "Permanent link") Install the `teectl` management tool on a machine with access to the nodes that will host controller instances by following the instructions in [this guide](https://doc.traefik.io/traefik-enterprise/installing/teectl-cli/) . Once `teectl` is installed, it is possible to generate a set of credentials that enables remote access to the cluster API: Command # Replace ipX with the Nomad Client Node address that will host Traefik Enterprise controller instances teectl setup --onpremise.hosts=",," This command creates a new `teectl` configuration under `~/.config/traefikee/default.yaml` and generates a `bundle.zip` that carries a set of needed assets for the installation. You must copy the `bundle.zip` file to the Nomad volume that will be used by the controllers. Since `teectl setup gen` does not provide support for Nomad manifest files, you will need to write your own job definition with the necessary resources/stanzas and deploy a Traefik Enteprise cluster of one controller and two proxies. ### Nomad Job Definition[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#nomad-job-definition "Permanent link") # Saved as traefikee.json { "job": [\ {\ "traefikee": [\ {\ "datacenters": [\ "dc1"\ ],\ "group": [\ {\ "controllers": [\ {\ "count": 1,\ "network": [\ {\ "port": [\ {\ "control": [\ {\ "static": 4242\ }\ ]\ },\ {\ "api": [\ {\ "static": 55055\ }\ ]\ }\ ]\ }\ ],\ "service": [\ {\ "check": [\ {\ "failures_before_critical": "2",\ "interval": "30s",\ "port": "control",\ "timeout": "5s",\ "type": "tcp"\ }\ ],\ "name": "traefikee-controllers",\ "port": "control",\ "task": "controllers"\ }\ ],\ "task": [\ {\ "controllers": [\ {\ "config": [\ {\ "args": [\ "controller",\ "--name=${NOMAD_ALLOC_NAME}",\ "--advertise=${NOMAD_ADDR_control}",\ "--discovery.static.peers=",\ "--license=${TRAEFIKEE_LICENSE}",\ "--statedir=/data",\ "--jointoken.file.path=/data/tokens",\ "--api.bundle=/data/bundle.zip",\ "--socket=${NOMAD_TASK_DIR}/cluster.sock",\ "--api.socket=${NOMAD_TASK_DIR}/api.sock",\ "--log.level=",\ "--log.filepath=",\ "--log.format="\ ],\ "cap_add": [\ "NET_BIND_SERVICE"\ ],\ "cap_drop": [\ "ALL"\ ],\ "image": "traefik/traefikee:v2.12.0",\ "ports": [\ "control",\ "api"\ ]\ }\ ],\ "driver": "docker",\ "resources": [\ {\ "cpu": 500,\ "memory": 256\ }\ ],\ "template": [\ {\ "data": "TRAEFIKEE_LICENSE=\"{{'{{'}}with secret \"secret/traefikee/license\"{{'}}'}}{{'{{'}}.Data.data.license_key{{'}}'}}{{'{{'}}end{{'}}'}}\"\r\n",\ "destination": "secrets/traefikee.env",\ "env": true\ }\ ],\ "volume_mount": [\ {\ "destination": "/data",\ "volume": "data"\ }\ ]\ }\ ]\ }\ ],\ "volume": [\ {\ "data": [\ {\ "source": "traefikee-data",\ "type": "host"\ }\ ]\ }\ ]\ }\ ]\ },\ {\ "proxies": [\ {\ "count": 2,\ "network": [\ {\ "mode": "host",\ "port": [\ {\ "distributed": [\ {\ "static": 8484\ }\ ]\ },\ {\ "web": [\ {}\ ]\ },\ {\ "websecure": [\ {}\ ]\ }\ ]\ }\ ],\ "service": [\ {\ "name": "traefikee-proxies",\ "port": "web",\ "task": "proxies"\ }\ ],\ "task": [\ {\ "proxies": [\ {\ "config": [\ {\ "args": [\ "proxy",\ "--discovery.static.peers=traefikee-controllers:4242",\ "--jointoken.value=${PROXY_JOIN_TOKEN}",\ "--log.level=",\ "--log.filepath=",\ "--log.format="\ ],\ "cap_add": [\ "NET_BIND_SERVICE"\ ],\ "cap_drop": [\ "ALL"\ ],\ "dns_servers": [\ "10.5.0.2",\ "${attr.unique.network.ip-address}",\ "8.8.8.8"\ ],\ "image": "traefik/traefikee:v2.12.0",\ "ports": [\ "web",\ "websecure",\ "distributed"\ ]\ }\ ],\ "driver": "docker",\ "resources": [\ {\ "cpu": 500,\ "memory": 256\ }\ ],\ "template": [\ {\ "data": "PROXY_JOIN_TOKEN=\"{{'{{'}}with secret \"secret/traefikee/tokens\"{{'}}'}}{{'{{'}}.Data.data.proxy_join{{'}}'}}{{'{{'}}end{{'}}'}}\"\r\n",\ "destination": "secrets/traefikee.env",\ "env": true\ }\ ]\ }\ ]\ }\ ]\ }\ ]\ }\ ],\ "type": "service",\ "update": [\ {\ "max_parallel": 1,\ "stagger": "30s"\ }\ ]\ }\ ]\ }\ ] } Customize the file to your needs then deploy: Command nomad run traefikee.json Expected output ==> Monitoring evaluation "0f10a2e6" Evaluation triggered by job "traefikee" Allocation "3713cdb9" created: node "23159a1c", group "controllers" Allocation "8f330cfb" created: node "23159a1c", group "proxies" Evaluation within deployment: "bc1568a8" Allocation "3713cdb9" status changed: "pending" -> "running" (Tasks are running) Evaluation status changed: "pending" -> "complete" ==> Evaluation "0f10a2e6" finished with status "complete" Check the status of the tasks: Command nomad status traefikee Expected output ID = traefikee Name = traefikee Submit Date = 2020-11-16T15:11:05-03:00 Type = service Priority = 50 Datacenters = dc1 Namespace = default Status = running Periodic = false Parameterized = false Summary Task Group Queued Starting Running Failed Complete Lost controllers 0 1 0 0 0 0 proxies 0 2 0 0 0 0 Latest Deployment ID = bc1568a8 Status = running Description = Deployment is running Deployed Task Group Desired Placed Healthy Unhealthy Progress Deadline controllers 1 1 0 1 2020-11-16T18:21:05Z proxies 2 1 0 0 2020-11-16T18:21:05Z Allocations ID Node ID Task Group Version Desired Status Created Modified bddea080 713fa2e6 controllers 1 run pending 21s ago 18s ago 8f330cfb 23159a1c proxies 1 run pending 21s ago 18s ago You should expect the Proxy instances to fail to start, staying on the "pending" status until you create the Vault secret containing the cluster join token. ### Sharing the Proxy Join Token[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#sharing-the-proxy-join-token "Permanent link") Once the controller is up and running, you can fetch the proxy join token by running: Command nomad alloc exec -i -t -task controllers bddea080 /traefikee tokens --socket local/cluster.sock Expected output export TRAEFIKEE_CONTROLLER_TOKEN=5531644e5645744f4c5445744e47706f4e7a5a3261574a765a485274616a55345a57526f4d7a566f65444e6f4e544e70616d4a6d615459314e5464684f48526f4d6e6c735933466e4e33686a6348417459544e6c4e5451314e475a70616d4e304e484e796432466f4e445a796447707859673d3d3a303a97b42afa416f0df94d7c453bd4c55fcddd339ec4570068eac2c5cc5504c158d42521e9852615ab95049e2b3296b67c4a export TRAEFIKEE_PROXY_TOKEN=5531644e5645744f4c5445744e47706f4e7a5a3261574a765a485274616a55345a57526f4d7a566f65444e6f4e544e70616d4a6d615459314e5464684f48526f4d6e6c735933466e4e33686a634841744e47397563484d31636a4d354d7a42354e5463785933557762546b774e7a55794f413d3d3a313a97b42afa416f0df94d7c453bd4c55fcddd339ec4570068eac2c5cc5504c158d42194b3059e6861761121966a44f964d3 Create a Vault secret with the `TRAEFIKEE_PROXY_TOKEN` value: vault kv put secret/traefikee/tokens proxy_join=$TRAEFIKEE_PROXY_TOKEN Once the secret is created, the proxy instances should start and join the cluster. Verify that the Traefik Enterprise installation was successful: Command teectl get nodes Result ID NAME STATUS ROLE mmc2qofw8hkudf8vcrs1k8cnw controller-0 Ready Controller (Leader) oncgmk54uuipcj7jnt0lhwwqy proxy-0 Ready Proxy u122z00fgr2cqrp78jc5em0fi proxy-1 Ready Proxy What Next? Now that the cluster is ready, you should read the various [operating guides](https://doc.traefik.io/traefik-enterprise/operations/introduction/) to dive into all the features that Traefik Enterprise provides. License Monitoring[¶](https://doc.traefik.io/traefik-enterprise/installing/nomad/#license-monitoring "Permanent link") ----------------------------------------------------------------------------------------------------------------------- When a Traefik Enterprise controller starts for the first time, it checks the license validity. If the license is valid, another check is done once every 24 hours. If the controller can't communicate with the license server, a 72-day grace period starts to recover from this situation. Once the grace period is over, the controller stops updating the proxies configuration. Please look at the [FAQ](https://doc.traefik.io/traefik-enterprise/kb/faq/) to know how to implement the license monitoring. --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/expose/docker/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/expose/kubernetes/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/expose/docker/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/expose/docker/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/expose/kubernetes/) . --- # Redirecting... You're being redirected to a [new destination](https://doc.traefik.io/traefik/expose/docker/) . --- # Install Traefik Enterprise On-Premises - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#installing-traefik-enterprise-on-premises) Initializing search Installing Traefik Enterprise On-Premises[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#installing-traefik-enterprise-on-premises "Permanent link") ========================================================================================================================================================================== This installation guide is for users who want to install a cluster on-premises. Requirements[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#requirements "Permanent link") ---------------------------------------------------------------------------------------------------------------- In order to start a Traefik Enterprise cluster with 1 controller, 2 proxies and a plugin registry, ensure that: * There are at least 4 Hosts/Virtual Machines * Network stack allows communication on [required ports](https://doc.traefik.io/traefik-enterprise/installing/requirements/#networking) * Controller Host/VM can reach `https://v4.license.containous.cloud` * The [`teectl` binary is installed](https://doc.traefik.io/traefik-enterprise/installing/teectl-cli/) , for cluster management Networking Only the hosts which run proxies have to be reachable from the internet. On Linux, root access is needed to bind to ports below 1024. Default Traefik Enterprise paths The default configration paths for `traefikee` includes: - /var/run/traefikee - /var/lib/traefikee - /var/run/secrets Read and write access are required on them. See the [`teectl` referece](https://doc.traefik.io/traefik-enterprise/references/cli/teectl/) for customization options. Please refer to the [documentation](https://doc.traefik.io/traefik-enterprise/references/cli/traefikee/) for more information Multiple instances on the same Host/VM Running multiple controllers or proxies on the same host is not recommended, and should be used only when upgrading a cluster for which there are no spare hosts. Installation behind a proxy In order to be able to install Traefik Enterprise behind a proxy, you must make sure that each Traefik Enterprise instance has the proper `HTTP_PROXY` and `HTTPS_PROXY` environment variables defined. Controller advertise address The controller advertise address must be an external address reachable by the proxies. Do not use a dynamic address allocation feature, such as ":4242" under Linux, as it may propagate the wrong address to the proxies, causing a connection failure upon restart. State Directory Management[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#state-directory-management "Permanent link") -------------------------------------------------------------------------------------------------------------------------------------------- By default, the `statedir` path is `/var/lib/traefikee`. * The state directory's contents are used to recover a cluster's state in the event of a controller restart. It has to persist between two executions. * In order to re-initialize a cluster, you have to delete the state directory before re-installing it. If this is not done, it will recover its previous state. Install `traefikee`[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#install-traefikee "Permanent link") ---------------------------------------------------------------------------------------------------------------------------- First, download `traefikee` on each virtual machine, by using one of the following links: * `traefikee` for [Linux (Intel) 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_v2.12.5_linux_amd64.tar.gz) * `traefikee` for [Linux (ARM) v6](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_v2.12.5_linux_armv6.tar.gz) * `traefikee` for [Linux (ARM) v7](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_v2.12.5_linux_armv7.tar.gz) * `traefikee` for [Linux (ARM) v8 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_v2.12.5_linux_arm64.tar.gz) * `traefikee` for [macOS (Intel/Apple) 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_v2.12.5_darwin_amd64.tar.gz) * `traefikee` for [Windows (Intel) 64 Bits](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_v2.12.5_windows_amd64.zip) Check the integrity of the downloaded file Use the [sha256 checksums of the binaries](https://s3.amazonaws.com/traefikee/binaries/v2.12.5/traefikee_checksums.txt) : Linux # Compare this value to the one found in traefikee_checksums.txt sha256sum ./traefikee_v2.12.5_linux_amd64.tar.gz macOS # Compare this value to the one found in traefikee_checksums.txt shasum -a256 ./traefikee_v2.12.5_darwin_amd64.tar.gz Windows PowerShell # Compare this value to the one found in traefikee_checksums.txt Get-FileHash traefikee_v2.12.5_windows_amd64.zip -Algorithm SHA256 Extract the downloaded archive Use the following commands to extract the archive: Linux # Compare this value to the one found in traefikee_checksums.txt tar -zxvf traefikee_v2.12.5_linux_amd64.tar.gz macOS # Compare this value to the one found in traefikee_checksums.txt tar -zxvf -a256 ./traefikee_v2.12.5_darwin_amd64.tar.gz Windows PowerShell # Compare this value to the one found in traefikee_checksums.txt Expand-Archive traefikee_v2.12.5_windows_amd64.zip Copy the `traefikee` binary to your `PATH` or add its location to your environment (`$PATH` or `%PATH%` depending on your OS) and make sure it's executable: Linux/macOS # Example with /usr/local/bin # These command may need sudo rights cp traefikee /usr/local/bin/traefikee chmod a+x /usr/local/bin/traefikee # Should print "/usr/local/bin/traefikee" command -v traefikee Windows PowerShell # Example with C:\Program Files Copy-Item "traefikee.exe" -Destination "C:\Program Files\traefikee.exe" # Should print "C:\Program Files\traefikee.exe" where traefikee You can now test your installation by executing `traefikee`: Command traefikee --help Result traefikee Traefik Enterprise (Enterprise Edition) is a Cloud Native Edge Routing Platform based on Traefik Proxy, a modern HTTP reverse proxy and load balancer made to deploy microservices with ease. Complete documentation is available at https://doc.traefik.io. Usage: traefikee [command] [resource] [flags] Use "traefikee [command] --help" for help on any command. Commands: controller Start a new controller proxy Start a new proxy tokens Get tokens from the cluster version Print version Generating the `teectl` Configuration[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#generating-the-teectl-configuration "Permanent link") ---------------------------------------------------------------------------------------------------------------------------------------------------------------- Install the `teectl` management tool on a machine that has access to a controller node by following the instructions on [this guide](https://doc.traefik.io/traefik-enterprise/installing/teectl-cli/) . Once `teectl` is installed, it is possible to generate a set of cluster credentials that enables remote access to the API: Command teectl setup --onpremise.hosts=",," The host IPs that will be used for controllers should also be set in the `onpremise.hosts` option. This command creates a new `teectl` configuration under `~/.config/traefikee/default.yaml` and generates a `bundle.zip` which carries a set of needed assets for the installation. The `bundle.zip` needs to be copied onto each controller host. To further configure the `teectl` setup, please refer to the [reference documentation](https://doc.traefik.io/traefik-enterprise/references/cli/teectl/#setup-a-cluster-connection-setup) . Connecting to a Controller Locally You can connect to a local controller through a socket connection by specifying the `socket` option in the `teectl` command (defaults to `/var/run/traefikee/teectl.sock`). Linux/macOS teectl get nodes --socket=/var/run/traefikee/teectl.sock Windows teectl get nodes --socket=\\.\pipe\teectl.sock In this case, no `bundle.zip` is needed to start the Controller and the above step can be skipped. Generating a Pre-Shared Token[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#generating-a-pre-shared-token "Permanent link") -------------------------------------------------------------------------------------------------------------------------------------------------- The Pre-Shared Token is used to secure communications between the controllers and the plugin registry. Token Strength As a security best practice, it is recommended that the token be at least 24 characters long made up of random characters. A Pre-Shared Token can be generated using `openssl`: Command openssl rand -base64 32 Result l9RLmLbAwrW73GzbDJ6+T+KOQ7u0sQt/we6OOGj0AKU Alternatively an online generator can be used: 1. Open the [random string generator web page](http://www.unit-conversion.info/texttools/random-string-generator/) . 2. Set `Number of strings` to **1**. 3. Set `Length` to **32**. 4. Click the `Generate` button. Start the Controller[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#start-the-controller "Permanent link") -------------------------------------------------------------------------------------------------------------------------------- Start a new controller by specifying the advertise address and Traefik Enterprise license: Command (Single Controller) traefikee controller --advertise="10.0.0.1:4242" --license="" --api.bundle="/bundle.zip" --plugin.url="https://plugins.mydomain" --plugin.token="" Command (Multi Controller Static) traefikee controller --advertise="10.0.0.1:4242" --license="" --api.bundle="/bundle.zip" --discovery.static.peers="10.0.0.1:4242,10.0.0.2:4242,10.0.0.3:4242" --plugin.url="https://plugins.mydomain" --plugin.token="" Command (Multi Controller DNS) traefikee controller --advertise="10.0.0.1:4242" --license="" --api.bundle="/bundle.zip" --discovery.dns.domain="traefikee.mydomain" --discovery.dns.port="4242" --discovery.dns.bootstrapexpected=2 --plugin.url="https://plugins.mydomain" --plugin.token="" Result INFO[2020-01-20T15:00:35-03:00] Using static discovery to discover other controllers node=controller-0 role=controller INFO[2020-01-20T15:00:35-03:00] Initializing a new node role=controller node=controller-0 INFO[2020-01-20T15:00:35-03:00] Discovering cluster node=controller-0 role=controller INFO[2020-01-20T15:00:35-03:00] Found peers [10.0.0.1:4242] node=controller-0 role=controller INFO[2020-01-20T15:00:35-03:00] Initial leader runs at 10.0.0.1:4242 node=controller-0 role=controller INFO[2020-01-20T15:00:35-03:00] Initializing a new Traefik Enterprise cluster node=controller-0 role=controller INFO[2020-01-20T15:00:35-03:00] API started role=controller node=controller-0 INFO[2020-01-20T15:00:35-03:00] Node started role=controller node=controller-0 INFO[2020-01-20T15:00:36-03:00] Node is ready node=controller-0 role=controller INFO[2020-01-20T15:00:36-03:00] Running the cluster info controller service=provider node=controller-0 role=controller INFO[2020-01-20T15:00:36-03:00] Running the cluster license controller with frequency "24h0m0s" node=controller-0 role=controller service=cleanup INFO[2020-01-20T15:00:36-03:00] Running the cluster cleanup controller role=controller node=controller-0 service=cleanup Controller socket on Windows systems When running on Windows systems, it is required that both the API and the cluster socket paths be defined as [named pipes](https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipes) , for example: traefikee controller --api.socket="\\.\pipe\teectl.sock" --socket="\\.\pipe\cluster.sock" ... Node Name By default Traefik Enterprise will use the hostname as the node. This behavior can be overridden by specifying the `--name` flag on the `controller` command. Multi Controller with DNS When using DNS as the discovery method it is a good practice to set the flag `discovery.dns.bootstrapexpected`, as this will make the controllers wait until the specified number of nodes are reachable before bootstraping the cluster. Get the Tokens[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#get-the-tokens "Permanent link") -------------------------------------------------------------------------------------------------------------------- Get the generated _proxy node token_: Command traefikee tokens | grep 'TRAEFIKEE_PROXY_TOKEN' | cut -d '=' -f2 Get the generated _controller node token_: Command traefikee tokens | grep 'TRAEFIKEE_CONTROLLER_TOKEN' | cut -d '=' -f2 Share the Tokens[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#share-the-tokens "Permanent link") ------------------------------------------------------------------------------------------------------------------------ All proxies require a token to start. Any additional controller also require a token to start. Sharing the token between controllers and proxies can be achieved using environment variables or a shared persistent storage. To use environment variables, set the token value directly with the command argument `--jointoken.value`. To use a shared persistent storage solution, set the path to the target directory with `--jointoken.file.path` on both proxies and controllers instead. The remaining steps on this guide assumes the tokens are shared using environment variables named `${PROXY_NODE_TOKEN}` and `${CONTROLLER_NODE_TOKEN}`. Start Additional Controllers (Multi Controller Only)[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#start-additional-controllers-multi-controller-only "Permanent link") ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Start additional controllers by adding the join token flag: Command (Multi Controller Static) traefikee controller --advertise="10.0.0.1:4242" --license="" --api.bundle="/bundle.zip" --discovery.static.peers="10.0.0.1:4242,10.0.0.2:4242,10.0.0.3:4242" --plugin.url="https://plugins.mydomain" --plugin.token="" --jointoken.value="${CONTROLLER_NODE_TOKEN}" Command (Multi Controller DNS) traefikee controller --advertise="10.0.0.1:4242" --license="" --api.bundle="/bundle.zip" --discovery.dns.domain="traefikee.mydomain" --discovery.dns.port="4242" --discovery.dns.bootstrapexpected=2 --plugin.url="https://plugins.mydomain" --plugin.token="" --jointoken.value="${CONTROLLER_NODE_TOKEN}" Start Proxies[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#start-proxies "Permanent link") ------------------------------------------------------------------------------------------------------------------ Start a proxy by specifying the controller discovery method, static in this example, and the join token: Command (Static) traefikee proxy --jointoken.value="$PROXY_NODE_TOKEN" --discovery.static.peers="10.0.0.1:4242" Command (DNS) traefikee proxy --jointoken.value="$PROXY_NODE_TOKEN" --discovery.dns.domain="traefikee.mydomain" Result INFO[2020-01-20T15:09:47-03:00] Applying a new static configuration node=proxy-0 role=proxy module=server INFO[2020-01-20T15:09:47-03:00] Using static discovery node=proxy-0 role=proxy peers="10.0.0.1:4242" INFO[2020-01-20T15:09:47-03:00] Discovering controllers node=proxy-0 role=proxy INFO[2020-01-20T15:09:47-03:00] Found controllers [10.0.0.1:4242] node=proxy-0 role=proxy INFO[2020-01-20T15:09:47-03:00] Waiting for the join tokens to be available node=proxy-0 role=proxy INFO[2020-01-20T15:09:47-03:00] Looking for a reachable peer role=proxy node=proxy-0 INFO[2020-01-20T15:09:47-03:00] Joining cluster role=proxy joined-peer="10.0.0.1:4242" node=proxy-0 INFO[2020-01-20T15:09:47-03:00] Node started node=proxy-0 role=proxy INFO[2020-01-20T15:09:47-03:00] Node is ready node=proxy-0 role=proxy Repeat the steps above for each proxy, then verify that the Traefik Enterprise installation was successful: Command teectl get nodes Result ID NAME STATUS ROLE c5j53krue2avv77ajr8h5bcoz controller-0 Ready Controller (Leader) 3l5xt87fkc2ztlqlkwcpavuev proxy-0 Ready Proxy / Ingress yjtz8kvnsgmqmuycup69vx180 proxy-1 Ready Proxy / Ingress Start the Plugin Registry[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#start-the-plugin-registry "Permanent link") ------------------------------------------------------------------------------------------------------------------------------------------ Start the plugin registry by specifying the controller discovery method, static in this example, and the join token: Command traefikee plugin-registry --token="" --jointoken.value="$PROXY_NODE_TOKEN" --discovery.static.peers="10.0.0.1:4242" Apply a Static Configuration[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#apply-a-static-configuration "Permanent link") ------------------------------------------------------------------------------------------------------------------------------------------------ A Traefik Enterprise cluster is created without any default configuration. To allow the controller to listen to a provider and proxies to manage incoming traffic, it is necessary to apply a [static configuration](https://doc.traefik.io/traefik-enterprise/operations/static-configuration/) . Below is an example of a static configuration: ### File provider[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#file-provider "Permanent link") File (YAML) entryPoints: web: address: ":80" websecure: address: ":443" providers: file: filename: dynamic_conf.yml File (TOML) [entryPoints] [entryPoints.web] address = ":80" [entryPoints.websecure] address = ":443" [providers] [providers.file] filename = "/etc/traefikee/dynamic_conf.toml" Important When running multiple controllers, make sure to replicate the configuration file on all nodes at the same path. Apply the configuration using the following command: Command (YAML) teectl apply --file=config.yaml Command (TOML) teectl apply --file=config.toml Systemd (Linux only)[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#systemd-linux-only "Permanent link") ------------------------------------------------------------------------------------------------------------------------------ When installing under Linux, you can leverage [systemd](https://en.wikipedia.org/wiki/Systemd) to improve the management of a Traefik Enterprise deployment while also allowing it to run as a daemon. Systemd limits The suggested value of `LimitNoFile=16384` is reasonable to start with but it should be increased for more demanding environments to prevent the error: `accept4: too many open files`. The system-wide limits that are typically defined at `/etc/security/limits.conf` are not inherited by Systemd. The value has to be configured explicitly in the Unit files that controlled the running of proxy and controller. Another benefit is the ability to load a file of environment variables, which may contain your license key, node join token, and other sensitive information. This avoids setting variables on the host terminal or exposing the keys directly in the unit file. ### VM/host preparation[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#vmhost-preparation "Permanent link") It is always recommended to run system processes unprivileged. For that, a specific user and group must be created on each host/VM (shown here with example user and group IDs of 1500): groupadd -g 1500 traefikee useradd -g traefikee --no-user-group --home-dir="/opt/traefikee" --shell="/usr/sbin/nologin" --system --uid="1500" traefikee OS Compatibility This guide, including any example config files, was created using [Debian Linux](https://www.debian.org/) . There may be slight differences on other distributions. Unit File Placement Usually, systemd files can be placed under `/etc/systemd/system`, but this may not be the case on all distributions. Unit Install Target The examples use `network-online` as the target group dependency, but this may not be the same on distributions other than Debian. To find out what targets are actually available, run: `systemctl list-units --type target` ### Controllers[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#controllers "Permanent link") #### Env File (optional)[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#env-file-optional "Permanent link") Store the license key and the bind address for the controller and the preshared token into a new environment file. Sensitive Information Make sure this file has restricted permissions. File permissions We recommend giving this file restricted access as it contains sensitive information. Bootstrap Controller # Saved as /opt/traefikee/controller.env, update the bind address on each host according to your needs. # Define your pre shared plugin registry token. # Use an external address, reachable by the proxies. CONTROLLER_BIND_ADDRESS="10.0.0.10:4242" TRAEFIKEE_LICENSE="" REGISTRY_TOKEN="" #### Unit File[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#unit-file "Permanent link") Bootstrap Controller [Unit] Description=Traefik Enterprise Controller After=network-online.target Wants=network-online.target systemd-networkd-wait-online.service [Service] EnvironmentFile=-/opt/traefikee/controller.env Restart=on-abnormal User=traefikee Group=traefikee ExecStart=/opt/traefikee/bin/traefikee controller --advertise=${CONTROLLER_BIND_ADDRESS} --license=${TRAEFIKEE_LICENSE} --api.socket=/opt/traefikee/run/teectl.sock --socket=/opt/traefikee/run/cluster.sock --statedir=/opt/traefikee/data --jointoken.file.path=/opt/traefikee/tokens --plugin.token=${REGISTRY_TOKEN} --api.autocerts PrivateTmp=true PrivateDevices=false ProtectHome=true ProtectSystem=full ReadWritePaths=/opt/traefikee PermissionsStartOnly=true ExecStartPre=/usr/bin/mkdir -p /opt/traefikee/run /opt/traefikee/data /opt/traefikee/tokens ExecStartPre=-chown -R traefikee.traefikee /opt/traefikee ExecStartPre=-chmod -R 700 /opt/traefikee NoNewPrivileges=true LimitNOFILE=16384 [Install] WantedBy=multi-user.target For this guide, the systemd unit above was saved as `/etc/systemd/system/traefikee-controller.service`. Systemd ExecStartPre paths In some systemd configurations all `ExecStartPre` commands must have an absolute path. If this is the case, please update the Unit file to have absolute paths. ### Plugin registry[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#plugin-registry "Permanent link") #### Env File (optional)[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#env-file-optional_1 "Permanent link") Store the list of controller peers to connect to, the node join token and the pre shared token into a new environment file. File permissions We recommend giving this file restricted access as it contains sensitive information. Bootstrap Registry # Saved as /opt/traefikee/registry.env CONTROLLER_PEERS="10.0.0.10:4242" PROXY_NODE_TOKEN="" REGISTRY_TOKEN="" #### Unit File[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#unit-file_1 "Permanent link") Bootstrap Registry [Unit] Description=Traefik Enterprise registry After=network-online.target Wants=network-online.target systemd-networkd-wait-online.service [Service] EnvironmentFile=-/opt/traefikee/registry.env Restart=on-abnormal User=traefikee Group=traefikee ExecStart=/usr/local/bin/traefikee plugin-registry --name=traefikee-registry --plugindir=/opt/traefikee/registry/plugins --token=${REGISTRY_TOKEN} --discovery.static.peers=&{CONTROLLER_PEERS} --jointoken.value=${PROXY_JOIN_TOKEN} --statedir=/opt/traefikee/plugins/data PrivateTmp=true PrivateDevices=false ProtectHome=true ProtectSystem=full ReadWritePaths=/opt/traefikee ExecStartPre=mkdir -p /opt/traefikee/registry/data /opt/traefikee/registry/plugins LimitNOFILE=16384 ; The following additional security directives only work with systemd v229 or later. CapabilityBoundingSet=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE NoNewPrivileges=true [Install] WantedBy=multi-user.target For this guide, the systemd unit above was saved as `/etc/systemd/system/traefikee-registry.service`. Systemd ExecStartPre paths In some systemd configurations all `ExecStartPre` commands must have an absolute path. If this is the case, please update the Unit file to have absolute paths. ### Proxies[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#proxies "Permanent link") #### Env File (optional)[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#env-file-optional_2 "Permanent link") Store the list of controller peers to connect to and the node join token into a new environment file. File permissions We recommend giving this file restricted access as it contains sensitive information. # Saved as /opt/traefikee/proxies.env CONTROLLER_PEERS="10.0.0.10:4242" PROXY_NODE_TOKEN="" #### Unit File[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#unit-file_2 "Permanent link") [Unit] Description=Traefik Enterprise proxy After=network-online.target Wants=network-online.target systemd-networkd-wait-online.service [Service] EnvironmentFile=-/opt/traefikee/traefikee.env Restart=on-abnormal User=traefikee Group=traefikee ExecStart=/opt/traefikee/bin/traefikee proxy --jointoken.value=${PROXY_NODE_TOKEN} --discovery.static.peers=${CONTROLLER_PEERS} --statedir=/opt/traefikee/data PrivateTmp=true PrivateDevices=false ProtectHome=true ProtectSystem=full ReadWritePaths=/opt/traefikee ExecStartPre=mkdir -p /opt/traefikee/data LimitNOFILE=16384 ; The following additional security directives only work with systemd v229 or later. CapabilityBoundingSet=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE NoNewPrivileges=true [Install] WantedBy=multi-user.target For this guide, the systemd unit above was saved as `/etc/systemd/system/traefikee-proxy.service`. Systemd ExecStartPre paths In some systemd configurations all `ExecStartPre` commands must have an absolute path. If this is the case, please update the Unit file to have absolute paths. Tip For the first boot, the [node join token](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#get-the-tokens) must be retrieved from a controller and updated on each proxy node before starting them. This can be automated or handled manually as a one-time operation. With everything in place, proceed to enable the units files on systemd with: Command (Controller) systemctl enable traefikee-controller Command (Proxies) systemctl enable traefikee-proxy Result (Controller) Created symlink /etc/systemd/system/multi-user.target.wants/traefikee-controller.service → /etc/systemd/system/traefikee-controller.service. Result (Proxies) Created symlink /etc/systemd/system/multi-user.target.wants/traefikee-proxy.service → /etc/systemd/system/traefikee-proxy.service. Now both the controller and proxies should be manageable by systemd as usual: Command (Controller) systemctl start traefikee-controller Command (Proxies) systemctl start traefikee-proxy ### Remote Access Through `teectl`[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#remote-access-through-teectl "Permanent link") Once your cluster is ready, if you want to operate it remotely using the `teectl` tool, you need to generate credentials from your cluster using `traefikee generate credentials` on one of your controllers and use `teectl` to import the cluster credentials. Linux/macOS traefikee generate credentials --onpremise.hosts=",," --cluster=default --socket="/opt/traefikee/run/teectl.sock" > config.yaml teectl cluster import --file="config.yaml" Windows traefikee generate credentials --onpremise.hosts=",," --cluster=default --socket="\\.\pipe\teectl.sock" > config.yaml teectl cluster import --file="config.yaml" You can now use `teectl` to operate your cluster. Command teectl get nodes Expected output ID NAME STATUS ROLE c5j53krue2avv77ajr8h5bcoz controller-0 Ready Controller (Leader) 3l5xt87fkc2ztlqlkwcpavuev proxy-0 Ready Proxy / Ingress yjtz8kvnsgmqmuycup69vx180 proxy-1 Ready Proxy / Ingress What's Next? Now that the cluster is ready, we recommend reading the various [operating guides](https://doc.traefik.io/traefik-enterprise/operations/introduction/) to dive into all features that Traefik Enterprise provides. License Monitoring[¶](https://doc.traefik.io/traefik-enterprise/installing/on-premise/#license-monitoring "Permanent link") ---------------------------------------------------------------------------------------------------------------------------- When a Traefik Enterprise controller starts for the first time, it checks the license validity. If the license is valid, another check is done once every 24 hours. If the controller can't communicate with the license server, a 72-day grace period starts to recover from this situation. Once the grace period is over, the controller stops updating the proxies configuration. Please look at the [FAQ](https://doc.traefik.io/traefik-enterprise/kb/faq/) to know how to implement the license monitoring. --- # Traefik Enterprise Installing Requirements - Traefik Enterprise [Skip to content](https://doc.traefik.io/traefik-enterprise/installing/requirements/#supported-platforms) Initializing search Requirements ============ Supported Platforms[¶](https://doc.traefik.io/traefik-enterprise/installing/requirements/#supported-platforms "Permanent link") -------------------------------------------------------------------------------------------------------------------------------- | Platform name | teectl setup | | --- | --- | | [On-Premise](https://doc.traefik.io/traefik-enterprise/installing/on-premise/) | ✖ | | [Kubernetes](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/) | ✔ | | [AKS](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/) | ✔ | | [Docker Swarm](https://doc.traefik.io/traefik-enterprise/installing/swarm/) | ✔ | | [DockerEE - Swarm](https://doc.traefik.io/traefik-enterprise/installing/swarm/#installing-on-dockeree) | ✔ | | [DockerEE - Kubernetes](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/) | ✔ | | [Konvoy](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/) | ✔ | | [OpenShift](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/#installing-on-openshift) | ✔ | | [Rancher 2](https://doc.traefik.io/traefik-enterprise/installing/kubernetes/teectl/) | ✔ | Networking[¶](https://doc.traefik.io/traefik-enterprise/installing/requirements/#networking "Permanent link") -------------------------------------------------------------------------------------------------------------- Here is an overview of the required ports used by the Traefik Enterprise nodes. Those ports must be available on the host. Keep in mind that the [entrypoints](https://doc.traefik.io/traefik/v2.11/routing/entrypoints/) defined in the [static configuration](https://doc.traefik.io/traefik-enterprise/operations/static-configuration/) also bind ports on the ingress proxy nodes. | Port | Name | Mode | Node Type | Comments | | --- | --- | --- | --- | --- | | 4242 \* | control | internal | Controller | internal cluster management | | 8484 | distributed | internal | Ingress Proxy | management of distributed features, like connection/rate limiting | | 55055 \* | teectl | internal/public | Controller | teectl api access | \* _default values, these ports can be changed in the configuration_ The internal ports must be available between nodes, no external exposure is required. Those marked with internal/public can be assigned according to the users preference and security requirements. In addition to those TCP ports, all nodes must have outgoing access to port **53** under **TCP** and **UDP** protocols, used for DNS resolution. To finish, the controllers must have access to `v4.license.containous.cloud` on port **443/TCP**. ### Installation Behind a Proxy[¶](https://doc.traefik.io/traefik-enterprise/installing/requirements/#installation-behind-a-proxy "Permanent link") In order to install Traefik Enterprise behind a proxy, the manifest files must be edited **before** being applied to the orchestrator, adding the following environment variables: * `HTTP_PROXY` * `HTTPS_PROXY` * `NO_PROXY` HTTP\_PROXY and HTTPS\_PROXY should point to the proxy server and NO\_PROXY should be set to a comma separated list of ip addresses or domains that will not pass through the proxy. `NO_PROXY` on Kubernetes As the controller will make requests to the Kubernetes API server, the `NO_PROXY` variable must contain its IP address, which can be obtained with `kubectl get service kubernetes`. Config excerpt example: Kubernetes [...] apiVersion: apps/v1 kind: StatefulSet [...] containers: - name: "default-controller" [...] env: - name: HTTP_PROXY value: myproxy:9999 - name: HTTPS_PROXY value: myproxy:9898 - name: NO_PROXY value: "10.23.0.123" Swarm [...] services: [...] controller-0: [...] environment: - HTTP_PROXY="myproxy:9999" - HTTPS_PROXY="myproxy:9999" - NO_PROXY="10.23.0.123" --- # Traefik Hub | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/#__docusaurus_skipToContent_fallback) On this page Traefik Hub API Gateway[​](https://doc.traefik.io/traefik-hub/#traefik-hub-api-gateway "Direct link to Traefik Hub API Gateway") --------------------------------------------------------------------------------------------------------------------------------- Traefik Hub API Gateway is a cloud-native, fully declarative API gateway that enables you to manage and secure your APIs and microservices with ease. Built on top of Traefik Proxy, it empowers DevOps teams with enterprise-grade access control, distributed security, dynamic configuration, flexible rate limiting, and high availability. Ready to experiment it? Start with [the documentation](https://doc.traefik.io/traefik-hub/api-gateway/intro) . Traefik Hub API Management[​](https://doc.traefik.io/traefik-hub/#traefik-hub-api-management "Direct link to Traefik Hub API Management") ------------------------------------------------------------------------------------------------------------------------------------------ Traefik Hub API Management is the industry’s first Kubernetes-native API Management solution for publishing, securing, and managing APIs. Traefik Hub API Management, purpose-built for K8s environments and GitOps workflows, drastically simplifies and accelerates the API lifecycle management, so organizations experience quick time to value, unleash workforce productivity, and can focus on building great applications. Ready to experiment it? Start with [the documentation](https://doc.traefik.io/traefik-hub/introduction/overview) . Features Matrix[​](https://doc.traefik.io/traefik-hub/#features-matrix "Direct link to Features Matrix") --------------------------------------------------------------------------------------------------------- | Feature | Traefik Proxy | Traefik Hub API Gateway | Traefik Hub API Management | | --- | --- | --- | --- | | Services Auto-Discovery | ✓ | ✓ | ✓ | | Graceful Configuration Reload | ✓ | ✓ | ✓ | | Websockets, HTTP/2, HTTP/3, TCP, UDP, GRPC ready | ✓ | ✓ | ✓ | | Real-time Metrics & Distributed Tracing | ✓ | ✓ | ✓ | | Canary Deployments | ✓ | ✓ | ✓ | | Let's Encrypt | ✓ | ✓ | ✓ | | [Plugin Support](https://plugins.traefik.io/plugins)
([Go](https://github.com/traefik/yaegi)
, [WASM](https://webassembly.org/)
) | ✓ | ✓ | ✓ | | Hybrid cloud, multi-cloud & on-prem compatible | ✓ | ✓ | | | Per-cluster dashboard | ✓ | ✓ | ✓ | | GitOps-native declarative configuration | ✓ | ✓ | ✓ | | JWT Authentication | | ✓ | ✓ | | OAuth 2.1/2.0 Token Introspection Authentication | | ✓ | ✓ | | OAuth 2.1/2.0 Client Credentials Authentication | | ✓ | ✓ | | OpenID Connect Authentication | | ✓ | ✓ | | Lightweight Directory Access Protocol (LDAP) | | ✓ | ✓ | | API Key Authentication | | ✓ | ✓ | | Open Policy Agent | | ✓ | ✓ | | Native Coraza Web Application Firewall (WAF) | | ✓ | ✓ | | HashiCorp Vault Integration | | ✓ | ✓ | | Distributed Let's Encrypt | | ✓ | ✓ | | Distributed Rate Limit | | ✓ | ✓ | | HTTP Caching | | ✓ | ✓ | | FIPS 140-2 Compliance | | ✓ | ✓ | | Flexible API grouping and versioning | | | ✓ | | API Developer Portal | | | ✓ | | OpenAPI Specifications Support | | | ✓ | | Multi-cluster dashboard | | | ✓ | | Built-in identity provider (or use your own) | | | ✓ | | Configuration linter & change impact analysis | | | ✓ | | Pre-built Grafana dashboards | | | ✓ | | Event correlation for quick incident mitigation | | | ✓ | | Traffic debugger (coming soon) | | | ✓ | | Built-In Commercial Support | ✓ | ✓ | ✓ | * [Traefik Hub API Gateway](https://doc.traefik.io/traefik-hub/#traefik-hub-api-gateway) * [Traefik Hub API Management](https://doc.traefik.io/traefik-hub/#traefik-hub-api-management) * [Features Matrix](https://doc.traefik.io/traefik-hub/#features-matrix) --- # Quick-Start Guide | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#__docusaurus_skipToContent_fallback) On this page In the next 8 minutes, you’ll install your first Traefik Hub agent, and you'll deploy your first APIs and configure the API Gateway and API Portal. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#introduction "Direct link to Introduction") -------------------------------------------------------------------------------------------------------------------- This quick start guide takes you through installing the Traefik Hub agent and [creating API Users using the internal IdP](https://doc.traefik.io/traefik-hub-v2/api-management/users-and-groups "Link to documentation about user and group management") and deploying an [API Management](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview "Link to API Management overview documentation") CRD stack into the `apps` namespace of your Kubernetes cluster. Once the deployment is done, you will have a working API Portal with three APIs, one API collection and configured access permissions. For a hassle-free experience, you will use our demo files from our [workshop repository on GitHub](https://github.com/traefik-workshops/hub-tutorials/tree/master/quickstart "Link to demo files on GitHub") tailored for this quick start guide. Good to Know Following this guide, you'll use `kubectl` to deploy files from a GitHub repository onto your Kubernetes cluster. This guide uses _traefikhub.io_ domains for API Gateways and Portals. This guide uses the [Internal IdP](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#internal "Link to documentation overview about the internal IdP") for user management. Before You Begin[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#before-you-begin "Direct link to Before You Begin") -------------------------------------------------------------------------------------------------------------------------------- Please make sure you have the following: * An account registered on the [Traefik Hub](https://hub.traefik.io/ "Link to Traefik Hub") platform. * [`kubectl`](https://kubernetes.io/docs/reference/kubectl/ "Link to website of kubectl") installed and configured. Installing the Traefik Hub Agent[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#installing-the-traefik-hub-agent "Direct link to Installing the Traefik Hub Agent") -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- info You can always refer to the [detailed installation documentation](https://doc.traefik.io/traefik-hub-v2/operations/installation "Link to Traefik Hub installation documentation") for more information. Login into the Traefik Hub dashboard and select **Create my first Traefik Hub agent**. https://hub.traefik.io ![Choose install](https://doc.traefik.io/traefik-hub-v2/assets/images/install1-76cd822cc5968c85209058a654ac9e03.png "Create my first Traefik Hub agent") Choose _Traefik Hub_ as Ingress Controller (this is the default installation method) and follow the steps in the UI. https://hub.traefik.io ![Ingress Controller mode](https://doc.traefik.io/traefik-hub-v2/assets/images/ingress-mode1-c3ca6162df2689b1a69c8ac43d6300d2.png "Choose Traefik Hub as Ingress Controller") Copy and paste the instructions provided in step 2 and run them on your cluster. This will install Traefik Hub. We recommend you save the agent token provided in step 3 for future reference. If you lose this token, you won't be able to recover it and will need to go through a new installation process. As the last step (4) give the agent a name or use the random created one by Traefik Hub. Select **Configuration Done**. Traefik Hub will then detect your newly installed agent. Custom Configuration For adjusting the default configuration, please refer to the [custom configuration](https://doc.traefik.io/traefik-hub-v2/operations/custom-configuration "Link to documentation about custom configuration") documentation. * * * User and Groups[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#user-and-groups "Direct link to User and Groups") ----------------------------------------------------------------------------------------------------------------------------- To consume APIs, a user needs to be part of a user group. Groups are a means of categorizing users. This allows for granting permissions to APIs for specific groups. Read More Please refer to the [user management documentation](https://doc.traefik.io/traefik-hub-v2/api-management/users-and-groups "Link to documentation about use and group management") for more information. ### Creating Groups[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#creating-groups "Direct link to Creating Groups") Head over to groups page in the dashboard by selecting **Groups** on the left navigation, followed by **Add group** in the right top corner of the groups overview page and create two user groups: * The `support` group will have access to an API Collection, containing two APIs, the `flight` and the `ticket` API. * The `internal` group will have only access to the `flight` API. https://hub.traefik.io/groups ![Form for adding a group.](https://doc.traefik.io/traefik-hub-v2/assets/images/quickstart-add-support-group-b7e2d1a3e05a453009ba1ce6af05c6b5.png "Form for adding a group") After you created the groups, you will now add two user. ### Creating User[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#creating-user "Direct link to Creating User") Select **Users** on the left navigation bar and **Add user** on the top right. https://hub.traefik.io/users ![Select the user creation form in the dashboard.](https://doc.traefik.io/traefik-hub-v2/assets/images/quickstart-add-user-5f7322751a9e04cfe29598ee292a0098.png "Select the user creation form in the dashboard") Create the first user and assign the user to the `support` group, don't forget to select the **Create** button. https://hub.traefik.io/users/new ![Filling in the user creation form.](https://doc.traefik.io/traefik-hub-v2/assets/images/quickstart-create-user-40cadbd8d825dc3f4f7b0cf67462ba98.png "Filling in the user creation form") Follow the instructions on the screen to set the user password. https://hub.traefik.io/users/new ![Follow the screen instructions to set a password for the user.](https://doc.traefik.io/traefik-hub-v2/assets/images/quickstart-set-user-password-68acdd9e5d70c14efec96a3921d747d2.png "Follow the screen instructions to set a password for the user") Repeat that step to create a second user, but this time assign the user to the group `internal`. Deploy the CRD Stack[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#deploy-the-crd-stack "Direct link to Deploy the CRD Stack") -------------------------------------------------------------------------------------------------------------------------------------------- It is now time to deploy the demo CRD file. This deployment will set up two different [APIs](https://doc.traefik.io/traefik-hub-v2/api-management/api "Link to documentation about how to use CRDs for managing APIs") (_flight_, _ticket_) and it will configure the [API access permissions](https://doc.traefik.io/traefik-hub-v2/api-management/api-access "Link to API Access CR documentation") , the [API Gateway](https://doc.traefik.io/traefik-hub-v2/api-management/api-gateway "Link to API Gateway CR documentation") and the [API Portal](https://doc.traefik.io/traefik-hub-v2/api-management/api-portal "Link to API Portal CR documentation") . warning Before you continue with this guide, please take the time to review the files on [GitHub](https://github.com/traefik-workshops/hub-tutorials/tree/master/quickstart "Link to demo files on GitHub") ! **Please do not deploy CRDs to your cluster without checking them first.** Use `kubectl` to push the deployment to your cluster. CLI kubectl apply -f https://raw.githubusercontent.com/traefik-workshops/hub-tutorials/master/quickstart/quickstart.yaml This will take a short moment. Access the API Portal[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#access-the-api-portal "Direct link to Access the API Portal") ----------------------------------------------------------------------------------------------------------------------------------------------- Use `kubectl` to get the URL of the newly created API Portal. * CLI Command * CLI Output kubectl get apiportal -n apps NAME URLStraefik-hub-demo-portal https://random-name.traefikhub.io info It may take a short moment till your Portal is fully deployed and reachable. It is possible that you see [warnings related to TLS](https://doc.traefik.io/traefik-hub-v2/faq#certificates "Link to FAQ related to TLS") during the initialization of the API Portal. Browse to the URL and log in as one of the user you created. Depending on the user, you will see that one of the user (member of the `support` group) has access to an API collection, containing two APIs. The other user (member of the `internal` group) has only access to the flight API. Read More Please refer to the [API Portal documentation](https://doc.traefik.io/traefik-hub-v2/portal/api-portal-overview "Link to API Portal overview documentation") to learn about how to use the API Portal. * Support Group * Internal Group https://random-name.traefikhub.io/collections/demo-travel-collection/apis/flight-api@apps ![API Portal showing an API Collection.](https://doc.traefik.io/traefik-hub-v2/assets/images/quickstart-support-group-14b8044cddbe1adefb421f33aa6d8aea.png "API Portal showing an API Collection.") https://random-name.traefikhub.io/apis/flight-api@apps ![API Portal showing only the flight API.](https://doc.traefik.io/traefik-hub-v2/assets/images/quickstart-internal-group-cd2b30a192889bf8a6d97317fe29a823.png "API Portal showing only the flight API.") Congratulations, you deployed two APIs with two different [API Accesses](https://doc.traefik.io/traefik-hub-v2/api-management/api-access "Link to API access documentation") granting permission to two different user groups, the related API Gateway and API Portal. * * * Related Content[​](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#related-content "Direct link to Related Content") ----------------------------------------------------------------------------------------------------------------------------- * Head over to the API Portal documentation and learn how to configure [API Keys](https://doc.traefik.io/traefik-hub-v2/portal/create-api-key "Links to documentation about how to create API Keys in the Portal") * Learn more about [API Management with Traefik Hub](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview "Link to APIM overview documentation") . * [Introduction](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#introduction) * [Before You Begin](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#before-you-begin) * [Installing the Traefik Hub Agent](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#installing-the-traefik-hub-agent) * [User and Groups](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#user-and-groups) * [Creating Groups](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#creating-groups) * [Creating User](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#creating-user) * [Deploy the CRD Stack](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#deploy-the-crd-stack) * [Access the API Portal](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#access-the-api-portal) * [Related Content](https://doc.traefik.io/traefik-hub-v2/quick-start-guide#related-content) --- # API Management Concepts | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#__docusaurus_skipToContent_fallback) On this page Traefik Hub API Management (APIM) concepts and components overview. * * * What Is APIM?[​](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#what-is-apim "Direct link to What Is APIM?") ---------------------------------------------------------------------------------------------------------------------------------- In Traefik Hub, API Management refers to the tasks of publishing and managing APIs. Concepts[​](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#concepts "Direct link to Concepts") -------------------------------------------------------------------------------------------------------------------- The following concepts are fundamental to API Management: * [API Manager](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-manager "API Manager") * [API User](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-user "API USER") * [API Consumer](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview "API Consumer") Components[​](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#components "Direct link to Components") -------------------------------------------------------------------------------------------------------------------------- API Management consists of three main components: * **API Management CRDs:** Custom resource definitions to manage API services. * **Traefik Hub Dashboard:** A web UI providing access to key API Management services. It allows API managers to publish APIs and to configure both global platform settings (user management) and specific portal settings. * **Developer Portal:** A web UI providing access to key APIs and API Collections. API Users can use it to manage API keys for consumers, search for, view and try out published APIs. * * * API Management Objects[​](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#api-management-objects "Direct link to API Management Objects") -------------------------------------------------------------------------------------------------------------------------------------------------------------- [📄️ API\ -------\ \ Managing APIs with Traefik Hub.](https://doc.traefik.io/traefik-hub-poc/api-management/api) [📄️ API Version\ ---------------\ \ API versioning with Traefik Hub.](https://doc.traefik.io/traefik-hub-poc/api-management/api-version) [📄️ API Collections\ -------------------\ \ Traefik Hub - API collections overview.](https://doc.traefik.io/traefik-hub-poc/api-management/api-collection) [📄️ API Access\ --------------\ \ Traefik Hub API Access overview.](https://doc.traefik.io/traefik-hub-poc/api-management/api-access) [📄️ API Rate Limit\ ------------------\ \ How to use rate limiting.](https://doc.traefik.io/traefik-hub-poc/api-management/api-rate-limit) [📄️ API Gateway\ ---------------\ \ Traefik Hub - API Gateway. How to expose APIs.](https://doc.traefik.io/traefik-hub-poc/api-management/api-gateway) [📄️ API Portal\ --------------\ \ Traefik Hub - API Portal overview and introduction.](https://doc.traefik.io/traefik-hub-poc/api-management/api-portal) [📄️ APIs from External URLs\ ---------------------------\ \ How to use Traefik Hub with External Services.](https://doc.traefik.io/traefik-hub-poc/api-management/external-apis) [📄️ User Management\ -------------------\ \ Traefik Hub - Control access to your APIs and documentation.](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups) * [What Is APIM?](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#what-is-apim) * [Concepts](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#concepts) * [Components](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#components) * [API Management Objects](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview#api-management-objects) --- # Quick-Start Guide | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#__docusaurus_skipToContent_fallback) On this page In the next 8 minutes, you’ll install your first Traefik Hub agent, and you'll deploy your first APIs and configure the API Gateway and API Portal. * * * Introduction[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#introduction "Direct link to Introduction") --------------------------------------------------------------------------------------------------------------------- This quick start guide takes you through installing the Traefik Hub agent and [creating API Users using the internal IdP](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups "Link to documentation about user and group management") and deploying an [API Management](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview "Link to API Management overview documentation") CRD stack into the `apps` namespace of your Kubernetes cluster. Once the deployment is done, you will have a working API Portal with three APIs, one API collection and configured access permissions. For a hassle-free experience, you will use our demo files from our [workshop repository on GitHub](https://github.com/traefik-workshops/hub-tutorials/tree/master/quickstart "Link to demo files on GitHub") tailored for this quick start guide. Good to Know Following this guide, you'll use `kubectl` to deploy files from a GitHub repository onto your Kubernetes cluster. This guide uses _traefikhub.io_ domains for API Gateways and Portals. This guide uses the [Internal IdP](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#internal "Link to documentation overview about the internal IdP") for user management. Before You Begin[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#before-you-begin "Direct link to Before You Begin") --------------------------------------------------------------------------------------------------------------------------------- Please make sure you have the following: * An account registered on the [Traefik Hub](https://hub.traefik.io/ "Link to Traefik Hub") platform. * [`kubectl`](https://kubernetes.io/docs/reference/kubectl/ "Link to website of kubectl") installed and configured. Installing the Traefik Hub Agent[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#installing-the-traefik-hub-agent "Direct link to Installing the Traefik Hub Agent") --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- info You can always refer to the [detailed installation documentation](https://doc.traefik.io/traefik-hub-poc/operations/installation "Link to Traefik Hub installation documentation") for more information. Login into the Traefik Hub dashboard and select **Create my first Traefik Hub agent**. https://hub.traefik.io ![Choose install](https://doc.traefik.io/traefik-hub-poc/assets/images/install1-76cd822cc5968c85209058a654ac9e03.png "Create my first Traefik Hub agent") Choose _Traefik Hub_ as Ingress Controller (this is the default installation method) and follow the steps in the UI. https://hub.traefik.io ![Ingress Controller mode](https://doc.traefik.io/traefik-hub-poc/assets/images/ingress-mode1-c3ca6162df2689b1a69c8ac43d6300d2.png "Choose Traefik Hub as Ingress Controller") Copy and paste the instructions provided in step 2 and run them on your cluster. This will install Traefik Hub. We recommend you save the agent token provided in step 3 for future reference. If you lose this token, you won't be able to recover it and will need to go through a new installation process. As the last step (4) give the agent a name or use the random created one by Traefik Hub. Select **Configuration Done**. Traefik Hub will then detect your newly installed agent. Custom Configuration For adjusting the default configuration, please refer to the [custom configuration](https://doc.traefik.io/traefik-hub-poc/operations/custom-configuration "Link to documentation about custom configuration") documentation. * * * User and Groups[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#user-and-groups "Direct link to User and Groups") ------------------------------------------------------------------------------------------------------------------------------ To consume APIs, a user needs to be part of a user group. Groups are a means of categorizing users. This allows for granting permissions to APIs for specific groups. Read More Please refer to the [user management documentation](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups "Link to documentation about use and group management") for more information. ### Creating Groups[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#creating-groups "Direct link to Creating Groups") Head over to groups page in the dashboard by selecting **Groups** on the left navigation, followed by **Add group** in the right top corner of the groups overview page and create two user groups: * The `support` group will have access to an API Collection, containing two APIs, the `flight` and the `ticket` API. * The `internal` group will have only access to the `flight` API. https://hub.traefik.io/groups ![Form for adding a group.](https://doc.traefik.io/traefik-hub-poc/assets/images/quickstart-add-support-group-b7e2d1a3e05a453009ba1ce6af05c6b5.png "Form for adding a group") After you created the groups, you will now add two user. ### Creating User[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#creating-user "Direct link to Creating User") Select **Users** on the left navigation bar and **Add user** on the top right. https://hub.traefik.io/users ![Select the user creation form in the dashboard.](https://doc.traefik.io/traefik-hub-poc/assets/images/quickstart-add-user-5f7322751a9e04cfe29598ee292a0098.png "Select the user creation form in the dashboard") Create the first user and assign the user to the `support` group, don't forget to select the **Create** button. https://hub.traefik.io/users/new ![Filling in the user creation form.](https://doc.traefik.io/traefik-hub-poc/assets/images/quickstart-create-user-40cadbd8d825dc3f4f7b0cf67462ba98.png "Filling in the user creation form") Follow the instructions on the screen to set the user password. https://hub.traefik.io/users/new ![Follow the screen instructions to set a password for the user.](https://doc.traefik.io/traefik-hub-poc/assets/images/quickstart-set-user-password-68acdd9e5d70c14efec96a3921d747d2.png "Follow the screen instructions to set a password for the user") Repeat that step to create a second user, but this time assign the user to the group `internal`. Deploy the CRD Stack[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#deploy-the-crd-stack "Direct link to Deploy the CRD Stack") --------------------------------------------------------------------------------------------------------------------------------------------- It is now time to deploy the demo CRD file. This deployment will set up two different [APIs](https://doc.traefik.io/traefik-hub-poc/api-management/api "Link to documentation about how to use CRDs for managing APIs") (_flight_, _ticket_) and it will configure the [API access permissions](https://doc.traefik.io/traefik-hub-poc/api-management/api-access "Link to API Access CR documentation") , the [API Gateway](https://doc.traefik.io/traefik-hub-poc/api-management/api-gateway "Link to API Gateway CR documentation") and the [API Portal](https://doc.traefik.io/traefik-hub-poc/api-management/api-portal "Link to API Portal CR documentation") . warning Before you continue with this guide, please take the time to review the files on [GitHub](https://github.com/traefik-workshops/hub-tutorials/tree/master/quickstart "Link to demo files on GitHub") ! **Please do not deploy CRDs to your cluster without checking them first.** Use `kubectl` to push the deployment to your cluster. CLI kubectl apply -f https://raw.githubusercontent.com/traefik-workshops/hub-tutorials/master/quickstart/quickstart.yaml This will take a short moment. Access the API Portal[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#access-the-api-portal "Direct link to Access the API Portal") ------------------------------------------------------------------------------------------------------------------------------------------------ Use `kubectl` to get the URL of the newly created API Portal. * CLI Command * CLI Output kubectl get apiportal -n apps NAME URLStraefik-hub-demo-portal https://random-name.traefikhub.io info It may take a short moment till your Portal is fully deployed and reachable. It is possible that you see [warnings related to TLS](https://doc.traefik.io/traefik-hub-poc/faq#certificates "Link to FAQ related to TLS") during the initialization of the API Portal. Browse to the URL and log in as one of the user you created. Depending on the user, you will see that one of the user (member of the `support` group) has access to an API collection, containing two APIs. The other user (member of the `internal` group) has only access to the flight API. Read More Please refer to the [API Portal documentation](https://doc.traefik.io/traefik-hub-poc/portal/api-portal-overview "Link to API Portal overview documentation") to learn about how to use the API Portal. * Support Group * Internal Group https://random-name.traefikhub.io/collections/demo-travel-collection/apis/flight-api@apps ![API Portal showing an API Collection.](https://doc.traefik.io/traefik-hub-poc/assets/images/quickstart-support-group-14b8044cddbe1adefb421f33aa6d8aea.png "API Portal showing an API Collection.") https://random-name.traefikhub.io/apis/flight-api@apps ![API Portal showing only the flight API.](https://doc.traefik.io/traefik-hub-poc/assets/images/quickstart-internal-group-cd2b30a192889bf8a6d97317fe29a823.png "API Portal showing only the flight API.") Congratulations, you deployed two APIs with two different [API Accesses](https://doc.traefik.io/traefik-hub-poc/api-management/api-access "Link to API access documentation") granting permission to two different user groups, the related API Gateway and API Portal. * * * Related Content[​](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#related-content "Direct link to Related Content") ------------------------------------------------------------------------------------------------------------------------------ * Head over to the API Portal documentation and learn how to configure [API Keys](https://doc.traefik.io/traefik-hub-poc/portal/create-api-key "Links to documentation about how to create API Keys in the Portal") * Learn more about [API Management with Traefik Hub](https://doc.traefik.io/traefik-hub-poc/api-management/apim-overview "Link to APIM overview documentation") . * [Introduction](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#introduction) * [Before You Begin](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#before-you-begin) * [Installing the Traefik Hub Agent](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#installing-the-traefik-hub-agent) * [User and Groups](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#user-and-groups) * [Creating Groups](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#creating-groups) * [Creating User](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#creating-user) * [Deploy the CRD Stack](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#deploy-the-crd-stack) * [Access the API Portal](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#access-the-api-portal) * [Related Content](https://doc.traefik.io/traefik-hub-poc/quick-start-guide#related-content) --- # Release Notes | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#__docusaurus_skipToContent_fallback) On this page What's new in Traefik Hub. * * * March 2024[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#march-2024 "Direct link to March 2024") ------------------------------------------------------------------------------------------------------------------------ ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new "Direct link to What's New") * We've released [API Gateway](https://doc.traefik.io/traefik-hub-poc/api-gateway/api-gateway-intro "Link to API Gateway introduction and overview page") capabilities with turnkey middleware support. You can use Traefik Hub now as a drop-in replacement for Traefik Proxy with some additional advanced features ported from Traefik Enterprise. Please refer to the documentation about [middleware](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/api-gateway-middleware-overview "Link to middleware overview documentation") to learn more. * We've added a new (read-only) [dashboard](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard) for checking the status and the currently applied Gateway configuration. ![API Gateway dashboard overview.](https://doc.traefik.io/traefik-hub-poc/assets/images/gateway-dash-release-notes-bc28aeb6cd192a43d410bae969c54c2b.png "API Gateway dashboard") February 2024[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#february-2024 "Direct link to February 2024") --------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-1 "Direct link to What's New") * We've added a new filtering concept in the [APIAccess CRD](https://doc.traefik.io/traefik-hub-poc/api-management/api-access "Link to APIAccess CRD") that enables you to select sets of OpenAPI operations defined on APIs or APIVersions. You can find more information in the [API CRD reference](https://doc.traefik.io/traefik-hub-poc/api-management/api#operation-filtering "Link to operation filtering docs in the API CRD reference") . * All-new API Portal. We've refreshed the API Portal UI to create a better user experience. ![New API Portal UI](https://doc.traefik.io/traefik-hub-poc/assets/images/custom-portal-overview-6fbc85fc3e94b535646c706a6dc88af4.png "Picture showing the new API Portal UI") * It is now possible to [turn off](https://doc.traefik.io/traefik-hub-poc/dashboard/workspace-settings#workspace-settings) the generation and usage of _traefikhub.io_ domains for your API Gateways and Portals. * Error logs generated by the Traefik Hub agent are now transmitted to the Traefik Hub platform and stored for 24 hours to assist in resolving support requests quickly. You can turn off sending error logs by adjusting the [default configuration](https://doc.traefik.io/traefik-hub-poc/operations/custom-configuration "Link to the default agent configuration") . * We've enhanced the [API](https://doc.traefik.io/traefik-hub-poc/api-management/api "Link to the API CRD reference") and the [APIVersion](https://doc.traefik.io/traefik-hub-poc/api-management/api-version "Link to APIVersion CRD") CRDs. Both CRDs support now naming of the API Service port `service.port.name`. December 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#december-2023 "Direct link to December 2023") --------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-2 "Direct link to What's New") * You can now publish APIs without an OpenAPI specification. ![No OAS spec required](https://doc.traefik.io/traefik-hub-poc/assets/images/no-oas-8eab55ba6b880d8f5bf6d75cec492834.png "Picture showing a info message if no OAS is used") * We've published a [complete Traefik Hub GitOps demo](https://github.com/traefik-workshops/traefik-hub-gitops/tree/master "Link to GitHub repository of the Traefik Hub GitOps demo") . Follow the tutorial to learn how to deploy and manage APIs on a local Kubernetes cluster with [Flux](https://fluxcd.io/ "Link to website of Flux") . ![Example Grafana dashboard](https://doc.traefik.io/traefik-hub-poc/assets/images/otel-1-1fec6414fecf25487eaaf7665605059d.png "Example Grafana dashboard") * We've updated the dashboard to make it more effortless for you to get an overview about configured access policies and rate limits. This information is now displayed in the API details page, as in the user and groups details pages. ![Computed values](https://doc.traefik.io/traefik-hub-poc/assets/images/ui-computed-values-ea79d9f5e6ca6e530b88026eb4f04726.png "Picture showing computed values") November 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#november-2023 "Direct link to November 2023") --------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-3 "Direct link to What's New") * Traefik Hub now has a direct integration with [Okta](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/okta "Link to documentation about how to use Okta with Traefik Hub") . ![IdP-Form](https://doc.traefik.io/traefik-hub-poc/assets/images/external-idp-overview-012b2843df9e3e6b232de02ccc1fc263.png "Overview picture of external IdPs in the dashboard") * Starting today, you're able to use [JWT](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/jwt-overview "Link to JWT overview") to secure access to APIs. ![UI-JWT](https://doc.traefik.io/traefik-hub-poc/assets/images/jwt-screen-e810a5b6e34db6dc5c93103257a2881d.png "Picture of JWT screen in the dashboard") * We've added support for [distributed rate limiting](https://doc.traefik.io/traefik-hub-poc/api-management/api-rate-limit "Links to documentation about distributed rate limiting with Traefik Hub") . * We've enhanced our OpenTelemetry metrics by adding support for API versions. * The dashboard now shows a warning sign when a Traefik Hub agent faces a connectivity issue. ![dashboard showing a warning](https://doc.traefik.io/traefik-hub-poc/assets/images/agent-offline-api-overview-24bbcd5742d4365a66b12a80aafbfa39.png "Picture of showing a warning that a Traefik Hub agent is offline in the dashboard") * We've released a new version of the Traefik Hub agent `v2.4.2` and of the Helm chart `v2.5.1` [Changelog](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.5.1 "Link to v2.5.1 changelog on GitHub") . Please upgrade the Traefik Hub agent to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the [Ingress Controller](https://doc.traefik.io/traefik-hub-poc/operations/upgrading "Link to documentation about upgrading the Ingress Controller Mode installation") or the [Sidecar Mode](https://doc.traefik.io/traefik-hub-poc/operations/upgrading "Link to documentation about upgrading the Sidecar Mode mode installation") installation. October 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#october-2023 "Direct link to October 2023") ------------------------------------------------------------------------------------------------------------------------------ ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-4 "Direct link to What's New") * In this release, we've added [OpenTelemetry](https://doc.traefik.io/traefik-hub-poc/operations/metrics "Link to documentation about how to use OTel with Traefik Hub") support to Traefik Hub. * We've added support for adjusting [CORS](https://doc.traefik.io/traefik-hub-poc/api-management/api-version#cors "Link to documentation about how to adjust CORS policies through the dashboard") and API header policies through CRDs and via the dashboard. ![UI](https://doc.traefik.io/traefik-hub-poc/assets/images/cors-headers-version-ui-188e78f3c4b1bb1dbaee5ded776187a5.png "Picture of showing the dashboard about adding CORS, headers and API versioning") * You can now manage [workspace roles](https://doc.traefik.io/traefik-hub-poc/dashboard#workspace-roles "Link to documentation about changing workspace roles") through the dashboard. ![UI](https://doc.traefik.io/traefik-hub-poc/assets/images/change-role-2-940790435326a07263e256c8ee8f3632.png "Picture of showing the dashboard about changing workspace roles") ### Security[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#security "Direct link to Security") * ⚠️ The Traefik Hub agent `v2.3.0` and Helm chart `v.2.3.0` ([Changelog](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.3.0 "Link to v2.3.0 changelog on GitHub") ) releases are fixing [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487) in the Traefik Hub agent. September 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#september-2023 "Direct link to September 2023") ------------------------------------------------------------------------------------------------------------------------------------ ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-5 "Direct link to What's New") * You can use [Keycloak](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/keycloak "Link to documentation about Keycloak") for Single Sign-On (SSO) or as an [identity broker](https://www.keycloak.org/docs/latest/server_admin/#features "Link to the website of Keycloak") for Traefik Hub. * We enhanced workspace management. You can now assign [roles](https://doc.traefik.io/traefik-hub-poc/dashboard#workspace-roles "Link to documentation about workspace roles in Traefik Hub") to workspace members. Every role, `Viewer`, `Editor` and `Admin` has a different set of permissions. * Traefik Hub now supports [CORS](https://doc.traefik.io/traefik-hub-poc/api-management/api-version#cors "Link to CORS documentation") (Cross-Origin Resource Sharing) configuration via CRDs. August 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#august-2023 "Direct link to August 2023") --------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-6 "Direct link to What's New") * We've added support for [API versioning](https://doc.traefik.io/traefik-hub-poc/api-management/api-version "Link to documentation about API versioning") through CRDs and via the dashboard. * We've published the [Traefik Hub Helm Chart](https://github.com/traefik/traefik-hub-helm-chart "Link to the Traefik Hub Helm chart on GitHub") on GitHub. * We've improved the dashboard to provide a better experience when you select Services. You can now better identify if you use an internal or external (API) Service. * The dashboard shows now a warning sign when the user's initial password reset has not been performed yet. * We've released a new version of the Traefik Hub Helm chart with an update of the Traefik Hub agent. Please find the changelog for `v2.2.0` on [GitHub](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.2.0 "Link to v2.2.0 changelog on GitHub") . Please upgrade to version `v2.2.0` to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the [Ingress Controller](https://doc.traefik.io/traefik-hub-poc/operations/upgrading "Link to documentation about upgrading the Ingress Controller Mode installation") or the Sidecar Mode installation. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes "Direct link to Bug Fixes") * We've fixed a couple of tiny bugs in the user interface (dashboard). July 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#july-2023 "Direct link to July 2023") --------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-7 "Direct link to What's New") * The Traefik Hub agent supports now two different [installation methods](https://doc.traefik.io/traefik-hub-poc/operations/installation "Link to installation overview") , the Ingress Controller mode and the Sidecar Mode. * We've added Emissary (formerly Ambassador, an Envoy-based) Ingress support with Sidecar Mode. * We've improved API management, you can now select APIs by name and by [Labels](https://doc.traefik.io/traefik-hub-poc/reference/labels-and-selectors "Link to reference documentation about Labels and Selectors") . You can combine names and Labels to filter your selections even more. * We've added support for [rate limiting](https://doc.traefik.io/traefik-hub-poc/api-management/api-rate-limit "Link to documentation about rate limiting") to the dashboard. * We've added support for [Swagger v2](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#swagger-v2 "Link to documentation about Swagger v2 support") . ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes-1 "Direct link to Bug Fixes") * We've fixed a couple of descriptions in the dashboard. June 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#june-2023 "Direct link to June 2023") --------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-8 "Direct link to What's New") * You can now manage [external APIs](https://doc.traefik.io/traefik-hub-poc/api-management/external-apis "Link to more info about external Services") , hosted outside your Kubernetes cluster, for example on Virtual Machines (VMs) or third party APIs. * Starting today, you're able to use [rate limiting](https://doc.traefik.io/traefik-hub-poc/api-management/api-rate-limit "Link to CRD documentation about rate limiting") for APIs. * We strengthened security. The Traefik Hub token is now provided as a [Secret](https://kubernetes.io/docs/concepts/configuration/secret/ "Link to K8s documentation about Secretes") during installation. * If you deal with large clusters, we made your life easier with filtering Services by namespace in the dashboard, to quickly find what you look for. * The dashboard provide more guidance, with clear indications of which fields are required and more descriptions. * We've updated the dashboard to put key information right at your fingertips: information on APIs and API Collections, the API Developer Portal and Users. Corresponding screens have been updated for better clarity. * We’ve improved the API Developer Portal responsiveness by adding HTTP cache control headers. * For you to more quickly see how to perform given tasks, we've restructured the documentation, added more tutorials and improved the content overall. * Based on your feedback, we've tinkered with the internal workings and polished some rough edges. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes-2 "Direct link to Bug Fixes") * If your session has expired, you will now be redirected to the login screen. * We've fixed a couple of bugs in the dashboard related to pop-ups, selecting Services, user groups and error pages. * We've fixed a bug related to TLS termination. * There were a few little bugs that caused performances issues, like bugs do. We fixed those, and we’ll fix the next ones too. May 2023[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#may-2023 "Direct link to May 2023") ------------------------------------------------------------------------------------------------------------------ ### What's New[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-9 "Direct link to What's New") * We've changed the architecture, Hub now supports only K8s, the Agent uses a sidecar, and it is compatible with any Ingress Controller. * We've added a new ACP (Access Control Policy) for API Keys. * We've added a new OAuth Introspection ACP. * Starting today, you're able to use CRDs for APIs, API Collections, API Accesses, API Gateways, and API Portal objects. * API consumption is now protected by [tokens](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/key-authentication "Link to documentation about Portal access") . * We've added [API Management](https://doc.traefik.io/traefik-hub-poc/ "Link to concepts page") , now you can use Hub as a platform for managing, routing, monitoring, and securing APIs. * You can use Traefik Hub as [IdP](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#internal "Link to documentation about Hub user management") (Identity Provider). * We've replaced freemium tiers with a new [trial mechanism](https://traefik.io/pricing/ "Link to pricing page") . * User deletion is now fully GDPR-compliant, no user data is retained. * Traefik Hub supports now team collaboration with workspaces. * Traefik Hub is now compatible with Traefik's IngressRoute. * We've added support for wildcard domains. * We've added the functionality to expose Prometheus compatible metrics from the Traefik Hub agent. * Hub errors are now leveraging K8s events. * We restructured and updated the documentation. * We adjusted the Service page in the dashboard, port numbers are now visible when they exceed more than 3 characters. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes-3 "Direct link to Bug Fixes") * We fixed an issue that prevented some ACPs to be deleted. * We improved the process of certificate renewals. * We solved an issue with custom domain validation. * [March 2024](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#march-2024) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new) * [February 2024](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#february-2024) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-1) * [December 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#december-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-2) * [November 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#november-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-3) * [October 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#october-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-4) * [Security](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#security) * [September 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#september-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-5) * [August 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#august-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-6) * [Bug Fixes](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes) * [July 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#july-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-7) * [Bug Fixes](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes-1) * [June 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#june-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-8) * [Bug Fixes](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes-2) * [May 2023](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#may-2023) * [What's New](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#whats-new-9) * [Bug Fixes](https://doc.traefik.io/traefik-hub-poc/introduction/release-notes#bug-fixes-3) --- # Release Notes | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#__docusaurus_skipToContent_fallback) On this page What's new in Traefik Hub. * * * March 2024[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#march-2024 "Direct link to March 2024") ----------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new "Direct link to What's New") * We've released [API Gateway](https://doc.traefik.io/traefik-hub-v2/api-gateway/api-gateway-intro "Link to API Gateway introduction and overview page") capabilities with turnkey middleware support. You can use Traefik Hub now as a drop-in replacement for Traefik Proxy with some additional advanced features ported from Traefik Enterprise. Please refer to the documentation about [middleware](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/api-gateway-middleware-overview "Link to middleware overview documentation") to learn more. * We've added a new (read-only) [dashboard](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/api-gateway-dashboard) for checking the status and the currently applied Gateway configuration. ![API Gateway dashboard overview.](https://doc.traefik.io/traefik-hub-v2/assets/images/gateway-dash-release-notes-bc28aeb6cd192a43d410bae969c54c2b.png "API Gateway dashboard") February 2024[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#february-2024 "Direct link to February 2024") -------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-1 "Direct link to What's New") * We've added a new filtering concept in the [APIAccess CRD](https://doc.traefik.io/traefik-hub-v2/api-management/api-access "Link to APIAccess CRD") that enables you to select sets of OpenAPI operations defined on APIs or APIVersions. You can find more information in the [API CRD reference](https://doc.traefik.io/traefik-hub-v2/api-management/api#operation-filtering "Link to operation filtering docs in the API CRD reference") . * All-new API Portal. We've refreshed the API Portal UI to create a better user experience. ![New API Portal UI](https://doc.traefik.io/traefik-hub-v2/assets/images/custom-portal-overview-6fbc85fc3e94b535646c706a6dc88af4.png "Picture showing the new API Portal UI") * It is now possible to [turn off](https://doc.traefik.io/traefik-hub-v2/dashboard/workspace-settings#workspace-settings) the generation and usage of _traefikhub.io_ domains for your API Gateways and Portals. * Error logs generated by the Traefik Hub agent are now transmitted to the Traefik Hub platform and stored for 24 hours to assist in resolving support requests quickly. You can turn off sending error logs by adjusting the [default configuration](https://doc.traefik.io/traefik-hub-v2/operations/custom-configuration "Link to the default agent configuration") . * We've enhanced the [API](https://doc.traefik.io/traefik-hub-v2/api-management/api "Link to the API CRD reference") and the [APIVersion](https://doc.traefik.io/traefik-hub-v2/api-management/api-version "Link to APIVersion CRD") CRDs. Both CRDs support now naming of the API Service port `service.port.name`. December 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#december-2023 "Direct link to December 2023") -------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-2 "Direct link to What's New") * You can now publish APIs without an OpenAPI specification. ![No OAS spec required](https://doc.traefik.io/traefik-hub-v2/assets/images/no-oas-8eab55ba6b880d8f5bf6d75cec492834.png "Picture showing a info message if no OAS is used") * We've published a [complete Traefik Hub GitOps demo](https://github.com/traefik-workshops/traefik-hub-gitops/tree/master "Link to GitHub repository of the Traefik Hub GitOps demo") . Follow the tutorial to learn how to deploy and manage APIs on a local Kubernetes cluster with [Flux](https://fluxcd.io/ "Link to website of Flux") . ![Example Grafana dashboard](https://doc.traefik.io/traefik-hub-v2/assets/images/otel-1-1fec6414fecf25487eaaf7665605059d.png "Example Grafana dashboard") * We've updated the dashboard to make it more effortless for you to get an overview about configured access policies and rate limits. This information is now displayed in the API details page, as in the user and groups details pages. ![Computed values](https://doc.traefik.io/traefik-hub-v2/assets/images/ui-computed-values-ea79d9f5e6ca6e530b88026eb4f04726.png "Picture showing computed values") November 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#november-2023 "Direct link to November 2023") -------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-3 "Direct link to What's New") * Traefik Hub now has a direct integration with [Okta](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/okta "Link to documentation about how to use Okta with Traefik Hub") . ![IdP-Form](https://doc.traefik.io/traefik-hub-v2/assets/images/external-idp-overview-012b2843df9e3e6b232de02ccc1fc263.png "Overview picture of external IdPs in the dashboard") * Starting today, you're able to use [JWT](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview "Link to JWT overview") to secure access to APIs. ![UI-JWT](https://doc.traefik.io/traefik-hub-v2/assets/images/jwt-screen-e810a5b6e34db6dc5c93103257a2881d.png "Picture of JWT screen in the dashboard") * We've added support for [distributed rate limiting](https://doc.traefik.io/traefik-hub-v2/api-management/api-rate-limit "Links to documentation about distributed rate limiting with Traefik Hub") . * We've enhanced our OpenTelemetry metrics by adding support for API versions. * The dashboard now shows a warning sign when a Traefik Hub agent faces a connectivity issue. ![dashboard showing a warning](https://doc.traefik.io/traefik-hub-v2/assets/images/agent-offline-api-overview-24bbcd5742d4365a66b12a80aafbfa39.png "Picture of showing a warning that a Traefik Hub agent is offline in the dashboard") * We've released a new version of the Traefik Hub agent `v2.4.2` and of the Helm chart `v2.5.1` [Changelog](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.5.1 "Link to v2.5.1 changelog on GitHub") . Please upgrade the Traefik Hub agent to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the [Ingress Controller](https://doc.traefik.io/traefik-hub-v2/operations/upgrading "Link to documentation about upgrading the Ingress Controller Mode installation") or the [Sidecar Mode](https://doc.traefik.io/traefik-hub-v2/operations/upgrading "Link to documentation about upgrading the Sidecar Mode mode installation") installation. October 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#october-2023 "Direct link to October 2023") ----------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-4 "Direct link to What's New") * In this release, we've added [OpenTelemetry](https://doc.traefik.io/traefik-hub-v2/operations/metrics "Link to documentation about how to use OTel with Traefik Hub") support to Traefik Hub. * We've added support for adjusting [CORS](https://doc.traefik.io/traefik-hub-v2/api-management/api-version#cors "Link to documentation about how to adjust CORS policies through the dashboard") and API header policies through CRDs and via the dashboard. ![UI](https://doc.traefik.io/traefik-hub-v2/assets/images/cors-headers-version-ui-188e78f3c4b1bb1dbaee5ded776187a5.png "Picture of showing the dashboard about adding CORS, headers and API versioning") * You can now manage [workspace roles](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles "Link to documentation about changing workspace roles") through the dashboard. ![UI](https://doc.traefik.io/traefik-hub-v2/assets/images/change-role-2-940790435326a07263e256c8ee8f3632.png "Picture of showing the dashboard about changing workspace roles") ### Security[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#security "Direct link to Security") * ⚠️ The Traefik Hub agent `v2.3.0` and Helm chart `v.2.3.0` ([Changelog](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.3.0 "Link to v2.3.0 changelog on GitHub") ) releases are fixing [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487) in the Traefik Hub agent. September 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#september-2023 "Direct link to September 2023") ----------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-5 "Direct link to What's New") * You can use [Keycloak](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/keycloak "Link to documentation about Keycloak") for Single Sign-On (SSO) or as an [identity broker](https://www.keycloak.org/docs/latest/server_admin/#features "Link to the website of Keycloak") for Traefik Hub. * We enhanced workspace management. You can now assign [roles](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles "Link to documentation about workspace roles in Traefik Hub") to workspace members. Every role, `Viewer`, `Editor` and `Admin` has a different set of permissions. * Traefik Hub now supports [CORS](https://doc.traefik.io/traefik-hub-v2/api-management/api-version#cors "Link to CORS documentation") (Cross-Origin Resource Sharing) configuration via CRDs. August 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#august-2023 "Direct link to August 2023") -------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-6 "Direct link to What's New") * We've added support for [API versioning](https://doc.traefik.io/traefik-hub-v2/api-management/api-version "Link to documentation about API versioning") through CRDs and via the dashboard. * We've published the [Traefik Hub Helm Chart](https://github.com/traefik/traefik-hub-helm-chart "Link to the Traefik Hub Helm chart on GitHub") on GitHub. * We've improved the dashboard to provide a better experience when you select Services. You can now better identify if you use an internal or external (API) Service. * The dashboard shows now a warning sign when the user's initial password reset has not been performed yet. * We've released a new version of the Traefik Hub Helm chart with an update of the Traefik Hub agent. Please find the changelog for `v2.2.0` on [GitHub](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.2.0 "Link to v2.2.0 changelog on GitHub") . Please upgrade to version `v2.2.0` to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the [Ingress Controller](https://doc.traefik.io/traefik-hub-v2/operations/upgrading "Link to documentation about upgrading the Ingress Controller Mode installation") or the Sidecar Mode installation. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes "Direct link to Bug Fixes") * We've fixed a couple of tiny bugs in the user interface (dashboard). July 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#july-2023 "Direct link to July 2023") -------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-7 "Direct link to What's New") * The Traefik Hub agent supports now two different [installation methods](https://doc.traefik.io/traefik-hub-v2/operations/installation "Link to installation overview") , the Ingress Controller mode and the Sidecar Mode. * We've added Emissary (formerly Ambassador, an Envoy-based) Ingress support with Sidecar Mode. * We've improved API management, you can now select APIs by name and by [Labels](https://doc.traefik.io/traefik-hub-v2/reference/labels-and-selectors "Link to reference documentation about Labels and Selectors") . You can combine names and Labels to filter your selections even more. * We've added support for [rate limiting](https://doc.traefik.io/traefik-hub-v2/api-management/api-rate-limit "Link to documentation about rate limiting") to the dashboard. * We've added support for [Swagger v2](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#swagger-v2 "Link to documentation about Swagger v2 support") . ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes-1 "Direct link to Bug Fixes") * We've fixed a couple of descriptions in the dashboard. June 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#june-2023 "Direct link to June 2023") -------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-8 "Direct link to What's New") * You can now manage [external APIs](https://doc.traefik.io/traefik-hub-v2/api-management/external-apis "Link to more info about external Services") , hosted outside your Kubernetes cluster, for example on Virtual Machines (VMs) or third party APIs. * Starting today, you're able to use [rate limiting](https://doc.traefik.io/traefik-hub-v2/api-management/api-rate-limit "Link to CRD documentation about rate limiting") for APIs. * We strengthened security. The Traefik Hub token is now provided as a [Secret](https://kubernetes.io/docs/concepts/configuration/secret/ "Link to K8s documentation about Secretes") during installation. * If you deal with large clusters, we made your life easier with filtering Services by namespace in the dashboard, to quickly find what you look for. * The dashboard provide more guidance, with clear indications of which fields are required and more descriptions. * We've updated the dashboard to put key information right at your fingertips: information on APIs and API Collections, the API Developer Portal and Users. Corresponding screens have been updated for better clarity. * We’ve improved the API Developer Portal responsiveness by adding HTTP cache control headers. * For you to more quickly see how to perform given tasks, we've restructured the documentation, added more tutorials and improved the content overall. * Based on your feedback, we've tinkered with the internal workings and polished some rough edges. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes-2 "Direct link to Bug Fixes") * If your session has expired, you will now be redirected to the login screen. * We've fixed a couple of bugs in the dashboard related to pop-ups, selecting Services, user groups and error pages. * We've fixed a bug related to TLS termination. * There were a few little bugs that caused performances issues, like bugs do. We fixed those, and we’ll fix the next ones too. May 2023[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#may-2023 "Direct link to May 2023") ----------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-9 "Direct link to What's New") * We've changed the architecture, Hub now supports only K8s, the Agent uses a sidecar, and it is compatible with any Ingress Controller. * We've added a new ACP (Access Control Policy) for API Keys. * We've added a new OAuth Introspection ACP. * Starting today, you're able to use CRDs for APIs, API Collections, API Accesses, API Gateways, and API Portal objects. * API consumption is now protected by [tokens](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/key-authentication "Link to documentation about Portal access") . * We've added [API Management](https://doc.traefik.io/traefik-hub-v2/ "Link to concepts page") , now you can use Hub as a platform for managing, routing, monitoring, and securing APIs. * You can use Traefik Hub as [IdP](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#internal "Link to documentation about Hub user management") (Identity Provider). * We've replaced freemium tiers with a new [trial mechanism](https://traefik.io/pricing/ "Link to pricing page") . * User deletion is now fully GDPR-compliant, no user data is retained. * Traefik Hub supports now team collaboration with workspaces. * Traefik Hub is now compatible with Traefik's IngressRoute. * We've added support for wildcard domains. * We've added the functionality to expose Prometheus compatible metrics from the Traefik Hub agent. * Hub errors are now leveraging K8s events. * We restructured and updated the documentation. * We adjusted the Service page in the dashboard, port numbers are now visible when they exceed more than 3 characters. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes-3 "Direct link to Bug Fixes") * We fixed an issue that prevented some ACPs to be deleted. * We improved the process of certificate renewals. * We solved an issue with custom domain validation. * [March 2024](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#march-2024) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new) * [February 2024](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#february-2024) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-1) * [December 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#december-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-2) * [November 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#november-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-3) * [October 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#october-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-4) * [Security](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#security) * [September 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#september-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-5) * [August 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#august-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-6) * [Bug Fixes](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes) * [July 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#july-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-7) * [Bug Fixes](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes-1) * [June 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#june-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-8) * [Bug Fixes](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes-2) * [May 2023](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#may-2023) * [What's New](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#whats-new-9) * [Bug Fixes](https://doc.traefik.io/traefik-hub-v2/introduction/release-notes#bug-fixes-3) --- # 61 docs tagged with "API Management" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-management#__docusaurus_skipToContent_fallback) [Account Settings\ ----------------](https://doc.traefik.io/traefik-hub/dashboard/account-settings) How to configure account settings in Traefik Hub. [API\ ---](https://doc.traefik.io/traefik-hub/api-management/api) Managing APIs with Traefik Hub. [API Bundle\ ----------](https://doc.traefik.io/traefik-hub/api-management/api-bundle) Traefik Hub API Bundle overview. [API CatalogItem\ ---------------](https://doc.traefik.io/traefik-hub/api-management/api-catalogitem) Traefik Hub API Catalog Item overview. [API Deprecation\ ---------------](https://doc.traefik.io/traefik-hub/reference/api/api-deprecation) Traefik Hub - How to deprecate an API in Traefik Hub. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/key-authentication) Traefik Hub - API Key Authentication [API Managed Subscriptions\ -------------------------](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) Traefik Hub API Managed Subscriptions overview. [API Management Concepts\ -----------------------](https://doc.traefik.io/traefik-hub/api-management/apim-overview) Traefik Hub - API Management Overview [API Management Offline Mode\ ---------------------------](https://doc.traefik.io/traefik-hub/api-management/offline-mode) Configure and operate Traefik Hub API Management in offline environments. [API Plan\ --------](https://doc.traefik.io/traefik-hub/api-management/api-plans) How to use API plans. [API Portal\ ----------](https://doc.traefik.io/traefik-hub/api-management/api-portal) Traefik Hub - API Portal overview and introduction. [API Portal Overview\ -------------------](https://doc.traefik.io/traefik-hub/portal/api-portal-overview) Traefik Hub - API Portal Overview [API Rate Limit\ --------------](https://doc.traefik.io/traefik-hub/api-management/api-rate-limit) How to use rate limiting. [API Self-Service Subscriptions\ ------------------------------](https://doc.traefik.io/traefik-hub/api-management/self-service-subscription) Traefik Hub API Self-Service Subscriptions overview. [API Version\ -----------](https://doc.traefik.io/traefik-hub/api-management/api-version) API versioning with Traefik Hub. [APIAuth\ -------](https://doc.traefik.io/traefik-hub/api-management/api-auth) Configure API authentication with the APIAuth CRD in Traefik Hub. [APIPortalAuth\ -------------](https://doc.traefik.io/traefik-hub/api-management/api-portal-auth) Configure API Portal authentication with the APIPortalAuth CRD in Traefik Hub. [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/access-overview) How to manage access to Traefik Hub [Configuring OIDC SSO and Gateway Authentication with Oracle IAM Identity Domains\ --------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/oracle/oci-iam-identity-domain) Configuring OIDC (OpenID Connect) SSO for the Traefik Hub API Portal and Gateway Authentication with Oracle IAM Identity Domains [Consumer Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/consumer-authentication) Consumer Authentication [Dashboard\ ---------](https://doc.traefik.io/traefik-hub/dashboard) How to manage member access in the Traefik Hub Dashboard [Data Sharing\ ------------](https://doc.traefik.io/traefik-hub/introduction/security/data-sharing) Overview about shared data between the Traefik Hub’s SaaS control plane and a Kubernetes cluster hosting the Traefik Hub agent [Deploy Traefik Hub API Management from the Oracle Marketplace\ -------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apim-marketplace) Learn how to deploy Traefik Hub API Management from the Oracle Cloud Infrastructure marketplace using the stacks. Read the technical documentation. [Deploy Traefik Hub API Management on Azure Arc\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/operations/azure/azure-arc-apim) Learn how to deploy Traefik Hub API Management on Azure Arc from Azure Marketplace. Read the technical documentation. [Deploy Traefik Hub from the Oracle Marketplace\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/oracle-oci/oci-marketplace) Learn how to deploy Traefik Hub from the Oracle marketplace using the stacks. Read the technical documentation. [Deploy Traefik Hub Gateway & API Management on Linode Kubernetes Engine (LKE)\ -----------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/lke) Deploy Traefik Hub on Linode Kubernetes Engine (LKE) [Distributed Rate Limit & Quota\ ------------------------------](https://doc.traefik.io/traefik-hub/reference/api/distributed-rate-limiting) Traefik Hub - How to configure and enable distributed rate limiting and quota in Traefik Hub. [External APIs\ -------------](https://doc.traefik.io/traefik-hub/api-management/external-api) Managing external APIs with Traefik Hub. [FAQ\ ---](https://doc.traefik.io/traefik-hub/faq) Traefik Hub frequently asked questions [Getting Started\ ---------------](https://doc.traefik.io/traefik-hub/api-management/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. [How to Create API Keys\ ----------------------](https://doc.traefik.io/traefik-hub/portal/create-api-key) How to Create API Keys. [How to Use API Key Authentication\ ---------------------------------](https://doc.traefik.io/traefik-hub/portal/key-auth) How to Use API Key Authentication. [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub/portal/jwt-portal) How to Use JWT in the API Portal. [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Install Traefik Hub Gateway & API Management on Nutanix Kubernetes Platform (NKP)\ ---------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nkp) Install and configure Traefik Hub on Nutanix Kubernetes Platform. [Installation\ ------------](https://doc.traefik.io/traefik-hub/operations/installation) Install and configure Traefik Hub. [Integrating External APIs with Traefik Hub on Oracle Cloud Infrastructure\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/external-api-integration) Learn how to integrate external APIs with Traefik Hub on Oracle Cloud Infrastructure, including security configuration with JWT and SSO. Read the technical documentation. [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. [JSON Web Tokens\ ---------------](https://doc.traefik.io/traefik-hub/authentication-authorization/jwt-overview) Traefik Hub JWT implementations [Keycloak\ --------](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Keycloak JWT Configuration\ --------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/keycloak-jwt) How to configure a Keycloak realm for JWT. [Labels and Selectors\ --------------------](https://doc.traefik.io/traefik-hub/reference/labels-and-selectors) Traefik Hub - How to use Labels and Selectors for resource management and selections. [Leveraging OCI DevOps for Continuous Traefik Hub Configuration Management\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-devops) Learn how to build an OCI DevOps pipeline for ongoing change management of Traefik Hub configuration. Read the technical documentation. [Leveraging OCI Logging Analytics for Deeper Troubleshooting Using Logs from Traefik Hub\ ---------------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-logging) Learn how to configure OCI logging analytics for deeper troubleshooting using Logs being emitted from Traefik hub. Read the technical documentation. [Leveraging Oracle APM to Visualize Traefik Hub OpenTelemetry Metrics\ --------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apm) Learn how to configure Oracle APM to visualize OpenTelemetry metrics from Traefik Hub. Read the technical documentation. [Managed Applications\ --------------------](https://doc.traefik.io/traefik-hub/api-management/managed-applications) Define and manage API-consuming applications as Git-operated Kubernetes resources. [Metrics\ -------](https://doc.traefik.io/traefik-hub/operations/metrics) This page explains all available Traefik Hub metrics which can be collected with OpenTelemetry. [Networking\ ----------](https://doc.traefik.io/traefik-hub/operations/networking) Traefik hub - Networking reference. [OIDC Identity Provider (IdP)\ ----------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/oidc) How to connect an OpenID Connect‑compliant third‑party identity provider (IdP) to Traefik Hub API Management (APIM) [Okta\ ----](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/okta) How to use Okta as the identity provider (IdP) for Traefik Hub. [Okta JWT Configuration\ ----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/okta-jwt) How to configure a Keycloak realm for JWT. [OpenAPI\ -------](https://doc.traefik.io/traefik-hub/reference/specs/openapi) Support for Swagger v2 and OpenAPI v3.x in Traefik Hub. [Prometheus\ ----------](https://doc.traefik.io/traefik-hub/operations/prometheus) This page describes how you can utilize Prometheus for Traefik Hub metrics collected by OpenTelemetry. [Running Multiple Traefik Hub Gateways on the Same Cluster\ ---------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/multi-tenancy) Configure Traefik Hub to run multiple, isolated gateway instances on a single Kubernetes cluster using namespaces. [Set up On-Premises API Mocking with Traefik Hub and Microcks\ ------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-mocking/on-premises-setup) Traefik Hub On-Premises API Mocking [Traefik Hub\ -----------](https://doc.traefik.io/traefik-hub/) Traefik Hub API Gateway and APIM descriptions [Traefik Hub API Management\ --------------------------](https://doc.traefik.io/traefik-hub/introduction/overview) API Management at Scale [Upstream Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/upstream-authentication) How to implement upstream authentication patterns with Traefik Hub API Management [Use Cases For Traefik Hub On-Premises API Mocking\ -------------------------------------------------](https://doc.traefik.io/traefik-hub/api-mocking/on-premises-usecases) Traefik Hub On-Premises API Mocking [User Management\ ---------------](https://doc.traefik.io/traefik-hub/api-management/users-and-groups) Traefik Hub - Control access to your APIs and documentation. [Workspace Settings\ ------------------](https://doc.traefik.io/traefik-hub/dashboard/workspace-settings) How to configure and use workspaces in Traefik Hub --- # API Management Concepts | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#__docusaurus_skipToContent_fallback) On this page Traefik Hub API Management (APIM) concepts and components overview. * * * What Is APIM?[​](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#what-is-apim "Direct link to What Is APIM?") --------------------------------------------------------------------------------------------------------------------------------- In Traefik Hub, API Management refers to the tasks of publishing and managing APIs. Concepts[​](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#concepts "Direct link to Concepts") ------------------------------------------------------------------------------------------------------------------- The following concepts are fundamental to API Management: * [API Manager](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-manager "API Manager") * [API User](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-user "API USER") * [API Consumer](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview "API Consumer") Components[​](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#components "Direct link to Components") ------------------------------------------------------------------------------------------------------------------------- API Management consists of three main components: * **API Management CRDs:** Custom resource definitions to manage API services. * **Traefik Hub Dashboard:** A web UI providing access to key API Management services. It allows API managers to publish APIs and to configure both global platform settings (user management) and specific portal settings. * **Developer Portal:** A web UI providing access to key APIs and API Collections. API Users can use it to manage API keys for consumers, search for, view and try out published APIs. * * * API Management Objects[​](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#api-management-objects "Direct link to API Management Objects") ------------------------------------------------------------------------------------------------------------------------------------------------------------- [📄️ API\ -------\ \ Managing APIs with Traefik Hub.](https://doc.traefik.io/traefik-hub-v2/api-management/api) [📄️ API Version\ ---------------\ \ API versioning with Traefik Hub.](https://doc.traefik.io/traefik-hub-v2/api-management/api-version) [📄️ API Collections\ -------------------\ \ Traefik Hub - API collections overview.](https://doc.traefik.io/traefik-hub-v2/api-management/api-collection) [📄️ API Access\ --------------\ \ Traefik Hub API Access overview.](https://doc.traefik.io/traefik-hub-v2/api-management/api-access) [📄️ API Rate Limit\ ------------------\ \ How to use rate limiting.](https://doc.traefik.io/traefik-hub-v2/api-management/api-rate-limit) [📄️ API Gateway\ ---------------\ \ Traefik Hub - API Gateway. How to expose APIs.](https://doc.traefik.io/traefik-hub-v2/api-management/api-gateway) [📄️ API Portal\ --------------\ \ Traefik Hub - API Portal overview and introduction.](https://doc.traefik.io/traefik-hub-v2/api-management/api-portal) [📄️ APIs from External URLs\ ---------------------------\ \ How to use Traefik Hub with External Services.](https://doc.traefik.io/traefik-hub-v2/api-management/external-apis) [📄️ User Management\ -------------------\ \ Traefik Hub - Control access to your APIs and documentation.](https://doc.traefik.io/traefik-hub-v2/api-management/users-and-groups) * [What Is APIM?](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#what-is-apim) * [Concepts](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#concepts) * [Components](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#components) * [API Management Objects](https://doc.traefik.io/traefik-hub-v2/api-management/apim-overview#api-management-objects) --- # Gateway Dashboard | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#__docusaurus_skipToContent_fallback) On this page The dashboard is the central place that shows you the current active routes. * * * The dashboard is the central place that shows you the current active routes handled by Traefik Hub. * Dashboard Overview * HTTP Router Overview * TCP Router Overview https://dev.example.com/dashboard/ ![Dashboard Overview.](https://doc.traefik.io/traefik-hub-poc/assets/images/gateway-dashboard-full-73352e1f023e768596ab5ee62902ecb2.png "Dashboard Overview") https://dev.example.com/dashboard/ ![HTTP Router Overview.](https://doc.traefik.io/traefik-hub-poc/assets/images/gateway-dash-http-routers-5ce68abe2f7c1c1cd670b22b07b67403.png "HTTP Router Overview") https://dev.example.com/dashboard/ ![TCP Router Overview.](https://doc.traefik.io/traefik-hub-poc/assets/images/gateway-dash-tcp-routers-d1992664d86730ad1cf310b171687eb0.png "TCP Router Overview") The dashboard is available at the same location as the [API](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api) but on the path `/dashboard/` by default. warning The trailing slash `/` in `/dashboard/` is mandatory. There are 2 ways to configure and access the dashboard: * [Secure mode (Recommended)](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#secure-mode) * [Insecure mode](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#insecure-mode) note There is also a redirect of the path `/` to the path `/dashboard/`, but one should not rely on that property as it is bound to change, and it might make for confusing routing rules anyway. Secure Mode[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#secure-mode "Direct link to Secure Mode") ---------------------------------------------------------------------------------------------------------------------------------------- This is the **recommended** method. | Field | Description | Default | Required | | --- | --- | --- | --- | | `dashboard` | Enable the dashboard. | True | No | First, save the default configuration. The following command will save it to a file with the name values.yaml in your working directory. CLI helm show values traefik/traefik-hub > values.yaml Second, adjust the file. values.yaml additionalArguments: - --api.dashboard=true ### Install the Agent with Your Custom Settings[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#install-the-agent-with-your-custom-settings "Direct link to Install the Agent with Your Custom Settings") Once you have the configuration adjusted to your needs, use Helm to deploy the Traefik Hub agent with the new values: CLI helm upgrade --install --namespace traefik-hub traefik-hub traefik/traefik-hub --values values.yaml Then define a routing configuration on Traefik Hub itself, with a router attached to the service `api@internal` to allow defining: * One or more security features through [middlewares](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/api-gateway-middleware-overview "Link to middleware overview documentation") like authentication ([basicAuth](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/basic-auth) , [OIDC](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) ) or [IP allow listing](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/ip-allow-list) . * A [router rule](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#dashboard-router-rule) for accessing the dashboard, through Traefik Hub itself (sometimes referred to as "Traefik-ception"). ### Dashboard Router Rule[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#dashboard-router-rule "Direct link to Dashboard Router Rule") As underlined in the [documentation for the `api.dashboard` option](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard "Link to API Gateway dashboard documentation") , the [router rule](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-routers) defined for Traefik Hub must match the path prefixes `/api` and `/dashboard`. We recommend using a _Host Based rule_ to match everything on the host domain, or to make sure that the defined rule captures both prefixes: * Host Rule * Path Prefix Rule * Combination of Rules # The dashboard can be accessed on http://dev.example.com/dashboard/rule = "Host(`dev.example.com`)" # The dashboard can be accessed on http://example.com/dashboard/ or http://dev.example.com/dashboard/rule = "PathPrefix(`/api`) || PathPrefix(`/dashboard`)" Combination of Rules # The dashboard can be accessed on http://dev.example.com/dashboard/rule = "Host(`dev.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))" ### Dashboard Configuration[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#dashboard-configuration "Direct link to Dashboard Configuration") Example of an deployment file: Kubernetes apiVersion: traefik.io/v1alpha1kind: IngressRoutemetadata: name: traefik-dashboardspec: routes: - match: Host(`dev.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`)) kind: Rule services: - name: api@internal kind: TraefikService middlewares: - name: auth-oidc---apiVersion: traefik.io/v1alpha1kind: Middlewaremetadata: name: auth-oidcspec: plugin: oidc: issuer: "https://tenant.auth0.com/realms/myrealm" redirectUrl: "/callback" clientID: my-oidc-client-name clientSecret: mysecret Insecure Mode[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#insecure-mode "Direct link to Insecure Mode") ---------------------------------------------------------------------------------------------------------------------------------------------- warning This mode is **not** recommended because it does not allow the use of security features. To enable the "insecure mode", adjust the default configuration. The following command will save it to a file with the name values.yaml in your working directory. Second, adjust the file. values.yaml additionalArguments: - --api.insecure=true ### Install the Agent with Your Custom Settings[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#install-the-agent-with-your-custom-settings-1 "Direct link to Install the Agent with Your Custom Settings") Once you have the configuration adjusted to your needs, use Helm to deploy the Traefik Hub agent with the new values: CLI helm upgrade --install --namespace traefik-hub traefik-hub traefik/traefik-hub --values values.yaml You can now access the dashboard on the port `8080` of the Traefik Hub agent instance, at the following URL: `http://:8080/dashboard/` (the trailing slash is mandatory). * [Secure Mode](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#secure-mode) * [Install the Agent with Your Custom Settings](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#install-the-agent-with-your-custom-settings) * [Dashboard Router Rule](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#dashboard-router-rule) * [Dashboard Configuration](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#dashboard-configuration) * [Insecure Mode](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#insecure-mode) * [Install the Agent with Your Custom Settings](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard#install-the-agent-with-your-custom-settings-1) --- # Unknown ���\_k�0p���OH�F+ ��R�v�R#�ڱ�>\]�::J̎���Dɟ \\���Um���P�J��k�4 ��N�ӄG���Qq�!7u��+Gc!���q�����Ͽ@�l�~�K�8���?NO��S8 ��on<��.���}2��I�M ��<�\\�Z�ܬ������$)�V���^?��qu�?�c�����c \`�\\�ߌq��s��?�R��WQb��K �z���� ��F\[@����@\]K���vwF6�A�R�\`2���ʎTQ6�=I���=�G �2�xw��}�%n�A�C��ڦ��6�2l��L�n�Q����<�F��v�>^-��Op6�+�B!�B!�B!�rs��\]i�( --- # Tags | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags#__docusaurus_skipToContent_fallback) Tags ==== A[​](https://doc.traefik.io/traefik-hub/tags#A "Direct link to A") ------------------------------------------------------------------- * [Access1](https://doc.traefik.io/traefik-hub/tags/access) * [Access Control1](https://doc.traefik.io/traefik-hub/tags/access-control) * [AccessLogs1](https://doc.traefik.io/traefik-hub/tags/access-logs) * [ACME5](https://doc.traefik.io/traefik-hub/tags/acme) * [AI1](https://doc.traefik.io/traefik-hub/tags/ai) * [AI Gateway7](https://doc.traefik.io/traefik-hub/tags/ai-gateway) * [API30](https://doc.traefik.io/traefik-hub/tags/api) * [API Access3](https://doc.traefik.io/traefik-hub/tags/api-access) * [API Auth1](https://doc.traefik.io/traefik-hub/tags/api-auth) * [API Gateway138](https://doc.traefik.io/traefik-hub/tags/api-gateway) * [API Key3](https://doc.traefik.io/traefik-hub/tags/api-key) * [API Key Introspection1](https://doc.traefik.io/traefik-hub/tags/api-key-introspection) * [API Management61](https://doc.traefik.io/traefik-hub/tags/api-management) * [API Mocking2](https://doc.traefik.io/traefik-hub/tags/api-mocking) * [API Portal7](https://doc.traefik.io/traefik-hub/tags/api-portal) * [API Portal Auth1](https://doc.traefik.io/traefik-hub/tags/api-portal-auth) * [API Version1](https://doc.traefik.io/traefik-hub/tags/api-version) * [API Versioning1](https://doc.traefik.io/traefik-hub/tags/api-versioning) * [APIM1](https://doc.traefik.io/traefik-hub/tags/apim) * [Applications1](https://doc.traefik.io/traefik-hub/tags/applications) * [Authentication10](https://doc.traefik.io/traefik-hub/tags/authentication) * [Authorization1](https://doc.traefik.io/traefik-hub/tags/authorization) * [Auto Discovery5](https://doc.traefik.io/traefik-hub/tags/auto-discovery) * [Azure1](https://doc.traefik.io/traefik-hub/tags/azure) * * * B[​](https://doc.traefik.io/traefik-hub/tags#B "Direct link to B") ------------------------------------------------------------------- * [BasicAuth1](https://doc.traefik.io/traefik-hub/tags/basic-auth) * * * C[​](https://doc.traefik.io/traefik-hub/tags#C "Direct link to C") ------------------------------------------------------------------- * [Caching1](https://doc.traefik.io/traefik-hub/tags/caching) * [Canary1](https://doc.traefik.io/traefik-hub/tags/canary) * [Compliance1](https://doc.traefik.io/traefik-hub/tags/compliance) * [Consul3](https://doc.traefik.io/traefik-hub/tags/consul) * [Consul Catalog1](https://doc.traefik.io/traefik-hub/tags/consul-catalog) * [CRD12](https://doc.traefik.io/traefik-hub/tags/crd) * * * D[​](https://doc.traefik.io/traefik-hub/tags#D "Direct link to D") ------------------------------------------------------------------- * [Dashboard2](https://doc.traefik.io/traefik-hub/tags/dashboard) * [Distributed RateLimit1](https://doc.traefik.io/traefik-hub/tags/distributed-rate-limit) * [Docker3](https://doc.traefik.io/traefik-hub/tags/docker) * * * E[​](https://doc.traefik.io/traefik-hub/tags#E "Direct link to E") ------------------------------------------------------------------- * [External APIs1](https://doc.traefik.io/traefik-hub/tags/external-ap-is) * * * F[​](https://doc.traefik.io/traefik-hub/tags#F "Direct link to F") ------------------------------------------------------------------- * [FIPS2](https://doc.traefik.io/traefik-hub/tags/fips) * * * G[​](https://doc.traefik.io/traefik-hub/tags#G "Direct link to G") ------------------------------------------------------------------- * [GatewayAPI2](https://doc.traefik.io/traefik-hub/tags/gateway-api) * [GitHub1](https://doc.traefik.io/traefik-hub/tags/git-hub) * [GitOps21](https://doc.traefik.io/traefik-hub/tags/git-ops) * [Governance1](https://doc.traefik.io/traefik-hub/tags/governance) * [Group1](https://doc.traefik.io/traefik-hub/tags/group) * [Guide1](https://doc.traefik.io/traefik-hub/tags/guide) * * * H[​](https://doc.traefik.io/traefik-hub/tags#H "Direct link to H") ------------------------------------------------------------------- * [Hashicorp2](https://doc.traefik.io/traefik-hub/tags/hashicorp) * [Heathcheck1](https://doc.traefik.io/traefik-hub/tags/heathcheck) * [Helm1](https://doc.traefik.io/traefik-hub/tags/helm) * [HTTP57](https://doc.traefik.io/traefik-hub/tags/http) * * * I[​](https://doc.traefik.io/traefik-hub/tags#I "Direct link to I") ------------------------------------------------------------------- * [IdP7](https://doc.traefik.io/traefik-hub/tags/id-p) * [Ingress4](https://doc.traefik.io/traefik-hub/tags/ingress) * [Ingress Management1](https://doc.traefik.io/traefik-hub/tags/ingress-management) * [Ingress Mode5](https://doc.traefik.io/traefik-hub/tags/ingress-mode) * [IngressRoute2](https://doc.traefik.io/traefik-hub/tags/ingress-route) * [Install2](https://doc.traefik.io/traefik-hub/tags/install) * * * J[​](https://doc.traefik.io/traefik-hub/tags#J "Direct link to J") ------------------------------------------------------------------- * [JWT9](https://doc.traefik.io/traefik-hub/tags/jwt) * [JWT Authentication1](https://doc.traefik.io/traefik-hub/tags/jwt-authentication) * * * K[​](https://doc.traefik.io/traefik-hub/tags#K "Direct link to K") ------------------------------------------------------------------- * [Key Authentication4](https://doc.traefik.io/traefik-hub/tags/key-authentication) * [Keycloak5](https://doc.traefik.io/traefik-hub/tags/keycloak) * [Kubernetes19](https://doc.traefik.io/traefik-hub/tags/kubernetes) * * * L[​](https://doc.traefik.io/traefik-hub/tags#L "Direct link to L") ------------------------------------------------------------------- * [Linode Kubernetes EngineLinode Kubernetes Engine (LKE)1](https://doc.traefik.io/traefik-hub/tags/linode-kubernetes-engine-linode-kubernetes-engine-lke) * [Linter1](https://doc.traefik.io/traefik-hub/tags/linter) * [Linux2](https://doc.traefik.io/traefik-hub/tags/linux) * [LLM1](https://doc.traefik.io/traefik-hub/tags/llm) * [Load-balacing8](https://doc.traefik.io/traefik-hub/tags/load-balacing) * [Load-Balancing2](https://doc.traefik.io/traefik-hub/tags/load-balancing) * [Logging1](https://doc.traefik.io/traefik-hub/tags/logging) * [Logs1](https://doc.traefik.io/traefik-hub/tags/logs) * * * M[​](https://doc.traefik.io/traefik-hub/tags#M "Direct link to M") ------------------------------------------------------------------- * [Managed Subscriptions1](https://doc.traefik.io/traefik-hub/tags/managed-subscriptions) * [MCP Gateway3](https://doc.traefik.io/traefik-hub/tags/mcp-gateway) * [Metrics6](https://doc.traefik.io/traefik-hub/tags/metrics) * [Middleware60](https://doc.traefik.io/traefik-hub/tags/middleware) * [Migration1](https://doc.traefik.io/traefik-hub/tags/migration) * [Mirroring5](https://doc.traefik.io/traefik-hub/tags/mirroring) * [Model Context Protocol1](https://doc.traefik.io/traefik-hub/tags/model-context-protocol) * [Model Context Protocol (MCP)1](https://doc.traefik.io/traefik-hub/tags/model-context-protocol-mcp) * [Monitoring6](https://doc.traefik.io/traefik-hub/tags/monitoring) * * * N[​](https://doc.traefik.io/traefik-hub/tags#N "Direct link to N") ------------------------------------------------------------------- * [Networking1](https://doc.traefik.io/traefik-hub/tags/networking) * [NIMs1](https://doc.traefik.io/traefik-hub/tags/ni-ms) * [Nomad2](https://doc.traefik.io/traefik-hub/tags/nomad) * [Nutanix Kubernetes Pltatform1](https://doc.traefik.io/traefik-hub/tags/nutanix-kubernetes-pltatform) * [NVIDIA1](https://doc.traefik.io/traefik-hub/tags/nvidia) * * * O[​](https://doc.traefik.io/traefik-hub/tags#O "Direct link to O") ------------------------------------------------------------------- * [OAuth3](https://doc.traefik.io/traefik-hub/tags/o-auth) * [Observability7](https://doc.traefik.io/traefik-hub/tags/observability) * [OCI Kubernetes Engine1](https://doc.traefik.io/traefik-hub/tags/oci-kubernetes-engine) * [Offline Mode1](https://doc.traefik.io/traefik-hub/tags/offline-mode) * [OIDC5](https://doc.traefik.io/traefik-hub/tags/oidc) * [Okta5](https://doc.traefik.io/traefik-hub/tags/okta) * [OpenAPI2](https://doc.traefik.io/traefik-hub/tags/open-api) * [OpenTelemetry2](https://doc.traefik.io/traefik-hub/tags/open-telemetry) * [Operations6](https://doc.traefik.io/traefik-hub/tags/operations) * [Oracle Cloud Infrastructure (OCI)6](https://doc.traefik.io/traefik-hub/tags/oracle-cloud-infrastructure-oci) * [Oracle IAM1](https://doc.traefik.io/traefik-hub/tags/oracle-iam) * [Oracle Kubernetes Engine (OKE)1](https://doc.traefik.io/traefik-hub/tags/oracle-kubernetes-engine-oke) * * * P[​](https://doc.traefik.io/traefik-hub/tags#P "Direct link to P") ------------------------------------------------------------------- * [Prometheus1](https://doc.traefik.io/traefik-hub/tags/prometheus) * [Providers1](https://doc.traefik.io/traefik-hub/tags/providers) * * * Q[​](https://doc.traefik.io/traefik-hub/tags#Q "Direct link to Q") ------------------------------------------------------------------- * [Quick Start1](https://doc.traefik.io/traefik-hub/tags/quick-start) * * * R[​](https://doc.traefik.io/traefik-hub/tags#R "Direct link to R") ------------------------------------------------------------------- * [Rate Limiting1](https://doc.traefik.io/traefik-hub/tags/rate-limiting) * [RateLimit1](https://doc.traefik.io/traefik-hub/tags/rate-limit) * [Router1](https://doc.traefik.io/traefik-hub/tags/router) * [Routing4](https://doc.traefik.io/traefik-hub/tags/routing) * * * S[​](https://doc.traefik.io/traefik-hub/tags#S "Direct link to S") ------------------------------------------------------------------- * [Security5](https://doc.traefik.io/traefik-hub/tags/security) * [Services1](https://doc.traefik.io/traefik-hub/tags/services) * [SPIFFE1](https://doc.traefik.io/traefik-hub/tags/spiffe) * [SSO1](https://doc.traefik.io/traefik-hub/tags/sso) * [Stickiness1](https://doc.traefik.io/traefik-hub/tags/stickiness) * [Swagger1](https://doc.traefik.io/traefik-hub/tags/swagger) * * * T[​](https://doc.traefik.io/traefik-hub/tags#T "Direct link to T") ------------------------------------------------------------------- * [Tailscale1](https://doc.traefik.io/traefik-hub/tags/tailscale) * [TBAC1](https://doc.traefik.io/traefik-hub/tags/tbac) * [TCP3](https://doc.traefik.io/traefik-hub/tags/tcp) * [TLS7](https://doc.traefik.io/traefik-hub/tags/tls) * [TLS certificates8](https://doc.traefik.io/traefik-hub/tags/tls-certificates) * [Tracing3](https://doc.traefik.io/traefik-hub/tags/tracing) * * * U[​](https://doc.traefik.io/traefik-hub/tags#U "Direct link to U") ------------------------------------------------------------------- * [User3](https://doc.traefik.io/traefik-hub/tags/user) * * * W[​](https://doc.traefik.io/traefik-hub/tags#W "Direct link to W") ------------------------------------------------------------------- * [Weighted Round Robin (WRR)4](https://doc.traefik.io/traefik-hub/tags/weighted-round-robin-wrr) * [Workspaces2](https://doc.traefik.io/traefik-hub/tags/workspaces) * * * --- # Installation | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/operations/installation#__docusaurus_skipToContent_fallback) On this page Install and configure Traefik Hub. * * * Before You Begin[​](https://doc.traefik.io/traefik-hub-poc/operations/installation#before-you-begin "Direct link to Before You Begin") --------------------------------------------------------------------------------------------------------------------------------------- Before you begin the installation process, it is recommended that you have a basic understanding of Kubernetes. You should have access to a working Kubernetes cluster, either on a cloud provider or on your own infrastructure. Please make sure that you have the following: * [Kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) * [Helm v3](https://helm.sh/docs/intro/install/) * Checked the documentation about [networking details](https://doc.traefik.io/traefik-hub-poc/operations/networking "Link to documentation about networking requirements") to make sure that the Traefik Hub agent can communicate with Traefik Hub. * * * To install Traefik Hub, go to the Traefik Hub Dashboard. When working on a new setup, the welcome page will invite you to **Create my first Traefik Hub agent** as shown below. https://hub.traefik.io ![Choose install](https://doc.traefik.io/traefik-hub-poc/assets/images/install1-76cd822cc5968c85209058a654ac9e03.png "Create my first Traefik Hub agent") Choose _Traefik Hub_ as Ingress Controller (this is the default installation method) and follow the steps in the UI. https://hub.traefik.io ![Ingress Controller mode](https://doc.traefik.io/traefik-hub-poc/assets/images/ingress-mode1-c3ca6162df2689b1a69c8ac43d6300d2.png "Choose Traefik Hub as Ingress Controller") Copy and paste the instructions provided in step 2 and run them on your cluster. This will install Traefik Hub. We recommend you save the agent token provided in step 3 for future reference. If you lose this token, you won't be able to recover it and will need to go through a new installation process. As the last step (4) give the agent a name or use the random created one by Traefik Hub. Select **Configuration Done**. Traefik Hub will then detect your newly installed agent. Custom Configuration For adjusting the default configuration, please refer to the [custom configuration](https://doc.traefik.io/traefik-hub-poc/operations/custom-configuration "Link to documentation about custom configuration") documentation. * * * Install Multiple Agents on Multiple Clusters[​](https://doc.traefik.io/traefik-hub-poc/operations/installation#install-multiple-agents-on-multiple-clusters "Direct link to Install Multiple Agents on Multiple Clusters") --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- info It is **not** possible to install multiple Traefik Hub agents on a **single** cluster. Traefik Hub allows you to configure multiple clusters that you will manage from the same dashboard. When installing your second agent, you will find the option to proceed with the installation in the cluster agents page. https://hub.traefik.io/agents ![Create second cluster agent.](https://doc.traefik.io/traefik-hub-poc/assets/images/create-second-cluster-agent-f0af6c5d1487d97c2ed7d6882022e41d.png "Create second cluster agent") * * * Related Content[​](https://doc.traefik.io/traefik-hub-poc/operations/installation#related-content "Direct link to Related Content") ------------------------------------------------------------------------------------------------------------------------------------ * Learn how to enable [OpenTelemetry](https://doc.traefik.io/traefik-hub-poc/operations/metrics "Link to documentation about how to enable OpenTelemetry") . * See how to [enable distributed rate limiting](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting "Link to documentation about distributed rate limiting in Traefik Hub") . * [Before You Begin](https://doc.traefik.io/traefik-hub-poc/operations/installation#before-you-begin) * [Install Multiple Agents on Multiple Clusters](https://doc.traefik.io/traefik-hub-poc/operations/installation#install-multiple-agents-on-multiple-clusters) * [Related Content](https://doc.traefik.io/traefik-hub-poc/operations/installation#related-content) --- # Installation | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/operations/installation#__docusaurus_skipToContent_fallback) On this page Install and configure Traefik Hub. * * * Before You Begin[​](https://doc.traefik.io/traefik-hub-v2/operations/installation#before-you-begin "Direct link to Before You Begin") -------------------------------------------------------------------------------------------------------------------------------------- Before you begin the installation process, it is recommended that you have a basic understanding of Kubernetes. You should have access to a working Kubernetes cluster, either on a cloud provider or on your own infrastructure. Please make sure that you have the following: * [Kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) * [Helm v3](https://helm.sh/docs/intro/install/) * Checked the documentation about [networking details](https://doc.traefik.io/traefik-hub-v2/operations/networking "Link to documentation about networking requirements") to make sure that the Traefik Hub agent can communicate with Traefik Hub. * * * To install Traefik Hub, go to the Traefik Hub Dashboard. When working on a new setup, the welcome page will invite you to **Create my first Traefik Hub agent** as shown below. https://hub.traefik.io ![Choose install](https://doc.traefik.io/traefik-hub-v2/assets/images/install1-76cd822cc5968c85209058a654ac9e03.png "Create my first Traefik Hub agent") Choose _Traefik Hub_ as Ingress Controller (this is the default installation method) and follow the steps in the UI. https://hub.traefik.io ![Ingress Controller mode](https://doc.traefik.io/traefik-hub-v2/assets/images/ingress-mode1-c3ca6162df2689b1a69c8ac43d6300d2.png "Choose Traefik Hub as Ingress Controller") Copy and paste the instructions provided in step 2 and run them on your cluster. This will install Traefik Hub. We recommend you save the agent token provided in step 3 for future reference. If you lose this token, you won't be able to recover it and will need to go through a new installation process. As the last step (4) give the agent a name or use the random created one by Traefik Hub. Select **Configuration Done**. Traefik Hub will then detect your newly installed agent. Custom Configuration For adjusting the default configuration, please refer to the [custom configuration](https://doc.traefik.io/traefik-hub-v2/operations/custom-configuration "Link to documentation about custom configuration") documentation. * * * Install Multiple Agents on Multiple Clusters[​](https://doc.traefik.io/traefik-hub-v2/operations/installation#install-multiple-agents-on-multiple-clusters "Direct link to Install Multiple Agents on Multiple Clusters") -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- info It is **not** possible to install multiple Traefik Hub agents on a **single** cluster. Traefik Hub allows you to configure multiple clusters that you will manage from the same dashboard. When installing your second agent, you will find the option to proceed with the installation in the cluster agents page. https://hub.traefik.io/agents ![Create second cluster agent.](https://doc.traefik.io/traefik-hub-v2/assets/images/create-second-cluster-agent-f0af6c5d1487d97c2ed7d6882022e41d.png "Create second cluster agent") * * * Related Content[​](https://doc.traefik.io/traefik-hub-v2/operations/installation#related-content "Direct link to Related Content") ----------------------------------------------------------------------------------------------------------------------------------- * Learn how to enable [OpenTelemetry](https://doc.traefik.io/traefik-hub-v2/operations/metrics "Link to documentation about how to enable OpenTelemetry") . * See how to [enable distributed rate limiting](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting "Link to documentation about distributed rate limiting in Traefik Hub") . * [Before You Begin](https://doc.traefik.io/traefik-hub-v2/operations/installation#before-you-begin) * [Install Multiple Agents on Multiple Clusters](https://doc.traefik.io/traefik-hub-v2/operations/installation#install-multiple-agents-on-multiple-clusters) * [Related Content](https://doc.traefik.io/traefik-hub-v2/operations/installation#related-content) --- # API Key Authentication | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/ref-api-key#__docusaurus_skipToContent_fallback) The API Key authentication middleware allows you to secure an API by requiring a secret key, base64 encoded or not, to be given, via an HTTP header, a cookie or a query parameter. * * * --- # Gateway API | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#__docusaurus_skipToContent_fallback) On this page The Traefik Hub API Gateway exposes a good deal of information through an API handler, such as the configuration of all routers, services, middlewares, etc. * * * Security[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#security "Direct link to Security") --------------------------------------------------------------------------------------------------------------------------------- Enabling the API in production is **not** recommended, because it will expose all configuration elements, including sensitive data. In production, it should be at least secured by authentication and authorizations. For example, at the transport level: **NOT** publicly exposing the API's port, keeping it restricted to internal networks (as in the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) , applied to networks). Configuration[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#configuration "Direct link to Configuration") ------------------------------------------------------------------------------------------------------------------------------------------------ If you enable the API, a new `service` named `api@internal` is created and can then be referenced in a router. To enable the API handler, update the settings if your Traefik Hub installation. First, save the default configuration. The following command will save it to a file with the name values.yaml in your working directory. CLI helm show values traefik/traefik-hub > values.yaml Second, adjust the file. values.yaml additionalArguments: - --api=true ### Install the Agent with Your Custom Settings[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#install-the-agent-with-your-custom-settings "Direct link to Install the Agent with Your Custom Settings") Once you have the configuration adjusted to your needs, use Helm to deploy the Traefik Hub agent with the new values: CLI helm upgrade --install --namespace traefik-hub traefik-hub traefik/traefik-hub --values values.yaml And then define a routing configuration on Traefik Hub itself: Kubernetes apiVersion: traefik.io/v1alpha1kind: IngressRoutemetadata: name: traefik-dashboardspec: routes: - match: Host(`dev.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`)) kind: Rule services: - name: api@internal kind: TraefikService middlewares: - name: auth-oidc---apiVersion: traefik.io/v1alpha1kind: Middlewaremetadata: name: auth-oidcspec: plugin: oidc: issuer: "https://tenant.auth0.com/realms/myrealm" redirectUrl: "/callback" clientID: my-oidc-client-name clientSecret: mysecret warning The router's [rule](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-routers#rule) must catch requests for the URI path `/api`. Using a "Host" rule is recommended, by catching all the incoming traffic on this host domain to the API. You can also use "path prefix" rule or any combination of rules. Details * Host Rule * Path Prefix Rule * Combination of Rules # Matches http://dev.example.com, http://dev.example.com/api# or http://dev.example.com/hellorule = "Host(`dev.example.com`)" # Matches http://api.dev.example.com/api or http://example.com/api# but does not match http://api.dev.example.com/hellorule = "PathPrefix(`/api`)" # Matches http://dev.example.com/api or http://dev.example.com/dashboard# but does not match http://dev.example.com/hellorule = "Host(`dev.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))" ### `insecure`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#insecure "Direct link to insecure") Enable the API in `insecure` mode, which means that the API will be available directly on the entryPoint named `traefik`. info If the entryPoint named `traefik` is not configured, it will be automatically created on port 8080. First, save the default configuration. The following command will save it to a file with the name values.yaml in your working directory. CLI helm show values traefik/traefik-hub > values.yaml Second, adjust the file. values.yaml additionalArguments: - --api.insecure=true #### Install the Agent with Your Custom Settings[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#install-the-agent-with-your-custom-settings-1 "Direct link to Install the Agent with Your Custom Settings") Once you have the configuration adjusted to your needs, use Helm to deploy the Traefik Hub agent with the new values: CLI helm upgrade --install --namespace traefik-hub traefik-hub traefik/traefik-hub --values values.yaml ### `dashboard`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#dashboard "Direct link to dashboard") | Field | Description | Default | Required | | --- | --- | --- | --- | | `dashboard` | Enable the dashboard. | True | No | First, save the default configuration. The following command will save it to a file with the name values.yaml in your working directory. CLI helm show values traefik/traefik-hub > values.yaml Second, adjust the file. values.yaml additionalArguments: - --api.dashboard=true #### Install the Agent with Your Custom Settings[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#install-the-agent-with-your-custom-settings-2 "Direct link to Install the Agent with Your Custom Settings") Once you have the configuration adjusted to your needs, use Helm to deploy the Traefik Hub agent with the new values: CLI helm upgrade --install --namespace traefik-hub traefik-hub traefik/traefik-hub --values values.yaml warning With Dashboard enabled, the router [rule](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-routers#rule) must catch requests for both `/api` and `/dashboard`. Endpoints[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#endpoints "Direct link to Endpoints") ------------------------------------------------------------------------------------------------------------------------------------ All the following endpoints must be accessed with a `GET` HTTP request. | Path | Description | | --- | --- | | `/api/http/routers` | Lists all the HTTP routers information. | | `/api/http/routers/{name}` | Returns the information of the HTTP router specified by `name`. | | `/api/http/services` | Lists all the HTTP services information. | | `/api/http/services/{name}` | Returns the information of the HTTP service specified by `name`. | | `/api/http/middlewares` | Lists all the HTTP middlewares information. | | `/api/http/middlewares/{name}` | Returns the information of the HTTP middleware specified by `name`. | | `/api/tcp/routers` | Lists all the TCP routers information. | | `/api/tcp/routers/{name}` | Returns the information of the TCP router specified by `name`. | | `/api/tcp/services` | Lists all the TCP services information. | | `/api/tcp/services/{name}` | Returns the information of the TCP service specified by `name`. | | `/api/tcp/middlewares` | Lists all the TCP middlewares information. | | `/api/tcp/middlewares/{name}` | Returns the information of the TCP middleware specified by `name`. | | `/api/udp/routers` | Lists all the UDP routers information. | | `/api/udp/routers/{name}` | Returns the information of the UDP router specified by `name`. | | `/api/udp/services` | Lists all the UDP services information. | | `/api/udp/services/{name}` | Returns the information of the UDP service specified by `name`. | | `/api/entrypoints` | Lists all the entry points information. | | `/api/entrypoints/{name}` | Returns the information of the entry point specified by `name`. | | `/api/overview` | Returns statistic information about HHTP, TCP and about enabled features and providers. | | `/api/rawdata` | Returns information about dynamic configurations, errors, status and dependency relations. | | `/api/version` | Returns information about Traefik version. | | `/debug/vars` | See the [expvar](https://golang.org/pkg/expvar/)
Go documentation. | | `/debug/pprof/` | See the [pprof Index](https://golang.org/pkg/net/http/pprof/#Index)
Go documentation. | | `/debug/pprof/cmdline` | See the [pprof Cmdline](https://golang.org/pkg/net/http/pprof/#Cmdline)
Go documentation. | | `/debug/pprof/profile` | See the [pprof Profile](https://golang.org/pkg/net/http/pprof/#Profile)
Go documentation. | | `/debug/pprof/symbol` | See the [pprof Symbol](https://golang.org/pkg/net/http/pprof/#Symbol)
Go documentation. | | `/debug/pprof/trace` | See the [pprof Trace](https://golang.org/pkg/net/http/pprof/#Trace)
Go documentation. | * [Security](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#security) * [Configuration](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#configuration) * [Install the Agent with Your Custom Settings](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#install-the-agent-with-your-custom-settings) * [`insecure`](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#insecure) * [`dashboard`](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#dashboard) * [Endpoints](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api#endpoints) --- # 42 docs tagged with "API Gateway" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/api-gateway#__docusaurus_skipToContent_fallback) [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/tcp/tcp-ip-allow-ist) Use IPAllowList in TCP middleware for limiting clients to specific IPs in Traefik Proxy. [AddPrefix\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/add-prefix) Learn how to implement the HTTP AddPrefix middleware in Traefik Hub to update request paths before being forwarded. [API Gateway\ -----------](https://doc.traefik.io/traefik-hub-poc/api-management/api-gateway) Traefik Hub - API Gateway. How to expose APIs. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-api-key) Traefik Hub - API Key authentication middleware. [API Portal\ ----------](https://doc.traefik.io/traefik-hub-poc/api-management/api-portal) Traefik Hub - API Portal overview and introduction. [API Rate Limit\ --------------](https://doc.traefik.io/traefik-hub-poc/api-management/api-rate-limit) How to use rate limiting. [BasicAuth\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/basic-auth) The HTTP basic authentication (BasicAuth) middleware in Traefik Hub restricts access to Services to known users. [Buffering\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/buffering) The HTTP buffering middleware in Traefik Hub limits the size of requests that can be forwarded to Services. [Chain\ -----](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [CircuitBreaker\ --------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/circuitbreaker) The HTTP circuit breaker prevents stacking requests to unhealthy Services, resulting in cascading failures. [Compress\ --------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/compress) The compress middleware lets you compress responses before sending them to the client. [ContentType\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/content-type) Traefik Hub's HTTP middleware automatically sets the \`Content-Type\` header value when it is not set by the backend. [DigestAuth\ ----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/digest-auth) HTTP DigestAuth middleware restricts access to your services to known users. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy [Entrypoints\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints) For routing and load balancing in Traefik Proxy, EntryPoints define which port will receive packets and whether in UDP or TCP. [Error Pages\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/errors) The Errors middleware returns custom pages according to configured ranges of HTTP Status codes. [ForwardAuth\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/forward-auth) The HTTP ForwardAuth middleware delegates authentication to an external Service. [Gateway API\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-api) The Traefik Hub Gateway exposes information through API handlers. [Gateway Dashboard\ -----------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/setup/api-gateway-dashboard) Agent Dashboard Overview [GrpcWeb\ -------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/grpc-web) GrpcWeb converts a gRPC Web requests to HTTP/2 gRPC requests. [Headers\ -------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/headers) The HTTP headers middleware manages the headers of requests and responses. [HTTP Middleware Overview\ ------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/http-overview) Controlling connections. [InFlightConn\ ------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/tcp/in-flight-conn) Limiting the number of simultaneous connections. [InFlightReq\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/in-flight-req) The InFlightReq HTTP middleware lets you limit the number of simultaneous in-flight requests. [Introduction to API Gateway\ ---------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/api-gateway-intro) Traefik Hub - API Gateway overview [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [Middleware\ ----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/api-gateway-middleware-overview) There are several available middleware in Traefik Hub used to modify requests or headers, take charge of redirections, add authentication, and so on [OAuth 2.0 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-oauth-client-creds) The OAuth 2.0 Client Credentials Authentication middleware secures your applications using the client credentials flow [OAuth 2.0 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-api-introspection) Traefik Hub - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [RateLimit\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests [RedirectRegex\ -------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/redirect-regex) RedirectRegex redirecting clients to different locations. [RedirectScheme\ --------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/redirect-scheme) RedirectScheme redirects clients to different schemes/ports. [ReplacePath\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/replace-path) ReplacePath updates paths before forwarding requests. [ReplacePathRegex\ ----------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/replace-path-regex) ReplacePathRegex updates paths before forwarding requests, using a regex. [Retry\ -----](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/retry) Retry requests to a backend server until it succeeds. [Routing\ -------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-routers) a router is in charge of connecting incoming requests to the Services that can handle them. [StripPrefix\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/strip-prefix) StripPrefix removes prefixes from paths before forwarding requests. [StripPrefixRegex\ ----------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/strip-prefix-regex) StripPrefixRegex removes prefixes from paths before forwarding requests, using regex. Read the technical documentation. [TCP Middleware Overview\ -----------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/tcp/tcp-overview) TCP Middleware Overview. --- # Distributed Rate Limit | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#__docusaurus_skipToContent_fallback) On this page Enable distributed rate limiting in Traefik Hub. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#introduction "Direct link to Introduction") ------------------------------------------------------------------------------------------------------------------------------------------ Traefik Hub uses [Redis](https://redis.io/ "Link to website of Redis") (Remote Dictionary Server) to store [rate limit](https://doc.traefik.io/traefik-hub-v2/api-management/api-rate-limit "Rate Limit") information across all Traefik Hub agents. Connection parameters to your Redis server are attached to your Traefik Hub deployment. The following Redis modes are supported: * Single instance mode * [Redis Cluster](https://redis.io/docs/management/scaling "Link to official Redis documentation about Redis Cluster mode") * [Redis Sentinel](https://redis.io/docs/management/sentinel "Link to official Redis documentation about Redis Sentinel mode") info For more information about Redis, we recommend the [official Redis documentation](https://redis.io/docs/ "Link to official Redis documentation") . * * * Available Configuration Options[​](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#available-configuration-options "Direct link to Available Configuration Options") --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The table below lists the configuration options in Traefik Hub to connect to Redis and store rate limit information. | Value | Description | Required | | --- | --- | --- | | `endpoints` | Endpoints of the Redis instances to connect to (example: `redis.traefik-hub.svc.cluster.local:6379`) | Yes | | `username` | The username Traefik Hub will use to connect to Redis | No | | `password` | The password Traefik Hub will use to connect to Redis | No | | `database` | The database Traefik Hub will use to sore information (default: `0`) | No | | `cluster` | Enable Redis Cluster | No | | `tls.caBundle` | Custom CA bundle | No | | `tls.cert` | TLS certificate | No | | `tls.key` | TLS key | No | | `tls.insecureSkipVerify` | Allow skipping the TLS verification | No | | `sentinel.masterSet` | Name of the set of main nodes to use for main selection. Required when using Sentinel. | No | | `sentinel.username` | Username to use for sentinel authentication (can be different from `username`) | No | | `sentinel.password` | Password to use for sentinel authentication (can be different from `password`) | No | info If you use Redis in single instance mode or Redis Sentinel, you can configure the `database` field. This value won't be taken into account if you use Redis Cluster (only database `0` is available). In this case, a warning is displayed, and the value is ignored. Adjust Traefik Hub's Configuration[​](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#adjust-traefik-hubs-configuration "Direct link to Adjust Traefik Hub's Configuration") ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- First, save the default Traefik Hub configuration to a _values.yaml_ file. helm show values traefik/traefik-hub > values.yaml Second, adjust the _values.yaml_ file by adding the configuration for distributed rate limiting to the `additionalArguments` part. * Redis single instance * Redis Cluster * Redis Sentinel additionalArguments: # Redis single instance mode - --hub.rateLimit.redis.endpoints=redis-headless.traefik-hub.svc.cluster.local:6379 - --hub.rateLimit.redis.password=$(PASSWORD)additionalEnvVars: # Redis in single instance mode - name: PASSWORD valueFrom: secretKeyRef: name: redis key: redis-passwordservice: type: LoadBalancer additionalArguments:# Redis Cluster - --hub.rateLimit.redis.cluster=true - --hub.rateLimit.redis.endpoints=redis-cluster.traefik-hub.svc.cluster.local:6379 - --hub.rateLimit.redis.password=$(CLUSTER_PASSWORD)additionalEnvVars: # Redis Cluster - name: CLUSTER_PASSWORD valueFrom: secretKeyRef: name: redis-cluster key: redis-passwordservice: type: LoadBalancer additionalArguments:# Redis Sentinel - --hub.rateLimit.redis.endpoints=redis-sentinel.traefik-hub.svc.cluster.local:26379 - --hub.rateLimit.redis.password=$(SENTINEL_PASSWORD) - --hub.rateLimit.redis.sentinel.password=$(SENTINEL_PASSWORD) - --hub.rateLimit.redis.sentinel.masterSet=mymasteradditionalEnvVars: # Redis Sentinel - name: SENTINEL_PASSWORD valueFrom: secretKeyRef: name: redis-sentinel key: redis-passwordservice: type: LoadBalancer All configuration settings Please see the [configuration options](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#available-configuration-options "Link to all configuration values for rate limiting") above for an overview about all possible values. Deploy Your Custom Configuration[​](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#deploy-your-custom-configuration "Direct link to Deploy Your Custom Configuration") ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Once the configuration is adjusted, use Helm to (re)deploy the Traefik Hub agent with the new values to enable distributed rate limiting. CLI helm upgrade --install --namespace traefik-hub traefik-hub traefik/traefik-hub \--values values.yaml * [Introduction](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#introduction) * [Available Configuration Options](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#available-configuration-options) * [Adjust Traefik Hub's Configuration](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#adjust-traefik-hubs-configuration) * [Deploy Your Custom Configuration](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting#deploy-your-custom-configuration) --- # Account Settings | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/dashboard/account-settings#__docusaurus_skipToContent_fallback) On this page This page explains how to configure account settings in Traefik Hub. * * * Introduction[​](https://doc.traefik.io/traefik-hub/dashboard/account-settings#introduction "Direct link to Introduction") -------------------------------------------------------------------------------------------------------------------------- You can view your account information and theme preferences in the dashboard. To adjust the settings, select the **User icon** on the top left in the Hub dashboard. ![User icon](https://doc.traefik.io/traefik-hub/assets/images/general-settings-14d9cefd9d2a9f78c4c3f08c3bf33500.png "User icon") ### Account Basics[​](https://doc.traefik.io/traefik-hub/dashboard/account-settings#account-basics "Direct link to Account Basics") ![Account info](https://doc.traefik.io/traefik-hub/assets/images/user-settings-48e49731b2ca442c3ce1c0c0e460928c.png "Account info") These settings are read-only. To update them, please contact your assigned sales engineer. ### Preferences[​](https://doc.traefik.io/traefik-hub/dashboard/account-settings#preferences "Direct link to Preferences") ### Configure Theme Preference[​](https://doc.traefik.io/traefik-hub/dashboard/account-settings#configure-theme-preference "Direct link to Configure Theme Preference") A theme specifies the visual appearance of the dashboard. Theme preferences allow you to change the look and feel to match your visual and accessibility requirements. The list of available themes includes Light, Dark, and OS preferences. ![Theme preference](https://doc.traefik.io/traefik-hub/assets/images/theme-settings-c5913ffe556ab59d30053690e61359c0.png "Theme preference") Select the theme of your choice and select **Save**. * [Introduction](https://doc.traefik.io/traefik-hub/dashboard/account-settings#introduction) * [Account Basics](https://doc.traefik.io/traefik-hub/dashboard/account-settings#account-basics) * [Preferences](https://doc.traefik.io/traefik-hub/dashboard/account-settings#preferences) * [Configure Theme Preference](https://doc.traefik.io/traefik-hub/dashboard/account-settings#configure-theme-preference) --- # Authentication & Authorization | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#__docusaurus_skipToContent_fallback) On this page Control and manage access to your workspace, APIs and documentation. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#introduction "Direct link to Introduction") ----------------------------------------------------------------------------------------------------------------------------------------------- Access management encompasses the control and authorization of users to access workspaces (the Traefik Hub dashboard), APIs and API Portals. Integral components in this realm are [JSON Web Tokens](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview "JWT overview documentation") and [API keys](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/key-authentication "API key authentication documentation") for APIs and [Identity Providers](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider "IdP overview documentation") (IdPs) as the source of truth for [Users and Groups](https://doc.traefik.io/traefik-hub-v2/api-management/users-and-groups "Link to documentation about users and groups management") . In Traefik Hub, an IdP serves as the foundation for user authentication, while API keys or JWTs play a key role in authorizing users to access APIs. * * * Traefik Hub support three main levels for access management, where the manager has the highest and the consumer the lowest permissions. ### API Manager[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-manager "Direct link to API Manager") The API Manager uses the Traefik Hub Dashboard to administrate workspaces, APIs, user and group management. * Can add, edit and remove [cluster agents](https://doc.traefik.io/traefik-hub-v2/operations/installation "Link to installation documentation") . * Can configure [IdP](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider "Link to IdP documentation") . * Can invite/add/remove [workspace member](https://doc.traefik.io/traefik-hub-v2/dashboard#account-management "Link to documentation about workspace management") . * Can set [member roles](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles "Link to documentation about workspace roles") . ### API User[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-user "Direct link to API User") Common actions of an API User: * Uses the Portal to [browse APIs and read documentation](https://doc.traefik.io/traefik-hub-v2/portal/api-portal-overview "Link to overview documentation about API Portals") . * Uses the Portal for API test calls (Portal playground) (API/JWT). * Uses the Portal to [configure API keys](https://doc.traefik.io/traefik-hub-v2/portal/key-auth "Link to documentation about key authentication in API Portals") . Please refer to the [IdP documentation](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider "Link to documentation about user and group management") to learn more about how to manage user authentication. ### API Consumer[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-consumer "Direct link to API Consumer") The API User or application accessing the API. Consumers are granted access to APIs and API Collections via [API Accesses](https://doc.traefik.io/traefik-hub-v2/api-management/api-access "API Access documentation") . * [Introduction](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#introduction) * [API Manager](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-manager) * [API User](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-user) * [API Consumer](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview#api-consumer) --- # API Plan | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/api-management/api-plans#__docusaurus_skipToContent_fallback) On this page Introduction[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#introduction "Direct link to Introduction") ------------------------------------------------------------------------------------------------------------------------ API Plans provide a holistic approach to API governance by unifying the management of rate limits and quotas into a single, cohesive resource. While they utilize existing functionalities, API Plans reorganize these features to better embody the concept of comprehensive API governance. By defining API Plans, you can manage access levels, control usage, and ensure fair distribution of resources among your API consumers in a more structured and policy-driven manner. This unified approach allows you to: * **Centralize Policy Management**: Consolidate rate limiting and quota enforcement into one resource, making it easier to maintain and update policies. * **Enhance Clarity**: Provide a clear representation of your API consumption policies, improving understanding for both API managers and consumers. * **Streamline Access Control**: Simplify the association between user groups and APIs through well-defined plans, leading to more efficient access management. * **Ensure Consistency**: Maintain consistent governance across all APIs by applying standardized plans, reducing the risk of misconfiguration. Prerequisites[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#prerequisites "Direct link to Prerequisites") --------------------------------------------------------------------------------------------------------------------------- For the `APIPlan` feature to work, you need to deploy and configure Redis in your cluster and Traefik deployment. You can do this by following these steps: Demo Redis Installation The following Redis installation is for demonstration purposes only and uses basic configuration without high availability, advanced security, or production-grade settings. For production deployments, configure Redis with appropriate security, persistence, and high availability settings. 1. Install Redis via the Helm chart * Helm helm install redis oci://registry-1.docker.io/cloudpirates/redis -n traefik --wait 2. Export your Redis instance password * Export Redis password export REDIS_PASSWORD=$(kubectl get secret redis -n traefik -o jsonpath="{.data.redis-password}" | base64 -d) 3. Finally, upgrade your Traefik deployment to include Redis * Upgrade Deployment helm upgrade traefik -n traefik --wait \ --reuse-values \ --set hub.redis.endpoints=redis.traefik.svc.cluster.local:6379 \ --set hub.redis.password=${REDIS_PASSWORD} \ traefik/traefik API Plans Behavior[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#api-plans-behavior "Direct link to API Plans Behavior") ------------------------------------------------------------------------------------------------------------------------------------------ An APIPlan is a resource that specifies rate limits and quotas for API consumption. It is associated with a [ManagedSubscription](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) resource, which grants applications access to specific APIs, and it is also reflected in an [APICatalogItem](https://doc.traefik.io/traefik-hub/api-management/api-catalogitem) that determines which APIs are displayed on the [API portal](https://doc.traefik.io/traefik-hub/api-management/api-portal) . API Plans provide a flexible way to manage API consumption policies across different user groups and APIs. ### Key Concepts[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#key-concepts "Direct link to Key Concepts") * API Plan: Defines the rate limits and quotas to be applied. * [`Managed Subscription`](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) : Grants access to APIs for applications and associates an API Plan. * [`APICatalogItem`](https://doc.traefik.io/traefik-hub/api-management/api-catalogitem) : Defines which APIs are visible to users on the Developer Portal. * [Groups](https://doc.traefik.io/traefik-hub/api-management/users-and-groups#user-groups) : User groups defined in your Identity Provider (IDP). #### Rate Limit[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#rate-limit "Direct link to Rate Limit") API rate limiting defines consumption limits for API consumers. It also controls the rate at which requests are allowed over a short period of time. It limits how fast requests can be made by delaying or rejecting excess requests to match the target rate. If requests exceed the allowed rate and cannot be delayed sufficiently, they are rejected with an HTTP status code `429 Too Many Requests`. Overall, It serves three main purposes: * Protecting infrastructure * Managing quotas * Enabling API monetization To learn more about how API rate limiting works, check out the rate limiting section in the [Distributed Rate Limit reference documentation](https://doc.traefik.io/traefik-hub/reference/api/distributed-rate-limiting#rate-limiting-behavior) #### Quota[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#quota "Direct link to Quota") Quota defines a fixed number of requests allowed over a given period of time. Once the quota limit is reached, further requests are immediately denied until the quota resets for the next period. If requests exceed the allowed rate and cannot be delayed sufficiently, they are rejected with an HTTP status code `429 Too Many Requests`. Note In order to allow a smooth transition between two plans, the count of requests is stored at the Subscription level. When a new API Plan is assigned to a Subscription (either [Managed](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) or [Self-Service](https://doc.traefik.io/traefik-hub/api-management/self-service-subscription) ), the remaining request quota is maintained. For Managed Subscriptions covering multiple APIs and groups, the bucket is shared among them.” ### Creating an API Plan[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#creating-an-api-plan "Direct link to Creating an API Plan") To create an API Plan, you can use the following Custom Resource (CR): #### Configuration Example[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#configuration-example "Direct link to Configuration Example") The following example defines an `APIPlan` named `my-plan` in the default namespace. It sets a **rate limit of 1 request per second** and a **quota of 10,000 requests per month** (expressed as 750 hours). This plan can be associated with a `ManagedSubscription` resources to enforce these limits on API consumers. * APIPlan apiVersion: hub.traefik.io/v1alpha1kind: APIPlanmetadata: name: my-plan namespace: defaultspec: title: "Standard" description: "**Standard Plan**" rateLimit: limit: 1 period: 1s quota: limit: 10000 period: 750h # 1 month #### Configuration Options[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#configuration-options "Direct link to Configuration Options") | Field | Description | Required | Default | | --- | --- | --- | --- | | `title` | A name for the plan. This is displayed in the consumer's API portal | Yes | \- | | `description` | A description of the plan, it is displayed in the consumer's API portal and it only supports markdown | No | \- | | `rateLimit` | Specifies the [rate limit](https://doc.traefik.io/traefik-hub/reference/api/distributed-rate-limiting#rate-limiting-behavior)
settings. This defines how many requests are allowed within a specified time period using the [Token Bucket algorithm](https://en.wikipedia.org/wiki/Token_bucket)
. | No | \- | | `rateLimit.limit` | The maximum number of requests allowed within the `rateLimit.period`. Determines the refill rate of tokens in the [Token Bucket algorithm](https://en.wikipedia.org/wiki/Token_bucket)
. | Yes (if `rateLimit` is set) | \- | | `rateLimit.period` | Time period for the rateLimit | No | Defaults to `1s` if omitted | | `quota` | specifies number of requests allowed in a larger time frame (e.g month) | No | \- | | `quota.limit` | Maximum number of requests in the specified time in `quota.period` | Yes (if `quota` is set) | \- | | `quota.period` | Time period for the quota. | No | \- | Note * The supported duration units for `periods` are s (seconds), m (minutes), and h (hours). Example: "3h10m" will be interpreted as 3 hours and 10 minutes. * The `description` field supports standard markdown and [GitHub Flavored Markdown](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax) ### Associating an API Plan with `ManagedSubscription` & `APICatalogItem`[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#associating-an-api-plan-with-managedsubscription--apicatalogitem "Direct link to associating-an-api-plan-with-managedsubscription--apicatalogitem") To enforce an API Plan, you need to associate it with both [`ManagedSubscription`](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) and [`APICatalogItem`](https://doc.traefik.io/traefik-hub/api-management/api-catalogitem) resources. * `APICatalogItem`: Controls the visibility of APIs or API Bundles on the Developer Portal for specific user groups and associates the available API Plans. * `ManagedSubscription`: Grants consumption access to applications, specifying which applications can consume which APIs or API Bundles under specific API Plans. When you associate an API Plan with these resources, the following occur: * Shared Quota Across APIs: The quota is shared across all APIs referenced by a single `ManagedSubscription`. For example, if an `APIPlan` sets a quota of 100 requests per month, and the `ManagedSubscription` is linked to two APIs, API A and API B, the combined requests to both APIs cannot exceed 100 requests per month. * Independent Rate Limits per `ManagedSubscription`: Rate limits are enforced per `ManagedSubscription`. If an application is included in multiple `ManagedSubscription` resources with different API Plans on the same APIs, the system determines which plan to enforce based on the weight and the name of the `ManagedSubscription`. info See the Managing overlapping plans [section](https://doc.traefik.io/traefik-hub/api-management/api-plans#managing-overlapping-plans) for more information #### Configuration Example[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#configuration-example-1 "Direct link to Configuration Example") The following example defines: * An `APICatalogItem` named `my-api-catalog` in the `default` namespace, making `my-api` visible to users in the group `my-group`, and associating it with the `my-plan` API Plan. * A `ManagedSubscription` named `my-subscription` in the `default` namespace, granting consumption access to the application with `appId: "my-app-id"`, associating it with `my-api` and the `my-plan` API Plan. The weight is set to `100`, giving this subscription a higher priority when resolving overlaps with other `ManagedSubscription` resources. * APICatalogItem * ManagedSubscription apiVersion: hub.traefik.io/v1alpha1kind: APICatalogItemmetadata: name: my-api-catalog namespace: defaultspec: groups: - my-group apis: - name: my-api apiPlan: name: my-plan apiVersion: hub.traefik.io/v1alpha1kind: ManagedSubscriptionmetadata: name: my-subscription namespace: defaultspec: applications: - appId: "my-app-id" apis: - name: my-api apiPlan: name: my-plan weight: 100 Info * Your `APIPlan`, `API`, `APICatalogItem`, and `ManagedSubscription` resources must exist in the same namespace. * Application-Level Access: Unlike APIAccess, which used user groups, `ManagedSubscription` operates at the application level. You must explicitly list the applications (appIds) that are granted access. * One `ManagedSubscription` per Application Group: To avoid shared quotas, create separate `ManagedSubscription` resources for each application or group of applications that should share quotas. * When multiple plans are applied to one application, the plan with the highest weight/priority takes precedence. ### Response Headers[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#response-headers "Direct link to Response Headers") The following headers will be present in your API responses to help you track your quotas and rate limits: #### Rate limit Headers[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#rate-limit-headers "Direct link to Rate limit Headers") * `X-RateLimit-Limit`: The maximum number of requests allowed in the current rate limit window. #### Quota Headers[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#quota-headers "Direct link to Quota Headers") * `X-Quota-Limit`: The maximum number of requests allowed in the current quota period. * `X-Quota-Remaining`: The number of requests remaining in the current quota period. Note Headers are only included if the quota or rate limit is set (not unlimited). ### Managing Overlapping Plans[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#managing-overlapping-plans "Direct link to Managing Overlapping Plans") When an application is associated with multiple `ManagedSubscription` resources pointing to the same API, the system determines which plan to enforce based on the weight and the name of the `ManagedSubscription`. * Weight: An optional integer value. Higher weight means higher priority. * Name Sorting: If weights are equal or not set, the ManagedSubscription with the name that comes first alphabetically is selected. #### Example[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#example "Direct link to Example") An application (`appId: "forecast-app"`) is included in both the `external` and `vip` Managed Subscriptions. There are two `ManagedSubscription` resources that grant access to the “forecast” API with different plans and weights. #### External Group[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#external-group "Direct link to External Group") * Standard API Plan * ManagedSubscription for External Application apiVersion: hub.traefik.io/v1alpha1kind: APIPlanmetadata: name: std-plan namespace: defaultspec: title: "Standard Plan" rateLimit: limit: 1 period: 1s apiVersion: hub.traefik.io/v1alpha1kind: ManagedSubscriptionmetadata: name: external-subscription namespace: defaultspec: applications: - appId: "forecast-app" apis: - name: forecast apiPlan: name: std-plan weight: 1 # Lower priority #### VIP Group[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#vip-group "Direct link to VIP Group") * VIP API Plan * ManagedSubscription for VIP Application apiVersion: hub.traefik.io/v1alpha1kind: APIPlanmetadata: name: vip-plan namespace: defaultspec: title: "VIP Plan" rateLimit: limit: 20 period: 1s quota: limit: 1000 period: 24h apiVersion: hub.traefik.io/v1alpha1kind: ManagedSubscriptionmetadata: name: vip-subscription namespace: defaultspec: applications: - appId: "forecast-app" apis: - name: forecast apiPlan: name: vip-plan weight: 10 # Higher priority due to higher weight Result: The system selects `vip-subscription` because it has a higher weight, and the application receives the rate limits and quotas defined in the “VIP Plan”. Note * If the weights were equal or not set for both `ManagedSubscription` resources, the system would select the one whose name comes first alphabetically. * Shared Quota Across APIs: If a `ManagedSubscription` resource grants access to multiple APIs, the quota is shared across those APIs. For example, with a quota of 1000 requests per 24 hours, requests to any of the associated APIs contribute to this total. * No Automatic Fallback: If the quota under extra-plan is exhausted, the system does not automatically fall back to std-plan. The application would receive an HTTP status code 429 Too Many Requests until the quota resets. Related Content[​](https://doc.traefik.io/traefik-hub/api-management/api-plans#related-content "Direct link to Related Content") --------------------------------------------------------------------------------------------------------------------------------- * Learn more about the `API` object in its [dedicated section](https://doc.traefik.io/traefik-hub/api-management/api) * Learn more about the `APICatalogItem` resource in its [dedicated section](https://doc.traefik.io/traefik-hub/api-management/api-catalogitem) * Learn more about `API Plan` in its [dedicated section](https://doc.traefik.io/traefik-hub/api-management/api-plans) * Learn more about the API Portal in its [dedicated section](https://doc.traefik.io/traefik-hub/api-management/api-portal) * Learn more about `ManagedSubscription` resource in its [dedicated section](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) * Learn more about User Management in its [dedicated section](https://doc.traefik.io/traefik-hub/api-management/users-and-groups) * [Introduction](https://doc.traefik.io/traefik-hub/api-management/api-plans#introduction) * [Prerequisites](https://doc.traefik.io/traefik-hub/api-management/api-plans#prerequisites) * [API Plans Behavior](https://doc.traefik.io/traefik-hub/api-management/api-plans#api-plans-behavior) * [Key Concepts](https://doc.traefik.io/traefik-hub/api-management/api-plans#key-concepts) * [Creating an API Plan](https://doc.traefik.io/traefik-hub/api-management/api-plans#creating-an-api-plan) * [Associating an API Plan with `ManagedSubscription` & `APICatalogItem`](https://doc.traefik.io/traefik-hub/api-management/api-plans#associating-an-api-plan-with-managedsubscription--apicatalogitem) * [Response Headers](https://doc.traefik.io/traefik-hub/api-management/api-plans#response-headers) * [Managing Overlapping Plans](https://doc.traefik.io/traefik-hub/api-management/api-plans#managing-overlapping-plans) * [Related Content](https://doc.traefik.io/traefik-hub/api-management/api-plans#related-content) --- # Distributed Rate Limit | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#__docusaurus_skipToContent_fallback) On this page Enable distributed rate limiting in Traefik Hub. * * * Introduction[​](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#introduction "Direct link to Introduction") ------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub uses [Redis](https://redis.io/ "Link to website of Redis") (Remote Dictionary Server) to store [rate limit](https://doc.traefik.io/traefik-hub-poc/api-management/api-rate-limit "Rate Limit") information across all Traefik Hub agents. Connection parameters to your Redis server are attached to your Traefik Hub deployment. The following Redis modes are supported: * Single instance mode * [Redis Cluster](https://redis.io/docs/management/scaling "Link to official Redis documentation about Redis Cluster mode") * [Redis Sentinel](https://redis.io/docs/management/sentinel "Link to official Redis documentation about Redis Sentinel mode") info For more information about Redis, we recommend the [official Redis documentation](https://redis.io/docs/ "Link to official Redis documentation") . * * * Available Configuration Options[​](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#available-configuration-options "Direct link to Available Configuration Options") ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The table below lists the configuration options in Traefik Hub to connect to Redis and store rate limit information. | Value | Description | Required | | --- | --- | --- | | `endpoints` | Endpoints of the Redis instances to connect to (example: `redis.traefik-hub.svc.cluster.local:6379`) | Yes | | `username` | The username Traefik Hub will use to connect to Redis | No | | `password` | The password Traefik Hub will use to connect to Redis | No | | `database` | The database Traefik Hub will use to sore information (default: `0`) | No | | `cluster` | Enable Redis Cluster | No | | `tls.caBundle` | Custom CA bundle | No | | `tls.cert` | TLS certificate | No | | `tls.key` | TLS key | No | | `tls.insecureSkipVerify` | Allow skipping the TLS verification | No | | `sentinel.masterSet` | Name of the set of main nodes to use for main selection. Required when using Sentinel. | No | | `sentinel.username` | Username to use for sentinel authentication (can be different from `username`) | No | | `sentinel.password` | Password to use for sentinel authentication (can be different from `password`) | No | info If you use Redis in single instance mode or Redis Sentinel, you can configure the `database` field. This value won't be taken into account if you use Redis Cluster (only database `0` is available). In this case, a warning is displayed, and the value is ignored. Adjust Traefik Hub's Configuration[​](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#adjust-traefik-hubs-configuration "Direct link to Adjust Traefik Hub's Configuration") ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ First, save the default Traefik Hub configuration to a _values.yaml_ file. helm show values traefik/traefik-hub > values.yaml Second, adjust the _values.yaml_ file by adding the configuration for distributed rate limiting to the `additionalArguments` part. * Redis single instance * Redis Cluster * Redis Sentinel additionalArguments: # Redis single instance mode - --hub.rateLimit.redis.endpoints=redis-headless.traefik-hub.svc.cluster.local:6379 - --hub.rateLimit.redis.password=$(PASSWORD)additionalEnvVars: # Redis in single instance mode - name: PASSWORD valueFrom: secretKeyRef: name: redis key: redis-passwordservice: type: LoadBalancer additionalArguments:# Redis Cluster - --hub.rateLimit.redis.cluster=true - --hub.rateLimit.redis.endpoints=redis-cluster.traefik-hub.svc.cluster.local:6379 - --hub.rateLimit.redis.password=$(CLUSTER_PASSWORD)additionalEnvVars: # Redis Cluster - name: CLUSTER_PASSWORD valueFrom: secretKeyRef: name: redis-cluster key: redis-passwordservice: type: LoadBalancer additionalArguments:# Redis Sentinel - --hub.rateLimit.redis.endpoints=redis-sentinel.traefik-hub.svc.cluster.local:26379 - --hub.rateLimit.redis.password=$(SENTINEL_PASSWORD) - --hub.rateLimit.redis.sentinel.password=$(SENTINEL_PASSWORD) - --hub.rateLimit.redis.sentinel.masterSet=mymasteradditionalEnvVars: # Redis Sentinel - name: SENTINEL_PASSWORD valueFrom: secretKeyRef: name: redis-sentinel key: redis-passwordservice: type: LoadBalancer All configuration settings Please see the [configuration options](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#available-configuration-options "Link to all configuration values for rate limiting") above for an overview about all possible values. Deploy Your Custom Configuration[​](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#deploy-your-custom-configuration "Direct link to Deploy Your Custom Configuration") ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Once the configuration is adjusted, use Helm to (re)deploy the Traefik Hub agent with the new values to enable distributed rate limiting. CLI helm upgrade --install --namespace traefik-hub traefik-hub traefik/traefik-hub \--values values.yaml * [Introduction](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#introduction) * [Available Configuration Options](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#available-configuration-options) * [Adjust Traefik Hub's Configuration](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#adjust-traefik-hubs-configuration) * [Deploy Your Custom Configuration](https://doc.traefik.io/traefik-hub-poc/reference/api/distributed-rate-limiting#deploy-your-custom-configuration) --- # Authentication & Authorization | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#__docusaurus_skipToContent_fallback) On this page Control and manage access to your workspace, APIs and documentation. * * * Introduction[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#introduction "Direct link to Introduction") ------------------------------------------------------------------------------------------------------------------------------------------------ Access management encompasses the control and authorization of users to access workspaces (the Traefik Hub dashboard), APIs and API Portals. Integral components in this realm are [JSON Web Tokens](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/jwt-overview "JWT overview documentation") and [API keys](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/key-authentication "API key authentication documentation") for APIs and [Identity Providers](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider "IdP overview documentation") (IdPs) as the source of truth for [Users and Groups](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups "Link to documentation about users and groups management") . In Traefik Hub, an IdP serves as the foundation for user authentication, while API keys or JWTs play a key role in authorizing users to access APIs. * * * Traefik Hub support three main levels for access management, where the manager has the highest and the consumer the lowest permissions. ### API Manager[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-manager "Direct link to API Manager") The API Manager uses the Traefik Hub Dashboard to administrate workspaces, APIs, user and group management. * Can add, edit and remove [cluster agents](https://doc.traefik.io/traefik-hub-poc/operations/installation "Link to installation documentation") . * Can configure [IdP](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider "Link to IdP documentation") . * Can invite/add/remove [workspace member](https://doc.traefik.io/traefik-hub-poc/dashboard#account-management "Link to documentation about workspace management") . * Can set [member roles](https://doc.traefik.io/traefik-hub-poc/dashboard#workspace-roles "Link to documentation about workspace roles") . ### API User[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-user "Direct link to API User") Common actions of an API User: * Uses the Portal to [browse APIs and read documentation](https://doc.traefik.io/traefik-hub-poc/portal/api-portal-overview "Link to overview documentation about API Portals") . * Uses the Portal for API test calls (Portal playground) (API/JWT). * Uses the Portal to [configure API keys](https://doc.traefik.io/traefik-hub-poc/portal/key-auth "Link to documentation about key authentication in API Portals") . Please refer to the [IdP documentation](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider "Link to documentation about user and group management") to learn more about how to manage user authentication. ### API Consumer[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-consumer "Direct link to API Consumer") The API User or application accessing the API. Consumers are granted access to APIs and API Collections via [API Accesses](https://doc.traefik.io/traefik-hub-poc/api-management/api-access "API Access documentation") . * [Introduction](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#introduction) * [API Manager](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-manager) * [API User](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-user) * [API Consumer](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview#api-consumer) --- # Dashboard | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/dashboard#__docusaurus_skipToContent_fallback) On this page Introduction[​](https://doc.traefik.io/traefik-hub-v2/dashboard#introduction "Direct link to Introduction") ------------------------------------------------------------------------------------------------------------ Accounts for the Traefik Hub Dashboard are separated accounts and not connected to API user or API consumer credentials. You can only invite member which have already a Traefik Hub account. The API Manager uses the Traefik Hub Dashboard to administrate workspaces, APIs, user and group management: * Add, edit and remove [cluster agents](https://doc.traefik.io/traefik-hub-v2/operations/installation "Link to installation documentation") . * Configure [IdP](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider "Link to IdP documentation") . * Invite/add/remove [workspace member](https://doc.traefik.io/traefik-hub-v2/dashboard#account-management "Link to documentation about workspace management") . * Set [member roles](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles "Link to documentation about workspace roles") . Workspace Roles[​](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles "Direct link to Workspace Roles") --------------------------------------------------------------------------------------------------------------------- Workspace roles are predefined according to varying access needs. You can assign roles to members when you invite them to your workspace. Workspace roles: * **Viewer:** Can view all resources in a workspace * **Editor:** In addition to the _Viewer_ permissions, an _Editor_ can manage resources. _Editors_ can adjust, add and delete resources in a workspace * **Admin:** In addition to the _Editor_ role, an _Admin_ can manage members of a workspace. You can have multiple _Admins_ for a workspace ### Permissions Overview[​](https://doc.traefik.io/traefik-hub-v2/dashboard#permissions-overview "Direct link to Permissions Overview") | Permission | Viewer | Editor | Admin | | --- | --- | --- | --- | | Read resources | ✅ | ✅ | ✅ | | Edit resources | | ✅ | ✅ | | Manage workspace | | | ✅ | Account Management[​](https://doc.traefik.io/traefik-hub-v2/dashboard#account-management "Direct link to Account Management") ------------------------------------------------------------------------------------------------------------------------------ ### Add New Member[​](https://doc.traefik.io/traefik-hub-v2/dashboard#add-new-member "Direct link to Add New Member") Here you can add other member to your workspace. To add a new member, select **Add member**. ![Workspace member.](https://doc.traefik.io/traefik-hub-v2/assets/images/workspace-user-overview-list-2d62d97de26b06bc67b00627c08f37a3.png "Workspace member") In the next step, choose the [role](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles "Links to documentation about workspace roles in Traefik Hub") you want to assign, add it to the e-mail address of the user you want to invite and select **Proceed invites**. ![Add a workspace member.](https://doc.traefik.io/traefik-hub-v2/assets/images/member-choose-role-4280a6db9f7b4ce48070a41f3c47af82.png "Add a workspace member") #### Example In the following example invites the member Jane Flour with the `Editor` role to a workspace. ![Example of inviting a member.](https://doc.traefik.io/traefik-hub-v2/assets/images/member-example-invite-81714e0f1444ca1bf8532f0090185250.png "Example of inviting a member") After the member accepted the invitation, the member will show up as a workspace member. You assign [roles](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles "Link to documentation about workspace roles") to members when you invite them to your workspace. If you want to change the role of a member, for example from _`Admin`_ to _`Editor`_, select the three dots next to the member name and choose **Change role**. ![Change workspace role.](https://doc.traefik.io/traefik-hub-v2/assets/images/change-role-2-940790435326a07263e256c8ee8f3632.png "Change workspace role") Choose the _`Editor`_ role from the drop-down and select **Save**. ![Choose Editor role and save.](https://doc.traefik.io/traefik-hub-v2/assets/images/change-role-3-977f2ef910183fe57b6e64aea834880d.png "Choose Editor role and save") Now the new role is applied to the workspace member. ![New workspace.](https://doc.traefik.io/traefik-hub-v2/assets/images/change-role-4-760b108ac946c8332acd706986b8d8e6.png) ### Remove Member[​](https://doc.traefik.io/traefik-hub-v2/dashboard#remove-member "Direct link to Remove Member") If you want to remove a workspace member, select the three dots next to the membername and choose **Remove from the workspace**. ![Remove workspace member.](https://doc.traefik.io/traefik-hub-v2/assets/images/remove-member-7a0d72cfc9fffec70162b7e0da94791c.png "Remove workspace member") * [Introduction](https://doc.traefik.io/traefik-hub-v2/dashboard#introduction) * [Workspace Roles](https://doc.traefik.io/traefik-hub-v2/dashboard#workspace-roles) * [Permissions Overview](https://doc.traefik.io/traefik-hub-v2/dashboard#permissions-overview) * [Account Management](https://doc.traefik.io/traefik-hub-v2/dashboard#account-management) * [Add New Member](https://doc.traefik.io/traefik-hub-v2/dashboard#add-new-member) * [Remove Member](https://doc.traefik.io/traefik-hub-v2/dashboard#remove-member) --- # One doc tagged with "Ingress Management" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/ingress-management#__docusaurus_skipToContent_fallback) [Data Sharing\ ------------](https://doc.traefik.io/traefik-hub-v2/introduction/security/data-sharing) Overview about shared data between the Traefik Hub’s SaaS control plane and a Kubernetes cluster hosting the Traefik Hub agent --- # Unknown apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: gateway-controller roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: gateway-role subjects: - kind: ServiceAccount name: traefik-controller namespace: default --- # 6 docs tagged with "CRD" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/crd#__docusaurus_skipToContent_fallback) [API Access\ ----------](https://doc.traefik.io/traefik-hub-poc/api-management/api-access) Traefik Hub API Access overview. [API Collections\ ---------------](https://doc.traefik.io/traefik-hub-poc/api-management/api-collection) Traefik Hub - API collections overview. [API Gateway\ -----------](https://doc.traefik.io/traefik-hub-poc/api-management/api-gateway) Traefik Hub - API Gateway. How to expose APIs. [API Portal\ ----------](https://doc.traefik.io/traefik-hub-poc/api-management/api-portal) Traefik Hub - API Portal overview and introduction. [API Rate Limit\ --------------](https://doc.traefik.io/traefik-hub-poc/api-management/api-rate-limit) How to use rate limiting. [Quick-Start Guide\ -----------------](https://doc.traefik.io/traefik-hub-poc/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. --- # FAQ | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/faq#__docusaurus_skipToContent_fallback) On this page How to determine, diagnose, and fix issues that you might encounter when you use Traefik Hub. * * * DO NOT DISPLAY IT YET[​](https://doc.traefik.io/traefik-hub/faq#do-not-display-it-yet "Direct link to DO NOT DISPLAY IT YET") ------------------------------------------------------------------------------------------------------------------------------ GitOps[​](https://doc.traefik.io/traefik-hub/faq#gitops "Direct link to GitOps") --------------------------------------------------------------------------------- ### What Is GitOps?[​](https://doc.traefik.io/traefik-hub/faq#what-is-gitops "Direct link to What Is GitOps?") GitOps for API management leverages version-controlled repositories and declarative configuration stored in Git to automate and streamline the continuous delivery of APIs. To get started, follow our [tutorial](https://github.com/traefik-workshops/traefik-hub-gitops "Link to Traefik Hub GitOps tutorial on GitHub") about how to deploy a Kubernetes cluster locally with [Flux](https://fluxcd.io/ "Link to website of Flux CD") and observability components. ### ArgoCD Has OutOfSync Issues[​](https://doc.traefik.io/traefik-hub/faq#argocd-has-outofsync-issues "Direct link to ArgoCD Has OutOfSync Issues") When using [Argo CD](https://argo-cd.readthedocs.io/en/stable/ "Link to website of Argo CD") , you must set the `application.instanceLabelKey` value in the `argocd-cm` to `argocd.argoproj.io/instance` instead of `app.kubernetes.io/instance`. This helps avoid _OutOfSync_ issues with Traefik Hub resources, as Traefik Hub also use the same label with the Hub Helm install. See the [Argo CD FAQ](https://argo-cd.readthedocs.io/en/stable/faq/#why-is-my-app-out-of-sync-even-after-syncing "Link to Argo CD FAQ") for more information. Observability[​](https://doc.traefik.io/traefik-hub/faq#observability "Direct link to Observability") ------------------------------------------------------------------------------------------------------ ### How to Set Up a Grafana Dashboard?[​](https://doc.traefik.io/traefik-hub/faq#how-to-set-up-a-grafana-dashboard "Direct link to How to Set Up a Grafana Dashboard?") You can use Traefik Hub's [pre-made dashboards](https://grafana.com/orgs/traefiklabs/dashboards "Link to Grafana Dashboards") to get started. * [DO NOT DISPLAY IT YET](https://doc.traefik.io/traefik-hub/faq#do-not-display-it-yet) * [GitOps](https://doc.traefik.io/traefik-hub/faq#gitops) * [What Is GitOps?](https://doc.traefik.io/traefik-hub/faq#what-is-gitops) * [ArgoCD Has OutOfSync Issues](https://doc.traefik.io/traefik-hub/faq#argocd-has-outofsync-issues) * [Observability](https://doc.traefik.io/traefik-hub/faq#observability) * [How to Set Up a Grafana Dashboard?](https://doc.traefik.io/traefik-hub/faq#how-to-set-up-a-grafana-dashboard) --- # FIPS Compliant Image | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/fips#__docusaurus_skipToContent_fallback) On this page FIPS 140-2 is a U.S. Federal Government security standard used to approve cryptographic modules. This section explains how Traefik Hub API Gateway is built with FIPS validated cryptographic libraries. Use of FIPS Compatible Go module[​](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/fips#use-of-fips-compatible-go-module "Direct link to Use of FIPS Compatible Go module") ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- For each Traefik Hub API Gateway version a specific Docker image is built using the Go option `GOEXPERIMENT=boringcrypto`. In Go, the BoringCrypto module is a general-purpose cryptographic library that is FIPS 140–2. Download the FIPS image[​](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/fips#download-the-fips-image "Direct link to Download the FIPS image") -------------------------------------------------------------------------------------------------------------------------------------------------------------------- Replace the main Traefik Hub Gateway image with the FIPS one. To do so, set the major version as a prefix in the image tag. For example, to download the FIPS compliant Traefik Hub API Gateway image in version v3: * Helm * Docker ## values.yamlimage: registry: ghcr.io repository: traefik/traefik-hub tag: "v3-fips" docker pull ghcr.io/traefik/traefik-hub:v3-fips * [Use of FIPS Compatible Go module](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/fips#use-of-fips-compatible-go-module) * [Download the FIPS image](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/fips#download-the-fips-image) --- # One doc tagged with "Quick Start" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/quick-start#__docusaurus_skipToContent_fallback) [Quick-Start Guide\ -----------------](https://doc.traefik.io/traefik-hub-poc/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. --- # One doc tagged with "Quick Start" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/quick-start#__docusaurus_skipToContent_fallback) [Quick-Start Guide\ -----------------](https://doc.traefik.io/traefik-hub-v2/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. --- # One doc tagged with "Guide" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/guide#__docusaurus_skipToContent_fallback) [Quick-Start Guide\ -----------------](https://doc.traefik.io/traefik-hub-poc/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. --- # One doc tagged with "Guide" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/guide#__docusaurus_skipToContent_fallback) [Quick-Start Guide\ -----------------](https://doc.traefik.io/traefik-hub-v2/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. --- # One doc tagged with "AccessLogs" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/access-logs#__docusaurus_skipToContent_fallback) [Logs and AccessLogs\ -------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-logs) Monitor APIs --- # One doc tagged with "Compliance" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/compliance#__docusaurus_skipToContent_fallback) [Traefik Hub FIPS Compliance\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/fips/ref-fips) Traefik Hub API adheres to FIPS 140-2. Read the Documentation --- # One doc tagged with "Consul Catalog" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/consul-catalog#__docusaurus_skipToContent_fallback) [Consul Catalog Enterprise\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-consul-catalog-enterprise) Configure Consul Catalog Enterprise as a provider for configuration discovery in Traefik Hub API Gateway --- # One doc tagged with "API Key Introspection" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-key-introspection#__docusaurus_skipToContent_fallback) [OAuth 2.1 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oauth-introspection) Traefik Hub - OAuth 2.1 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.1 server. --- # 5 docs tagged with "Auto Discovery" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/auto-discovery#__docusaurus_skipToContent_fallback) [Auto Discovery (Providers)\ --------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-overview) A provider is in charge of the routing configuration discovery. [Consul Catalog Enterprise\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-consul-catalog-enterprise) Configure Consul Catalog Enterprise as a provider for configuration discovery in Traefik Hub API Gateway [Kubernetes Custom Resources\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-crd) Configure the Kubernetes CRD provider that allows managing Traefik Hub API Gateway custom resources. [Kubernetes Gateway API\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-gatewayapi) Configure the Kubernetes Ingress provider that allows managing the Gateway API. [Kubernetes Ingress\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-ingress) Configure the Kubernetes Ingress provider that allows managing the Ingress objects. --- # One doc tagged with "Access" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/access#__docusaurus_skipToContent_fallback) [User Management\ ---------------](https://doc.traefik.io/traefik-hub/api-management/users-and-groups) Traefik Hub - Control access to your APIs and documentation. --- # One doc tagged with "AI" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/ai#__docusaurus_skipToContent_fallback) [Traefik Hub AI Gateway\ ----------------------](https://doc.traefik.io/traefik-hub/ai-gateway/overview) Traefik Hub - Learn how to configure the AI Gateway. --- # One doc tagged with "Logs" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/logs#__docusaurus_skipToContent_fallback) [Logs and AccessLogs\ -------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-logs) Monitor APIs --- # One doc tagged with "Migration" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/migration#__docusaurus_skipToContent_fallback) [Migrate from Traefik Proxy on Docker\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/docker/migration) Migrate your existing Traefik Proxy Docker setup to Traefik Hub API Gateway. --- # 3 docs tagged with "Consul" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/consul#__docusaurus_skipToContent_fallback) [Consul Catalog Enterprise\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-consul-catalog-enterprise) Configure Consul Catalog Enterprise as a provider for configuration discovery in Traefik Hub API Gateway [Install Traefik Hub Gateway on Nomad\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad) Install and configure Traefik Hub. [Upgrading Traefik Hub API Gateway In Nomad\ ------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad/upgrading-nomad) How to upgrade an existing Traefik Hub API Gateway installation in Nomad --- # One doc tagged with "Distributed RateLimit" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/distributed-rate-limit#__docusaurus_skipToContent_fallback) [Secure Access with Distributed Rate Limit and OIDC\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/rl-oidc) Traefik Hub - The Distributed RateLimit middleware ensures that requests are limited over time throughout your cluster and not only on an individual proxy while the OIDC authentication middleware secures your applications by delegating the authentication to an external provider. --- # 3 docs tagged with "Docker" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/docker#__docusaurus_skipToContent_fallback) [Auto Discovery (Providers)\ --------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-overview) A provider is in charge of the routing configuration discovery. [Docker\ ------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/docker) Install and configure Traefik Hub on Docker. [Migrate from Traefik Proxy on Docker\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/docker/migration) Migrate your existing Traefik Proxy Docker setup to Traefik Hub API Gateway. --- # One doc tagged with "External APIs" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/external-ap-is#__docusaurus_skipToContent_fallback) [Integrating External APIs with Traefik Hub on Oracle Cloud Infrastructure\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/external-api-integration) Learn how to integrate external APIs with Traefik Hub on Oracle Cloud Infrastructure, including security configuration with JWT and SSO. Read the technical documentation. --- # 2 docs tagged with "FIPS" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/fips#__docusaurus_skipToContent_fallback) [FIPS Compliant Image\ --------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/fips) Install Traefik Hub FIPS Image. [Traefik Hub FIPS Compliance\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/fips/ref-fips) Traefik Hub API adheres to FIPS 140-2. Read the Documentation --- # 2 docs tagged with "GatewayAPI" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/gateway-api#__docusaurus_skipToContent_fallback) [Expose APIs using Hub API Gateway\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/routers) A router is in charge of connecting incoming requests to the Services that can handle them. [Traefik Hub API Gateway & Kubernetes Gateway API\ ------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/ref-routing-provider-gatewayapi) The Kubernetes Gateway API can be used as a provider for routing and load balancing in Traefik Hub API Gateway. Read the technical documentation. --- # One doc tagged with "Group" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/group#__docusaurus_skipToContent_fallback) [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. --- # One doc tagged with "Guide" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/guide#__docusaurus_skipToContent_fallback) [Getting Started\ ---------------](https://doc.traefik.io/traefik-hub/api-management/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. --- # 2 docs tagged with "Hashicorp" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/hashicorp#__docusaurus_skipToContent_fallback) [Install Traefik Hub Gateway on Nomad\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad) Install and configure Traefik Hub. [Upgrading Traefik Hub API Gateway In Nomad\ ------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad/upgrading-nomad) How to upgrade an existing Traefik Hub API Gateway installation in Nomad --- # One doc tagged with "Heathcheck" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/heathcheck#__docusaurus_skipToContent_fallback) [Load-Balancing Strategies\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/services/api-gateway-lb) Define the load-balancing method to spread the traffic between the services. --- # One doc tagged with "API Portal Auth" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-portal-auth#__docusaurus_skipToContent_fallback) [APIPortalAuth\ -------------](https://doc.traefik.io/traefik-hub/api-management/api-portal-auth) Configure API Portal authentication with the APIPortalAuth CRD in Traefik Hub. --- # One doc tagged with "API Version" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-version#__docusaurus_skipToContent_fallback) [API Deprecation\ ---------------](https://doc.traefik.io/traefik-hub/reference/api/api-deprecation) Traefik Hub - How to deprecate an API in Traefik Hub. --- # One doc tagged with "API Versioning" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-versioning#__docusaurus_skipToContent_fallback) [API Version\ -----------](https://doc.traefik.io/traefik-hub/api-management/api-version) API versioning with Traefik Hub. --- # One doc tagged with "APIM" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/apim#__docusaurus_skipToContent_fallback) [API Management Offline Mode\ ---------------------------](https://doc.traefik.io/traefik-hub/api-management/offline-mode) Configure and operate Traefik Hub API Management in offline environments. --- # One doc tagged with "Applications" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/applications#__docusaurus_skipToContent_fallback) [Managed Applications\ --------------------](https://doc.traefik.io/traefik-hub/api-management/managed-applications) Define and manage API-consuming applications as Git-operated Kubernetes resources. --- # One doc tagged with "Authorization" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/authorization#__docusaurus_skipToContent_fallback) [Understanding Task-Based Access Control\ ---------------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/understanding-tbac) Learn about Task-Based Access Control (TBAC) and how it secures AI agents --- # One doc tagged with "Azure" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/azure#__docusaurus_skipToContent_fallback) [Deploy Traefik Hub API Management on Azure Arc\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/operations/azure/azure-arc-apim) Learn how to deploy Traefik Hub API Management on Azure Arc from Azure Marketplace. Read the technical documentation. --- # One doc tagged with "BasicAuth" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/basic-auth#__docusaurus_skipToContent_fallback) [Upstream Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/upstream-authentication) How to implement upstream authentication patterns with Traefik Hub API Management --- # One doc tagged with "Caching" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/caching#__docusaurus_skipToContent_fallback) [Semantic Cache\ --------------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/semantic-cache) Traefik Hub - Learn how to configure the Semantic Cache middleware for the AI gateway. --- # One doc tagged with "Canary" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/canary#__docusaurus_skipToContent_fallback) [Load-Balancing Strategies\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/services/api-gateway-lb) Define the load-balancing method to spread the traffic between the services. --- # 5 docs tagged with "ACME" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/acme#__docusaurus_skipToContent_fallback) [ACME Certificates Resolvers\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/cert-resolvers/ref-certs-resolvers-acme) Automatic Certificate Management using Let's Encrypt/Vault. [Automate Certificates with Let's Encrypt\ ----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/letsencrypt) Generate TLS certificates on the fly. [Automate Certificates with Vault PKI\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/vault-pki) Automatic Certificate Management Environment using Vault PKI secret engine. [Certificates Resolvers\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/cert-resolvers/ref-certs-resolvers-overview) Automatic Certificate Management using Let's Encrypt/Vault and Tailscale. [Tailscale Certificates Resolver\ -------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/cert-resolvers/ref-certs-resolvers-tailscale) Automatic Certificate Management using Tailscale. --- # 3 docs tagged with "API Key" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-key#__docusaurus_skipToContent_fallback) [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-api-key) Traefik Hub - API Key authentication middleware. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/ref-api-key) Traefik Hub - API Key authentication middleware. [Upstream Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/upstream-authentication) How to implement upstream authentication patterns with Traefik Hub API Management --- # One doc tagged with "Providers" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/providers#__docusaurus_skipToContent_fallback) [Auto Discovery (Providers)\ --------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-overview) A provider is in charge of the routing configuration discovery. --- # One doc tagged with "Router" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/router#__docusaurus_skipToContent_fallback) [Routers Definition in Kubernetes\ --------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/routers/ref-routers-overview) A router is in charge of connecting incoming requests to the Services that can handle them in HTTP. --- # 4 docs tagged with "Routing" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/routing#__docusaurus_skipToContent_fallback) [Kubernetes Routers - Ingress\ ----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/routers/ref-ingress-annotations) An Ingress object is in charge of connecting incoming requests to the Services that can handle them in HTTP. [Kubernetes Routers - IngressRoute\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/routers/ref-httpingressroute) A IngressRoute is a Traefik Hub API Gateway CRD is in charge of connecting incoming requests to the Services that can handle them in HTTP. [Kubernetes Service Annotations\ ------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-svc-annotations) The annotations allows tuning the connections between Traefik Hub API Gateway and the pods [Traefik Hub API Gateway & Kubernetes Gateway API\ ------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/ref-routing-provider-gatewayapi) The Kubernetes Gateway API can be used as a provider for routing and load balancing in Traefik Hub API Gateway. Read the technical documentation. --- # One doc tagged with "SPIFFE" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/spiffe#__docusaurus_skipToContent_fallback) [Spiffe Integration\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/ref-spiffe) Provide SPIFFE support. --- # One doc tagged with "Services" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/services#__docusaurus_skipToContent_fallback) [Services Management in Kubernetes\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-services-overview) In Kubernetes, a service is in charge of connecting incoming requests to the pods that can handle them. --- # One doc tagged with "Linode Kubernetes EngineLinode Kubernetes Engine (LKE)" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/linode-kubernetes-engine-linode-kubernetes-engine-lke#__docusaurus_skipToContent_fallback) [Deploy Traefik Hub Gateway & API Management on Linode Kubernetes Engine (LKE)\ -----------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/lke) Deploy Traefik Hub on Linode Kubernetes Engine (LKE) --- # One doc tagged with "Linter" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/linter#__docusaurus_skipToContent_fallback) [Static Analyzer\ ---------------](https://doc.traefik.io/traefik-hub/static-analyzer) Analyze Traefik Hub manifests before deploying them --- # One doc tagged with "LLM" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/llm#__docusaurus_skipToContent_fallback) [Traefik Hub AI Gateway\ ----------------------](https://doc.traefik.io/traefik-hub/ai-gateway/overview) Traefik Hub - Learn how to configure the AI Gateway. --- # 8 docs tagged with "Load-balacing" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/load-balacing#__docusaurus_skipToContent_fallback) [Default ServersTransport\ ------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-defaultserverstransport) The default ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers by default. [Kubernetes Custom Resources\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-crd) Configure the Kubernetes CRD provider that allows managing Traefik Hub API Gateway custom resources. [Kubernetes Gateway API\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-gatewayapi) Configure the Kubernetes Ingress provider that allows managing the Gateway API. [Kubernetes Ingress\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-ingress) Configure the Kubernetes Ingress provider that allows managing the Ingress objects. [Routers Definition in Kubernetes\ --------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/routers/ref-routers-overview) A router is in charge of connecting incoming requests to the Services that can handle them in HTTP. [ServersTransport in Kubernetes\ ------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-serverstransport) In Kubernetes, a ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers. [Services Management in Kubernetes\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-services-overview) In Kubernetes, a service is in charge of connecting incoming requests to the pods that can handle them. [Traefik Service in Kubernetes\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-kubetraefikservice) In Kubernetes, a TraefikService is in charge of defining advanced load-balancing strategies on top of Kubernetes Services. --- # One doc tagged with "Logging" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/logging#__docusaurus_skipToContent_fallback) [Leveraging OCI Logging Analytics for Deeper Troubleshooting Using Logs from Traefik Hub\ ---------------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-logging) Learn how to configure OCI logging analytics for deeper troubleshooting using Logs being emitted from Traefik hub. Read the technical documentation. --- # One doc tagged with "Managed Subscriptions" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/managed-subscriptions#__docusaurus_skipToContent_fallback) [External APIs\ -------------](https://doc.traefik.io/traefik-hub/api-management/external-api) Managing external APIs with Traefik Hub. --- # One doc tagged with "Model Context Protocol" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/model-context-protocol#__docusaurus_skipToContent_fallback) [Getting Started with MCP Gateway\ --------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started) Learn how to proxy and govern remote MCP servers using Traefik Hub MCP Gateway --- # One doc tagged with "Oracle Kubernetes Engine (OKE)" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/oracle-kubernetes-engine-oke#__docusaurus_skipToContent_fallback) [Integrating External APIs with Traefik Hub on Oracle Cloud Infrastructure\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/external-api-integration) Learn how to integrate external APIs with Traefik Hub on Oracle Cloud Infrastructure, including security configuration with JWT and SSO. Read the technical documentation. --- # One doc tagged with "Prometheus" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/prometheus#__docusaurus_skipToContent_fallback) [Prometheus\ ----------](https://doc.traefik.io/traefik-hub/operations/prometheus) This page describes how you can utilize Prometheus for Traefik Hub metrics collected by OpenTelemetry. --- # One doc tagged with "API Auth" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-auth#__docusaurus_skipToContent_fallback) [APIAuth\ -------](https://doc.traefik.io/traefik-hub/api-management/api-auth) Configure API authentication with the APIAuth CRD in Traefik Hub. --- # 4 docs tagged with "Ingress" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/ingress#__docusaurus_skipToContent_fallback) [Expose APIs using Hub API Gateway\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/routers) A router is in charge of connecting incoming requests to the Services that can handle them. [Kubernetes Gateway API\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-gatewayapi) Configure the Kubernetes Ingress provider that allows managing the Gateway API. [Kubernetes Ingress\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-ingress) Configure the Kubernetes Ingress provider that allows managing the Ingress objects. [Routers Definition in Kubernetes\ --------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/routers/ref-routers-overview) A router is in charge of connecting incoming requests to the Services that can handle them in HTTP. --- # One doc tagged with "Ingress Management" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/ingress-management#__docusaurus_skipToContent_fallback) [Data Sharing\ ------------](https://doc.traefik.io/traefik-hub/introduction/security/data-sharing) Overview about shared data between the Traefik Hub’s SaaS control plane and a Kubernetes cluster hosting the Traefik Hub agent --- # 2 docs tagged with "IngressRoute" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/ingress-route#__docusaurus_skipToContent_fallback) [Expose APIs using Hub API Gateway\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/routers) A router is in charge of connecting incoming requests to the Services that can handle them. [Routers Definition in Kubernetes\ --------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/routers/ref-routers-overview) A router is in charge of connecting incoming requests to the Services that can handle them in HTTP. --- # One doc tagged with "JWT Authentication" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/jwt-authentication#__docusaurus_skipToContent_fallback) [Integrating External APIs with Traefik Hub on Oracle Cloud Infrastructure\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/external-api-integration) Learn how to integrate external APIs with Traefik Hub on Oracle Cloud Infrastructure, including security configuration with JWT and SSO. Read the technical documentation. --- # 2 docs tagged with "Dashboard" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/dashboard#__docusaurus_skipToContent_fallback) [Secure Traefik Hub Gateway Dashboard and API\ --------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/dashboard-api) The Traefik Hub Gateway exposes information through API handlers and a dashboard. [Traefik Hub Gateway Dashboard and API\ -------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-dashboard-api) The Traefik Hub Gateway exposes information through API handlers and a dashboard. --- # One doc tagged with "Model Context Protocol (MCP)" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/model-context-protocol-mcp#__docusaurus_skipToContent_fallback) [Model Context Protocol (MCP)\ ----------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/mcp) Traefik Hub - Configure the MCP middleware for secure access control and governance of MCP servers. --- # One doc tagged with "Networking" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/networking#__docusaurus_skipToContent_fallback) [Networking\ ----------](https://doc.traefik.io/traefik-hub/operations/networking) Traefik hub - Networking reference. --- # One doc tagged with "NIMs" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/ni-ms#__docusaurus_skipToContent_fallback) [NVIDIA NIMs Integration with Traefik Hub AI Gateway LLM Guard Middleware\ ------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration) Complete guide for integrating NVIDIA NIMs with Traefik Hub AI Gateway LLM Guard middleware for advanced AI content security and topic control. --- # One doc tagged with "Nutanix Kubernetes Pltatform" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/nutanix-kubernetes-pltatform#__docusaurus_skipToContent_fallback) [Install Traefik Hub Gateway & API Management on Nutanix Kubernetes Platform (NKP)\ ---------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nkp) Install and configure Traefik Hub on Nutanix Kubernetes Platform. --- # One doc tagged with "NVIDIA" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/nvidia#__docusaurus_skipToContent_fallback) [NVIDIA NIMs Integration with Traefik Hub AI Gateway LLM Guard Middleware\ ------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration) Complete guide for integrating NVIDIA NIMs with Traefik Hub AI Gateway LLM Guard middleware for advanced AI content security and topic control. --- # One doc tagged with "OCI Kubernetes Engine" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/oci-kubernetes-engine#__docusaurus_skipToContent_fallback) [Leveraging OCI DevOps for Continuous Traefik Hub Configuration Management\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-devops) Learn how to build an OCI DevOps pipeline for ongoing change management of Traefik Hub configuration. Read the technical documentation. --- # One doc tagged with "Offline Mode" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/offline-mode#__docusaurus_skipToContent_fallback) [API Management Offline Mode\ ---------------------------](https://doc.traefik.io/traefik-hub/api-management/offline-mode) Configure and operate Traefik Hub API Management in offline environments. --- # 2 docs tagged with "Nomad" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/nomad#__docusaurus_skipToContent_fallback) [Install Traefik Hub Gateway on Nomad\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad) Install and configure Traefik Hub. [Upgrading Traefik Hub API Gateway In Nomad\ ------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad/upgrading-nomad) How to upgrade an existing Traefik Hub API Gateway installation in Nomad --- # 2 docs tagged with "API Mocking" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-mocking#__docusaurus_skipToContent_fallback) [Set up On-Premises API Mocking with Traefik Hub and Microcks\ ------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-mocking/on-premises-setup) Traefik Hub On-Premises API Mocking [Use Cases For Traefik Hub On-Premises API Mocking\ -------------------------------------------------](https://doc.traefik.io/traefik-hub/api-mocking/on-premises-usecases) Traefik Hub On-Premises API Mocking --- # 3 docs tagged with "API Access" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/api-access#__docusaurus_skipToContent_fallback) [API Managed Subscriptions\ -------------------------](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) Traefik Hub API Managed Subscriptions overview. [API Self-Service Subscriptions\ ------------------------------](https://doc.traefik.io/traefik-hub/api-management/self-service-subscription) Traefik Hub API Self-Service Subscriptions overview. [Managed Applications\ --------------------](https://doc.traefik.io/traefik-hub/api-management/managed-applications) Define and manage API-consuming applications as Git-operated Kubernetes resources. --- # One doc tagged with "Quick Start" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/quick-start#__docusaurus_skipToContent_fallback) [Getting Started\ ---------------](https://doc.traefik.io/traefik-hub/api-management/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. --- # One doc tagged with "Rate Limiting" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/rate-limiting#__docusaurus_skipToContent_fallback) [Distributed Rate Limit & Quota\ ------------------------------](https://doc.traefik.io/traefik-hub/reference/api/distributed-rate-limiting) Traefik Hub - How to configure and enable distributed rate limiting and quota in Traefik Hub. --- # One doc tagged with "RateLimit" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/rate-limit#__docusaurus_skipToContent_fallback) [Secure Access with Distributed Rate Limit and OIDC\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/rl-oidc) Traefik Hub - The Distributed RateLimit middleware ensures that requests are limited over time throughout your cluster and not only on an individual proxy while the OIDC authentication middleware secures your applications by delegating the authentication to an external provider. --- # One doc tagged with "SSO" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/sso#__docusaurus_skipToContent_fallback) [Integrating External APIs with Traefik Hub on Oracle Cloud Infrastructure\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/external-api-integration) Learn how to integrate external APIs with Traefik Hub on Oracle Cloud Infrastructure, including security configuration with JWT and SSO. Read the technical documentation. --- # One doc tagged with "Stickiness" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/stickiness#__docusaurus_skipToContent_fallback) [Load-Balancing Strategies\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/services/api-gateway-lb) Define the load-balancing method to spread the traffic between the services. --- # One doc tagged with "Swagger" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/swagger#__docusaurus_skipToContent_fallback) [OpenAPI\ -------](https://doc.traefik.io/traefik-hub/reference/specs/openapi) Support for Swagger v2 and OpenAPI v3.x in Traefik Hub. --- # One doc tagged with "TBAC" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/tbac#__docusaurus_skipToContent_fallback) [Understanding Task-Based Access Control\ ---------------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/understanding-tbac) Learn about Task-Based Access Control (TBAC) and how it secures AI agents --- # One doc tagged with "Tailscale" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/tailscale#__docusaurus_skipToContent_fallback) [Automate Certificates with Tailscale\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/tailscale) Generate TLS certificates on the fly. --- # 3 docs tagged with "TCP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/tcp#__docusaurus_skipToContent_fallback) [TCP - IPAllowList\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/tcp/middlewares/ref-ip-allow-list) Use IPAllowList in TCP middleware for limiting clients to specific IPs in Traefik Hub. [TCP - InFlightConn\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/tcp/middlewares/ref-in-flight-conn) Limiting the number of simultaneous connections. [Terminate (m)TLS Connections on Services\ ----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/passthrough) TUse the L4 capabilities the passthrough TLS/mTLS connections. --- # One doc tagged with "Oracle IAM" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/oracle-iam#__docusaurus_skipToContent_fallback) [Configuring OIDC SSO and Gateway Authentication with Oracle IAM Identity Domains\ --------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/oracle/oci-iam-identity-domain) Configuring OIDC (OpenID Connect) SSO for the Traefik Hub API Portal and Gateway Authentication with Oracle IAM Identity Domains --- # 2 docs tagged with "Linux" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/linux#__docusaurus_skipToContent_fallback) [Install Traefik Hub Gateway on Linux\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/linux/installation) Install and configure Traefik Hub. [Linux\ -----](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/linux) Install and configure Traefik Hub Linux. --- # 2 docs tagged with "Load-Balancing" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/load-balancing#__docusaurus_skipToContent_fallback) [Autoscaling Traefik Hub API Gateway\ -----------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/api-gateway-autoscaling) Autoscaling the Traefik Hub Gateway allows your API Gateway to dynamically adjust its capacity based on traffic load. Read the technical documentation. [Load-Balancing Strategies\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/services/api-gateway-lb) Define the load-balancing method to spread the traffic between the services. --- # 5 docs tagged with "Mirroring" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/mirroring#__docusaurus_skipToContent_fallback) [Default ServersTransport\ ------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-defaultserverstransport) The default ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers by default. [Load-Balancing Strategies\ -------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/services/api-gateway-lb) Define the load-balancing method to spread the traffic between the services. [ServersTransport in Kubernetes\ ------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-serverstransport) In Kubernetes, a ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers. [Services Management in Kubernetes\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-services-overview) In Kubernetes, a service is in charge of connecting incoming requests to the pods that can handle them. [Traefik Service in Kubernetes\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-kubetraefikservice) In Kubernetes, a TraefikService is in charge of defining advanced load-balancing strategies on top of Kubernetes Services. --- # 2 docs tagged with "OpenAPI" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/open-api#__docusaurus_skipToContent_fallback) [API Deprecation\ ---------------](https://doc.traefik.io/traefik-hub/reference/api/api-deprecation) Traefik Hub - How to deprecate an API in Traefik Hub. [OpenAPI\ -------](https://doc.traefik.io/traefik-hub/reference/specs/openapi) Support for Swagger v2 and OpenAPI v3.x in Traefik Hub. --- # 2 docs tagged with "OpenTelemetry" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/open-telemetry#__docusaurus_skipToContent_fallback) [Metrics\ -------](https://doc.traefik.io/traefik-hub/operations/metrics) This page explains all available Traefik Hub metrics which can be collected with OpenTelemetry. [Prometheus\ ----------](https://doc.traefik.io/traefik-hub/operations/prometheus) This page describes how you can utilize Prometheus for Traefik Hub metrics collected by OpenTelemetry. --- # 4 docs tagged with "Weighted Round Robin (WRR)" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/weighted-round-robin-wrr#__docusaurus_skipToContent_fallback) [Default ServersTransport\ ------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-defaultserverstransport) The default ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers by default. [ServersTransport in Kubernetes\ ------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-serverstransport) In Kubernetes, a ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers. [Services Management in Kubernetes\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-services-overview) In Kubernetes, a service is in charge of connecting incoming requests to the pods that can handle them. [Traefik Service in Kubernetes\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-kubetraefikservice) In Kubernetes, a TraefikService is in charge of defining advanced load-balancing strategies on top of Kubernetes Services. --- # One doc tagged with "GitOps" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/git-ops#__docusaurus_skipToContent_fallback) [Installation\ ------------](https://doc.traefik.io/traefik-hub-poc/operations/installation) Install and configure Traefik Hub. --- # 6 docs tagged with "Monitoring" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/monitoring#__docusaurus_skipToContent_fallback) [Integrate Treblle with Traefik Hub API Gateway\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/Treblle/traefik-and-treblle) Monitor Your APIs in Traefik Hub with Treblle [Leveraging Oracle APM to Visualize Traefik Hub OpenTelemetry Metrics\ --------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apm) Learn how to configure Oracle APM to visualize OpenTelemetry metrics from Traefik Hub. Read the technical documentation. [Logs and AccessLogs\ -------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-logs) Monitor APIs [Metrics\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-metrics) Monitor APIs [Tracing\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-tracing) Tracing APIs [Traefik Hub API Gateway Observability & Monitoring\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/metrics-tracing-logs) Monitor APIs --- # 3 docs tagged with "OAuth" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/o-auth#__docusaurus_skipToContent_fallback) [Getting Started with MCP Gateway\ --------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started) Learn how to proxy and govern remote MCP servers using Traefik Hub MCP Gateway [Model Context Protocol (MCP)\ ----------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/mcp) Traefik Hub - Configure the MCP middleware for secure access control and governance of MCP servers. [Upstream Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/upstream-authentication) How to implement upstream authentication patterns with Traefik Hub API Management --- # 3 docs tagged with "Tracing" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/tracing#__docusaurus_skipToContent_fallback) [Integrate Treblle with Traefik Hub API Gateway\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/Treblle/traefik-and-treblle) Monitor Your APIs in Traefik Hub with Treblle [Tracing\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-tracing) Tracing APIs [Traefik Hub API Gateway Observability & Monitoring\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/metrics-tracing-logs) Monitor APIs --- # 8 docs tagged with "TLS certificates" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/tls-certificates#__docusaurus_skipToContent_fallback) [Automate Certificates with Let's Encrypt\ ----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/letsencrypt) Generate TLS certificates on the fly. [Automate Certificates with Tailscale\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/tailscale) Generate TLS certificates on the fly. [Provide Certificates\ --------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/cert) Provide custom certificates to Traefik Hub. [Spiffe Integration\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/ref-spiffe) Provide SPIFFE support. [TLS Certificates Store\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/tls/ref-tls-store) Store Certificates in Traefik Hub API Gateway [TLS Certificates Store\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/tcp/tls/ref-tls-store-tcp) Store Certificates in Traefik Hub API Gateway [TLS Options\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/tls/ref-tls-option) TLS Options in Traefik Hub API Gateway [TLS Options\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/tcp/tls/ref-tls-option-tcp) TLS Options in Traefik Hub API Gateway --- # 2 docs tagged with "Kubernetes" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/kubernetes#__docusaurus_skipToContent_fallback) [Custom Configuration\ --------------------](https://doc.traefik.io/traefik-hub-poc/operations/custom-configuration) Custom Configuration [Installation\ ------------](https://doc.traefik.io/traefik-hub-poc/operations/installation) Install and configure Traefik Hub. --- # 2 docs tagged with "GitOps" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/git-ops#__docusaurus_skipToContent_fallback) [Installation\ ------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/installation) Install and configure Traefik Hub. [Installation\ ------------](https://doc.traefik.io/traefik-hub-v2/operations/installation) Install and configure Traefik Hub. --- # One doc tagged with "Access Control" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/access-control#__docusaurus_skipToContent_fallback) [Understanding Task-Based Access Control\ ---------------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/understanding-tbac) Learn about Task-Based Access Control (TBAC) and how it secures AI agents --- # 6 docs tagged with "Metrics" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/metrics#__docusaurus_skipToContent_fallback) [Integrate Treblle with Traefik Hub API Gateway\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/Treblle/traefik-and-treblle) Monitor Your APIs in Traefik Hub with Treblle [Metrics\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-metrics) Monitor APIs [Metrics\ -------](https://doc.traefik.io/traefik-hub/operations/metrics) This page explains all available Traefik Hub metrics which can be collected with OpenTelemetry. [Prometheus\ ----------](https://doc.traefik.io/traefik-hub/operations/prometheus) This page describes how you can utilize Prometheus for Traefik Hub metrics collected by OpenTelemetry. [Tracing\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-tracing) Tracing APIs [Traefik Hub API Gateway Observability & Monitoring\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/metrics-tracing-logs) Monitor APIs --- # One doc tagged with "Rate Limiting" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/rate-limiting#__docusaurus_skipToContent_fallback) [Distributed Rate Limit\ ----------------------](https://doc.traefik.io/traefik-hub-v2/reference/api/distributed-rate-limiting) Traefik Hub - How to configure and enable distributed rate limiting in Traefik Hub. --- # 4 docs tagged with "Key Authentication" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/key-authentication#__docusaurus_skipToContent_fallback) [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/key-authentication) Traefik Hub - API Key Authentication [Consumer Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/consumer-authentication) Consumer Authentication [How to Create API Keys\ ----------------------](https://doc.traefik.io/traefik-hub/portal/create-api-key) How to Create API Keys. [How to Use API Key Authentication\ ---------------------------------](https://doc.traefik.io/traefik-hub/portal/key-auth) How to Use API Key Authentication. --- # 7 docs tagged with "Observability" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/observability#__docusaurus_skipToContent_fallback) [Integrate Treblle with Traefik Hub API Gateway\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/Treblle/traefik-and-treblle) Monitor Your APIs in Traefik Hub with Treblle [Leveraging OCI Logging Analytics for Deeper Troubleshooting Using Logs from Traefik Hub\ ---------------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-logging) Learn how to configure OCI logging analytics for deeper troubleshooting using Logs being emitted from Traefik hub. Read the technical documentation. [Leveraging Oracle APM to Visualize Traefik Hub OpenTelemetry Metrics\ --------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apm) Learn how to configure Oracle APM to visualize OpenTelemetry metrics from Traefik Hub. Read the technical documentation. [Logs and AccessLogs\ -------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-logs) Monitor APIs [Metrics\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-metrics) Monitor APIs [Tracing\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-tracing) Tracing APIs [Traefik Hub API Gateway Observability & Monitoring\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/observability/metrics-tracing-logs) Monitor APIs --- # 5 docs tagged with "OIDC" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/oidc#__docusaurus_skipToContent_fallback) [APIPortalAuth\ -------------](https://doc.traefik.io/traefik-hub/api-management/api-portal-auth) Configure API Portal authentication with the APIPortalAuth CRD in Traefik Hub. [OIDC Identity Provider (IdP)\ ----------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/oidc) How to connect an OpenID Connect‑compliant third‑party identity provider (IdP) to Traefik Hub API Management (APIM) [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [Secure Access with Distributed Rate Limit and OIDC\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/rl-oidc) Traefik Hub - The Distributed RateLimit middleware ensures that requests are limited over time throughout your cluster and not only on an individual proxy while the OIDC authentication middleware secures your applications by delegating the authentication to an external provider. --- # 3 docs tagged with "User" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/user#__docusaurus_skipToContent_fallback) [Account Settings\ ----------------](https://doc.traefik.io/traefik-hub/dashboard/account-settings) How to configure account settings in Traefik Hub. [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. [User Management\ ---------------](https://doc.traefik.io/traefik-hub/api-management/users-and-groups) Traefik Hub - Control access to your APIs and documentation. --- # One doc tagged with "GitHub" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/git-hub#__docusaurus_skipToContent_fallback) [GitHub Action\ -------------](https://doc.traefik.io/traefik-hub/static-analyzer/github-action) Performs static analysis and generates reports on GitHub --- # One doc tagged with "Governance" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/governance#__docusaurus_skipToContent_fallback) [Getting Started with MCP Gateway\ --------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started) Learn how to proxy and govern remote MCP servers using Traefik Hub MCP Gateway --- # 7 docs tagged with "TLS" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/tls#__docusaurus_skipToContent_fallback) [ACME Certificates Resolvers\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/cert-resolvers/ref-certs-resolvers-acme) Automatic Certificate Management using Let's Encrypt/Vault. [Automate Certificates with Vault PKI\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/vault-pki) Automatic Certificate Management Environment using Vault PKI secret engine. [Certificates Resolvers\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/cert-resolvers/ref-certs-resolvers-overview) Automatic Certificate Management using Let's Encrypt/Vault and Tailscale. [Secure access with TLS Certificates\ -----------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/secure-overview-tls) A service is in charge of connecting incoming requests to the Servers that can handle them. [Secure the access with Traefik Hub Middlewares\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/secure-middleware-overview) Secure API Access [Secure the API Access\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/secure-overview) Secure API Access [Tailscale Certificates Resolver\ -------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/tls/cert-resolvers/ref-certs-resolvers-tailscale) Automatic Certificate Management using Tailscale. --- # 2 docs tagged with "Workspaces" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/workspaces#__docusaurus_skipToContent_fallback) [Account Settings\ ----------------](https://doc.traefik.io/traefik-hub/dashboard/account-settings) How to configure account settings in Traefik Hub. [Workspace Settings\ ------------------](https://doc.traefik.io/traefik-hub/dashboard/workspace-settings) How to configure and use workspaces in Traefik Hub --- # 3 docs tagged with "Ingress Mode" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/ingress-mode#__docusaurus_skipToContent_fallback) [Custom Configuration\ --------------------](https://doc.traefik.io/traefik-hub-poc/operations/custom-configuration) Custom Configuration [Installation\ ------------](https://doc.traefik.io/traefik-hub-poc/operations/installation) Install and configure Traefik Hub. [Upgrade the Traefik Hub Agent\ -----------------------------](https://doc.traefik.io/traefik-hub-poc/operations/upgrading) How to upgrade an existing Traefik Hub agent installation/ --- # 5 docs tagged with "Keycloak" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/keycloak#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/access-overview) How to manage access to Traefik Hub [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub/portal/jwt-portal) How to Use JWT in the API Portal. [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Keycloak\ --------](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Keycloak JWT Configuration\ --------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/keycloak-jwt) How to configure a Keycloak realm for JWT. --- # 6 docs tagged with "Operations" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/operations#__docusaurus_skipToContent_fallback) [Installation\ ------------](https://doc.traefik.io/traefik-hub/operations/installation) Install and configure Traefik Hub. [Running Multiple Traefik Hub Gateways on the Same Cluster\ ---------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/multi-tenancy) Configure Traefik Hub to run multiple, isolated gateway instances on a single Kubernetes cluster using namespaces. [Upgrade Traefik Hub\ -------------------](https://doc.traefik.io/traefik-hub/operations/upgrading) How to upgrade an existing Traefik Hub installation/ [Upgrade Traefik Hub API Gateway\ -------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/api-gateway-upgrading) How to upgrade an existing Traefik Hub API Gateway installation [Upgrading Traefik Hub API Gateway In Nomad\ ------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad/upgrading-nomad) How to upgrade an existing Traefik Hub API Gateway installation in Nomad [Upgrading Traefik Hub API Gateway On Linux\ ------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/linux/api-gateway-upgrading-linux) How to upgrade an existing Traefik Hub API Gateway installation in Linux --- # 5 docs tagged with "Ingress Mode" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/ingress-mode#__docusaurus_skipToContent_fallback) [Docker\ ------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/docker) Install and configure Traefik Hub on Docker. [Installation\ ------------](https://doc.traefik.io/traefik-hub/operations/installation) Install and configure Traefik Hub. [Kubernetes\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/kubernetes) Install and configure Traefik Hub. [Linux\ -----](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/linux) Install and configure Traefik Hub Linux. [Migrate from Traefik Proxy on Kubernetes\ ----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/migration) Install and configure Traefik Hub. --- # 5 docs tagged with "Okta" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/okta#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/access-overview) How to manage access to Traefik Hub [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub/portal/jwt-portal) How to Use JWT in the API Portal. [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Okta\ ----](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/okta) How to use Okta as the identity provider (IdP) for Traefik Hub. [Okta JWT Configuration\ ----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/okta-jwt) How to configure a Keycloak realm for JWT. --- # 6 docs tagged with "Oracle Cloud Infrastructure (OCI)" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/oracle-cloud-infrastructure-oci#__docusaurus_skipToContent_fallback) [Deploy Traefik Hub API Management from the Oracle Marketplace\ -------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apim-marketplace) Learn how to deploy Traefik Hub API Management from the Oracle Cloud Infrastructure marketplace using the stacks. Read the technical documentation. [Deploy Traefik Hub from the Oracle Marketplace\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/oracle-oci/oci-marketplace) Learn how to deploy Traefik Hub from the Oracle marketplace using the stacks. Read the technical documentation. [Integrating External APIs with Traefik Hub on Oracle Cloud Infrastructure\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/external-api-integration) Learn how to integrate external APIs with Traefik Hub on Oracle Cloud Infrastructure, including security configuration with JWT and SSO. Read the technical documentation. [Leveraging OCI DevOps for Continuous Traefik Hub Configuration Management\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-devops) Learn how to build an OCI DevOps pipeline for ongoing change management of Traefik Hub configuration. Read the technical documentation. [Leveraging OCI Logging Analytics for Deeper Troubleshooting Using Logs from Traefik Hub\ ---------------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-logging) Learn how to configure OCI logging analytics for deeper troubleshooting using Logs being emitted from Traefik hub. Read the technical documentation. [Leveraging Oracle APM to Visualize Traefik Hub OpenTelemetry Metrics\ --------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apm) Learn how to configure Oracle APM to visualize OpenTelemetry metrics from Traefik Hub. Read the technical documentation. --- # One doc tagged with "Helm" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/helm#__docusaurus_skipToContent_fallback) [Helm Chart Values\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-helm) Traefik Hub Helm Chart Values. --- # 10 docs tagged with "Authentication" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/authentication#__docusaurus_skipToContent_fallback) [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-api-key) Traefik Hub - API Key authentication middleware. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/ref-api-key) Traefik Hub - API Key authentication middleware. [APIAuth\ -------](https://doc.traefik.io/traefik-hub/api-management/api-auth) Configure API authentication with the APIAuth CRD in Traefik Hub. [APIPortalAuth\ -------------](https://doc.traefik.io/traefik-hub/api-management/api-portal-auth) Configure API Portal authentication with the APIPortalAuth CRD in Traefik Hub. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [OAuth 2.1 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oauth-introspection) Traefik Hub - OAuth 2.1 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.1 server. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [Upstream Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/upstream-authentication) How to implement upstream authentication patterns with Traefik Hub API Management --- # 5 docs tagged with "Security" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/security#__docusaurus_skipToContent_fallback) [LLM Guard\ ---------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/llm-guard) Traefik Hub - Learn how to configure the LLM Guard middleware for flexible content security in the AI Gateway. [MCP Gateway Best Practices\ --------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/mcp-gateway-best-practices) Learn about the essential security patterns and best practices for deploying MCP Gateway in production environments [Secure the access with Traefik Hub Middlewares\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/secure-middleware-overview) Secure API Access [Secure the API Access\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/secure-overview) Secure API Access [Understanding Task-Based Access Control\ ---------------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/understanding-tbac) Learn about Task-Based Access Control (TBAC) and how it secures AI agents --- # 4 docs tagged with "Kubernetes" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/kubernetes#__docusaurus_skipToContent_fallback) [Custom Configuration\ --------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/custom-configuration) Custom Configuration [Custom Configuration\ --------------------](https://doc.traefik.io/traefik-hub-v2/operations/custom-configuration) Custom Configuration [Installation\ ------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/installation) Install and configure Traefik Hub. [Installation\ ------------](https://doc.traefik.io/traefik-hub-v2/operations/installation) Install and configure Traefik Hub. --- # 2 docs tagged with "Install" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/install#__docusaurus_skipToContent_fallback) [Helm Chart Values\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-helm) Traefik Hub Helm Chart Values. [Static Configuration Options\ ----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-static-conf) Traefik Hub Static Configuration. --- # 5 docs tagged with "Ingress Mode" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/ingress-mode#__docusaurus_skipToContent_fallback) [Custom Configuration\ --------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/custom-configuration) Custom Configuration [Custom Configuration\ --------------------](https://doc.traefik.io/traefik-hub-v2/operations/custom-configuration) Custom Configuration [Installation\ ------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/installation) Install and configure Traefik Hub. [Installation\ ------------](https://doc.traefik.io/traefik-hub-v2/operations/installation) Install and configure Traefik Hub. [Upgrade the Traefik Hub Agent\ -----------------------------](https://doc.traefik.io/traefik-hub-v2/operations/upgrading) How to upgrade an existing Traefik Hub agent installation/ --- # 7 docs tagged with "IdP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/id-p#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/access-overview) How to manage access to Traefik Hub [Configuring OIDC SSO and Gateway Authentication with Oracle IAM Identity Domains\ --------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/oracle/oci-iam-identity-domain) Configuring OIDC (OpenID Connect) SSO for the Traefik Hub API Portal and Gateway Authentication with Oracle IAM Identity Domains [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. [Keycloak\ --------](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [OIDC Identity Provider (IdP)\ ----------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/oidc) How to connect an OpenID Connect‑compliant third‑party identity provider (IdP) to Traefik Hub API Management (APIM) [Okta\ ----](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/okta) How to use Okta as the identity provider (IdP) for Traefik Hub. --- # 12 docs tagged with "CRD" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/crd#__docusaurus_skipToContent_fallback) [API Bundle\ ----------](https://doc.traefik.io/traefik-hub/api-management/api-bundle) Traefik Hub API Bundle overview. [API Plan\ --------](https://doc.traefik.io/traefik-hub/api-management/api-plans) How to use API plans. [API Portal\ ----------](https://doc.traefik.io/traefik-hub/api-management/api-portal) Traefik Hub - API Portal overview and introduction. [API Rate Limit\ --------------](https://doc.traefik.io/traefik-hub/api-management/api-rate-limit) How to use rate limiting. [APIAuth\ -------](https://doc.traefik.io/traefik-hub/api-management/api-auth) Configure API authentication with the APIAuth CRD in Traefik Hub. [APIPortalAuth\ -------------](https://doc.traefik.io/traefik-hub/api-management/api-portal-auth) Configure API Portal authentication with the APIPortalAuth CRD in Traefik Hub. [Default ServersTransport\ ------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-defaultserverstransport) The default ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers by default. [Getting Started\ ---------------](https://doc.traefik.io/traefik-hub/api-management/quick-start-guide) Traefik Hub Quick Start - Publish your first APIs using CRDs. [Kubernetes Custom Resources\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-crd) Configure the Kubernetes CRD provider that allows managing Traefik Hub API Gateway custom resources. [ServersTransport in Kubernetes\ ------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-serverstransport) In Kubernetes, a ServersTransport allows configuring the connection between Traefik Hub API Gateway and the HTTP servers. [Services Management in Kubernetes\ ---------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-services-overview) In Kubernetes, a service is in charge of connecting incoming requests to the pods that can handle them. [Traefik Service in Kubernetes\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/http/services/ref-kubetraefikservice) In Kubernetes, a TraefikService is in charge of defining advanced load-balancing strategies on top of Kubernetes Services. --- # 3 docs tagged with "MCP Gateway" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/mcp-gateway#__docusaurus_skipToContent_fallback) [Getting Started with MCP Gateway\ --------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started) Learn how to proxy and govern remote MCP servers using Traefik Hub MCP Gateway [MCP Gateway Best Practices\ --------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/mcp-gateway-best-practices) Learn about the essential security patterns and best practices for deploying MCP Gateway in production environments [Understanding Task-Based Access Control\ ---------------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/understanding-tbac) Learn about Task-Based Access Control (TBAC) and how it secures AI agents --- # 9 docs tagged with "JWT" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/jwt#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/access-overview) How to manage access to Traefik Hub [Consumer Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/consumer-authentication) Consumer Authentication [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub/portal/jwt-portal) How to Use JWT in the API Portal. [JSON Web Tokens\ ---------------](https://doc.traefik.io/traefik-hub/authentication-authorization/jwt-overview) Traefik Hub JWT implementations [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [Keycloak\ --------](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Keycloak JWT Configuration\ --------------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/keycloak-jwt) How to configure a Keycloak realm for JWT. [Okta JWT Configuration\ ----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/okta-jwt) How to configure a Keycloak realm for JWT. --- # 19 docs tagged with "Kubernetes" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/kubernetes#__docusaurus_skipToContent_fallback) [API Management Offline Mode\ ---------------------------](https://doc.traefik.io/traefik-hub/api-management/offline-mode) Configure and operate Traefik Hub API Management in offline environments. [Auto Discovery (Providers)\ --------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-overview) A provider is in charge of the routing configuration discovery. [Autoscaling Traefik Hub API Gateway\ -----------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/api-gateway-autoscaling) Autoscaling the Traefik Hub Gateway allows your API Gateway to dynamically adjust its capacity based on traffic load. Read the technical documentation. [Getting Started\ ---------------](https://doc.traefik.io/traefik-hub/api-gateway/getting-started) Traefik Hub API Gateway Quick Start - Publish your first APIs using CRDs. [Getting Started with MCP Gateway\ --------------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started) Learn how to proxy and govern remote MCP servers using Traefik Hub MCP Gateway [Helm Chart Values\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-helm) Traefik Hub Helm Chart Values. [IngressRouteTCP\ ---------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/tcp/routers/ref-ingressroutetcp) Understand the routing configuration for the Kubernetes IngressRoute & Traefik CRD [IngressRouteUDP\ ---------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/udp/routers/ref-ingressrouteudp) Understand the routing configuration for the Kubernetes IngressRouteUDP & Traefik CRD [Install Traefik Hub Gateway on Kubernetes\ -----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/installation) Install and configure Traefik Hub. [Installation\ ------------](https://doc.traefik.io/traefik-hub/operations/installation) Install and configure Traefik Hub. [Kubernetes\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/kubernetes) Install and configure Traefik Hub. [Kubernetes Custom Resources\ ---------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-crd) Configure the Kubernetes CRD provider that allows managing Traefik Hub API Gateway custom resources. [Kubernetes Gateway API\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-gatewayapi) Configure the Kubernetes Ingress provider that allows managing the Gateway API. [Kubernetes Ingress\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-ingress) Configure the Kubernetes Ingress provider that allows managing the Ingress objects. [Migrate from Traefik Proxy on Kubernetes\ ----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/migration) Install and configure Traefik Hub. [Rules and Priorities\ --------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/udp/router/ref-udp-routers) A router is in charge of connecting incoming requests to the Services that can handle them. [Running Multiple Traefik Hub Gateways on the Same Cluster\ ---------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/multi-tenancy) Configure Traefik Hub to run multiple, isolated gateway instances on a single Kubernetes cluster using namespaces. [ServerTransportTCP\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/tcp/services/ref-servertransporttcp) Understand the service routing configuration for the Kubernetes ServerTransportTCP & Traefik CRD [Traefik Hub API Gateway & Kubernetes Gateway API\ ------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/ref-routing-provider-gatewayapi) The Kubernetes Gateway API can be used as a provider for routing and load balancing in Traefik Hub API Gateway. Read the technical documentation. --- # 5 docs tagged with "IdP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/id-p#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview) How to manage access to Traefik Hub [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. [Keycloak\ --------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Okta\ ----](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/okta) How to use Okta as the identity provider (IdP) for Traefik Hub. --- # 5 docs tagged with "IdP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/id-p#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview) How to manage access to Traefik Hub [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. [Keycloak\ --------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Okta\ ----](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/okta) How to use Okta as the identity provider (IdP) for Traefik Hub. --- # Entrypoints | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#__docusaurus_skipToContent_fallback) On this page Opening Connections for Incoming Requests[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#opening-connections-for-incoming-requests "Direct link to Opening Connections for Incoming Requests") -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- EntryPoints are the network entry points into Traefik Hub. They define the port which will receive the packets, and whether to listen for TCP or UDP connections. Configuration Examples[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#configuration-examples "Direct link to Configuration Examples") ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Port 80 only Kubernetes ## Static configurationentryPoints: web: address: ":80" You define an `entrypoint` called `web` that will listen on port `80`. Port 80 & 443 Kubernetes ## Static configurationentryPoints: web: address: ":80" websecure: address: ":443" * Two entrypoints are defined: one called `web`, and the other called `websecure`. * `web` listens on port `80`, and `websecure` on port `443`. UDP on port 1704 Kubernetes ## Static configurationentryPoints: streaming: address: ":1704/udp" Configuration[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#configuration "Direct link to Configuration") -------------------------------------------------------------------------------------------------------------------------------------------------------- ### General[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#general "Direct link to General") Entrypoints are part of the static configuration. ### Address[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#address "Direct link to Address") The address defines the port, and optionally the hostname, on which to listen for incoming connections and packets. It also defines the protocol to use (TCP or UDP). If no protocol is specified, the default is TCP. The format is: [host]:port[/tcp|/udp] If both TCP and UDP are wanted for the same port, two entryPoints definitions are needed, such as in the example below. Both TCP and UDP on Port 3179 Kubernetes ## Static configurationentryPoints: tcp_ep: address: ":3179" udp_ep: address: ":3179/udp" Listen on Specific IP Addresses Only Kubernetes entryPoints: specificIPv4: address: "192.168.2.7:8888" specificIPv6: address: "[2001:db8::1]:8888" Full details for how to specify `address` can be found in [net.Listen](https://golang.org/pkg/net/#Listen) (and [net.Dial](https://golang.org/pkg/net/#Dial) ) of the doc for go. ### ReusePort[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#reuseport "Direct link to ReusePort") | Field | Description | Default | Required | | --- | --- | --- | --- | | `ReusePort` | The `ReusePort` option enables EntryPoints from the same or different processes listening on the same TCP/UDP port by utilizing the `SO_REUSEPORT` socket option.
It also allows the kernel to act like a load balancer to distribute incoming connections between entry points. | false | No | For example, you can use it with the [transport.lifeCycle](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#lifecycle) to do canary deployments against Traefik Hub itself. Like upgrading Traefik Hub version or reloading the static configuration without any service downtime. Supported platforms The `ReusePort` option currently works only on Linux, FreeBSD, OpenBSD and Darwin. It will be ignored on other platforms. There is a known bug in the Linux kernel that may cause unintended TCP connection failures when using the `ReusePort` option. For more details, see [https://lwn.net/Articles/853637/](https://lwn.net/Articles/853637/) . Listen on the same port Kubernetes entryPoints: web: address: ":80" reusePort: true Now it is possible to run multiple Traefik Hub processes with the same EntryPoint configuration. Listen on the same port but bind to a different host Kubernetes entryPoints: web: address: ":80" reusePort: true privateWeb: address: "192.168.1.2:80" reusePort: true Requests to `192.168.1.2:80` will only be handled by routers that have `privateWeb` as the entry point. ### AsDefault[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#asdefault "Direct link to AsDefault") | Field | Description | Default | Required | | --- | --- | --- | --- | | `AsDefault` | The `AsDefault` option marks the EntryPoint to be in the list of default EntryPoints.
EntryPoints in this list are used (by default) on HTTP and TCP routers that do not define their own EntryPoints option. | false | No | List of default EntryPoints If there is no EntryPoint with the `AsDefault` option set to `true`, then the list of default EntryPoints includes all HTTP/TCP EntryPoints. If at least one EntryPoint has the `AsDefault` option set to `true`, then the list of default EntryPoints includes only EntryPoints that have the `AsDefault` option set to `true`. Some built-in EntryPoints are always excluded from the list, namely: `traefik`. Only TCP and HTTP The `AsDefault` option has no effect on UDP EntryPoints. When a UDP router does not define the EntryPoints option, it is attached to all available UDP EntryPoints. Defining only one EntryPoint as default: Kubernetes entryPoints: web: address: ":80" websecure: address: ":443" asDefault: true ### HTTP/2[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#http2 "Direct link to HTTP/2") #### `maxConcurrentStreams`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#maxconcurrentstreams "Direct link to maxconcurrentstreams") | Field | Description | Default | Required | | --- | --- | --- | --- | | `maxConcurrentStreams` | `maxConcurrentStreams` specifies the number of concurrent streams per connection that each client is allowed to initiate.
The `maxConcurrentStreams` value must be greater than zero. | 250 | No | Kubernetes entryPoints: foo: http2: maxConcurrentStreams: 250 ### HTTP/3[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#http3 "Direct link to HTTP/3") #### `http3`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#http3-1 "Direct link to http3-1") `http3` enables HTTP/3 protocol on the entryPoint. HTTP/3 requires a TCP entryPoint, as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this entryPoint is the same as the one used for TLS traffic. Kubernetes entryPoints: name: http3: {} HTTP/3 uses UDP+TLS As HTTP/3 actually uses UDP, when traefik hub is configured with a TCP entryPoint on port N with HTTP/3 enabled, the underlying HTTP/3 server that is started automatically listens on UDP port N too. As a consequence, it means port N cannot be used by another UDP entryPoint. Since HTTP/3 requires the use of TLS, only routers with TLS enabled will be usable with HTTP/3. #### `advertisedPort`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#advertisedport "Direct link to advertisedport") `http3.advertisedPort` defines which UDP port to advertise as the HTTP/3 authority. It defaults to the entryPoint's address port. It can be used to override the authority in the `alt-svc` header, for example if the public facing port is different from where Traefik Hub is listening. Kubernetes entryPoints: name: http3: advertisedPort: 443 ### Forwarded Headers[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#forwarded-headers "Direct link to Forwarded Headers") You can configure Traefik Hub to trust the forwarded headers information (`X-Forwarded-*`). #### `forwardedHeaders.trustedIPs`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#forwardedheaderstrustedips "Direct link to forwardedheaderstrustedips") Trusting Forwarded Headers from specific IPs. Kubernetes ## Static configurationentryPoints: web: address: ":80" forwardedHeaders: trustedIPs: - "127.0.0.1/32" - "192.168.1.7" #### `forwardedHeaders.insecure`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#forwardedheadersinsecure "Direct link to forwardedheadersinsecure") Insecure Mode (Always Trusting Forwarded Headers). Kubernetes ## Static configurationentryPoints: web: address: ":80" forwardedHeaders: insecure: true ### Transport[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#transport "Direct link to Transport") #### `respondingTimeouts`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#respondingtimeouts "Direct link to respondingtimeouts") | Field | Description | Default | Required | | --- | --- | --- | --- | | `respondingTimeouts` | `respondingTimeouts` are timeouts for incoming requests to the Traefik Hub instance. This is the maximum duration for reading the entire request, including the body. Setting them has no effect for UDP entryPoints. | 0s (seconds) | No | transport.respondingTimeouts.readTimeout `readTimeout` is the maximum duration for reading the entire request, including the body. If zero, no timeout exists. Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). If no units are provided, the value is parsed assuming seconds. ## Static configurationentryPoints: name: address: ":8888" transport: respondingTimeouts: readTimeout: 42 transport.respondingTimeouts.writeTimeout | Field | Description | Default | Required | | --- | --- | --- | --- | | `writeTimeout` | `writeTimeout` is the maximum duration before timing out writes of the response.
It covers the time from the end of the request header read to the end of the response write.
If zero, no timeout exists. | 0s (seconds) | No | Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). If no units are provided, the value is parsed assuming seconds. Kubernetes ## Static configurationentryPoints: name: address: ":8888" transport: respondingTimeouts: writeTimeout: 42 transport.respondingTimeouts.idleTimeout | Field | Description | Default | Required | | --- | --- | --- | --- | | `idleTimeout` | `idleTimeout` is the maximum duration an idle (keep-alive) connection will remain idle before closing itself.
If zero, no timeout exists | 180s (seconds) | No | Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). If no units are provided, the value is parsed assuming seconds. Kubernetes ## Static configurationentryPoints: name: address: ":8888" transport: respondingTimeouts: idleTimeout: 42 #### `lifeCycle`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#lifecycle "Direct link to lifecycle") `lifeCycle` controls the behavior of Traefik Hub during the shutdown phase | Field | Description | Default | Required | | --- | --- | --- | --- | | `lifeCycle.requestAcceptGraceTimeout` | Duration to keep accepting requests prior to initiating the graceful termination period (as defined by the `graceTimeOut` option).
This option is meant to give downstream load-balancers sufficient time to take Traefik Hub out of rotation. | 0s (seconds) | No | Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). If no units are provided, the value is parsed assuming seconds. The zero duration disables the request accepting grace period, i.e., Traefik Hub will immediately proceed to the grace period. Kubernetes ## Static configurationentryPoints: name: address: ":8888" transport: lifeCycle: requestAcceptGraceTimeout: 42 | Field | Description | Default | Required | | --- | --- | --- | --- | | `lifeCycle.graceTimeOut` | Duration to give active requests a chance to finish before Traefik Hub stops. | 10s (seconds) | No | Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). If no units are provided, the value is parsed assuming seconds. In this time frame no new requests are accepted. Kubernetes ## Static configurationentryPoints: name: address: ":8888" transport: lifeCycle: graceTimeOut: 42 #### `keepAliveMaxRequests`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#keepalivemaxrequests "Direct link to keepalivemaxrequests") | Field | Description | Default | Required | | --- | --- | --- | --- | | `keepAliveMaxRequests` | The maximum number of requests Traefik Hub can handle before sending a `Connection: Close` header to the client (for HTTP2, Traefik Hub sends a GOAWAY). Zero means no limit. | 0s (seconds) | No | Kubernetes ## Static configurationentryPoints: name: address: ":8888" transport: keepAliveMaxRequests: 42 #### `keepAliveMaxTime`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#keepalivemaxtime "Direct link to keepalivemaxtime") | Field | Description | Default | Required | | --- | --- | --- | --- | | `keepAliveMaxTime` | The maximum duration Traefik Hub can handle requests before sending a `Connection: Close` header to the client (for HTTP2, Traefik Hub sends a GOAWAY). Zero means no limit. | 0s (seconds) | No | Kubernetes ## Static configurationentryPoints: name: address: ":8888" transport: keepAliveMaxTime: 42s ### ProxyProtocol[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#proxyprotocol "Direct link to ProxyProtocol") Traefik Hub supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2. If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers. If the PROXY protocol header is passed, then the version is determined automatically. #### `proxyProtocol.trustedIPs`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#proxyprotocoltrustedips "Direct link to proxyprotocoltrustedips") Enabling PROXY protocol with Trusted IPs. Kubernetes ## Static configurationentryPoints: web: address: ":80" proxyProtocol: trustedIPs: - "127.0.0.1/32" - "192.168.1.7" IPs in `trustedIPs` only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here. #### `proxyProtocol.insecure`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#proxyprotocolinsecure "Direct link to proxyprotocolinsecure") Insecure Mode (test environment only). In a test environment, you can configure Traefik Hub to trust every incoming connection. Doing so, every remote client address will be replaced (`trustedIPs` won't have any effect) Kubernetes ## Static configurationentryPoints: web: address: ":80" proxyProtocol: insecure: true Queuing Traefik Hub behind Another Load Balancer When queuing Traefik Hub behind another load-balancer, make sure to configure PROXY protocol on both sides. Not doing so could introduce a security risk in your system (enabling request forgery). HTTP Options[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#http-options "Direct link to HTTP Options") ----------------------------------------------------------------------------------------------------------------------------------------------------- This whole section is dedicated to options, keyed by entry point, that will apply only to HTTP routing. ### Redirection[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#redirection "Direct link to Redirection") Example HTTPS redirection (80 to 443): Kubernetes entryPoints: web: address: :80 http: redirections: entryPoint: to: websecure scheme: https websecure: address: :443 #### `entryPoint`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#entrypoint "Direct link to entrypoint") This section is a convenience to enable (permanent) redirecting of all incoming requests on an entry point (for example, port `80`) to another entry point (for example, port `443`) or an explicit port (`:443`). ##### `entryPoint.to`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#entrypointto "Direct link to entrypointto") | Field | Description | Required | | --- | --- | --- | | `entryPoint.to` | The target element. | Yes | The target element, it can be: * An entry point name (ex: `websecure`). * A port (`:443`). Kubernetes entryPoints: foo: # ... http: redirections: entryPoint: to: websecure ##### `entryPoint.scheme`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#entrypointscheme "Direct link to entrypointscheme") | Field | Description | Default | Required | | --- | --- | --- | --- | | `entryPoint.scheme` | The redirection target scheme. | https | No | Kubernetes entryPoints: foo: # ... http: redirections: entryPoint: # ... scheme: https ##### `entryPoint.permanent`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#entrypointpermanent "Direct link to entrypointpermanent") | Field | Description | Default | Required | | --- | --- | --- | --- | | `entryPoint.permanent` | To apply a permanent redirection. | true | No | Kubernetes entryPoints: foo: # ... http: redirections: entryPoint: # ... permanent: true ##### `entryPoint.priority`[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#entrypointpriority "Direct link to entrypointpriority") | Field | Description | Default | Required | | --- | --- | --- | --- | | `entryPoint.priority` | Priority of the generated router. | MaxInt32-1 (2147483646) | No | Kubernetes entryPoints: foo: # ... http: redirections: entryPoint: # ... priority: 10 ### EncodeQuerySemicolons[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#encodequerysemicolons "Direct link to EncodeQuerySemicolons") | Field | Description | Default | Required | | --- | --- | --- | --- | | `encodeQuerySemicolons` | The `encodeQuerySemicolons` option allows enabling query semicolons encoding
One could use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik Hub.
When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend. | false | No | Kubernetes entryPoints: websecure: address: ':443' http: encodeQuerySemicolons: true #### Examples[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#examples "Direct link to Examples") | EncodeQuerySemicolons | Request Query | Resulting Request Query | | --- | --- | --- | | false | foo=bar;baz=bar | foo=bar&baz=bar | | true | foo=bar;baz=bar | foo=bar%3Bbaz=bar | | false | foo=bar&baz=bar;foo | foo=bar&baz=bar&foo | | true | foo=bar&baz=bar;foo | foo=bar&baz=bar%3Bfoo | ### Middlewares[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#middlewares "Direct link to Middlewares") The list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point. Kubernetes entryPoints: websecure: address: ':443' http: middlewares: - auth@file - strip@file ### TLS[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#tls "Direct link to TLS") This section is about the default TLS configuration applied to all routers associated with the named entry point. If a TLS section (that is any of its fields) is user-defined, then the default configuration does not apply at all. The TLS section is the same as the TLS section on HTTP routers. Kubernetes entryPoints: websecure: address: ':443' http: tls: options: foobar certResolver: leresolver domains: - main: example.com sans: - foo.example.com - bar.example.com - main: test.com sans: - foo.test.com - bar.test.com #### Example with "Let's Encrypt"[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#example-with-lets-encrypt "Direct link to Example with "Let's Encrypt"") Kubernetes entryPoints: websecure: address: ':443' http: tls: certResolver: leresolver UDP Options[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#udp-options "Direct link to UDP Options") -------------------------------------------------------------------------------------------------------------------------------------------------- This whole section is dedicated to options, keyed by entry point, that will apply only to UDP routing. ### Timeout[​](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#timeout "Direct link to Timeout") | Field | Description | Default | Required | | --- | --- | --- | --- | | `timeout` | Timeout defines how long to wait on an idle session before releasing the related resources.
The Timeout value must be greater than zero. | 3s (seconds) | No | Kubernetes entryPoints: foo: address: ':8000/udp' udp: timeout: 10s * [Opening Connections for Incoming Requests](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#opening-connections-for-incoming-requests) * [Configuration Examples](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#configuration-examples) * [Configuration](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#configuration) * [General](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#general) * [Address](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#address) * [ReusePort](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#reuseport) * [AsDefault](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#asdefault) * [HTTP/2](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#http2) * [HTTP/3](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#http3) * [Forwarded Headers](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#forwarded-headers) * [Transport](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#transport) * [ProxyProtocol](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#proxyprotocol) * [HTTP Options](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#http-options) * [Redirection](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#redirection) * [EncodeQuerySemicolons](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#encodequerysemicolons) * [Middlewares](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#middlewares) * [TLS](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#tls) * [UDP Options](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#udp-options) * [Timeout](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/api-gateway-entrypoints#timeout) --- # 21 docs tagged with "GitOps" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/git-ops#__docusaurus_skipToContent_fallback) [Deploy Traefik Hub API Management from the Oracle Marketplace\ -------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apim-marketplace) Learn how to deploy Traefik Hub API Management from the Oracle Cloud Infrastructure marketplace using the stacks. Read the technical documentation. [Deploy Traefik Hub API Management on Azure Arc\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/operations/azure/azure-arc-apim) Learn how to deploy Traefik Hub API Management on Azure Arc from Azure Marketplace. Read the technical documentation. [Deploy Traefik Hub from the Oracle Marketplace\ ----------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/oracle-oci/oci-marketplace) Learn how to deploy Traefik Hub from the Oracle marketplace using the stacks. Read the technical documentation. [Deploy Traefik Hub Gateway & API Management on Linode Kubernetes Engine (LKE)\ -----------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/lke) Deploy Traefik Hub on Linode Kubernetes Engine (LKE) [Docker\ ------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/docker) Install and configure Traefik Hub on Docker. [Getting Started\ ---------------](https://doc.traefik.io/traefik-hub/api-gateway/getting-started) Traefik Hub API Gateway Quick Start - Publish your first APIs using CRDs. [GitHub Action\ -------------](https://doc.traefik.io/traefik-hub/static-analyzer/github-action) Performs static analysis and generates reports on GitHub [Install Traefik Hub Gateway & API Management on Nutanix Kubernetes Platform (NKP)\ ---------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nkp) Install and configure Traefik Hub on Nutanix Kubernetes Platform. [Install Traefik Hub Gateway on Kubernetes\ -----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/installation) Install and configure Traefik Hub. [Install Traefik Hub Gateway on Linux\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/linux/installation) Install and configure Traefik Hub. [Install Traefik Hub Gateway on Nomad\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nomad) Install and configure Traefik Hub. [Installation\ ------------](https://doc.traefik.io/traefik-hub/operations/installation) Install and configure Traefik Hub. [Kubernetes\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/kubernetes) Install and configure Traefik Hub. [Leveraging OCI DevOps for Continuous Traefik Hub Configuration Management\ -------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-devops) Learn how to build an OCI DevOps pipeline for ongoing change management of Traefik Hub configuration. Read the technical documentation. [Leveraging OCI Logging Analytics for Deeper Troubleshooting Using Logs from Traefik Hub\ ---------------------------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-logging) Learn how to configure OCI logging analytics for deeper troubleshooting using Logs being emitted from Traefik hub. Read the technical documentation. [Leveraging Oracle APM to Visualize Traefik Hub OpenTelemetry Metrics\ --------------------------------------------------------------------](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apm) Learn how to configure Oracle APM to visualize OpenTelemetry metrics from Traefik Hub. Read the technical documentation. [Linux\ -----](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/linux) Install and configure Traefik Hub Linux. [Managed Applications\ --------------------](https://doc.traefik.io/traefik-hub/api-management/managed-applications) Define and manage API-consuming applications as Git-operated Kubernetes resources. [Migrate from Traefik Proxy on Docker\ ------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/docker/migration) Migrate your existing Traefik Proxy Docker setup to Traefik Hub API Gateway. [Migrate from Traefik Proxy on Kubernetes\ ----------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/migration) Install and configure Traefik Hub. [Static Analyzer\ ---------------](https://doc.traefik.io/traefik-hub/static-analyzer) Analyze Traefik Hub manifests before deploying them --- # How to Use API Key Authentication | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#__docusaurus_skipToContent_fallback) On this page How to use API keys in the API Portal to authorize and test APIs. * * * Key Authorization[​](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#key-authorization "Direct link to Key Authorization") --------------------------------------------------------------------------------------------------------------------------------- 1. Choose the API you want to use, this example uses the _Ticket API_. 2. Second, select the endpoint you want to use. 3. Third, choose the authorization type for the API and add your API key. **Bearer token:** The API key is included in the request header. **API key:** You send the key-value pair to the API as query parameter. 4. Paste your API Key. 5. Set the limit. 6. Select **Send API Request**. 7. View the output. https://dev.example.com/collections/travel-collection/apis/ticket-api@apps#/operations/getTickets ![API Portal.](https://doc.traefik.io/traefik-hub-v2/assets/images/portal-request-0e718a1cb9952106454ac664d2665626.png "Picture of an API Portal.") CLI[​](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#cli "Direct link to CLI") --------------------------------------------------------------------------------------- The following examples show how to use [curl](https://curl.se/ "Link to website of curl") and [HTTPIe](https://httpie.io/ "Link to website of HTTPIe") to send API requests using an API key for authentication. | Field | Description | | --- | --- | | `$PORTAL-URL` | The base URL of your Portal, for example `api.example.com`. | | `$API-KEY` | The API key of the consumer | ### Examples[​](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#examples "Direct link to Examples") #### API Key In Header[​](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#api-key-in-header "Direct link to API Key In Header") * Curl Command * Output CLI curl -X 'GET' \ 'https://$PORTAL-URL/tickets/tickets' \ -H 'accept: application/json' \ -H 'Authorization: Bearer $API-KEY' CLI curl -X 'GET' \ 'https://$PORTAL-URL/tickets/tickets' \ -H 'accept: application/json' \ -H 'Authorization: Bearer $API-KEY'[ { "id": 1, "flightCode": "TL123", "fare": 500, "class": "first", "available": 5, "total": 20 }, { "id": 2, "flightCode": "TL234", "fare": 200, "class": "economy", "available": 2, "total": 5 }, { "id": 3, "flightCode": "TL345", "fare": 300, "class": "business", "available": 3, "total": 10 }] #### API Key In Query Param[​](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#api-key-in-query-param "Direct link to API Key In Query Param") * Curl Command * Output CLI curl -X 'GET' \ 'https://$PORTAL_URL/tickets/tickets?limit=1&api_key=$API-KEY' \ -H 'accept: application/json' CLI curl -X 'GET' \ 'https://$PORTAL_URL/tickets/tickets?limit=1&api_key=$API-KEY' \ -H 'accept: application/json'[ { "id": 1, "flightCode": "TL123", "fare": 500, "class": "first", "available": 5, "total": 20 }, { "id": 2, "flightCode": "TL234", "fare": 200, "class": "economy", "available": 2, "total": 5 }, { "id": 3, "flightCode": "TL345", "fare": 300, "class": "business", "available": 3, "total": 10 }] * [Key Authorization](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#key-authorization) * [CLI](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#cli) * [Examples](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#examples) * [API Key In Header](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#api-key-in-header) * [API Key In Query Param](https://doc.traefik.io/traefik-hub-v2/portal/key-auth#api-key-in-query-param) --- # 5 docs tagged with "Okta" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/okta#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview) How to manage access to Traefik Hub [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub-v2/portal/jwt-portal) How to Use JWT in the API Portal. [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Okta\ ----](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/okta) How to use Okta as the identity provider (IdP) for Traefik Hub. [Okta JWT Configuration\ ----------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt) How to configure a Keycloak realm for JWT. --- # Static Analyzer | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/static-analyzer#__docusaurus_skipToContent_fallback) On this page The Traefik Hub Static Analyzer is a tool designed to analyze your Traefik Hub manifests, ensuring they adhere to best practices and avoid common pitfalls. * * * Introduction[​](https://doc.traefik.io/traefik-hub/static-analyzer#introduction "Direct link to Introduction") --------------------------------------------------------------------------------------------------------------- When developing APIs, managing configurations, or integrating changes into your CI/CD pipelines, this tool can be a go-to solution for maintaining the quality and consistency of Traefik Hub-based projects. The Static Analyzer can validate Traefik Hub resources with Custom Resource Definitions (CRDs), lint custom resources, and generate diff change reports. By integrating it into development workflows, one can catch issues early, streamline collaboration, and ensure the reliability of a change. Install[​](https://doc.traefik.io/traefik-hub/static-analyzer#install "Direct link to Install") ------------------------------------------------------------------------------------------------ The tool can be downloaded for Linux, Mac and Windows in [traefik/hub releases](https://github.com/traefik/hub/releases?q=static-analyzer) Lint[​](https://doc.traefik.io/traefik-hub/static-analyzer#lint "Direct link to Lint") --------------------------------------------------------------------------------------- Evaluate resources and check common sources of misconfiguration. hub-static-analyzer lint --path [path/to/manifests] The linter evaluates different rules against your manifests. By default, all rules are enabled. | Name | Description | | --- | --- | | **childless** | Check childless resources | | **duplicate** | Check duplicate resources and resource references | | **operation-set** | Check for unknown operation sets | | **orphan** | Check orphan resources | | **reference** | Check invalid resource references | | **regex** | Check invalid regex | | **release** | Check duplicate releases of a given API | | **resource** | Check resource definitions | | **selector** | Check selector definitions | A rule can be turned off using the `--rule.=false` flag. By default, it outputs results in Unix format: manifests/02-api.yaml:1:1 service port :8081 defined on field "service.openApiSpec.port" in resource petstore/my-petstore-api (API) is not found in petstore/petstore (Service) [service-port] A different output format can be specified using the flag `--format`: * `json` * `checkstyle` * `unix` Diff[​](https://doc.traefik.io/traefik-hub/static-analyzer#diff "Direct link to Diff") --------------------------------------------------------------------------------------- Analyze the differences between two revisions. This command generates change reports to better understand the impact of a manifest update. hub-static-analyzer diff --path [path/to/manifests] [...] # Gateway 1:Groups gained access:| GROUP | API | BUNDLE | PLAN ||----------|----------|-----------|-----------------------------|| my-group | my-ns/my-api-2 | my-bundle | gold (rl: 1/1s, q: 1/750h) |Groups lost access:| GROUP | API | BUNDLE ||----------|---------|-----------|| my-group | my-ns/old-api | my-bundle |Plans has changed for groups:| GROUP | API | BUNDLE | PLAN ||----------|--------------|-----------|----------------------------|| my-group | my-ns/my-api | my-bundle | gold (rl: 1/1s, q: 1/750h) |API versions have been added:| API | VERSION | CURRENT ||--------|--------------------|---------|| my-api | my-api-v2 (v2.0.0) | true |APIs current version have changed:| API | BEFORE | AFTER ||--------|--------------------|--------------------|| my-api | my-api-v1 (v1.0.0) | my-api-v2 (v2.0.0) | Kustomize[​](https://doc.traefik.io/traefik-hub/static-analyzer#kustomize "Direct link to Kustomize") ------------------------------------------------------------------------------------------------------ `hub-static-analyzer` analyzes the content of raw manifests. Therefore, when using Kustomize, you must first generate your final manifest. To use Kustomize with an overlay, point your `--path` to the overlay directory. This can be achieved by running the following command: kubectl kustomize /path/to/manifests -o /tmp/kustomizedhub-static-analyzer lint -p /tmp/kustomized When using [Flux](https://fluxcd.io/ "Link to Flux website") , you may rely on variable substitutions. `hub-static-analyzer` will fail to analyze your files if they contain such variables. In this case, you'll need to substitute variables before running the static analysis: go install github.com/drone/envsubst/cmd/envsubst@latest# Or install the `gettext-base` package on Debian/Ubuntu or `gettext` on CentOS/RHEL/Fedora/Archexport MY_VARIABLE=MY_VALUEkubectl kustomize /path/to/manifests -o /tmp/kustomized | $GOPATH/bin/envsubst | yq --split-exp '.metadata.name + "." + $index + ".yaml"' --no-dochub-static-analyzer lint -p /tmp/kustomized * [Introduction](https://doc.traefik.io/traefik-hub/static-analyzer#introduction) * [Install](https://doc.traefik.io/traefik-hub/static-analyzer#install) * [Lint](https://doc.traefik.io/traefik-hub/static-analyzer#lint) * [Diff](https://doc.traefik.io/traefik-hub/static-analyzer#diff) * [Kustomize](https://doc.traefik.io/traefik-hub/static-analyzer#kustomize) --- # How to Use API Key Authentication | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#__docusaurus_skipToContent_fallback) On this page How to use API keys in the API Portal to authorize and test APIs. * * * Key Authorization[​](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#key-authorization "Direct link to Key Authorization") ---------------------------------------------------------------------------------------------------------------------------------- 1. Choose the API you want to use, this example uses the _Ticket API_. 2. Second, select the endpoint you want to use. 3. Third, choose the authorization type for the API and add your API key. **Bearer token:** The API key is included in the request header. **API key:** You send the key-value pair to the API as query parameter. 4. Paste your API Key. 5. Set the limit. 6. Select **Send API Request**. 7. View the output. https://dev.example.com/collections/travel-collection/apis/ticket-api@apps#/operations/getTickets ![API Portal.](https://doc.traefik.io/traefik-hub-poc/assets/images/portal-request-0e718a1cb9952106454ac664d2665626.png "Picture of an API Portal.") CLI[​](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#cli "Direct link to CLI") ---------------------------------------------------------------------------------------- The following examples show how to use [curl](https://curl.se/ "Link to website of curl") and [HTTPIe](https://httpie.io/ "Link to website of HTTPIe") to send API requests using an API key for authentication. | Field | Description | | --- | --- | | `$PORTAL-URL` | The base URL of your Portal, for example `api.example.com`. | | `$API-KEY` | The API key of the consumer | ### Examples[​](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#examples "Direct link to Examples") #### API Key In Header[​](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#api-key-in-header "Direct link to API Key In Header") * Curl Command * Output CLI curl -X 'GET' \ 'https://$PORTAL-URL/tickets/tickets' \ -H 'accept: application/json' \ -H 'Authorization: Bearer $API-KEY' CLI curl -X 'GET' \ 'https://$PORTAL-URL/tickets/tickets' \ -H 'accept: application/json' \ -H 'Authorization: Bearer $API-KEY'[ { "id": 1, "flightCode": "TL123", "fare": 500, "class": "first", "available": 5, "total": 20 }, { "id": 2, "flightCode": "TL234", "fare": 200, "class": "economy", "available": 2, "total": 5 }, { "id": 3, "flightCode": "TL345", "fare": 300, "class": "business", "available": 3, "total": 10 }] #### API Key In Query Param[​](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#api-key-in-query-param "Direct link to API Key In Query Param") * Curl Command * Output CLI curl -X 'GET' \ 'https://$PORTAL_URL/tickets/tickets?limit=1&api_key=$API-KEY' \ -H 'accept: application/json' CLI curl -X 'GET' \ 'https://$PORTAL_URL/tickets/tickets?limit=1&api_key=$API-KEY' \ -H 'accept: application/json'[ { "id": 1, "flightCode": "TL123", "fare": 500, "class": "first", "available": 5, "total": 20 }, { "id": 2, "flightCode": "TL234", "fare": 200, "class": "economy", "available": 2, "total": 5 }, { "id": 3, "flightCode": "TL345", "fare": 300, "class": "business", "available": 3, "total": 10 }] * [Key Authorization](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#key-authorization) * [CLI](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#cli) * [Examples](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#examples) * [API Key In Header](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#api-key-in-header) * [API Key In Query Param](https://doc.traefik.io/traefik-hub-poc/portal/key-auth#api-key-in-query-param) --- # 57 docs tagged with "HTTP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/http#__docusaurus_skipToContent_fallback) [AddPrefix\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-add-prefix) Learn how to implement the HTTP AddPrefix middleware in Traefik Hub to update request paths before being forwarded. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-api-key) Traefik Hub - API Key authentication middleware. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/ref-api-key) Traefik Hub - API Key authentication middleware. [BasicAuth\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-basic-auth) The HTTP basic authentication (BasicAuth) middleware in Traefik Hub restricts access to Services to known users. [Buffering\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-buffering) The HTTP buffering middleware in Traefik Hub limits the size of requests that can be forwarded to Services. [Chain Middlewares\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [Chain Middlewares\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [Chat Completion\ ---------------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/chat-completion) Traefik Hub – Configure the Chat Completion middleware for the AI Gateway. [CircuitBreaker\ --------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-circuitbreaker) The HTTP circuit breaker prevents stacking requests to unhealthy Services, resulting in cascading failures. [Compress\ --------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-compress) The compress middleware lets you compress responses before sending them to the client. [Content Guard\ -------------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/content-guard) Traefik Hub - Learn how to configure the Content Guard middleware for the AI & API gateway. [ContentType\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-content-type) Traefik Hub's HTTP middleware automatically sets the \`Content-Type\` header value when it is not set by the backend. [Coraza Web Application Firewall\ -------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-coraza-waf) The HTTP Coraza middleware in Traefik Proxy provides web application firewall capabilities [DigestAuth\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-digest-auth) HTTP DigestAuth middleware restricts access to your services to known users. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy [Error Pages\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-errors) The Errors middleware returns custom pages according to configured ranges of HTTP Status codes. [Force Case\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-force-case) The HTTP Force Case middleware enforces specific header casing for requests and responses. [ForwardAuth\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-forward-auth) The HTTP ForwardAuth middleware delegates authentication to an external Service. [GrpcWeb\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-grpc-web) GrpcWeb converts a gRPC Web requests to HTTP/2 gRPC requests. [Headers\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-headers) The HTTP headers middleware manages the headers of requests and responses. [HMAC\ ----](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-hmac) The HMAC Middleware allows you secure your APIs using the HMAC mechanism. [HTTP Cache\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-httpcache) The HTTP Cache Middleware allows you to add caching to your routers and improve the performance of your infrastructure. [InFlightReq\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-in-flight-req) The InFlightReq HTTP middleware lets you limit the number of simultaneous in-flight requests. [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [LDAP Authentication\ -------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-ldap) Traefik Hub - Learn how to configure the LDAP Authentication middleware for Ingress management. [LLM Guard\ ---------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/llm-guard) Traefik Hub - Learn how to configure the LLM Guard middleware for flexible content security in the AI Gateway. [Manage the errors\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/errors) This middleware allows substituting error responses. [Model Context Protocol (MCP)\ ----------------------------](https://doc.traefik.io/traefik-hub/mcp-gateway/mcp) Traefik Hub - Configure the MCP middleware for secure access control and governance of MCP servers. [Modify the Requests and the Responses\ -------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/modify) This middleware allows modifying the requests and the responses. [OAuth 2.1 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oauth-client-creds) The OAuth 2.1 Client Credentials Authentication middleware secures your applications using the client credentials flow [OAuth 2.1 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oauth-cc) The OAuth 2.1 Client Credentials Authentication middleware secures your applications using the client credentials flow. [OAuth 2.1 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oauth-introspection) Traefik Hub - OAuth 2.1 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.1 server. [OAuth 2.1 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oauth-token-intro) The OAuth 2.1 Token Introspection Authentication middleware secures your applications using the Token Introspection flow. [Open Policy Agent\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-opa) The Open Policy Agent (OPA) middleware that allows you to restrict access to your services. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [Query Parameter\ ---------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-query-param) The Query Parameter middleware allows manipulation of query parameters in HTTP requests before forwarding them to services. [Query Parameter Manipulation\ ----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/query-param) Learn how to use the Query Parameter middleware to manipulate query parameters in HTTP requests [RateLimit\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests [Redirect the requests\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/redirect) This middleware allows redirecting the traffic from one port to another one. [RedirectRegex\ -------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-redirect-regex) RedirectRegex redirecting clients to different locations. [RedirectScheme\ --------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-redirect-scheme) RedirectScheme redirects clients to different schemes/ports. [ReplacePath\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-replace-path) ReplacePath updates paths before forwarding requests. [ReplacePathRegex\ ----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-replace-path-regex) ReplacePathRegex updates paths before forwarding requests, using a regex. [Retry\ -----](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-retry) Retry requests to a backend server until it succeeds. [Secure Access with Distributed Rate Limit and OIDC\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/rl-oidc) Traefik Hub - The Distributed RateLimit middleware ensures that requests are limited over time throughout your cluster and not only on an individual proxy while the OIDC authentication middleware secures your applications by delegating the authentication to an external provider. [Security & CORS Headers\ -----------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/headers) The HTTP headers middleware manages the headers of requests and responses. [Semantic Cache\ --------------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/semantic-cache) Traefik Hub - Learn how to configure the Semantic Cache middleware for the AI gateway. [StripPrefix\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-strip-prefix) StripPrefix removes prefixes from paths before forwarding requests. [StripPrefixRegex\ ----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-strip-prefix-regex) StripPrefixRegex removes prefixes from paths before forwarding requests, using regex. Read the technical documentation. [Traefik Hub AI Gateway\ ----------------------](https://doc.traefik.io/traefik-hub/ai-gateway/overview) Traefik Hub - Learn how to configure the AI Gateway. --- # 60 docs tagged with "Middleware" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/tags/middleware#__docusaurus_skipToContent_fallback) [TCP - IPAllowList\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/tcp/middlewares/ref-ip-allow-list) Use IPAllowList in TCP middleware for limiting clients to specific IPs in Traefik Hub. [AddPrefix\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-add-prefix) Learn how to implement the HTTP AddPrefix middleware in Traefik Hub to update request paths before being forwarded. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-api-key) Traefik Hub - API Key authentication middleware. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/ref-api-key) Traefik Hub - API Key authentication middleware. [BasicAuth\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-basic-auth) The HTTP basic authentication (BasicAuth) middleware in Traefik Hub restricts access to Services to known users. [Buffering\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-buffering) The HTTP buffering middleware in Traefik Hub limits the size of requests that can be forwarded to Services. [Chain Middlewares\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [Chain Middlewares\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [Chat Completion\ ---------------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/chat-completion) Traefik Hub – Configure the Chat Completion middleware for the AI Gateway. [CircuitBreaker\ --------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-circuitbreaker) The HTTP circuit breaker prevents stacking requests to unhealthy Services, resulting in cascading failures. [Compress\ --------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-compress) The compress middleware lets you compress responses before sending them to the client. [Content Guard\ -------------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/content-guard) Traefik Hub - Learn how to configure the Content Guard middleware for the AI & API gateway. [ContentType\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-content-type) Traefik Hub's HTTP middleware automatically sets the \`Content-Type\` header value when it is not set by the backend. [Coraza Web Application Firewall\ -------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-coraza-waf) The HTTP Coraza middleware in Traefik Proxy provides web application firewall capabilities [DigestAuth\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-digest-auth) HTTP DigestAuth middleware restricts access to your services to known users. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy [Error Pages\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-errors) The Errors middleware returns custom pages according to configured ranges of HTTP Status codes. [Force Case\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-force-case) The HTTP Force Case middleware enforces specific header casing for requests and responses. [ForwardAuth\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-forward-auth) The HTTP ForwardAuth middleware delegates authentication to an external Service. [GrpcWeb\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-grpc-web) GrpcWeb converts a gRPC Web requests to HTTP/2 gRPC requests. [Headers\ -------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-headers) The HTTP headers middleware manages the headers of requests and responses. [HMAC\ ----](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-hmac) The HMAC Middleware allows you secure your APIs using the HMAC mechanism. [HTTP Cache\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-httpcache) The HTTP Cache Middleware allows you to add caching to your routers and improve the performance of your infrastructure. [InFlightReq\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-in-flight-req) The InFlightReq HTTP middleware lets you limit the number of simultaneous in-flight requests. [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [LDAP Authentication\ -------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-ldap) Traefik Hub - Learn how to configure the LDAP Authentication middleware for Ingress management. [LLM Guard\ ---------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/llm-guard) Traefik Hub - Learn how to configure the LLM Guard middleware for flexible content security in the AI Gateway. [Manage the errors\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/errors) This middleware allows substituting error responses. [Middleware\ ----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-middlewares-overview) There are several available middleware in Traefik Hub used to modify requests or headers, take charge of redirections, add authentication, and so on [Modify the Requests and the Responses\ -------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/modify) This middleware allows modifying the requests and the responses. [OAuth 2.1 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oauth-client-creds) The OAuth 2.1 Client Credentials Authentication middleware secures your applications using the client credentials flow [OAuth 2.1 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oauth-cc) The OAuth 2.1 Client Credentials Authentication middleware secures your applications using the client credentials flow. [OAuth 2.1 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oauth-introspection) Traefik Hub - OAuth 2.1 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.1 server. [OAuth 2.1 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oauth-token-intro) The OAuth 2.1 Token Introspection Authentication middleware secures your applications using the Token Introspection flow. [Open Policy Agent\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-opa) The Open Policy Agent (OPA) middleware that allows you to restrict access to your services. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [Query Parameter\ ---------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-query-param) The Query Parameter middleware allows manipulation of query parameters in HTTP requests before forwarding them to services. [Query Parameter Manipulation\ ----------------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/query-param) Learn how to use the Query Parameter middleware to manipulate query parameters in HTTP requests [RateLimit\ ---------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests [Redirect the requests\ ---------------------](https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/redirect) This middleware allows redirecting the traffic from one port to another one. [RedirectRegex\ -------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-redirect-regex) RedirectRegex redirecting clients to different locations. [RedirectScheme\ --------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-redirect-scheme) RedirectScheme redirects clients to different schemes/ports. [ReplacePath\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-replace-path) ReplacePath updates paths before forwarding requests. [ReplacePathRegex\ ----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-replace-path-regex) ReplacePathRegex updates paths before forwarding requests, using a regex. [Retry\ -----](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-retry) Retry requests to a backend server until it succeeds. [Secure Access with Distributed Rate Limit and OIDC\ --------------------------------------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/rl-oidc) Traefik Hub - The Distributed RateLimit middleware ensures that requests are limited over time throughout your cluster and not only on an individual proxy while the OIDC authentication middleware secures your applications by delegating the authentication to an external provider. [Security & CORS Headers\ -----------------------](https://doc.traefik.io/traefik-hub/api-gateway/secure/middleware/headers) The HTTP headers middleware manages the headers of requests and responses. [Semantic Cache\ --------------](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/semantic-cache) Traefik Hub - Learn how to configure the Semantic Cache middleware for the AI gateway. [StripPrefix\ -----------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-strip-prefix) StripPrefix removes prefixes from paths before forwarding requests. [StripPrefixRegex\ ----------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-strip-prefix-regex) StripPrefixRegex removes prefixes from paths before forwarding requests, using regex. Read the technical documentation. [TCP - InFlightConn\ ------------------](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/tcp/middlewares/ref-in-flight-conn) Limiting the number of simultaneous connections. [Traefik Hub AI Gateway\ ----------------------](https://doc.traefik.io/traefik-hub/ai-gateway/overview) Traefik Hub - Learn how to configure the AI Gateway. [Upstream Authentication\ -----------------------](https://doc.traefik.io/traefik-hub/authentication-authorization/upstream-authentication) How to implement upstream authentication patterns with Traefik Hub API Management --- # Networking | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/operations/networking#__docusaurus_skipToContent_fallback) On this page Documentation about networking details related to Traefik Hub. * * * Internet Address Requirements[​](https://doc.traefik.io/traefik-hub-poc/operations/networking#internet-address-requirements "Direct link to Internet Address Requirements") ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The Traefik Hub agent needs to be able to communicate with Traefik Hub. Please make sure to allow **outgoing requests** to all IPs listed on our [IP overview page](https://hub.traefik.io/ips "Link to IP overview list") on all ports (1-65535). There will be **no** incoming requests from the listed IPs! note The [list of IPs](https://hub.traefik.io/ips "Link to IP overview list") is dynamic and changes over time. * [Internet Address Requirements](https://doc.traefik.io/traefik-hub-poc/operations/networking#internet-address-requirements) --- # Networking | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/operations/networking#__docusaurus_skipToContent_fallback) On this page Documentation about networking details related to Traefik Hub. * * * Internet Address Requirements[​](https://doc.traefik.io/traefik-hub-v2/operations/networking#internet-address-requirements "Direct link to Internet Address Requirements") --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The Traefik Hub agent needs to be able to communicate with Traefik Hub. Please make sure to allow **outgoing requests** to all IPs listed on our [IP overview page](https://hub.traefik.io/ips "Link to IP overview list") on all ports (1-65535). There will be **no** incoming requests from the listed IPs! note The [list of IPs](https://hub.traefik.io/ips "Link to IP overview list") is dynamic and changes over time. * [Internet Address Requirements](https://doc.traefik.io/traefik-hub-v2/operations/networking#internet-address-requirements) --- # Consumer Authentication | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#__docusaurus_skipToContent_fallback) On this page API Consumer authentication methods overview. * * * Introduction[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#introduction "Direct link to Introduction") -------------------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub supports the following methods for API Consumer authentication: * [Key Authentication](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#key-authentication "Link to documentation about API Key authentication below") * [JWT](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#jwt "Link to documentation about JWT authentication below") Authentication Methods[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#authentication-methods "Direct link to Authentication Methods") -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### Key Authentication[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#key-authentication "Direct link to Key Authentication") Key authentication for APIs is a method that utilizes unique keys to authenticate and authorize access to APIs. API consumers can generate API keys in the Traefik Hub Portal or use [JWT](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#jwt "Link to JWT overview") (JSON Web Token) to authorize. [API keys are managed via the API Portal](https://doc.traefik.io/traefik-hub-poc/portal/key-auth "Link to documentation about how to configure API keys in the API Portal") and stored in Traefik Hub. Read More [Follow the detailed documentation about API Key authentication](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/key-authentication "Link to the detailed API Key authentication documentation") . [Learn how to create API Keys in the API Portal](https://doc.traefik.io/traefik-hub-poc/portal/key-auth) . * * * ### JWT[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#jwt "Direct link to JWT") JWT, or JSON Web Token, is a compact and self-contained method for transmitting information between parties as a JSON object. JWTs are used to control the access to APIs and API Gateways. Read More Please head over to our [JWT overview](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/jwt-overview "Link to JTW overview documentation") for more detailed documentation. * * * Related Content[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#related-content "Direct link to Related Content") ----------------------------------------------------------------------------------------------------------------------------------------------------------------- * Read how to use [API Key authentication](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/key-authentication "Link to documentation explaining how to use API Key authentication") . * Learn how to use [JWT validation with Keycloak](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt "Link to documentation explaining how to validate JWT with Keycloak") . * See how to validate [JWT with Okta](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/okta-jwt "Link to documentation explaining how to validate JWT with Okta") . * [Introduction](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#introduction) * [Authentication Methods](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#authentication-methods) * [Key Authentication](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#key-authentication) * [JWT](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#jwt) * [Related Content](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/consumer-authentication#related-content) --- # Consumer Authentication | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#__docusaurus_skipToContent_fallback) On this page API Consumer authentication methods overview. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#introduction "Direct link to Introduction") ------------------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub supports the following methods for API Consumer authentication: * [Key Authentication](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#key-authentication "Link to documentation about API Key authentication below") * [JWT](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#jwt "Link to documentation about JWT authentication below") Authentication Methods[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#authentication-methods "Direct link to Authentication Methods") ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### Key Authentication[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#key-authentication "Direct link to Key Authentication") Key authentication for APIs is a method that utilizes unique keys to authenticate and authorize access to APIs. API consumers can generate API keys in the Traefik Hub Portal or use [JWT](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#jwt "Link to JWT overview") (JSON Web Token) to authorize. [API keys are managed via the API Portal](https://doc.traefik.io/traefik-hub-v2/portal/key-auth "Link to documentation about how to configure API keys in the API Portal") and stored in Traefik Hub. Read More [Follow the detailed documentation about API Key authentication](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/key-authentication "Link to the detailed API Key authentication documentation") . [Learn how to create API Keys in the API Portal](https://doc.traefik.io/traefik-hub-v2/portal/key-auth) . * * * ### JWT[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#jwt "Direct link to JWT") JWT, or JSON Web Token, is a compact and self-contained method for transmitting information between parties as a JSON object. JWTs are used to control the access to APIs and API Gateways. Read More Please head over to our [JWT overview](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview "Link to JTW overview documentation") for more detailed documentation. * * * Related Content[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#related-content "Direct link to Related Content") ---------------------------------------------------------------------------------------------------------------------------------------------------------------- * Read how to use [API Key authentication](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/key-authentication "Link to documentation explaining how to use API Key authentication") . * Learn how to use [JWT validation with Keycloak](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/keycloak-jwt "Link to documentation explaining how to validate JWT with Keycloak") . * See how to validate [JWT with Okta](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt "Link to documentation explaining how to validate JWT with Okta") . * [Introduction](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#introduction) * [Authentication Methods](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#authentication-methods) * [Key Authentication](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#key-authentication) * [JWT](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#jwt) * [Related Content](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication#related-content) --- # Custom Domains | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#__docusaurus_skipToContent_fallback) On this page This page explains how to use Traefik Hub with custom domains. * * * Introduction[​](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#introduction "Direct link to Introduction") ----------------------------------------------------------------------------------------------------------------------------- Custom domains allow you to make your Portal or Gateway accessible at your own domain names (for example, _`api.example.com`_). By using custom domains, you connect your API Portal or Gateway directly from Traefik Hub to your infrastructure without using random subdomains under the _traefikhub.io_ namespace. warning We highly recommend the use of custom domains for production deployments! Domains generated by Traefik Hub will change with every redeployment, resulting in a new domain. You can control the generation of _traefikhub.io_ domains in the [workspace settings](https://doc.traefik.io/traefik-hub-poc/dashboard/workspace-settings#workspace-settings "Link to documentation about turning off *traefikhub.io* domains") . Configure a Custom Domain[​](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#configure-a-custom-domain "Direct link to Configure a Custom Domain") -------------------------------------------------------------------------------------------------------------------------------------------------------------------- On your DNS provider’s site, add a `CNAME` record for the [DNS-01 challenge](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-01-challenge) and a `A` record with your custom domain name (for example, _`api.example.com`_). ### DNS CNAME Record[​](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-cname-record "Direct link to DNS CNAME Record") A DNS `CNAME` (Canonical Name) record is a type of DNS (Domain Name System) record that's used to create an alias or alternative name for a domain or subdomain. It allows you to associate a domain or subdomain with another domain or subdomain. _acme-challenge.api.example.com. CNAME acme-challenge.traefikhub.io. In the above example, _`_acme-challenge.api.example.com.`_ is configured as `CNAME` of _`acme-challenge.traefikhub.io.`_ which is needed for the [DNS-01 challenge](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-01-challenge) . ### DNS A Record[​](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-a-record "Direct link to DNS A Record") A DNS `A` (Address) record is a type of DNS (Domain Name System) record that's used to map a domain or subdomain to an IPv4 (Internet Protocol version 4) address. It associates a domain name with the corresponding IP address, allowing DNS resolvers to translate human-readable domain names into machine-readable IP addresses. When a DNS lookup is performed for a domain or subdomain with an `A` record, the DNS resolver queries the authoritative DNS server for the IP address associated with that domain or subdomain. The DNS server then responds with the IPv4 address specified in the `A` record. Here's an example of how an `A` record looks: api.example.com. IN A 192.0.2.10 In this example, the `A` record maps the domain _`api.example.com`_ to the IPv4 address _`192.0.2.10`_ (the external IP of your public load-balancer). When someone tries to access _`api.example.com`_ in a web browser, their computer performs a DNS lookup to find the IP address associated with the domain. If the `A` record is properly configured, it will receive the IP address _`192.0.2.10`_ as the response. Once, you're done, your configuration should look like the following example: _acme-challenge.api.example.com. CNAME acme-challenge.traefikhub.io.api.example.com. A 192.0.2.10 Where _`192.0.2.10`_ is the external IP address of your public load-balancer. DNS-01 Challenge[​](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-01-challenge "Direct link to DNS-01 Challenge") ----------------------------------------------------------------------------------------------------------------------------------------- Behind the scenes, Traefik Hub uses [ACME DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge "Let’s Encrypt documentation about DNS-01") challenge type to get the certificates for your custom domains. This challenge asks you to prove that you control the DNS for your domain name. For better security, Traefik Hub uses `CNAME` records to delegate the validation to an external domain (no credentials needed, the ACME client will query the DNS system for validation). * * * Related Content[​](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#related-content "Direct link to Related Content") -------------------------------------------------------------------------------------------------------------------------------------- * Please visit the Let’s Encrypt documentation about [ACME DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge "Let’s Encrypt documentation about DNS-01") to learn more. * [Introduction](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#introduction) * [Configure a Custom Domain](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#configure-a-custom-domain) * [DNS CNAME Record](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-cname-record) * [DNS A Record](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-a-record) * [DNS-01 Challenge](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#dns-01-challenge) * [Related Content](https://doc.traefik.io/traefik-hub-poc/operations/custom-domains#related-content) --- # Custom Domains | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#__docusaurus_skipToContent_fallback) On this page This page explains how to use Traefik Hub with custom domains. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#introduction "Direct link to Introduction") ---------------------------------------------------------------------------------------------------------------------------- Custom domains allow you to make your Portal or Gateway accessible at your own domain names (for example, _`api.example.com`_). By using custom domains, you connect your API Portal or Gateway directly from Traefik Hub to your infrastructure without using random subdomains under the _traefikhub.io_ namespace. warning We highly recommend the use of custom domains for production deployments! Domains generated by Traefik Hub will change with every redeployment, resulting in a new domain. You can control the generation of _traefikhub.io_ domains in the [workspace settings](https://doc.traefik.io/traefik-hub-v2/dashboard/workspace-settings#workspace-settings "Link to documentation about turning off *traefikhub.io* domains") . Configure a Custom Domain[​](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#configure-a-custom-domain "Direct link to Configure a Custom Domain") ------------------------------------------------------------------------------------------------------------------------------------------------------------------- On your DNS provider’s site, add a `CNAME` record for the [DNS-01 challenge](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-01-challenge) and a `A` record with your custom domain name (for example, _`api.example.com`_). ### DNS CNAME Record[​](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-cname-record "Direct link to DNS CNAME Record") A DNS `CNAME` (Canonical Name) record is a type of DNS (Domain Name System) record that's used to create an alias or alternative name for a domain or subdomain. It allows you to associate a domain or subdomain with another domain or subdomain. _acme-challenge.api.example.com. CNAME acme-challenge.traefikhub.io. In the above example, _`_acme-challenge.api.example.com.`_ is configured as `CNAME` of _`acme-challenge.traefikhub.io.`_ which is needed for the [DNS-01 challenge](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-01-challenge) . ### DNS A Record[​](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-a-record "Direct link to DNS A Record") A DNS `A` (Address) record is a type of DNS (Domain Name System) record that's used to map a domain or subdomain to an IPv4 (Internet Protocol version 4) address. It associates a domain name with the corresponding IP address, allowing DNS resolvers to translate human-readable domain names into machine-readable IP addresses. When a DNS lookup is performed for a domain or subdomain with an `A` record, the DNS resolver queries the authoritative DNS server for the IP address associated with that domain or subdomain. The DNS server then responds with the IPv4 address specified in the `A` record. Here's an example of how an `A` record looks: api.example.com. IN A 192.0.2.10 In this example, the `A` record maps the domain _`api.example.com`_ to the IPv4 address _`192.0.2.10`_ (the external IP of your public load-balancer). When someone tries to access _`api.example.com`_ in a web browser, their computer performs a DNS lookup to find the IP address associated with the domain. If the `A` record is properly configured, it will receive the IP address _`192.0.2.10`_ as the response. Once, you're done, your configuration should look like the following example: _acme-challenge.api.example.com. CNAME acme-challenge.traefikhub.io.api.example.com. A 192.0.2.10 Where _`192.0.2.10`_ is the external IP address of your public load-balancer. DNS-01 Challenge[​](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-01-challenge "Direct link to DNS-01 Challenge") ---------------------------------------------------------------------------------------------------------------------------------------- Behind the scenes, Traefik Hub uses [ACME DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge "Let’s Encrypt documentation about DNS-01") challenge type to get the certificates for your custom domains. This challenge asks you to prove that you control the DNS for your domain name. For better security, Traefik Hub uses `CNAME` records to delegate the validation to an external domain (no credentials needed, the ACME client will query the DNS system for validation). * * * Related Content[​](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#related-content "Direct link to Related Content") ------------------------------------------------------------------------------------------------------------------------------------- * Please visit the Let’s Encrypt documentation about [ACME DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge "Let’s Encrypt documentation about DNS-01") to learn more. * [Introduction](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#introduction) * [Configure a Custom Domain](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#configure-a-custom-domain) * [DNS CNAME Record](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-cname-record) * [DNS A Record](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-a-record) * [DNS-01 Challenge](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#dns-01-challenge) * [Related Content](https://doc.traefik.io/traefik-hub-v2/operations/custom-domains#related-content) --- # Identity Providers | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#__docusaurus_skipToContent_fallback) On this page This page explains how to manage access to API Portals and how to control API and API Gateway access. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#introduction "Direct link to Introduction") ------------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub uses [Identity Providers (IdPs)](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#idp "Link to IdP documentation below") to manage user identities and to authorize access to API Portals. In conjunction, [API keys](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/key-authentication "Link to documentation about authentication with API keys") or [JSON Web Tokens (JWT)](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview "Link to JWT overview") are used to control the [access](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#consuming-apis "Link to documentation about API access") to APIs and API Gateways. In Traefik Hub, an IdP serves as the foundation for user authentication, while API keys or JWTs play a key role in authorizing users to access APIs. * * * IdP[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#idp "Direct link to IdP") ---------------------------------------------------------------------------------------------------------------------- An identity provider (IdP) is a centralized system or service responsible for verifying users’ identities. You can use Traefik Hub to manage your users and groups (internal IdP), or you can use an external IdP, such as Keycloak or Okta. ### Internal[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#internal "Direct link to Internal") All [user management](https://doc.traefik.io/traefik-hub-v2/api-management/users-and-groups "Link to documentation about users and groups management") is done through the internal IdP. Traefik Hub will manage all users, groups, and tokens. This is the **default** configuration. ### External[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#external "Direct link to External") Traefik Hub supports [Keycloak](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/keycloak "Link to documentation about how to use Traefik Hub with Keycloak as IdP") and [Okta](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/okta "Link to documentation about how to use Traefik Hub with Okta as IdP") . When using an external IdP all user management is done via this IdP, Traefik Hub will only sync the user and groups into its own database. It is not possible to create, for example, a new user or user group in Traefik Hub. [📄️ Keycloak\ ------------\ \ How to use Keycloak as the identity provider (IdP) for Traefik Hub.](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/keycloak) [📄️ Okta\ --------\ \ How to use Okta as the identity provider (IdP) for Traefik Hub.](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/okta) * * * Consuming APIs[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#consuming-apis "Direct link to Consuming APIs") ------------------------------------------------------------------------------------------------------------------------------------------------------- To consume APIs, a user needs to be part of a user group. Groups are a means of categorizing users. This allows for granting permissions to APIs for specific groups. When a user is a member of multiple groups, the user will inherit the permission level of the group with the most access. For more info, please refer to the [APIAccess CRD](https://doc.traefik.io/traefik-hub-v2/api-management/api-access "Link to APIAccess CRD") and the documentation about [user management](https://doc.traefik.io/traefik-hub-v2/api-management/users-and-groups "Link to documentation about user management in Traefik Hub") . Further, access to APIs and API Gateways is controlled by [API keys](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/key-authentication "Link to documentation about how to manage API keys in the Traefik Hub API Portal") or [JWTs](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview "Link to documentation about how to use JWT with Traefik Hub") . warning If you switch from the default configuration to JWT, all API keys generated in the API Portal will be **turned off**. * * * Related Content[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#related-content "Direct link to Related Content") ---------------------------------------------------------------------------------------------------------------------------------------------------------- * Learn how to use [Keycloak as an identity provider for Traefik Hub](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/keycloak "Link to documentation about how to use Keycloak with Traefik Hub") . * Read the documentation about how to use [Okta as IdP](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/okta "Link to documentation about how to use Okta as IdP") . * Learn how to use [JWT for authorization](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview "Link to JWT overview") . * See how to use [Okta for JWT validation](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt "documentation about how to use Okta for JWT validation") . * [Introduction](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#introduction) * [IdP](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#idp) * [Internal](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#internal) * [External](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#external) * [Consuming APIs](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#consuming-apis) * [Related Content](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider#related-content) --- # Identity Providers | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#__docusaurus_skipToContent_fallback) On this page This page explains how to manage access to API Portals and how to control API and API Gateway access. * * * Introduction[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#introduction "Direct link to Introduction") -------------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub uses [Identity Providers (IdPs)](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#idp "Link to IdP documentation below") to manage user identities and to authorize access to API Portals. In conjunction, [API keys](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/key-authentication "Link to documentation about authentication with API keys") or [JSON Web Tokens (JWT)](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/jwt-overview "Link to JWT overview") are used to control the [access](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#consuming-apis "Link to documentation about API access") to APIs and API Gateways. In Traefik Hub, an IdP serves as the foundation for user authentication, while API keys or JWTs play a key role in authorizing users to access APIs. * * * IdP[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#idp "Direct link to IdP") ----------------------------------------------------------------------------------------------------------------------- An identity provider (IdP) is a centralized system or service responsible for verifying users’ identities. You can use Traefik Hub to manage your users and groups (internal IdP), or you can use an external IdP, such as Keycloak or Okta. ### Internal[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#internal "Direct link to Internal") All [user management](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups "Link to documentation about users and groups management") is done through the internal IdP. Traefik Hub will manage all users, groups, and tokens. This is the **default** configuration. ### External[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#external "Direct link to External") Traefik Hub supports [Keycloak](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/keycloak "Link to documentation about how to use Traefik Hub with Keycloak as IdP") and [Okta](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/okta "Link to documentation about how to use Traefik Hub with Okta as IdP") . When using an external IdP all user management is done via this IdP, Traefik Hub will only sync the user and groups into its own database. It is not possible to create, for example, a new user or user group in Traefik Hub. [📄️ Keycloak\ ------------\ \ How to use Keycloak as the identity provider (IdP) for Traefik Hub.](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/keycloak) [📄️ Okta\ --------\ \ How to use Okta as the identity provider (IdP) for Traefik Hub.](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/okta) * * * Consuming APIs[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#consuming-apis "Direct link to Consuming APIs") -------------------------------------------------------------------------------------------------------------------------------------------------------- To consume APIs, a user needs to be part of a user group. Groups are a means of categorizing users. This allows for granting permissions to APIs for specific groups. When a user is a member of multiple groups, the user will inherit the permission level of the group with the most access. For more info, please refer to the [APIAccess CRD](https://doc.traefik.io/traefik-hub-poc/api-management/api-access "Link to APIAccess CRD") and the documentation about [user management](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups "Link to documentation about user management in Traefik Hub") . Further, access to APIs and API Gateways is controlled by [API keys](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/key-authentication "Link to documentation about how to manage API keys in the Traefik Hub API Portal") or [JWTs](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/jwt-overview "Link to documentation about how to use JWT with Traefik Hub") . warning If you switch from the default configuration to JWT, all API keys generated in the API Portal will be **turned off**. * * * Related Content[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#related-content "Direct link to Related Content") ----------------------------------------------------------------------------------------------------------------------------------------------------------- * Learn how to use [Keycloak as an identity provider for Traefik Hub](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/keycloak "Link to documentation about how to use Keycloak with Traefik Hub") . * Read the documentation about how to use [Okta as IdP](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/okta "Link to documentation about how to use Okta as IdP") . * Learn how to use [JWT for authorization](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/jwt-overview "Link to JWT overview") . * See how to use [Okta for JWT validation](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/okta-jwt "documentation about how to use Okta for JWT validation") . * [Introduction](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#introduction) * [IdP](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#idp) * [Internal](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#internal) * [External](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#external) * [Consuming APIs](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#consuming-apis) * [Related Content](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider#related-content) --- # Okta JWT Configuration | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#__docusaurus_skipToContent_fallback) On this page How to configure Okta for JWT. * * * warning If you switch from the default configuration to JSON Web Tokens, all API keys generated in the API Portal will be **turned off**. This walk-through covers a basic example configuration of Okta using the minimal needed settings, please **don't** use it in production! ### Requirements[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#requirements "Direct link to Requirements") Please ensure you have the following: * An Okta instance with admin permissions. * [Admin permissions](https://doc.traefik.io/traefik-hub-v2/dashboard/workspace-settings "Link to documentation about workspace roles in Traefik Hub") for the Traefik Hub workspace. * `curl` * * * ### Create an Authorization Server[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#create-an-authorization-server "Direct link to Create an Authorization Server") As the first step, create a [custom authorization](https://developer.okta.com/docs/concepts/auth-servers/#custom-authorization-server "Link to Okta documentation about creating a custom authorization server") server in Okta. Browse to **Security** → **API** and select **Add Authorization Server**. ![Create custom Okta authorization server](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-create-auth-server1-7bf8b6aab329ff0168b82cdce64d657e.png "Create custom Okta authorization server") Enter the **Name**, **Audience**[1](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#user-content-fn-1) , and **Description** for the authorization server. ![Custom auth server form](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-create-auth-server2-af673654d7b91bc5d8daed156b5a8121.png "Custom auth server form") #### Add an Access Policy[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#add-an-access-policy "Direct link to Add an Access Policy") Now it is time to add an [access policy](https://developer.okta.com/docs/guides/configure-access-policy/main/ "Link to Okta documentation about access policies") to the new authorization server. In the overview of the new authorization server, select **Access Policies** followed by **Add New Access Policy**. ![Add a new access policy](https://doc.traefik.io/traefik-hub-v2/assets/images/add-new-access-policy-6723dc7143a12cb3ffbe761991c4bfff.png "Add a new access policy") Enter the **Name**, the **Description** and assign a client. In this example, the policy is assigned to all clients. ![Configure the ACP](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-configure-acp1-f7a64d8fff8d1b0353291b57b1c5df74.png "Configure the ACP") Once you're done, select **Create Policy**. ##### Add an Access Policy Rule After the new policy is created, it is time to add a new rule to the policy. In a [rule](https://developer.okta.com/docs/guides/configure-access-policy/main/#create-the-rule "Link to Okta documentation about access policy rules") , you define the access permissions. Select **Add rule** in the access policy overview. ![Add a new rule](https://doc.traefik.io/traefik-hub-v2/assets/images/select-add-rule-2e13e40d520a2e35df958d8a386e0148.png "Add a new rule") Enter a **Rule Name** and select **Create rule**. warning This example uses the default rule configuration. You may want to adjust that for your production environment. ![Configure the rule](https://doc.traefik.io/traefik-hub-v2/assets/images/configure-rule-e62c9e5831abac23df11256c622a9f26.png "Configure the rule") #### Claims[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#claims "Direct link to Claims") As the last part of the custom authorization server configuration, you will add a [custom claim](https://help.okta.com/en-us/content/topics/security/api-config-claims.htm "Link to Okta documentation about claims") for _groups_. In Traefik Hub, every user must be a member of a user group. These groups are used to configure API access and rate limiting. Browse to **Security** → **API** choose the new authorization server, select **Claims**, choose **Add Claim** and provide the requested information. | Field | Description | Example | | --- | --- | --- | | Name | Name of the [claim](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview#claims "Link to documentation about claims in Traefik Hub")
needed by Traefik Hub. | _groups_ | | Include in token type | Select Access Token for(OAuth 2.0). For ID tokens, in the second dropdown, choose _Always_. | _Access Token_ and _Always_ | | Value type | Choose whether the values defined in the claim use a _Group_ filter or an _Expression_ written using the [Okta Expression Language](https://developer.okta.com/reference/okta_expression_language/ "Link toO kta Expression Language")
. | `.*` | | Disable claim | Check this option to temporarily disable the claim for testing or debugging. | Empty | | Include in | Specify whether the claim is valid for any scope, or select the scopes for which it’s valid. | Any Scope | ![Add custom claim](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-add-claim-8267a9527514281a766c6ce8f0dec5cb.png "Add custom claim") ![Configure custom claim](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-claim-config-895806198aa91200ce30f21a3f3bac0c.png "Configure custom claim") ### Create an Application Integration[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#create-an-application-integration "Direct link to Create an Application Integration") After you created and configured the custom authorization server, it's now time to create an [Okta application](https://help.okta.com/oag/en-us/content/topics/access-gateway/about-access-gateway-applications.htm "Link to Okta documentation about applications") . In the Okta admin panel, go to → **Applications** -→ **Applications** and select **Create App Integration**. ![Create integration](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-create-application1-59697cf3a9c4abafef468d162e38dc6e.png "Create integration") Select the following settings: * Sign-in method: _OIDC_ * Application type: _Native Application_ and Select **Next**. ![Create integration configuration](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-new-application-6c25eaec85d8cfdb5e35c34420a31c88.png "Create integration configuration]") In the following step, you will configure the new app integration. Select the following settings: * Grant type: _Resource Owner Password_ * Assignments (Controlled access): _Allow everyone in your organization to access_ and select **Save**. ![Configure the new app integration](https://doc.traefik.io/traefik-hub-v2/assets/images/okta-new-application-settings-5c55bcc5006d313085a03a6e71894ff9.png "Configure the new app integration") Congratulations, OKta is now ready to issue JWTs. ### Test the Configuration[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#test-the-configuration "Direct link to Test the Configuration") Use `curl` to generate a JWT and validate it against your Okta instance. Okta Authorization Server Documentation Please refer to the [Okta OpenID Connect & OAuth documentation](https://developer.okta.com/docs/reference/api/oidc/#_2-okta-as-the-identity-platform-for-your-app-or-api "Link to official Okra documentation about OpenID Connect & OAuth") to learn more about the Okta authorization settings used below. The following example uses the _password grant type_ as a validation method. CLI curl -L -s -X POST 'https://$your-okta-org/oauth2/${authorizationServerId}/v1/token' \-H 'Content-Type: application/x-www-form-urlencoded' \--data-urlencode '[email protected]' \--data-urlencode 'password=$your-secure-password' \--data-urlencode 'grant_type=password' \--data-urlencode 'scope=openid' \--data-urlencode 'client_id=$your-client-id'{"token_type":"Bearer","expires_in":3600,"access_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXIiOjEsImp0aSI6IkFULkZxUXZ4dzN1TmY5WWVLUXNadkluMWxROE9oUWNMM2ZwV2p4eEh6WFFXRVIiLCJpc3MiOiJodHRwczovL2Rldi1leGFtcGxlLm9rdGEuY29tL29hdXRoMi9hdXNkOHNsbmRpYVNnMXY0MTIzNCIsImF1ZCI6ImFwaTovL2h1YiIsImlhdCI6MTcwMDcyNzExOCwiZXhwIjoxNzAwNzMwNzE4LCJjaWQiOiIwb2FkOWZrbW81NjRUM2pSMzVlNiIsInVpZCI6IjAwdWRnZTJmcjBPcThJTXFLNWU2Iiwic2NwIjpbIm9wZW5pZCJdLCJhdXRoX3RpbWUiOjE3MDA3MjcxMjEsInN1YiI6ImphbmUuZG9lQHRyYWVmaWstYWlybGluZXMuaW8iLCJncm91cHMiOlsiRXZlcnlvbmUiXX0.8LHqpNnh-JxX-mb7YyTLPhnxYtSxSjQIWXIxmcsG6qA"} * * * Related Content[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#related-content "Direct link to Related Content") ------------------------------------------------------------------------------------------------------------------------------------------------- * Learn how to [enable JWT authentication in the dashboard](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview#enable-jwt-in-traefik-hub "Link to documentation about how to enable JWT in the dashboard") . * * * Footnotes[​](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#footnote-label "Direct link to Footnotes") ------------------------------------------------------------------------------------------------------------------------------------ 1. The recipients that the tokens are intended for. This becomes the audience claim in an access token. Currently, Okta supports only one audience. See the [official Okta documentation](https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server) . [↩](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#user-content-fnref-1) * [Requirements](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#requirements) * [Create an Authorization Server](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#create-an-authorization-server) * [Create an Application Integration](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#create-an-application-integration) * [Test the Configuration](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#test-the-configuration) * [Related Content](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt#related-content) --- # OpenAPI | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#__docusaurus_skipToContent_fallback) On this page Traefik Hub supports Swagger v2 and OpenAPI v3.0.x. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#introduction "Direct link to Introduction") -------------------------------------------------------------------------------------------------------------------------- OpenAPI, formerly known as Swagger, is an open standard specification for defining, documenting, and designing web APIs. OpenAPI uses a JSON or YAML format to describe the endpoints, data models, request and response parameters, and other details of an API. * * * Supported Versions[​](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#supported-versions "Direct link to Supported Versions") -------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub supports the following versions: * Swagger v2.0 * OpenAPI v3.0.x Supported file formats are _YAML_ and _JSON_. * * * Swagger v2[​](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#swagger-v2 "Direct link to Swagger v2") -------------------------------------------------------------------------------------------------------------------- It is possible to use API specs based on Swagger 2.0 with Traefik Hub. info Traefik Hub will automatically [convert](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#conversion "Link to documentation about conversion") the specification to OpenAPI v3.0.3. Because of the auto conversion, all OpenAPI files in the Portal are OpenAPI v3.0.3. ### Swagger Extensions[​](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#swagger-extensions "Direct link to Swagger Extensions") [Extensions](https://swagger.io/docs/specification/2-0/swagger-extensions/ "Link to official Swagger documentation about extensions") , are custom properties that can be added to a Swagger specification to provide extra information or behavior not covered by the standard specification. These extensions are denoted by starting with the `x- prefix`, for example `x-logo`. Traefik Hub will try to convert Swagger extensions to OpenAPI extensions during the conversion process. Good to know Not all Swagger extensions are supported by OpenAPI v3.x. For example, `x-example` in Swagger v2 changed to `example` in OpenAPI v3.0.0. That means that your converted spec will still have `x-example`\> in the source but, but example will be shown in the generated file in the Portal. ### Conversion[​](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#conversion "Direct link to Conversion") Under the hood, Traefik Hub uses [kin-openapi](https://github.com/getkin/kin-openapi "Link to kin-openapi on GitHub") to convert Swagger v2.0 to OpenAPI v3.0.3. If you face any problems with the conversion or if you're encountering issues with the converted specification, please get in contact with our support team. * [Introduction](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#introduction) * [Supported Versions](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#supported-versions) * [Swagger v2](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#swagger-v2) * [Swagger Extensions](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#swagger-extensions) * [Conversion](https://doc.traefik.io/traefik-hub-v2/reference/specs/openapi#conversion) --- # OpenAPI | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#__docusaurus_skipToContent_fallback) On this page Traefik Hub supports Swagger v2 and OpenAPI v3.0.x. * * * Introduction[​](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#introduction "Direct link to Introduction") --------------------------------------------------------------------------------------------------------------------------- OpenAPI, formerly known as Swagger, is an open standard specification for defining, documenting, and designing web APIs. OpenAPI uses a JSON or YAML format to describe the endpoints, data models, request and response parameters, and other details of an API. * * * Supported Versions[​](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#supported-versions "Direct link to Supported Versions") --------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub supports the following versions: * Swagger v2.0 * OpenAPI v3.0.x Supported file formats are _YAML_ and _JSON_. * * * Swagger v2[​](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#swagger-v2 "Direct link to Swagger v2") --------------------------------------------------------------------------------------------------------------------- It is possible to use API specs based on Swagger 2.0 with Traefik Hub. info Traefik Hub will automatically [convert](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#conversion "Link to documentation about conversion") the specification to OpenAPI v3.0.3. Because of the auto conversion, all OpenAPI files in the Portal are OpenAPI v3.0.3. ### Swagger Extensions[​](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#swagger-extensions "Direct link to Swagger Extensions") [Extensions](https://swagger.io/docs/specification/2-0/swagger-extensions/ "Link to official Swagger documentation about extensions") , are custom properties that can be added to a Swagger specification to provide extra information or behavior not covered by the standard specification. These extensions are denoted by starting with the `x- prefix`, for example `x-logo`. Traefik Hub will try to convert Swagger extensions to OpenAPI extensions during the conversion process. Good to know Not all Swagger extensions are supported by OpenAPI v3.x. For example, `x-example` in Swagger v2 changed to `example` in OpenAPI v3.0.0. That means that your converted spec will still have `x-example`\> in the source but, but example will be shown in the generated file in the Portal. ### Conversion[​](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#conversion "Direct link to Conversion") Under the hood, Traefik Hub uses [kin-openapi](https://github.com/getkin/kin-openapi "Link to kin-openapi on GitHub") to convert Swagger v2.0 to OpenAPI v3.0.3. If you face any problems with the conversion or if you're encountering issues with the converted specification, please get in contact with our support team. * [Introduction](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#introduction) * [Supported Versions](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#supported-versions) * [Swagger v2](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#swagger-v2) * [Swagger Extensions](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#swagger-extensions) * [Conversion](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi#conversion) --- # Tags | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags#__docusaurus_skipToContent_fallback) Tags ==== A[​](https://doc.traefik.io/traefik-hub-poc/tags#A "Direct link to A") ----------------------------------------------------------------------- * [Access1](https://doc.traefik.io/traefik-hub-poc/tags/access) * [API15](https://doc.traefik.io/traefik-hub-poc/tags/api) * [API Access1](https://doc.traefik.io/traefik-hub-poc/tags/api-access) * [API Collection1](https://doc.traefik.io/traefik-hub-poc/tags/api-collection) * [API Gateway42](https://doc.traefik.io/traefik-hub-poc/tags/api-gateway) * [API Key1](https://doc.traefik.io/traefik-hub-poc/tags/api-key) * [API Key Introspection1](https://doc.traefik.io/traefik-hub-poc/tags/api-key-introspection) * [API Management42](https://doc.traefik.io/traefik-hub-poc/tags/api-management) * [API Portal6](https://doc.traefik.io/traefik-hub-poc/tags/api-portal) * [API Versioning1](https://doc.traefik.io/traefik-hub-poc/tags/api-versioning) * [Authentication4](https://doc.traefik.io/traefik-hub-poc/tags/authentication) * * * C[​](https://doc.traefik.io/traefik-hub-poc/tags#C "Direct link to C") ----------------------------------------------------------------------- * [CRD6](https://doc.traefik.io/traefik-hub-poc/tags/crd) * [Custom Certificates1](https://doc.traefik.io/traefik-hub-poc/tags/custom-certificates) * [Custom Domains1](https://doc.traefik.io/traefik-hub-poc/tags/custom-domains) * * * D[​](https://doc.traefik.io/traefik-hub-poc/tags#D "Direct link to D") ----------------------------------------------------------------------- * [Dashboard2](https://doc.traefik.io/traefik-hub-poc/tags/dashboard) * * * G[​](https://doc.traefik.io/traefik-hub-poc/tags#G "Direct link to G") ----------------------------------------------------------------------- * [GitOps1](https://doc.traefik.io/traefik-hub-poc/tags/git-ops) * [Group1](https://doc.traefik.io/traefik-hub-poc/tags/group) * [Guide1](https://doc.traefik.io/traefik-hub-poc/tags/guide) * * * H[​](https://doc.traefik.io/traefik-hub-poc/tags#H "Direct link to H") ----------------------------------------------------------------------- * [HTTP30](https://doc.traefik.io/traefik-hub-poc/tags/http) * * * I[​](https://doc.traefik.io/traefik-hub-poc/tags#I "Direct link to I") ----------------------------------------------------------------------- * [IdP5](https://doc.traefik.io/traefik-hub-poc/tags/id-p) * [Ingress Management1](https://doc.traefik.io/traefik-hub-poc/tags/ingress-management) * [Ingress Mode3](https://doc.traefik.io/traefik-hub-poc/tags/ingress-mode) * * * J[​](https://doc.traefik.io/traefik-hub-poc/tags#J "Direct link to J") ----------------------------------------------------------------------- * [JWT8](https://doc.traefik.io/traefik-hub-poc/tags/jwt) * * * K[​](https://doc.traefik.io/traefik-hub-poc/tags#K "Direct link to K") ----------------------------------------------------------------------- * [Key Authentication4](https://doc.traefik.io/traefik-hub-poc/tags/key-authentication) * [Keycloak5](https://doc.traefik.io/traefik-hub-poc/tags/keycloak) * [Kubernetes2](https://doc.traefik.io/traefik-hub-poc/tags/kubernetes) * * * M[​](https://doc.traefik.io/traefik-hub-poc/tags#M "Direct link to M") ----------------------------------------------------------------------- * [Metrics2](https://doc.traefik.io/traefik-hub-poc/tags/metrics) * [Middleware33](https://doc.traefik.io/traefik-hub-poc/tags/middleware) * * * N[​](https://doc.traefik.io/traefik-hub-poc/tags#N "Direct link to N") ----------------------------------------------------------------------- * [Networking1](https://doc.traefik.io/traefik-hub-poc/tags/networking) * * * O[​](https://doc.traefik.io/traefik-hub-poc/tags#O "Direct link to O") ----------------------------------------------------------------------- * [OIDC1](https://doc.traefik.io/traefik-hub-poc/tags/oidc) * [Okta5](https://doc.traefik.io/traefik-hub-poc/tags/okta) * [OpenAPI1](https://doc.traefik.io/traefik-hub-poc/tags/open-api) * [OpenTelemetry2](https://doc.traefik.io/traefik-hub-poc/tags/open-telemetry) * * * P[​](https://doc.traefik.io/traefik-hub-poc/tags#P "Direct link to P") ----------------------------------------------------------------------- * [Prometheus1](https://doc.traefik.io/traefik-hub-poc/tags/prometheus) * * * Q[​](https://doc.traefik.io/traefik-hub-poc/tags#Q "Direct link to Q") ----------------------------------------------------------------------- * [Quick Start1](https://doc.traefik.io/traefik-hub-poc/tags/quick-start) * * * R[​](https://doc.traefik.io/traefik-hub-poc/tags#R "Direct link to R") ----------------------------------------------------------------------- * [Rate Limiting1](https://doc.traefik.io/traefik-hub-poc/tags/rate-limiting) * * * S[​](https://doc.traefik.io/traefik-hub-poc/tags#S "Direct link to S") ----------------------------------------------------------------------- * [Swagger1](https://doc.traefik.io/traefik-hub-poc/tags/swagger) * * * T[​](https://doc.traefik.io/traefik-hub-poc/tags#T "Direct link to T") ----------------------------------------------------------------------- * [TCP3](https://doc.traefik.io/traefik-hub-poc/tags/tcp) * [Tutorial1](https://doc.traefik.io/traefik-hub-poc/tags/tutorial) * * * U[​](https://doc.traefik.io/traefik-hub-poc/tags#U "Direct link to U") ----------------------------------------------------------------------- * [User3](https://doc.traefik.io/traefik-hub-poc/tags/user) * * * W[​](https://doc.traefik.io/traefik-hub-poc/tags#W "Direct link to W") ----------------------------------------------------------------------- * [Workspaces2](https://doc.traefik.io/traefik-hub-poc/tags/workspaces) * * * --- # Traefik Hub Licensing | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/legal/licensing#__docusaurus_skipToContent_fallback) On this page This document provides information about licensing. * * * Request a Free Trial License[​](https://doc.traefik.io/traefik-hub/legal/licensing#request-a-free-trial-license "Direct link to Request a Free Trial License") --------------------------------------------------------------------------------------------------------------------------------------------------------------- If you're interested in trying out Traefik Hub, head over to our [signup page](https://info.traefik.io/traefik-hub-signup "Link to the Traefik Hub signup page") and request a free 14-day trial license. ### What's Included[​](https://doc.traefik.io/traefik-hub/legal/licensing#whats-included "Direct link to What's Included") All features of Traefik Hub are available for 14 days without any limitations. ### Is a Credit/Debit Card Required for the Free Trial?[​](https://doc.traefik.io/traefik-hub/legal/licensing#is-a-creditdebit-card-required-for-the-free-trial "Direct link to Is a Credit/Debit Card Required for the Free Trial?") A credit/debit card is not required for the 14-day free trial. ### How Can I Track the Remaining Time of My Trial?[​](https://doc.traefik.io/traefik-hub/legal/licensing#how-can-i-track-the-remaining-time-of-my-trial "Direct link to How Can I Track the Remaining Time of My Trial?") Once your trial license is activated, you will see a counter in the dashboard, displaying how many days are left. ### What Happens When the Trial License Expires?[​](https://doc.traefik.io/traefik-hub/legal/licensing#what-happens-when-the-trial-license-expires "Direct link to What Happens When the Trial License Expires?") After the trial period, the workspace will be locked, and no changes can be made to it anymore. Your account will not be lost after your free trial expires, you will still be able to log into your Traefik Hub account to view your dashboard. To continue using Traefik Hub after your free trial, you can purchase a [license](https://doc.traefik.io/traefik-hub/legal/licensing#how-to-get-a-license "Anchor link to how to get a license") . * * * How to Get a License[​](https://doc.traefik.io/traefik-hub/legal/licensing#how-to-get-a-license "Direct link to How to Get a License") --------------------------------------------------------------------------------------------------------------------------------------- The Traefik Labs team will unlock your Traefik Hub workspace(s) where you can invite colleagues to collaborate on your API initiatives. * * * Managing Your Licenses[​](https://doc.traefik.io/traefik-hub/legal/licensing#managing-your-licenses "Direct link to Managing Your Licenses") --------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub is a SaaS solution, you don’t have to do anything, everything is handled by the Traefik Labs team based on your entitlements and contracts. * * * Updating Your License[​](https://doc.traefik.io/traefik-hub/legal/licensing#updating-your-license "Direct link to Updating Your License") ------------------------------------------------------------------------------------------------------------------------------------------ You don’t need to perform any license upgrade, renewal or application configuration changes, it’s all handled by the Traefik Labs team. Please get in touch with your sales engineer or our [sales team](https://doc.traefik.io/cdn-cgi/l/email-protection#b5c6d4d9d0c6f5c1c7d4d0d3dcde9bdcda) to ask for the license renewal at the end of the licensed period. ℹ️ When Traefik Hub gateways are deployed in offline mode (without Internet access), you need to update the license tokens used by your Traefik Hub deployment to reflect the new license expiration date. ### Updating License Tokens for Offline Gateways[​](https://doc.traefik.io/traefik-hub/legal/licensing#updating-license-tokens-for-offline-gateways "Direct link to Updating License Tokens for Offline Gateways") 1. Contact Sales: Please get in touch with your sales engineer or our [sales team](https://doc.traefik.io/cdn-cgi/l/email-protection#7201131e17013206001317141b195c1b1d) to renew your license at the end of the licensed period. 2. Generate New Token: After your license is renewed, log in to the Traefik Hub dashboard and generate a new token for your gateway. 3. Update Gateway Configuration: Update the configuration of your offline gateways with the new token. 4. Restart Gateway: Restart your Traefik Hub deployment to apply the changes. By updating the license token, you ensure that your offline Gateway are aware of the new license expiration date and continue to operate without interruption. * * * Increasing Your License[​](https://doc.traefik.io/traefik-hub/legal/licensing#increasing-your-license "Direct link to Increasing Your License") ------------------------------------------------------------------------------------------------------------------------------------------------ If you want to increase your licensed amounts (amount of Nodes and API Developer Portals), please get in touch with your sales engineer or our [sales team](https://doc.traefik.io/cdn-cgi/l/email-protection#0a796b666f794a7e786b6f6c6361246365) . * * * What Happens When the License Expires?[​](https://doc.traefik.io/traefik-hub/legal/licensing#what-happens-when-the-license-expires "Direct link to What Happens When the License Expires?") -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub licenses have an expiration date, after which your Traefik Hub instances may not function as expected. It’s important to understand how license expiration affects your Traefik Hub deployment, especially in both online and offline scenarios. ### License Expiration Notifications[​](https://doc.traefik.io/traefik-hub/legal/licensing#license-expiration-notifications "Direct link to License Expiration Notifications") 30 days before the license expires, a counter appears in the top left corner of the Traefik Hub dashboard to show a countdown of the remaining days of the licensed period, along with a link to get in touch with the [sales team](https://doc.traefik.io/cdn-cgi/l/email-protection#394a58555c4a794d4b585c5f5052175056) . ![Dashboard showing the license expiry date.](https://doc.traefik.io/traefik-hub/assets/images/license-expires-in-days-175a9e552a3018ea947d50c3a144d7ca.png "Picture showing the license expiry date in the dashboard.") 15 days before the license expires, both you and our sales team will receive an email notification to discuss the situation and plan for renewal if needed. ### Behavior After License Expiration[​](https://doc.traefik.io/traefik-hub/legal/licensing#behavior-after-license-expiration "Direct link to Behavior After License Expiration") If the license expires and you decide not to renew it, the behavior of your Traefik Hub instances depends on whether they can communicate with the Traefik Hub SaaS control plane (online) or not (offline). #### Online Scenarios[​](https://doc.traefik.io/traefik-hub/legal/licensing#online-scenarios "Direct link to Online Scenarios") If your Traefik Hub gateways can communicate with the Traefik Hub SaaS control plane, they will receive updates about the license status directly from the platform. * License Expired but Within Grace Period: After the license expires, a 30-day grace period begins during which your gateways continue to operate normally, the Traefik Hub dashboard workspace remains accessible but enters a [read-only mode](https://doc.traefik.io/traefik-hub/legal/licensing#read-only-mode) where you can view configurations but cannot make modifications, and you will receive notifications to renew your license. * License Expired and Grace Period Over: If the license is not renewed within the 30-day grace period, your gateways will stop working. The Traefik Hub dashboard workspace will be locked, and no modifications can be made. #### Offline Scenarios[​](https://doc.traefik.io/traefik-hub/legal/licensing#offline-scenarios "Direct link to Offline Scenarios") If your Traefik Hub gateways cannot communicate with the Traefik Hub SaaS control plane, they rely on the license token provided during installation, which contains the license expiration date. * License Token Expired: If the expiration date in the token has passed, the gateway will not start. If the gateway is already running when the token expires, it will enter a 30-day grace period. During this period, the gateway will continue to operate but will log messages indicating that the license has expired and the grace period has begun. * Grace Period Over: After the 30-day grace period, if the license is not renewed and the token is not updated, the gateway will stop working. #### Importance of Updating License Tokens[​](https://doc.traefik.io/traefik-hub/legal/licensing#importance-of-updating-license-tokens "Direct link to Importance of Updating License Tokens") In offline scenarios, even if you have renewed your license with Traefik Labs, you must update the license token in your gateways to reflect the new expiration date. The gateways rely on the expiration date in the token when they cannot contact the Traefik Hub SaaS control plane. To update the license token: * Generate a new token from the Traefik Hub dashboard after renewing your license. * Update your gateway configuration with the new token. * Restart the gateway to apply the changes. #### Read-Only Mode[​](https://doc.traefik.io/traefik-hub/legal/licensing#read-only-mode "Direct link to Read-Only Mode") When the license expires and the grace period has ended, the Traefik Hub dashboard workspace is locked, and no modifications can be made. The gateway will enter a read-only mode, which discards any configuration changes performed via the dashboard or CRDs but continues serving traffic on the data plane without service disruption. However, after the grace period, the gateway will stop working entirely, especially in offline scenarios. If you decide to renew your license, update your license tokens (especially for offline gateway), and all operations will return to normal without any configuration loss. API Management Requires Internet Access If you are using the API Management features of Traefik Hub, the gateway must have access to the Internet to communicate with the SaaS control plane. If the gateway cannot connect to the control plane, it will not start when API Management is enabled. * * * How Do You Control Licensing?[​](https://doc.traefik.io/traefik-hub/legal/licensing#how-do-you-control-licensing "Direct link to How Do You Control Licensing?") ----------------------------------------------------------------------------------------------------------------------------------------------------------------- Traefik Hub is licensed per the number of Nodes hosting the services behind the APIs, and the number of API Developer Portals. The reporting is done by the Traefik Hub gateways connected to the SaaS control plane. * * * License Check Frequency[​](https://doc.traefik.io/traefik-hub/legal/licensing#license-check-frequency "Direct link to License Check Frequency") ------------------------------------------------------------------------------------------------------------------------------------------------ Traefik Hub checks your license status every 24 hours. If your gateways are online, they receive status updates directly from the Traefik Hub SaaS control plane. In offline scenarios, the gateway relies on the expiration date in the token file until you update it. * * * What Data Are Shared between the Traefik Hub’s SaaS Control Plane and the Kubernetes Cluster(s)[​](https://doc.traefik.io/traefik-hub/legal/licensing#what-data-are-shared-between-the-traefik-hubs-saas-control-plane-and-the-kubernetes-clusters "Direct link to What Data Are Shared between the Traefik Hub’s SaaS Control Plane and the Kubernetes Cluster(s)") --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Please read our [data sharing page](https://doc.traefik.io/traefik-hub/introduction/security/data-sharing "Link to shared data page") to learn what data are shared. If you have any questions about licensing, do not hesitate to contact your sales engineer or by sending an email to [\[email protected\]](https://doc.traefik.io/cdn-cgi/l/email-protection#0b786a676e784b7f796a6e6d6260256264) . * [Request a Free Trial License](https://doc.traefik.io/traefik-hub/legal/licensing#request-a-free-trial-license) * [What's Included](https://doc.traefik.io/traefik-hub/legal/licensing#whats-included) * [Is a Credit/Debit Card Required for the Free Trial?](https://doc.traefik.io/traefik-hub/legal/licensing#is-a-creditdebit-card-required-for-the-free-trial) * [How Can I Track the Remaining Time of My Trial?](https://doc.traefik.io/traefik-hub/legal/licensing#how-can-i-track-the-remaining-time-of-my-trial) * [What Happens When the Trial License Expires?](https://doc.traefik.io/traefik-hub/legal/licensing#what-happens-when-the-trial-license-expires) * [How to Get a License](https://doc.traefik.io/traefik-hub/legal/licensing#how-to-get-a-license) * [Managing Your Licenses](https://doc.traefik.io/traefik-hub/legal/licensing#managing-your-licenses) * [Updating Your License](https://doc.traefik.io/traefik-hub/legal/licensing#updating-your-license) * [Updating License Tokens for Offline Gateways](https://doc.traefik.io/traefik-hub/legal/licensing#updating-license-tokens-for-offline-gateways) * [Increasing Your License](https://doc.traefik.io/traefik-hub/legal/licensing#increasing-your-license) * [What Happens When the License Expires?](https://doc.traefik.io/traefik-hub/legal/licensing#what-happens-when-the-license-expires) * [License Expiration Notifications](https://doc.traefik.io/traefik-hub/legal/licensing#license-expiration-notifications) * [Behavior After License Expiration](https://doc.traefik.io/traefik-hub/legal/licensing#behavior-after-license-expiration) * [How Do You Control Licensing?](https://doc.traefik.io/traefik-hub/legal/licensing#how-do-you-control-licensing) * [License Check Frequency](https://doc.traefik.io/traefik-hub/legal/licensing#license-check-frequency) * [What Data Are Shared between the Traefik Hub’s SaaS Control Plane and the Kubernetes Cluster(s)](https://doc.traefik.io/traefik-hub/legal/licensing#what-data-are-shared-between-the-traefik-hubs-saas-control-plane-and-the-kubernetes-clusters) --- # 5 docs tagged with "Okta" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/okta#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview) How to manage access to Traefik Hub [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub-poc/portal/jwt-portal) How to Use JWT in the API Portal. [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Okta\ ----](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/okta) How to use Okta as the identity provider (IdP) for Traefik Hub. [Okta JWT Configuration\ ----------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/okta-jwt) How to configure a Keycloak realm for JWT. --- # 5 docs tagged with "Keycloak" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/keycloak#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview) How to manage access to Traefik Hub [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub-v2/portal/jwt-portal) How to Use JWT in the API Portal. [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Keycloak\ --------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Keycloak JWT Configuration\ --------------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/keycloak-jwt) How to configure a Keycloak realm for JWT. --- # What's new in Traefik Hub? | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/api-management/release-notes#__docusaurus_skipToContent_fallback) On this page * * * October 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#october-2025 "Direct link to October 2025") ---------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new "Direct link to What's New") #### New Feature: MCP Gateway with Task-Based Access Control[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-mcp-gateway-with-task-based-access-control "Direct link to New Feature: MCP Gateway with Task-Based Access Control") Traefik Hub now includes **MCP Gateway**, a dedicated gateway for securing and governing Model Context Protocol (MCP) servers. The MCP Gateway acts as an OAuth-compliant proxy that enables organizations to centrally manage access to MCP servers, tools, and resources with **Task-Based Access Control (TBAC)**—a new authorization paradigm designed specifically for AI agents. **Why TBAC?** Traditional Role-Based Access Control (RBAC) fails for AI agents because agents don't have static job functions—they complete tasks that span multiple domains. TBAC provides authorization across three dimensions: **Tasks** (business objectives), **Tools** (system access), and **Transactions** (parameter-level constraints), ensuring agents get precisely the permissions they need for their current work, nothing more. **Variable Substitution.** Traefik's `${jwt.claim}` and `${mcp.parameter}` syntax enables writing a single adaptive policy that works for unlimited agents, with permissions determined by JWT claims. Instead of managing thousands of agent-specific policy lines, you write a handful of policies that dynamically enforce authorization based on each agent's claims—making TBAC practical at enterprise scale. The MCP Gateway includes: * **Task-Based Access Control (TBAC)** with three-dimensional authorization (tasks, tools, transactions) using variable substitution for scalable, adaptive policies * **MCP middleware** with expression language supporting string matching (Equals, Contains, Prefix) and numeric comparisons (Lt, Gt, Lte, Gte) for transaction-level limits like approval amounts and rate quotas * **OAuth 2.1/2.0 Resource Server compliance** with automatic `/.well-known/oauth-protected-resource` endpoint generation for MCP client discovery * **JWT authentication** for seamless integration with existing identity providers (Auth0, Okta, Azure AD, etc.) * **Zero infrastructure overhead** by leveraging existing identity providers—no new databases, policy engines, or specialized infrastructure required * **Sub-millisecond authorization** through stateless JWT validation with no external API calls or database queries * **Comprehensive audit trails** capturing the complete three-dimensional authorization context for compliance (SOX, HIPAA, GDPR, PCI DSS) * **OpenTelemetry observability** with metrics and traces for all MCP operations The MCP Gateway is essential for organizations deploying AI agents that need controlled access to external tools and data sources. Unlike traditional approaches that rely on role inheritance or impersonation, TBAC ensures AI systems get precisely scoped permissions based on the work they're performing. To enable MCP Gateway, use: --set hub.mcpgateway.enabled=true For more details, see the [MCP Gateway documentation](https://doc.traefik.io/traefik-hub/mcp-gateway/mcp) , [Understanding TBAC guide](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/understanding-tbac) , and [getting started guide](https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started) . September 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#september-2025 "Direct link to September 2025") ---------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-1 "Direct link to What's New") #### New Middleware: LLM Guard (AI Gateway)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-middleware-llm-guard-ai-gateway "Direct link to New Middleware: LLM Guard (AI Gateway)") The LLM Guard middleware brings flexible content security to any API traffic through external guard services or LLMs. This middleware supports four variants to handle different integration patterns, from generic APIs with custom security services to chat completions with LLM-based guards like Llama Guard. The non-chat-completion variants (`llm-guard` and `llm-guard-custom`) provide a unique advantage by applying AI-powered security analysis to any incoming API traffic, not just AI or chat APIs. The `-custom` suffix variants integrate with non-chat-compatible upstream guard services. While traditional solutions only secure predefined AI formats, Traefik Hub protects your entire API ecosystem including e-commerce product APIs, banking transactions, HR systems, and customer data endpoints. This enables AI-driven threat detection, content policy enforcement, and fraud analysis across all business APIs. Key features include: * Custom Go templates for request formatting * Powerful JSON path expressions for blocking conditions * Integration with safety models supporting categories like hate speech and violence detection * Streaming response analysis for chat completions * Full response body logging with the `logResponseBody` option for debugging * Multi-layered security pipelines where multiple guards can analyze different aspects of interactions before they reach backend services For complete configuration details and deployment patterns, see the [LLM Guard middleware](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/llm-guard) documentation. August 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#august-2025 "Direct link to August 2025") ------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-2 "Direct link to What's New") #### New Middleware: Force Case[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-middleware-force-case "Direct link to New Middleware: Force Case") The Force Case middleware enforces specific header casing for both incoming requests and outgoing responses. HTTP headers are typically case-insensitive according to RFC specifications, but some legacy systems or APIs require headers to maintain specific capitalization patterns. This middleware ensures that designated headers preserve their exact case format instead of being normalized to canonical MIME header format. It's particularly useful for SOAP services that expect headers like `SOAPAction` with exact capitalization, legacy API integrations with strict header casing requirements, and compliance scenarios where specific header formatting must be preserved. For more details, see the [Force Case middleware](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-force-case) documentation. #### Compatibility Matrix[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#compatibility-matrix "Direct link to Compatibility Matrix") This release comes with the following components: | Component | Version | | --- | --- | | Traefik Hub | v3.18.0-beta3 | | Helm Chart | v37.0.0 | | Traefik Proxy | v3.4.5 | | Coraza WAF | v3.3.3 | | OWASP CRS | v4.14.0 | | Static Analyzer | v1.5.0 | | Kubernetes Gateway API | v1.2.1 | July 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#july-2025 "Direct link to July 2025") ------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-3 "Direct link to What's New") #### API Management Offline Mode[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#api-management-offline-mode "Direct link to API Management Offline Mode") Traefik Hub API Management now supports full offline operation, providing the same level of authentication and API management configuration as the Online Dashboard. This release introduces two new Custom Resource Definitions: * `APIAuth` for namespace-level API authentication using API Key or JWT * `APIPortalAuth` for configuring API Portal authentication with OpenID Connect (OIDC). The OIDC integration works with major identity providers such as Auth0, Azure AD, and Keycloak and includes flexible claim mapping and attribute synchronization. ##### Enhanced Static Analyzer for Offline Mode[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#enhanced-static-analyzer-for-offline-mode "Direct link to Enhanced Static Analyzer for Offline Mode") The [static analyzer](https://doc.traefik.io/traefik-hub/static-analyzer) now supports offline mode validation using the `--offline` flag. This update checks that every namespace with APIs has the required APIAuth resources and confirms that each APIPortal resource is linked to an APIPortalAuth configuration. The analyzer generates tables that show which authentication method is assigned to each API and application, and the diff tool now includes tables that clarify how changes to APIAuth or APIPortalAuth affect your APIs and applications. These improvements help you verify that your offline API management setup is complete and correctly organized before deployment. For more details, see the [API Management Offline Mode](https://doc.traefik.io/traefik-hub/api-management/offline-mode) , [APIAuth](https://doc.traefik.io/traefik-hub/api-management/api-auth) , and [APIPortalAuth](https://doc.traefik.io/traefik-hub/api-management/api-portal-auth) documentation. #### New Middleware: Query[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-middleware-query "Direct link to New Middleware: Query") We are excited to announce the new Query middleware, which allows you to manipulate query parameters in HTTP requests before forwarding them to services. This middleware provides a flexible way to modify query parameters in a request, including setting, appending, removing, and renaming them. For more details, see the [Query middleware](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-query-param) documentation. #### Compatibility Matrix[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#compatibility-matrix-1 "Direct link to Compatibility Matrix") This release comes with the following components: | Component | Version | | --- | --- | | Traefik Hub | v3.18.0-beta1 | | Helm Chart | v37.0.0 | | Traefik Proxy | v3.4.5 | | Coraza WAF | v3.3.3 | | OWASP CRS | v4.14.0 | | Static Analyzer | v1.5.0 | | Kubernetes Gateway API | v1.2.1 | Bug Fixes Timeline * **2025-06-23**: Traefik Hub v3.17.3 and v3.16.6 were released with the following fix: * Fixed [CVE-2025-54386](https://nvd.nist.gov/vuln/detail/CVE-2025-54386) . June 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#june-2025 "Direct link to June 2025") ------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-4 "Direct link to What's New") #### AI Gateway General Availability[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#ai-gateway-general-availability "Direct link to AI Gateway General Availability") * **AI Gateway graduates from experimental**: enable all AI features with `--set hub.aigateway.enabled=true`. * **New [chat-completion](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/chat-completion) middleware** replaces the experimental `AIService`, adds GenAI metrics, and centralises governance of `model` and generation parameters. * **Model-based routing**: use the ``Model(``)`` matcher to steer traffic by JSON `model` field. * **Request-size guard**: `hub.aigateway.maxRequestBodySize` prevents OOM/DoS from oversized bodies. * **[Semantic Cache](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/semantic-cache) ** gains a chat-specific variant, Weaviate vector DB support, and additional vectorizers (Azure OpenAI, Cohere, Gemini, Bedrock). * **[Content Guard](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/content-guard) ** now offers a chat-aware variant with stream support. For more details, see the [AI Gateway](https://doc.traefik.io/traefik-hub/ai-gateway/overview) documentation. #### Managed Applications (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#managed-applications-api-management "Direct link to Managed Applications (API Management)") Traefik Hub API Management now lets platform teams fully automate application onboarding with the new [**ManagedApplication**](https://doc.traefik.io/traefik-hub/api-management/managed-applications) resource. Publishers can declaratively create applications, pre-provision API keys, and bind them to **[ManagedSubscription](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) ** objects — all without any consumer interaction with the Developer Portal. Key capabilities include: * GitOps-friendly `ManagedApplication` resource that stores `appId`, JWT / API Keys, owner ID, optional notes, and zero-to-many API keys (secrets may be provided inline or by reference). * Publishers provision the `appId`, and quotas up front; consumers can call the API straight away * Updated `ManagedSubscription` resource with a `managedApplications` selector for explicit targeting of managed apps. * API consumers authenticate immediately with JWT or API keys issued by the publisher; no portal login is required. * The Hub dashboard lists both managed and self-service applications, with clear indicators and full key management. * Static-Analyzer rule warns if multiple ManagedApplications share the same `appId` within a namespace. See the [Managed Applications documentation](https://doc.traefik.io/traefik-hub/api-management/managed-applications) for more information. #### Offline Mode[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#offline-mode "Direct link to Offline Mode") Traefik Hub now supports offline mode, which allows you to run the Traefik Hub API Gateway in a completely offline environment. For more details, see the [Offline Mode](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/offline-mode) documentation. #### Compatibility Matrix[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#compatibility-matrix-2 "Direct link to Compatibility Matrix") This release comes with the following components: | Component | Version | | --- | --- | | Traefik Hub | v3.17.0 | | Helm Chart | v36.3.0 | | Traefik Proxy | v3.4.1 | | Coraza WAF | v3.3.3 | | OWASP CRS | v4.7.0 | | Static Analyzer | v1.4.0 | | Kubernetes Gateway API | v1.2.1 | Bug Fixes Timeline * **2025-06-23**: Traefik Hub v3.16.2 and v3.15.3 were released with the following fix: * Fixed [CVE-2025-47952](https://nvd.nist.gov/vuln/detail/CVE-2025-47952) . April 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#april-2025 "Direct link to April 2025") ---------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-5 "Direct link to What's New") #### Multi-Tenant Installation on Kubernetes[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#multi-tenant-installation-on-kubernetes "Direct link to Multi-Tenant Installation on Kubernetes") Traefik Hub now supports deploying multiple, isolated gateway instances on a single Kubernetes cluster. By configuring specific namespaces for each instance, you can achieve resource isolation, simplify deployments aligned with team structures, and maintain consistent API management across different environments within the same cluster. Learn more about this feature in the [multi-tenancy documentation](https://doc.traefik.io/traefik-hub/operations/multi-tenancy) . #### OpenAPI v3.1.x Support[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#openapi-v31x-support "Direct link to OpenAPI v3.1.x Support") Traefik Hub now supports OpenAPI v3.1.x, in addition to Swagger v2.0 and OpenAPI v3.0.x. Swagger v2 specifications are automatically converted to OpenAPI v3.1 upon processing, ensuring consistency across your API documentation within the Hub. See the [OpenAPI documentation](https://doc.traefik.io/traefik-hub/reference/specs/openapi) for more details. March 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#march-2025 "Direct link to March 2025") ---------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-6 "Direct link to What's New") #### New Middleware: Semantic Cache[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-middleware-semantic-cache "Direct link to New Middleware: Semantic Cache") We introduced a **Semantic Cache** middleware for the AI Gateway, allowing you to store and retrieve responses based on semantic similarity. If a similar request appears, the middleware returns the cached result immediately instead of calling the AI backend again. This feature helps reduce latency and saves on provider costs. Learn more about this middleware in it's [documentation page](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/semantic-cache) . #### New Middleware: Content Guard[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-middleware-content-guard "Direct link to New Middleware: Content Guard") **Content Guard** is a middleware that protects sensitive data across both AI and API Gateway environments by blocking or masking content before it reaches any upstream service. It helps ensure that confidential data is safeguarded in all scenarios, whether processing AI-specific traffic or general API requests. Learn more about this middleware in it's [documentation page](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/content-guard) . #### Reference Secrets as Credentials Storage in the AI Gateway[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#reference-secrets-as-credentials-storage-in-the-ai-gateway "Direct link to Reference Secrets as Credentials Storage in the AI Gateway") We now allow you to specify tokens in the AIService resource as securely stored credentials in a Kubernetes Secret instead of embedding them directly in YAML (previous `token` field). This approach improved security and aligns with centralized governance over secret management. For more details, see our updated [AI Gateway documentation](https://doc.traefik.io/traefik-hub/ai-gateway/overview) and the relevant example manifest changes. #### Traefik Hub Integration Now Available on Nutanix NKP[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#traefik-hub-integration-now-available-on-nutanix-nkp "Direct link to Traefik Hub Integration Now Available on Nutanix NKP") Traefik Proxy is now the default ingress controller in Nutanix Kubernetes Platform (NKP). You can upgrade your NKP cluster to Traefik Hub API Gateway and API Management to unlock advanced enterprise features, including centralized API governance, enhanced security, and dynamic routing. For more details on the upgrade process and benefits, please read our [blog post](https://traefik.io/blog/from-ingress-to-api-intelligence-unlocking-traefik-v3-xs-full-potential-in-nkp-v2-14/) and refer to the [Nutanix NKP Installation Guide](https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/nkp) . #### API, APIVersion & APIBundle Resources: New `title` & `description` fields[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#api-apiversion--apibundle-resources-new-title--description-fields "Direct link to api-apiversion--apibundle-resources-new-title--description-fields") `API`, `APIVersion`, and `APIBundle` resources now support dedicated `title` and `description` fields. For `API` and `APIVersion` resources, these fields override the values from the OpenAPI specification, allowing you to present tailored content in the API portal. For `APIBundle` resources, you can now specify a custom `title` to display a more user-friendly name on the portal. See the [API](https://doc.traefik.io/traefik-hub/api-management/api#title--description) , [APIVersion](https://doc.traefik.io/traefik-hub/api-management/api-version#title--description) & [APIBundle](https://doc.traefik.io/traefik-hub/api-management/api-bundle#title) documentation for more information. #### Resource Ownership & Editability in the Dashboard[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#resource-ownership--editability-in-the-dashboard "Direct link to Resource Ownership & Editability in the Dashboard") Traefik Hub now distinguishes between resources created through the Online Dashboard and those managed externally (via GitOps), to prevent accidental modifications and conflicting changes. The following changes have been made: * Resources created via the dashboard remain fully editable, while those managed externally become read-only. * Visual indicators have been added: read-only resources display a Kubernetes icon, whereas editable resources show a monitor-like icon. For more details on how resource ownership is handled in the Dashboard now, please refer to the [Online Dashboard documentation](https://doc.traefik.io/traefik-hub/dashboard#resource-ownership--editability) . February 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#february-2025 "Direct link to February 2025") ------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-7 "Direct link to What's New") #### New AI Providers: DeepSeek & QWen[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-ai-providers-deepseek--qwen "Direct link to New AI Providers: DeepSeek & QWen") Traefik Hub AI Gateway now supports two additional AI providers: * DeepSeek * QWen Both AI providers use the OpenAI API structure with a different base URL and models. ##### Updated OpenAI Implementation[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#updated-openai-implementation "Direct link to Updated OpenAI Implementation") The OpenAI integration in Traefik Hub AI Gateway has been enhanced with support a custom `baseUrl` option for OpenAI-compatible AI services. #### New Feature: API Mocking for Expanded API Development & Testing[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-api-mocking-for-expanded-api-development--testing "Direct link to New Feature: API Mocking for Expanded API Development & Testing") Traefik Hub is evolving beyond API runtime management to support a comprehensive API Development and Testing use case. This enhancement empowers API developers and platform engineers to: * Rapidly prototype and test API designs using live API mocks generated via Microcks. * Refine gateway settings and security policies in a safe, sandboxed environment. * Iterate quickly based on real-world testing feedback before full-scale production deployment. For a detailed guide on setting up and leveraging these capabilities, please refer to our [On-Premises API Mocking guide](https://doc.traefik.io/traefik-hub/api-mocking/on-premises-setup) . #### Including an API Plan is Mandatory in Managed Subscription[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#including-an-api-plan-is-mandatory-in-managed-subscription "Direct link to Including an API Plan is Mandatory in Managed Subscription") A Managed Subscription must always include an API Plan. Even unlimited plans must be explicitly defined, there are no more implicit unlimited plans to improve governance and avoid unwanted misconfiguration scenarios. For existing Traefik Hub Kubernetes deployments, upgrade your cluster to version 34.3.0 or later of the Traefik Helm chart and also upgrade your CRDs to the new version that introduces this change. Please see [upgrading instructions](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/api-gateway-upgrading) for more information. #### Compatibility Matrix[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#compatibility-matrix-3 "Direct link to Compatibility Matrix") This release comes with the following components: | Component | Version | | --- | --- | | Traefik Hub | v3.14.1 | | Helm Chart | v34.4.0 | | Traefik Proxy | v3.3.4 | | Coraza WAF | v3.3.2 | | OWASP CRS | v4.7.0 | | Static Analyzer | v1.4.0 | | Kubernetes Gateway API | v1.2.1 | Bug Fixes Timeline * **2025-02-11**: Traefik Hub v3.11.1 was released with the following fixes: * Fixed empty API column in the subscription table on the API portal. * Fixed AI gateway panic when using Gemini with OTel. * **2025-02-18**: Traefik Hub v3.13.0 was released with the following updates: * Bump Go version from v1.23.0 to v1.23.6. * Add CORS support for API & API version resources. * New `baseUrl` option for the OpenAI provider in the Traefik Hub AI Gateway. * New `title` option for the API Bundle, similar to the API and API Version CRDs. * **2025-02-26**: Traefik Hub v3.14.1 was released with the following updates: * Bump Traefik Proxy to v3.3.4 * New Windows FIPS 140-2 build with `microsoft/go` * Add search functionality in the available APIs list on the Portal UI. January 2025[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#january-2025 "Direct link to January 2025") ---------------------------------------------------------------------------------------------------------------------------- ### What’s New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-8 "Direct link to What’s New") #### New Feature: Self-Service Subscriptions (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-self-service-subscriptions-api-management "Direct link to New Feature: Self-Service Subscriptions (API Management)") We are excited to introduce **Self-Service Subscriptions**, which empower API consumers to directly subscribe their applications to APIs—or entire API Bundle—through the API Portal. **Key Highlights**: * **Instant Access**: API consumers can subscribe immediately, reducing time-to-integration. * **Bundle Support**: Subscribe to multiple APIs at once via a bundle subscription workflow. * **Coexistence with Managed Subscriptions**: If a self-service subscription coexists with a managed subscription, the self-service plan takes precedence, but unsubscribing reactivates the managed one. * **Streamlined Portal Subscription Flow**: A user-friendly interface in the API Portal lets consumers quickly select an application and confirm a plan, simplifying the overall onboarding process. For more details, see [Self-Service Subscriptions](https://doc.traefik.io/traefik-hub/api-management/self-service-subscription) . #### New Feature: Block Requests to Undocumented Paths and Methods (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-block-requests-to-undocumented-paths-and-methods-api-management "Direct link to New Feature: Block Requests to Undocumented Paths and Methods (API Management)") We’ve introduced a `validateRequestMethodAndPath` option for both `API` and `APIVersion` resources, preventing “zombie” or “shadow” endpoints by blocking requests to paths and methods not defined in your OpenAPI specification. This helps strengthen security and maintain a well documented API surface. For more information about the `validateRequestMethodAndPath` feature, see the [API](https://doc.traefik.io/traefik-hub/api-management/api#validaterequestmethodandpath) & [APIVersion](https://doc.traefik.io/traefik-hub/api-management/api-version#validaterequestmethodandpath) documentation. Bug Fixes * We fixed the [CVE-2024-53259](https://www.cve.org/CVERecord?id=CVE-2024-53259) vulnerability in Traefik Hub v3.9.0. December 2024[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#december-2024 "Direct link to December 2024") ------------------------------------------------------------------------------------------------------------------------------- ### What’s New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-9 "Direct link to What’s New") #### New Feature: Secure, Govern, and Observe AI Endpoints Like APIs[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-secure-govern-and-observe-ai-endpoints-like-apis "Direct link to New Feature: Secure, Govern, and Observe AI Endpoints Like APIs") We are excited to announce the new AI gateway feature which allows you to manage and integrate multiple Large Language Model (LLM) providers. To get started, check out our [AI Gateway](https://doc.traefik.io/traefik-hub/ai-gateway/overview) documentation to learn how to enable & start using it. #### New Feature: Managed Subscriptions (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-managed-subscriptions-api-management "Direct link to New Feature: Managed Subscriptions (API Management)") Introducing managed subscriptions, a powerful way to manage subscriptions between applications and your APIs or API Bundles. With `ManagedSubscription`, you get the following benefits: * Application-level control: With managed subscriptions, you can specify applications that will consume APIs via an application identifier (`appId`). This allows you to manage API consumption at the application level rather than the user level. * Control access: Define which applications can access specific APIs or API Bundles. * Enforce API plans: Apply API Plans to subscriptions to enforce rate limits, quotas, and other policies. * Claims-based authorization: Use expressions to validate claims in authentication tokens (e.g., JWTs) for fine-grained access control. For more details, refer to the [Managed Subscriptions](https://doc.traefik.io/traefik-hub/api-management/managed-subscriptions) documentation. #### New Feature: APICatalogItem (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-apicatalogitem-api-management "Direct link to New Feature: APICatalogItem (API Management)") We are excited to announce the addition of the `APICatalogItem` Custom Resource Definition (CRD) in Traefik Hub API Management. `APICatalogItem` is a resource in Traefik Hub that defines which APIs are visible to users in the Developer Portal. It allows API managers to control the visibility of APIs and API Bundles to specific user groups, ensuring that API consumers only see the APIs they are authorized to access. Key Features of `APICatalogItem`: * Specify which APIs or API Bundles are displayed to specific user groups. * Control the visibility of specific operations within APIs. For more details, refer to the [APICatalogItem](https://doc.traefik.io/traefik-hub/api-management/api-catalogitem) documentation. Upgrading your cluster For existing Traefik Hub Kubernetes deployments, you need to upgrade your cluster to use at least v33.1.0 of the Traefik Helm chart that introduces the `AIService`, `ManagedSubscription` & `APICatalogItem` CRDs, please see [upgrading instructions](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/api-gateway-upgrading) for more information. #### Deprecation of `APIAccess` resource (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#deprecation-of-apiaccess-resource-api-management "Direct link to deprecation-of-apiaccess-resource-api-management") As part of our efforts to simplify and enhance the API management experience, we are deprecating the `APIAccess` CRD. The functionalities provided by `APIAccess` are now encompassed by the new `ManagedSubscription` & `APICatalogItem` CRDs, offering more visibilty, flexibility and control over API access management. We recommend transitioning from `APIAccess` to `ManagedSubscription` & `APICatalogItem` to take advantage of the new features and improvements. Bug Fixes * We fixed the [CVE-2024-52003](https://nvd.nist.gov/vuln/detail/CVE-2024-52003) vulnerability in Traefik Hub v3.8.0. * We fixed the [CVE-2024-45410](https://nvd.nist.gov/vuln/detail/CVE-2024-45410) vulnerability in Traefik Hub v3.8.1. November 2024[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#november-2024 "Direct link to November 2024") ------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-10 "Direct link to What's New") #### Support for Managing APIs with `HTTPRoute` in API Management[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#support-for-managing-apis-with-httproute-in-api-management "Direct link to support-for-managing-apis-with-httproute-in-api-management") Traefik Hub API Management now supports using [HTTPRoute](https://gateway-api.sigs.k8s.io/api-types/httproute/) to manage APIs. For more information, check out our Kubernetes Gateway API [glossary page](https://traefik.io/glossary/kubernetes-gateway-api/) & [API resource](https://doc.traefik.io/traefik-hub/api-management/api) documentation. October 2024[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#october-2024 "Direct link to October 2024") ---------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-11 "Direct link to What's New") #### Support for Consul Catalog Enterprise[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#support-for-consul-catalog-enterprise "Direct link to Support for Consul Catalog Enterprise") We are excited to announce that Traefik Hub API Gateway now supports [Consul Catalog Enterprise](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-consul-catalog-enterprise) as a part of our providers. To get started, check out our [Consul Catalog Enterprise](https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-consul-catalog-enterprise) documentation to learn how to enable & configure it. September 2024[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#september-2024 "Direct link to September 2024") ---------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-12 "Direct link to What's New") #### New Feature: Traffic Debugger[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-traffic-debugger "Direct link to New Feature: Traffic Debugger") We are excited to announce that Traefik Hub now integrates with [Treblle](https://treblle.com/) as the Traffic Debugger, enhancing your API observability experience across both API Management and Gateway features. ##### What Does This Mean For You?[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#what-does-this-mean-for-you "Direct link to What Does This Mean For You?") * Real-Time API Monitoring: Gain immediate insights into your API traffic, helping you identify and address issues as they happen. * Request and Response Debugging: The Traffic Debugger provides detailed insights into individual API calls, allowing you to troubleshoot and resolve problems efficiently. * Error Tracking and Performance Metrics: Monitor error rates, response times, and other critical metrics to optimize your APIs. ##### Why Is This Important?[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#why-is-this-important "Direct link to Why Is This Important?") With the Treblle integration, you can improve the reliability and performance of your APIs, leading to better user experiences and increased confidence in your API infrastructure. To get started, check out our [Treblle integration guide](https://doc.traefik.io/traefik-hub/api-gateway/observability/Treblle/traefik-and-treblle) to learn how to enable this feature and start enhancing your API observability. #### New Feature: API Plans (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-api-plans-api-management "Direct link to New Feature: API Plans (API Management)") Introducing API Plans, a comprehensive solution for API governance that centralizes the management of rate limits and quotas. API Plans replace the previous `APIRateLimit` feature, providing a more structured and policy-driven approach to controlling API consumption. This ensures fair and efficient resource distribution among your API consumers. ##### Key Features[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#key-features "Direct link to Key Features") * Centralized Policy Management: Consolidate rate limiting and quota enforcement into a single resource, making it easier to maintain and update policies. * Streamlined Access Control: Simplify the association between user groups and APIs through well-defined plans, enhancing access management efficiency. * Consistent Governance: Apply standardized API Plans across all APIs to ensure uniform governance and reduce the risk of misconfigurations. #### Breaking Change[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#breaking-change "Direct link to Breaking Change") With the introduction of API Plans, the older `APIRateLimit` feature is removed. Users are encouraged to transition to API Plans to take advantage of the enhanced governance and management capabilities. ##### Prerequisites[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#prerequisites "Direct link to Prerequisites") For creating Plans other than unlimited, ensure that Redis is deployed and configured in your cluster and Traefik deployment to utilize the `APIPlan` feature. For detailed installation and configuration steps, follow the [API Plan documentation](https://doc.traefik.io/traefik-hub/api-management/api-plans) . #### New Feature: API Bundle (API Management)[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#new-feature-api-bundle-api-management "Direct link to New Feature: API Bundle (API Management)") We are thrilled to introduce API Bundles, a new feature designed to streamline the management of your APIs. API Bundles allow you to group multiple APIs into a single, cohesive entity, enhancing efficiency and governance. ##### Key Benefits[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#key-benefits "Direct link to Key Benefits") * Unified Management: Group one or more APIs under a single API Bundle, simplifying reference and access across your infrastructure. * Centralized Policy Enforcement: Apply API Plans directly to API Bundles, enabling consistent rate limits and quotas across all included APIs. * Flexible Inclusion Methods: Add APIs to a bundle by explicitly naming them or using Kubernetes-native label selectors for dynamic and scalable management. To get started with creating API Bundles, refer to our [API Bundle Documentation](https://doc.traefik.io/traefik-hub/api-management/api-bundle) . July 2024[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#july-2024 "Direct link to July 2024") ------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-13 "Direct link to What's New") * **Native Coraza WAF integration**: Secure APIs with the [Coraza Web Application Firewall](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-coraza-waf "Link to documentation about how to use the native Coraza WAF with Traefik Hub") (endorsed by [OWASP](https://owasp.org/ "Link to OWASP, the Open Source Foundation for Application Security") ). The native WAF integration in Traefik Hub provides more than 23x performance improvement over Traefik Proxy's WASM-based WAF plugin. * **Distributed ACME on all platforms using Vault**: Simplify certificate management and ensure that certificates are always up-to-date by automatically obtaining and renewing TLS certificates with ACME from Certificate Authorities like Let's Encrypt. The Hub-exclusive [distributed ACME](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/letsencrypt#configuring-distributed-acme "Link to documentation about how to use distributed ACME with Traefik Hub") is more efficient for large-scale or high-availability setups, as it reduces duplication and ensures consistency across all Gateway instances by leveraging HashiCorp Vault as shared secure certificate storage. Now available for all supported installation platforms. * **Vault Public Key Infrastructure**: Create your own private certificate authority (CA) with the HashiCorp [Vault PKI](https://doc.traefik.io/traefik-hub/api-gateway/secure/tls/vault-pki "Link to documentation about how to use Vault PKI with Traefik Hub") secret engine to issue, manage, and revoke digital certificates. Combine it with the gateway's ACME resolvers for automated certificate management, even in a distributed way. * **LDAP middleware**: Secure your APIs by delegating the authentication to an external LDAP server with the [LDAP middleware](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-ldap "Link to documentation about how to use LDAP with Traefik Hub") . * **OPA middleware**: The [Open Policy Agent middleware](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-opa "Link to documentation about how to use OPA with Traefik Hub") restricts access to your APIs and allows you to enrich request headers with data extracted from policies. * **Cache middleware**: Add [cache middleware](https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-httpcache "Link to documentation about how to use caching with Traefik Hub") to your routers and improve the performance of your infrastructure by reducing latency, network traffic, and the time needed to interact with an API. * **FIPS-compliant Docker image**: Traefik Hub is now compliant with [FIPS 140-2](https://doc.traefik.io/traefik-hub/api-gateway/setup/kubernetes/installation#install-using-a-fips-140-2-compliant-image "Link to documentation about how to get a FIPS-compliant Docker image of Traefik Hub") , a U.S. Federal Government security standard used to approve cryptographic modules. * **Multi-platform install snippets**: A newly added platform selector helps you in the new gateway creation wizard to get tailored installation snippets for Kubernetes, Docker Compose, Docker Swarm, HashiCorp Nomad, and Systemd for Linux-based virtual machines, bare-metal hardware or cloud computing instances like AWS EC2. * The embedded Traefik Proxy version has been updated to bring the latest open-source improvements for Hub. #### API Management-Exclusive Features[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#api-management-exclusive-features "Direct link to API Management-Exclusive Features") * **Add any third-party Identity Provider with OIDC**: User management has never been easier. Secure your API Developer Portals and API Gateways with any third-party Identity Provider you already have, such as Okta or Azure Entra ID, using enterprise-grade OIDC. Check the [documentation](https://doc.traefik.io/traefik-hub/api-management/users-and-groups "Link to documentation about how to use OIDC with Traefik Hub API Management") about how to configure it on the online Hub dashboard. * **Metrics overview in the online dashboard**: The Hub online dashboard gives you an overview of your APIs' overall consumption and health. You can also filter for every API, user, and API Management-enabled gateway. Fine-grained metrics are still available on the gateway with [OpenTelemetry](https://doc.traefik.io/traefik-hub/operations/metrics "Link to documentation about how to use OTel with Traefik Hub") . May 2024[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#may-2024 "Direct link to May 2024") ---------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-14 "Direct link to What's New") * Traefik Hub now embeds all Traefik Proxy v3.0 features (compatible with Traefik v2). * Capacity to install Traefik Hub as a drop-in replacement of Traefik Proxy, with additional Enterprise features such as authentication, authorization, distributed rate limit, and more. * Traefik Hub provides robust API management capabilities for API publishers and consumers. The features include API versioning, user and fine-grained access management, rate limiting, declarative configuration linting, API developer portals, API observability metrics, and many more. * Promote any Ingress or IngressRoute to become a managed API. This means one can now attach any built-in gateway middleware or plugins to APIs, unlocking Traefik's entire network power for APIs. * Extend Traefik Hub with your custom WebAssembly (WASM) plugins. * Leverage the new Coraza Web Application Firewall, a plugin Traefik Labs supports. * OpenTelemetry (OTel) metrics are now available on both ingresses and managed APIs. * Operate API Gateways fully offline without reliance on any SaaS platform. February 2024[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#february-2024 "Direct link to February 2024") ------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-15 "Direct link to What's New") * We've added a new filtering concept in the APIAccess CRD that enables you to select sets of OpenAPI operations defined on APIs or APIVersions. You can find more information in the [API CRD reference](https://doc.traefik.io/traefik-hub/api-management/api#operation-filtering "Link to operation filtering docs in the API CRD reference") . * All-new API Portal. We've refreshed the API Portal UI to create a better user experience. ![New API Portal UI.](https://doc.traefik.io/traefik-hub/assets/images/custom-portal-overview-6fbc85fc3e94b535646c706a6dc88af4.png "Picture showing the new API Portal UI") * It is now possible to [turn off](https://doc.traefik.io/traefik-hub/dashboard/workspace-settings#workspace-settings) the generation and usage of _traefikhub.io_ domains for your API Gateways and Portals. * Error logs generated by the Traefik Hub agent are now transmitted to the Traefik Hub platform and stored for 24 hours to assist in resolving support requests quickly. You can turn off sending error logs by adjusting the default configuration. * We've enhanced the [API](https://doc.traefik.io/traefik-hub/api-management/api "Link to the API CRD reference") and the [APIVersion](https://doc.traefik.io/traefik-hub/api-management/api-version "Link to APIVersion CRD") CRDs. Both CRDs support now naming of the API Service port `service.port.name`. December 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#december-2023 "Direct link to December 2023") ------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-16 "Direct link to What's New") * You can now publish APIs without an OpenAPI specification. ![No OAS spec required.](https://doc.traefik.io/traefik-hub/assets/images/no-oas-8eab55ba6b880d8f5bf6d75cec492834.png "Picture showing a info message if no OAS is used") * We've published a [complete Traefik Hub GitOps demo](https://github.com/traefik-workshops/traefik-hub-gitops/tree/master "Link to GitHub repository of the Traefik Hub GitOps demo") . Follow the tutorial to learn how to deploy and manage APIs on a local Kubernetes cluster with [Flux](https://fluxcd.io/ "Link to website of Flux") . ![Example Grafana dashboard.](https://doc.traefik.io/traefik-hub/assets/images/otel-1-1fec6414fecf25487eaaf7665605059d.png "Example Grafana dashboard") * We've updated the dashboard to make it more effortless for you to get an overview about configured access policies and rate limits. This information is now displayed in the API details page, as in the user and groups details pages. ![Computed values.](https://doc.traefik.io/traefik-hub/assets/images/ui-computed-values-ea79d9f5e6ca6e530b88026eb4f04726.png "Picture showing computed values") November 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#november-2023 "Direct link to November 2023") ------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-17 "Direct link to What's New") * Traefik Hub now has a direct integration with [Okta](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/okta "Link to documentation about how to use Okta with Traefik Hub") . ![IdP-Form.](https://doc.traefik.io/traefik-hub/assets/images/external-idp-overview-012b2843df9e3e6b232de02ccc1fc263.png "Overview picture of external IdPs in the dashboard") * Starting today, you're able to use [JWT](https://doc.traefik.io/traefik-hub/authentication-authorization/jwt-overview "Link to JWT overview") to secure access to APIs. ![UI-JWT.](https://doc.traefik.io/traefik-hub/assets/images/jwt-screen-e810a5b6e34db6dc5c93103257a2881d.png "Picture of JWT screen in the dashboard") * We've added support for [distributed rate limiting](https://doc.traefik.io/traefik-hub/api-management/api-rate-limit "Links to documentation about distributed rate limiting with Traefik Hub") . * We've enhanced our OpenTelemetry metrics by adding support for API versions. * The dashboard now shows a warning sign when a Traefik Hub agent faces a connectivity issue. ![Dashboard showing a warning.](https://doc.traefik.io/traefik-hub/assets/images/agent-offline-api-overview-24bbcd5742d4365a66b12a80aafbfa39.png "Picture of showing a warning that a Traefik Hub agent is offline in the dashboard") * We've released a new version of the Traefik Hub agent `v2.4.2` and of the Helm chart `v2.5.1` [v2.5.1 Changelog](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.5.1 "Link to v2.5.1 changelog on GitHub") . Please upgrade the Traefik Hub agent to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the [Ingress Controller](https://doc.traefik.io/traefik-hub/operations/upgrading "Link to documentation about upgrading the Ingress Controller Mode installation") or the [Sidecar Mode](https://doc.traefik.io/traefik-hub/operations/upgrading "Link to documentation about upgrading the Sidecar Mode mode installation") installation. October 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#october-2023 "Direct link to October 2023") ---------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-18 "Direct link to What's New") * In this release, we've added [OpenTelemetry](https://doc.traefik.io/traefik-hub/operations/metrics "Link to documentation about how to use OTel with Traefik Hub") support to Traefik Hub. * We've added support for adjusting CORS and API header policies through CRDs and via the dashboard. ![UI.](https://doc.traefik.io/traefik-hub/assets/images/cors-headers-version-ui-188e78f3c4b1bb1dbaee5ded776187a5.png "Picture of showing the dashboard about adding CORS, headers and API versioning") * You can now manage [workspace roles](https://doc.traefik.io/traefik-hub/dashboard#workspace-roles "Link to documentation about changing workspace roles") through the dashboard. ![UI.](https://doc.traefik.io/traefik-hub/assets/images/change-role-2-245efc8b95072e2244e04e3905210cfc.png "Picture of showing the dashboard about changing workspace roles") ### Security[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#security "Direct link to Security") * ⚠️ The Traefik Hub agent `v2.3.0` and Helm chart `v.2.3.0` ([v2.3.0 Changelog](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.3.0 "Link to v2.3.0 changelog on GitHub") ) releases are fixing [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487) in the Traefik Hub agent. September 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#september-2023 "Direct link to September 2023") ---------------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-19 "Direct link to What's New") * You can use [Keycloak](https://doc.traefik.io/traefik-hub/authentication-authorization/idp/keycloak "Link to documentation about Keycloak") for Single Sign-On (SSO) or as an [identity broker](https://www.keycloak.org/docs/latest/server_admin/#features "Link to the website of Keycloak") for Traefik Hub. * We enhanced workspace management. You can now assign [roles](https://doc.traefik.io/traefik-hub/dashboard#workspace-roles "Link to documentation about workspace roles in Traefik Hub") to workspace members. Every role, `Viewer`, `Editor` and `Admin` has a different set of permissions. * Traefik Hub now supports CORS (Cross-Origin Resource Sharing) configuration via CRDs. August 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#august-2023 "Direct link to August 2023") ------------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-20 "Direct link to What's New") * We've added support for [API versioning](https://doc.traefik.io/traefik-hub/api-management/api-version "Link to documentation about API versioning") through CRDs and via the dashboard. * We've published the [Traefik Hub Helm Chart](https://github.com/traefik/traefik-hub-helm-chart "Link to the Traefik Hub Helm chart on GitHub") on GitHub. * We've improved the dashboard to provide a better experience when you select Services. You can now better identify if you use an internal or external (API) Service. * The dashboard shows now a warning sign when the user's initial password reset has not been performed yet. * We've released a new version of the Traefik Hub Helm chart with an update of the Traefik Hub agent. Please find the changelog for `v2.2.0` on [GitHub](https://github.com/traefik/traefik-hub-helm-chart/releases/tag/v2.2.0 "Link to v2.2.0 changelog on GitHub") . Please upgrade to version `v2.2.0` to enjoy the latest enhancements. Depending on your set-up, please follow the detailed documentation about upgrading the [Ingress Controller](https://doc.traefik.io/traefik-hub/operations/upgrading "Link to documentation about upgrading the Ingress Controller Mode installation") or the Sidecar Mode installation. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes "Direct link to Bug Fixes") * We've fixed a couple of tiny bugs in the user interface (dashboard). July 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#july-2023 "Direct link to July 2023") ------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-21 "Direct link to What's New") * The Traefik Hub agent supports now two different [installation methods](https://doc.traefik.io/traefik-hub/operations/installation "Link to installation overview") , the Ingress Controller mode and the Sidecar Mode. * We've added Emissary (formerly Ambassador, an Envoy-based) Ingress support with Sidecar Mode. * We've improved API management, you can now select APIs by name and by [Labels](https://doc.traefik.io/traefik-hub/reference/labels-and-selectors "Link to reference documentation about Labels and Selectors") . You can combine names and Labels to filter your selections even more. * We've added support for [rate limiting](https://doc.traefik.io/traefik-hub/api-management/api-rate-limit "Link to documentation about rate limiting") to the dashboard. * We've added support for [Swagger v2](https://doc.traefik.io/traefik-hub/reference/specs/openapi#swagger-v2 "Link to documentation about Swagger v2 support") . ### Bug Fixes[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes-1 "Direct link to Bug Fixes") * We've fixed a couple of descriptions in the dashboard. June 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#june-2023 "Direct link to June 2023") ------------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-22 "Direct link to What's New") * You can now manage external APIs, hosted outside your Kubernetes cluster, for example on Virtual Machines (VMs) or third party APIs. * Starting today, you're able to use [rate limiting](https://doc.traefik.io/traefik-hub/api-management/api-rate-limit "Link to CRD documentation about rate limiting") for APIs. * We strengthened security. The Traefik Hub token is now provided as a [Secret](https://kubernetes.io/docs/concepts/configuration/secret/ "Link to K8s documentation about Secretes") during installation. * If you deal with large clusters, we made your life easier with filtering Services by namespace in the dashboard, to quickly find what you look for. * The dashboard provide more guidance, with clear indications of which fields are required and more descriptions. * We've updated the dashboard to put key information right at your fingertips: information on APIs and API Collections, the API Developer Portal and Users. Corresponding screens have been updated for better clarity. * We’ve improved the API Developer Portal responsiveness by adding HTTP cache control headers. * For you to more quickly see how to perform given tasks, we've restructured the documentation, added more tutorials and improved the content overall. * Based on your feedback, we've tinkered with the internal workings and polished some rough edges. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes-2 "Direct link to Bug Fixes") * If your session has expired, you will now be redirected to the login screen. * We've fixed a couple of bugs in the dashboard related to pop-ups, selecting Services, user groups and error pages. * We've fixed a bug related to TLS termination. * There were a few little bugs that caused performances issues, like bugs do. We fixed those, and we’ll fix the next ones too. May 2023[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#may-2023 "Direct link to May 2023") ---------------------------------------------------------------------------------------------------------------- ### What's New[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-23 "Direct link to What's New") * We've changed the architecture, Hub now supports only K8s, the Agent uses a sidecar, and it is compatible with any Ingress Controller. * We've added a new ACP (Access Control Policy) for API Keys. * We've added a new OAuth Introspection ACP. * Starting today, you're able to use CRDs for APIs, API Collections, API Accesses, API Gateways, and API Portal objects. * API consumption is now protected by [tokens](https://doc.traefik.io/traefik-hub/authentication-authorization/key-authentication "Link to documentation about Portal access") . * We've added [API Management](https://doc.traefik.io/traefik-hub/ "Link to concepts page") , now you can use Hub as a platform for managing, routing, monitoring, and securing APIs. * You can use Traefik Hub as [IdP](https://doc.traefik.io/traefik-hub/authentication-authorization/identity-provider#internal "Link to documentation about Hub user management") (Identity Provider). * We've replaced freemium tiers with a new [trial mechanism](https://traefik.io/pricing/ "Link to pricing page") . * User deletion is now fully GDPR-compliant, no user data is retained. * Traefik Hub supports now team collaboration with workspaces. * Traefik Hub is now compatible with Traefik's IngressRoute. * We've added support for wildcard domains. * We've added the functionality to expose Prometheus compatible metrics from the Traefik Hub agent. * Hub errors are now leveraging K8s events. * We restructured and updated the documentation. * We adjusted the Service page in the dashboard, port numbers are now visible when they exceed more than 3 characters. ### Bug Fixes[​](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes-3 "Direct link to Bug Fixes") * We fixed an issue that prevented some ACPs to be deleted. * We improved the process of certificate renewals. * We solved an issue with custom domain validation. * [October 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#october-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new) * [September 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#september-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-1) * [August 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#august-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-2) * [July 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#july-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-3) * [June 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#june-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-4) * [April 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#april-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-5) * [March 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#march-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-6) * [February 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#february-2025) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-7) * [January 2025](https://doc.traefik.io/traefik-hub/api-management/release-notes#january-2025) * [What’s New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-8) * [December 2024](https://doc.traefik.io/traefik-hub/api-management/release-notes#december-2024) * [What’s New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-9) * [November 2024](https://doc.traefik.io/traefik-hub/api-management/release-notes#november-2024) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-10) * [October 2024](https://doc.traefik.io/traefik-hub/api-management/release-notes#october-2024) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-11) * [September 2024](https://doc.traefik.io/traefik-hub/api-management/release-notes#september-2024) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-12) * [July 2024](https://doc.traefik.io/traefik-hub/api-management/release-notes#july-2024) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-13) * [May 2024](https://doc.traefik.io/traefik-hub/api-management/release-notes#may-2024) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-14) * [February 2024](https://doc.traefik.io/traefik-hub/api-management/release-notes#february-2024) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-15) * [December 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#december-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-16) * [November 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#november-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-17) * [October 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#october-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-18) * [Security](https://doc.traefik.io/traefik-hub/api-management/release-notes#security) * [September 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#september-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-19) * [August 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#august-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-20) * [Bug Fixes](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes) * [July 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#july-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-21) * [Bug Fixes](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes-1) * [June 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#june-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-22) * [Bug Fixes](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes-2) * [May 2023](https://doc.traefik.io/traefik-hub/api-management/release-notes#may-2023) * [What's New](https://doc.traefik.io/traefik-hub/api-management/release-notes#whats-new-23) * [Bug Fixes](https://doc.traefik.io/traefik-hub/api-management/release-notes#bug-fixes-3) --- # Account Settings | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#__docusaurus_skipToContent_fallback) On this page This page explains how to configure account settings in Traefik Hub. * * * Introduction[​](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#introduction "Direct link to Introduction") ----------------------------------------------------------------------------------------------------------------------------- You can view your account information and theme preferences in the dashboard. To adjust the settings, select the **User icon** on the top left in the Hub dashboard. ![User icon](https://doc.traefik.io/traefik-hub-v2/assets/images/general-settings-14d9cefd9d2a9f78c4c3f08c3bf33500.png "User icon") ### Account Basics[​](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#account-basics "Direct link to Account Basics") ![Account info](https://doc.traefik.io/traefik-hub-v2/assets/images/user-settings-48e49731b2ca442c3ce1c0c0e460928c.png "Account info") These settings are read-only. To update them, please contact your assigned sales engineer. ### Preferences[​](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#preferences "Direct link to Preferences") ### Configure Theme Preference[​](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#configure-theme-preference "Direct link to Configure Theme Preference") A theme specifies the visual appearance of the dashboard. Theme preferences allow you to change the look and feel to match your visual and accessibility requirements. The list of available themes includes Light, Dark, and OS preferences. ![Theme preference](https://doc.traefik.io/traefik-hub-v2/assets/images/theme-settings-c5913ffe556ab59d30053690e61359c0.png "Theme preference") Select the theme of your choice and select **Save**. * [Introduction](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#introduction) * [Account Basics](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#account-basics) * [Preferences](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#preferences) * [Configure Theme Preference](https://doc.traefik.io/traefik-hub-v2/dashboard/account-settings#configure-theme-preference) --- # 5 docs tagged with "Keycloak" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/keycloak#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/access-overview) How to manage access to Traefik Hub [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub-poc/portal/jwt-portal) How to Use JWT in the API Portal. [Identity Providers\ ------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/identity-provider) How to manage access to Traefik Hub [Keycloak\ --------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Keycloak JWT Configuration\ --------------------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt) How to configure a Keycloak realm for JWT. --- # 8 docs tagged with "JWT" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/jwt#__docusaurus_skipToContent_fallback) [Authentication & Authorization\ ------------------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/access-overview) How to manage access to Traefik Hub [Consumer Authentication\ -----------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/consumer-authentication) Consumer Authentication [How to Use JWT in the API Portal\ --------------------------------](https://doc.traefik.io/traefik-hub-v2/portal/jwt-portal) How to Use JWT in the API Portal. [JSON Web Tokens\ ---------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/jwt-overview) Traefik Hub JWT implementations [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [Keycloak\ --------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/idp/keycloak) How to use Keycloak as the identity provider (IdP) for Traefik Hub. [Keycloak JWT Configuration\ --------------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/keycloak-jwt) How to configure a Keycloak realm for JWT. [Okta JWT Configuration\ ----------------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/okta-jwt) How to configure a Keycloak realm for JWT. --- # NVIDIA NIMs Integration with Traefik Hub AI Gateway LLM Guard Middleware | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#__docusaurus_skipToContent_fallback) On this page NVIDIA NIMs (NVIDIA Inference Microservices) provide GPU-accelerated content security models that integrate seamlessly with Traefik Hub's AI Gateway through the [LLM Guard middleware](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/llm-guard) . This guide demonstrates how to deploy and configure NIMs with Traefik Hub AI Gateway for advanced content filtering, topic control, and jailbreak detection. What Are NVIDIA NIMs?[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#what-are-nvidia-nims "Direct link to What Are NVIDIA NIMs?") ------------------------------------------------------------------------------------------------------------------------------------------------------------------- NVIDIA NIMs are containerized AI microservices optimized for production deployment on NVIDIA GPUs. For content security, they provide: * **Topic Control**: Block conversations about specific topics (competitors, off-topic discussions) * **Content Safety**: Detect harmful content across 22+ safety categories using pre-trained models * **Jailbreak Detection**: Prevent attempts to override system prompts or bypass restrictions Unlike general-purpose LLMs, NIMs are purpose-built for specific security tasks and deliver consistent, reliable results with optimized GPU performance. ![Responsible AI Blueprint](https://doc.traefik.io/traefik-hub/assets/images/responsible-ai-blueprint-93a4cdc3795365ebe1c4a50ab2f08fb3.png) Prerequisites[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#prerequisites "Direct link to Prerequisites") -------------------------------------------------------------------------------------------------------------------------------------------- Before implementing this integration, ensure you have: ### Infrastructure Requirements[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#infrastructure-requirements "Direct link to Infrastructure Requirements") * **Kubernetes Cluster with NVIDIA GPU** (MIG must be turned off - NIMs are incompatible with MIG partitioning) * **Compatible GPU with at least 24 GB of memory**: Each NIM requires dedicated GPU resources (see [gpu resource planning](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#gpu-resource-planning) and [supported models](https://docs.nvidia.com/nim/large-language-models/latest/supported-models.html) ) * **High-performance storage**: For model caching and fast startup times ### Access and Authentication[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#access-and-authentication "Direct link to Access and Authentication") * **NVIDIA NGC API Key**: Obtain from [NVIDIA NGC](https://catalog.ngc.nvidia.com/) * **Traefik Hub with AI Gateway enabled**: helm upgrade traefik traefik/traefik -n traefik --wait \ --reset-then-reuse-values \ --set hub.aigateway.enabled=true Available NVIDIA NIMs for Content Security[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#available-nvidia-nims-for-content-security "Direct link to Available NVIDIA NIMs for Content Security") ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### Topic Control NIM[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#topic-control-nim "Direct link to Topic Control NIM") **Container**: [`nvcr.io/nim/nvidia/llama-3.1-nemoguard-8b-topic-control`](https://catalog.ngc.nvidia.com/orgs/nim/teams/nvidia/containers/llama-3.1-nemoguard-8b-topic-control) Controls conversation topics by analyzing user inputs against predefined allowed and prohibited subjects. Ideal for: * Preventing off-topic conversations (financial advice, legal guidance) * Maintaining brand focus and conversation boundaries ### Content Safety NIM[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#content-safety-nim "Direct link to Content Safety NIM") **Container**: [`nvcr.io/nim/nvidia/llama-3.1-nemoguard-8b-content-safety`](https://catalog.ngc.nvidia.com/orgs/nim/teams/nvidia/containers/llama-3.1-nemoguard-8b-content-safety) Detects harmful content across 22 safety categories including hate speech, and inappropriate material. Categories include: * S1-S23: Harmful content, inappropriate material, prohibited planning, discriminatory speech, privacy violations, and [more](https://catalog.ngc.nvidia.com/orgs/nim/teams/nvidia/containers/llama-3.1-nemoguard-8b-content-safety) * Real-time content analysis for both requests and responses * Compliance with content policies and regulations ### Jailbreak Detection NIM[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#jailbreak-detection-nim "Direct link to Jailbreak Detection NIM") **Container**: [`nvcr.io/nim/nvidia/nemoguard-jailbreak-detect`](https://catalog.ngc.nvidia.com/orgs/nim/teams/nvidia/containers/nemoguard-jailbreak-detect) Identifies attempts to bypass AI system restrictions through prompt manipulation. Detects: * System prompt override attempts * Context escape techniques * Sophisticated prompt injection attacks **Note**: This NIM uses a custom API format (`{"input": "text"}` → `{"jailbreak": boolean}`) rather than OpenAI chat completion format. Implementation Guide[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#implementation-guide "Direct link to Implementation Guide") ----------------------------------------------------------------------------------------------------------------------------------------------------------------- ### Step 1: Deploy NVIDIA NIMs[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-1-deploy-nvidia-nims "Direct link to Step 1: Deploy NVIDIA NIMs") Deploy NVIDIA NIMs using the official NVIDIA deployment guide. Follow the comprehensive instructions at [NVIDIA NIM Deployment Guide](https://docs.nvidia.com/nim/large-language-models/latest/deployment-guide.html) . Prerequisites Before deploying, ensure you have your NGC API key ready. You can obtain it from [NVIDIA NGC](https://catalog.ngc.nvidia.com/) after creating an account. #### Deployment Options[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#deployment-options "Direct link to Deployment Options") The NVIDIA deployment guide provides multiple deployment options: * **Docker** - Quick local deployment and testing * **Kubernetes** - Production deployment with Helm charts * **Cloud Platforms** - AWS EKS, Azure AKS, Google GKE * **Managed Services** - AWS SageMaker, Azure ML, etc. Kubernetes Deployment with NGC Authentication For Kubernetes deployments (like GKE), you need to create secrets for NGC container registry authentication and the API key: # Create docker-registry secret for pulling NIM containerskubectl create secret docker-registry ngc-secret \ --docker-server=nvcr.io \ --docker-username='$oauthtoken' \ --docker-password="$NGC_API_KEY" \ --namespace=# Create generic secret for NIM runtime authenticationkubectl create secret generic ngc-api-secret \ --from-literal=NGC_API_KEY="$NGC_API_KEY" \ --namespace= Reference these secrets in your Kubernetes manifests: * Use `ngc-secret` in `imagePullSecrets` to pull NIM containers * Use `ngc-api-secret` to provide the `NGC_API_KEY` environment variable to NIM pods For this integration, you'll need to deploy the following content security NIMs: * **Topic Control NIM**: [`nvcr.io/nim/nvidia/llama-3.1-nemoguard-8b-topic-control`](https://catalog.ngc.nvidia.com/orgs/nim/teams/nvidia/containers/llama-3.1-nemoguard-8b-topic-control) * **Content Safety NIM**: [`nvcr.io/nim/nvidia/llama-3.1-nemoguard-8b-content-safety`](https://catalog.ngc.nvidia.com/orgs/nim/teams/nvidia/containers/llama-3.1-nemoguard-8b-content-safety) * **Jailbreak Detection NIM**: [`nvcr.io/nim/nvidia/nemoguard-jailbreak-detect`](https://catalog.ngc.nvidia.com/orgs/nim/teams/nvidia/containers/nemoguard-jailbreak-detect) Sample Kubernetes Deployment Manifests Below are complete Kubernetes manifests for deploying each NIM with proper GPU resource allocation and secret references. **Jailbreak Detection NIM:** * Jailbreak Detection NIM * Jailbreak Detection NIM Service * Topic Control NIM * Topic Control NIM Service * Content Safety NIM * Content Safety NIM Service apiVersion: apps/v1kind: Deploymentmetadata: name: jailbreak-detection-nim namespace: appsspec: replicas: 1 selector: matchLabels: app: jailbreak-detection-nim template: metadata: labels: app: jailbreak-detection-nim spec: containers: - name: nim image: nvcr.io/nim/nvidia/nemoguard-jailbreak-detect:1.10.1 ports: - containerPort: 8000 env: - name: NGC_API_KEY valueFrom: secretKeyRef: name: ngc-api-secret key: NGC_API_KEY resources: requests: nvidia.com/gpu: 1 limits: nvidia.com/gpu: 1 imagePullSecrets: - name: ngc-secret apiVersion: v1kind: Servicemetadata: name: jailbreak-detection-nim namespace: appsspec: selector: app: jailbreak-detection-nim ports: - port: 8000 targetPort: 8000 type: ClusterIP apiVersion: apps/v1kind: Deploymentmetadata: name: topic-control-nim namespace: appsspec: replicas: 1 selector: matchLabels: app: topic-control-nim template: metadata: labels: app: topic-control-nim spec: containers: - name: nim image: nvcr.io/nim/nvidia/llama-3.1-nemoguard-8b-topic-control:1.10.1 ports: - containerPort: 8000 env: - name: NGC_API_KEY valueFrom: secretKeyRef: name: ngc-api-secret key: NGC_API_KEY - name: NIM_SERVED_MODEL_NAME value: llama-3.1-nemoguard-8b-topic-control - name: NIM_CUSTOM_MODEL_NAME value: llama-3.1-nemoguard-8b-topic-control resources: requests: nvidia.com/gpu: 1 limits: nvidia.com/gpu: 1 imagePullSecrets: - name: ngc-secret apiVersion: v1kind: Servicemetadata: name: topic-control-nim namespace: appsspec: selector: app: topic-control-nim ports: - port: 8000 targetPort: 8000 type: ClusterIP apiVersion: apps/v1kind: Deploymentmetadata: name: content-safety-nim namespace: appsspec: replicas: 1 selector: matchLabels: app: content-safety-nim template: metadata: labels: app: content-safety-nim spec: containers: - name: nim image: nvcr.io/nim/nvidia/llama-3.1-nemoguard-8b-content-safety:1.10.1 ports: - containerPort: 8000 env: - name: NGC_API_KEY valueFrom: secretKeyRef: name: ngc-api-secret key: NGC_API_KEY - name: NIM_SERVED_MODEL_NAME value: llama-3.1-nemoguard-8b-content-safety - name: NIM_CUSTOM_MODEL_NAME value: llama-3.1-nemoguard-8b-content-safety resources: requests: nvidia.com/gpu: 1 limits: nvidia.com/gpu: 1 imagePullSecrets: - name: ngc-secret apiVersion: v1kind: Servicemetadata: name: content-safety-nim namespace: appsspec: selector: app: content-safety-nim ports: - port: 8000 targetPort: 8000 type: ClusterIP **Apply the manifests:** kubectl apply -f jailbreak-detection-nim.yamlkubectl apply -f topic-control-nim.yamlkubectl apply -f content-safety-nim.yaml **Verify deployments:** kubectl get pods -n apps -l app=jailbreak-detection-nimkubectl get pods -n apps -l app=topic-control-nimkubectl get pods -n apps -l app=content-safety-nim Key Deployment Considerations for Kubernetes Based on production deployments, consider these essential configurations. **GPU Resource Requirements**: NIMs require GPU access. You **must** specify GPU resource requests to ensure Kubernetes schedules pods on GPU-enabled nodes: spec: containers: - name: nim resources: requests: nvidia.com/gpu: 1 # Request 1 GPU limits: nvidia.com/gpu: 1 # Limit to 1 GPU Without GPU resource requests, Kubernetes may schedule NIM pods on non-GPU nodes (for example, `default-pool` instead of `gpu-pool` in GKE), causing deployment failures. **Security Context Requirements**: spec: securityContext: runAsUser: 1000 runAsGroup: 1000 fsGroup: 1000 containers: - name: nim securityContext: privileged: true # Required for GPU access in some environments info NIMs can take 10-15 minutes to start as they download and load large models. Monitor startup progress using the instructions in the [NVIDIA documentation](https://docs.nvidia.com/nim/large-language-models/latest/deployment-guide.html) . MIG Compatibility NVIDIA NIMs are **incompatible with Multi-Instance GPU (MIG)** partitioning. If your GKE cluster has MIG enabled, NIMs will fail with out-of-memory errors even when requesting multiple GPU instances. Ensure MIG is turned off on GPU nodes before deploying NIMs. ### Step 2: Configure LLM Guard Middlewares[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-2-configure-llm-guard-middlewares "Direct link to Step 2: Configure LLM Guard Middlewares") Create the [LLM Guard](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/llm-guard) Middleware configurations that integrate with your deployed NIMs: * Topic Control Middleware * Content Safety Middleware * Jailbreak Detection Middleware apiVersion: traefik.io/v1alpha1kind: Middlewaremetadata: name: topic-control-guard namespace: appsspec: plugin: chat-completion-llm-guard: endpoint: http://topic-control-nim.apps.svc.cluster.local:8000/v1/chat/completions model: llama-3.1-nemoguard-8b-topic-control request: systemPrompt: | You are a topic control agent for an AI assistant focused on cloud-native technologies and DevOps practices. PROHIBITED TOPICS: 1. Competitor products: Gopher Gateway, Badger Proxy, Ferret Router, Weasel Load Balancer, Otter API Manager 2. Financial advice: Investment recommendations, stock trading, cryptocurrency advice 3. Legal guidance: Legal opinions, contract interpretation, compliance advice 4. Medical recommendations: Health advice, medical diagnoses, treatment suggestions 5. Personal information requests: Asking for private data, credentials, API keys ALLOWED TOPICS: - Traefik configuration and usage - Kubernetes networking and ingress - Cloud-native architecture patterns - DevOps best practices and tools - Container orchestration - API gateway concepts (general) - Load balancing principles - Service mesh technologies Respond with "on-topic" or "off-topic". blockCondition: Contains("off-topic") traceCondition: Contains("off-topic") apiVersion: traefik.io/v1alpha1kind: Middlewaremetadata: name: content-safety-guard namespace: appsspec: plugin: chat-completion-llm-guard: endpoint: http://content-safety-nim.apps.svc.cluster.local:8000/v1/chat/completions model: llama-3.1-nemoguard-8b-content-safety request: systemPrompt: | Task: Check if there is unsafe content in user messages according to our safety policy. S1: Violence, S2: Sexual, S3: Criminal Planning, S4: Guns and Illegal Weapons S5: Controlled Substances, S6: Suicide and Self Harm, S7: Sexual (minor) S8: Hate/Identity Hate, S9: PII/Privacy, S10: Harassment, S11: Threat S12: Profanity, S13: Needs Caution, S14: Other, S15: Manipulation S16: Fraud/Deception, S17: Malware, S18: High Risk Gov Decision Making S19: Political/Misinformation, S20: Copyright/Trademark S21: Unauthorized Advice, S22: Illegal Activity, S23: Immoral/Unethical Provide your safety assessment: - First line: 'safe' or 'unsafe' - If unsafe, second line: comma-separated list of violated categories blockCondition: Contains("unsafe") traceCondition: Contains("unsafe") response: systemPrompt: | Task: Check if there is unsafe content in the AI assistant's response according to our safety policy. S1: Violence, S2: Sexual, S3: Criminal Planning, S4: Guns and Illegal Weapons S5: Controlled Substances, S6: Suicide and Self Harm, S7: Sexual (minor) S8: Hate/Identity Hate, S9: PII/Privacy, S10: Harassment, S11: Threat S12: Profanity, S13: Needs Caution, S14: Other, S15: Manipulation S16: Fraud/Deception, S17: Malware, S18: High Risk Gov Decision Making S19: Political/Misinformation, S20: Copyright/Trademark S21: Unauthorized Advice, S22: Illegal Activity, S23: Immoral/Unethical Provide your safety assessment: - First line: 'safe' or 'unsafe' - If unsafe, second line: comma-separated list of violated categories blockCondition: Contains("unsafe") useRequestHistory: true apiVersion: traefik.io/v1alpha1kind: Middlewaremetadata: name: jailbreak-detection-guard namespace: appsspec: plugin: chat-completion-llm-guard-custom: endpoint: http://jailbreak-detection-nim.apps.svc.cluster.local:8000/v1/classify request: # Jailbreak NIM uses custom API format template: '{"input": "{{ (index .messages 0).content }}"}' blockCondition: JSONEquals(".jailbreak", "true") traceCondition: JSONEquals(".jailbreak", "true") ### Step 3: Create Multi-Layer Security Pipeline[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-3-create-multi-layer-security-pipeline "Direct link to Step 3: Create Multi-Layer Security Pipeline") First, create the [chat-completion](https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/chat-completion) middleware to forward validated requests to the target AI service (OpenAI, Gemini, etc.): apiVersion: traefik.io/v1alpha1kind: Middlewaremetadata: name: chat-completion namespace: appsspec: plugin: chat-completion: token: urn:k8s:secret:ai-keys:openai-token model: gpt-4o allowModelOverride: false allowParamsOverride: true params: temperature: 0.7 maxTokens: 2048---apiVersion: v1kind: Secretmetadata: name: ai-keys namespace: appstype: Opaquedata: openai-token: XXXXXXXXXXX # should be base64 encoded---apiVersion: v1kind: Servicemetadata: name: openai-service namespace: appsspec: type: ExternalName externalName: api.openai.com ports: - port: 443 targetPort: 443 Then combine all security layers in a single IngressRoute for comprehensive protection: apiVersion: traefik.io/v1alpha1kind: IngressRoutemetadata: name: multi-layer-secure-ai namespace: appsspec: routes: - kind: Rule match: Host(`ai-secure.example.com`) middlewares: - name: topic-control-guard # Layer 1: Topic compliance - name: jailbreak-detection-guard # Layer 2: Jailbreak prevention - name: content-safety-guard # Layer 3: Content safety - name: chat-completion # Layer 4: AI processing services: - name: openai-service port: 443 scheme: https passHostHeader: false Path Routing with OpenAI This example uses host-only matching, so clients **must** send requests to `/v1/chat/completions` (the path OpenAI expects). If you modify the IngressRoute to use a **custom path** (for example, changing the match to `Host(`ai-secure.example.com`) && PathPrefix(`/api/chat`)`), the example will break because OpenAI will receive `/api/chat` instead of `/v1/chat/completions`. **To use custom paths, add a path rewrite middleware:** apiVersion: traefik.io/v1alpha1kind: Middlewaremetadata: name: ai-openai-pathrewrite namespace: appsspec: replacePathRegex: regex: ^/(.*) replacement: /v1/chat/completions Then add it as the **first middleware** in your IngressRoute: middlewares: - name: ai-openai-pathrewrite # Must be first to rewrite path before processing - name: topic-control-guard - name: jailbreak-detection-guard - name: content-safety-guard - name: chat-completion This ensures that any incoming path is rewritten to `/v1/chat/completions` before reaching OpenAI. GPU Resource Planning Each NIM requires **1 dedicated GPU**. Running all three NIMs (Topic Control, Jailbreak Detection, Content Safety) simultaneously requires **3 GPUs**. If you have limited GPU resources (for example, 2 GPUs in your cluster), you can: * Deploy only the NIMs you need for your use case (for example, Topic Control + Content Safety) * Remove unused middleware layers from your IngressRoute * Scale NIMs based on your security requirements and available GPU capacity For production deployments with high traffic, consider separate GPU node pools for each NIM to ensure isolation and performance. ### Step 4: Testing and Validation[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-4-testing-and-validation "Direct link to Step 4: Testing and Validation") Test your multi-layer security pipeline with real requests to verify proper functionality: #### Blocked Request Example (Topic Control)[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#blocked-request-example-topic-control "Direct link to Blocked Request Example (Topic Control)") **Request**: curl -X POST "http://ai-secure.example.com/v1/chat/completions" \ -H "Content-Type: application/json" \ -d '{ "model": "gpt-4o", "messages": [ { "role": "user", "content": "Please help me set up Gopher Gateway with rate limiting features." } ] }' **Response**: HTTP/1.1 403 ForbiddenContent-Type: text/plain; charset=utf-8Forbidden **Analysis**: Request blocked by Topic Control layer because "Gopher Gateway" is identified as a competitor product. #### Allowed Request Example (Passes All Layers)[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#allowed-request-example-passes-all-layers "Direct link to Allowed Request Example (Passes All Layers)") **Request**: curl -X POST "http://ai-secure.example.com/v1/chat/completions" \ -H "Content-Type: application/json" \ -d '{ "model": "gpt-4o", "messages": [ { "role": "user", "content": "How do I configure Traefik middlewares for rate limiting in Kubernetes?" } ] }' **Response**: HTTP/1.1 200 OKContent-Type: application/json{ "id": "chatcmpl-...", "object": "chat.completion", "created": 1757671447, "model": "gpt-4o", "choices": [ { "index": 0, "message": { "role": "assistant", "content": "To configure Traefik middlewares for rate limiting in Kubernetes..." } } ]} **Analysis**: Request successfully passes through all security layers: 1. **Topic Control**: "Traefik" is an allowed topic 2. **Content Safety**: Request contains no harmful content 3. **Chat Completion**: Forwards to OpenAI and returns AI response Performance Considerations[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#performance-considerations "Direct link to Performance Considerations") ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### GPU Resource Planning[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#gpu-resource-planning "Direct link to GPU Resource Planning") Each NIM requires dedicated GPU resources: * **Topic Control NIM**: ~8GB GPU memory * **Content Safety NIM**: ~12GB GPU memory * **Jailbreak Detection NIM**: ~4GB GPU memory Plan your cluster capacity accordingly and consider: * **Node affinity** to co-locate NIMs on the same GPU nodes * **Resource limits** to prevent resource contention * **Horizontal scaling** for high-traffic scenarios ### Latency Optimization[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#latency-optimization "Direct link to Latency Optimization") NIMs add processing latency to each request: * **Topic Control**: ~50-100ms per request * **Content Safety**: ~100-200ms per request * **Jailbreak Detection**: ~30-50ms per request Optimize performance by: * **Deploying NIMs close to Traefik Hub** (same cluster/region) * **Implementing selective filtering** based on request characteristics Troubleshooting[​](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#troubleshooting "Direct link to Troubleshooting") -------------------------------------------------------------------------------------------------------------------------------------------------- | Issue | Symptoms | Solution | | --- | --- | --- | | **ImagePullBackOff (401 Unauthorized)** | `Error: Failed to pull image: 401 Unauthorized` | • Verify NGC API key is correctly base64 encoded
• Use `kubectl create secret --from-literal` instead of environment variable substitution
• Check NGC account permissions for specific NIM | | **ImagePullBackOff (402 Payment Required)** | `Error: Failed to pull image: 402 Payment Required` | • Verify NGC account has access to the specific NIM
• Check subscription status for commercial NIMs | | **Permission Denied on Cache Directory** | `PermissionError: [Errno 13] Permission denied: '/opt/nim/.cache'` | • Add pod-level `securityContext` with `runAsUser: 1000`, `runAsGroup: 1000`, `fsGroup: 1000`
• Ensure PVC has correct permissions | | **CUDA Runtime Error** | `RuntimeError: Failed to dlopen libcuda.so.1` | • Add `securityContext: privileged: true` to container
• Set `NVIDIA_VISIBLE_DEVICES: "all"` and `NVIDIA_DRIVER_CAPABILITIES: "compute,utility"`
• Mount NVIDIA drivers with hostPath volume if needed | | **Out of Memory (MIG Enabled)** | `Cuda Runtime (out of memory)` with MIG partitions | • **Disable MIG** on GPU nodes (NIMs are incompatible with MIG)
• Use `NIM_MODEL_PROFILE` to force vLLM backend
• Reduce `NIM_GPU_MEMORY_UTILIZATION` to 0.7 or lower | | **Model Not Found (404 Error)** | `The model 'model-name' does not exist` | • Use correct model names: `llama-3.1-nemoguard-8b-topic-control`, `llama-3.1-nemoguard-8b-content-safety`
• Check NIM `/v1/models` endpoint for available models | | **High Latency** | Requests taking >5 seconds | • Check network connectivity between components
• Verify GPU utilization and memory usage
• Consider request batching or caching strategies | | **Unexpected Blocking/Allowing** | Security layers not working as expected | • Test NIMs directly to isolate middleware issues
• Verify system prompts match working configurations
• Check `blockCondition` and `traceCondition` expressions
• Ensure model responses match expected format | This integration provides enterprise-grade content security for AI applications while maintaining the flexibility and performance required for production deployments. The combination of NVIDIA's specialized NIMs with Traefik Hub's AI Gateway creates a powerful platform for safe, controlled AI interactions. * [What Are NVIDIA NIMs?](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#what-are-nvidia-nims) * [Prerequisites](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#prerequisites) * [Infrastructure Requirements](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#infrastructure-requirements) * [Access and Authentication](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#access-and-authentication) * [Available NVIDIA NIMs for Content Security](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#available-nvidia-nims-for-content-security) * [Topic Control NIM](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#topic-control-nim) * [Content Safety NIM](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#content-safety-nim) * [Jailbreak Detection NIM](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#jailbreak-detection-nim) * [Implementation Guide](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#implementation-guide) * [Step 1: Deploy NVIDIA NIMs](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-1-deploy-nvidia-nims) * [Step 2: Configure LLM Guard Middlewares](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-2-configure-llm-guard-middlewares) * [Step 3: Create Multi-Layer Security Pipeline](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-3-create-multi-layer-security-pipeline) * [Step 4: Testing and Validation](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#step-4-testing-and-validation) * [Performance Considerations](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#performance-considerations) * [GPU Resource Planning](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#gpu-resource-planning) * [Latency Optimization](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#latency-optimization) * [Troubleshooting](https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration#troubleshooting) --- # One doc tagged with "Access" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/access#__docusaurus_skipToContent_fallback) [User Management\ ---------------](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups) Traefik Hub - Control access to your APIs and documentation. --- # Keycloak JWT Configuration | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#__docusaurus_skipToContent_fallback) On this page How to configure a Keycloak realm for JWT. * * * warning If you switch from the default configuration to JSON Web Tokens, all API keys generated in the API Portal will be **turned off**. Requirements[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#requirements "Direct link to Requirements") --------------------------------------------------------------------------------------------------------------------------------------------- Please ensure you have the following: * A Keycloak instance with all the required permissions * A Keycloak realm * [Admin permissions](https://doc.traefik.io/traefik-hub-poc/dashboard#workspace-roles "Link to documentation about workspace roles in Traefik Hub") for the Traefik Hub workspace * `curl` * * * Client Configuration[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#client-configuration "Direct link to Client Configuration") --------------------------------------------------------------------------------------------------------------------------------------------------------------------- In the first step, select the realm and select **Create client** to create a new [Keycloak client](https://example.com/) . The example uses the realm _keycloak-demo_ and the name of the new client will be _new-client_. ![Choose realm and create a new client](https://doc.traefik.io/traefik-hub-poc/assets/images/kc-jwt-346e949fe80407008703f759f90d569c.png "Choose realm and create a new client") ![Create new client scope](https://doc.traefik.io/traefik-hub-poc/assets/images/kc-jwt-ca1-3c0e72ace8ec51e327d61d2f7ae52de1.png "Create new client scope") ### Create a Client Scope[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#create-a-client-scope "Direct link to Create a Client Scope") A client scope is a way to limit the roles that get declared inside an access token. When a client requests that a user be authenticated, the access token they receive back will only contain the role mappings you’ve explicitly specified for the client’s scope. This allows you to limit the permissions each individual access token has, rather than giving the client access to all the user’s permissions. Make sure to disable the full group path setting. ![Disable full group path setting](https://doc.traefik.io/traefik-hub-poc/assets/images/kc-client-scope-group-path-5fe717bd1bff49ae505cac14c8027528.png "Disable full group path setting") ### Read More [Learn more about client scopes and Keycloak.](https://www.keycloak.org/docs/latest/authorization_services/index.html#_resource_overview) Test the Configuration[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#test-the-configuration "Direct link to Test the Configuration") --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Use `curl` to generate a JWT and validate it against your Keycloak instance. The following example uses the _password grant type_ as a validation method. CLI curl -s \--data-urlencode 'username=jane.doe' \--data-urlencode 'password=&MY-SECURE-PASSWORD' \--data-urlencode 'grant_type=password' \--data-urlencode 'client_id=jwt-demo' \https://$KEYCLOAK-URL/realms/keycloak-demo/protocol/openid-connect/token{"access_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTk1MTg5NDYsImlhdCI6MTY5OTUxODY0NiwianRpIjoiN2U5ZTUxYjQtN2M5Ny00MjdiLWIyZWMtYzA1NGIyMGFiMDMwIiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5leGFtcGxlLmlvL3JlYWxtcy9rZXljbG9hay1kZW1vIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjM0MTYwNWIyLWU0NGItNGNkMC1hNDZjLWEwNjMzNWFhYTVkYiIsInR5cCI6IkJlYXJlciIsImF6cCI6Imp3dC1kZW1vIiwic2Vzc2lvbl9zdGF0ZSI6IjU2MDQwZmE3LTJiZjQtNGRhZi05YjhhLWEzZjRmZjhhZWM3MSIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiLyoiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMta2V5Y2xvYWstZGVtbyIsIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Imdyb3VwcyBlbWFpbCBwcm9maWxlIHVzZXJfaWQiLCJzaWQiOiI1NjA0MGZhNy0yYmY0LTRkYWYtOWI4YS1hM2Y0ZmY4YWVjNzEiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwibmFtZSI6IkphbmUgRG9lIiwiZ3JvdXBzIjpbInN1cHBvcnQiXSwicHJlZmVycmVkX3VzZXJuYW1lIjoiamFuZS5kb2UiLCJnaXZlbl9uYW1lIjoiSmFuZSIsImZhbWlseV9uYW1lIjoiRG9lIiwiZW1haWwiOiJqYW5lLmRvZUB0cmFlZmlrLWFpcmxpbmVzLmlvIn0.3NcJ3sbItZmPLe6ZAome17yT-50MM6mjumeh9ROvNfE"} * * * Related Content[​](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#related-content "Direct link to Related Content") ------------------------------------------------------------------------------------------------------------------------------------------------------ * Learn how to [enable JWT authentication in the dashboard](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/jwt-overview#enable-jwt-in-traefik-hub "Link to documentation about how to enable JWT in the dashboard") . * [Requirements](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#requirements) * [Client Configuration](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#client-configuration) * [Create a Client Scope](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#create-a-client-scope) * [Test the Configuration](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#test-the-configuration) * [Related Content](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/keycloak-jwt#related-content) --- # One doc tagged with "API Versioning" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/api-versioning#__docusaurus_skipToContent_fallback) [API Version\ -----------](https://doc.traefik.io/traefik-hub-poc/api-management/api-version) API versioning with Traefik Hub. --- # One doc tagged with "API Collection" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/api-collection#__docusaurus_skipToContent_fallback) [API Collections\ ---------------](https://doc.traefik.io/traefik-hub-poc/api-management/api-collection) Traefik Hub - API collections overview. --- # One doc tagged with "Ingress Management" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/ingress-management#__docusaurus_skipToContent_fallback) [Data Sharing\ ------------](https://doc.traefik.io/traefik-hub-poc/introduction/security/data-sharing) Overview about shared data between the Traefik Hub’s SaaS control plane and a Kubernetes cluster hosting the Traefik Hub agent --- # 3 docs tagged with "User" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/user#__docusaurus_skipToContent_fallback) [Account Settings\ ----------------](https://doc.traefik.io/traefik-hub-poc/dashboard/account-settings) How to configure account settings in Traefik Hub. [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. [User Management\ ---------------](https://doc.traefik.io/traefik-hub-poc/api-management/users-and-groups) Traefik Hub - Control access to your APIs and documentation. --- # One doc tagged with "Custom Certificates" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/custom-certificates#__docusaurus_skipToContent_fallback) [Custom Certificates\ -------------------](https://doc.traefik.io/traefik-hub-poc/operations/custom-certificates) This page explains how to attach a custom certificate to an API. --- # One doc tagged with "Swagger" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/swagger#__docusaurus_skipToContent_fallback) [OpenAPI\ -------](https://doc.traefik.io/traefik-hub-poc/reference/specs/openapi) Support for Swagger v2 and OpenAPI v3.0.x in Traefik Hub. --- # One doc tagged with "Group" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/group#__docusaurus_skipToContent_fallback) [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub-poc/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. --- # 30 docs tagged with "HTTP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/http#__docusaurus_skipToContent_fallback) [AddPrefix\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/add-prefix) Learn how to implement the HTTP AddPrefix middleware in Traefik Hub to update request paths before being forwarded. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-api-key) Traefik Hub - API Key authentication middleware. [BasicAuth\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/basic-auth) The HTTP basic authentication (BasicAuth) middleware in Traefik Hub restricts access to Services to known users. [Buffering\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/buffering) The HTTP buffering middleware in Traefik Hub limits the size of requests that can be forwarded to Services. [Chain\ -----](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [CircuitBreaker\ --------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/circuitbreaker) The HTTP circuit breaker prevents stacking requests to unhealthy Services, resulting in cascading failures. [Compress\ --------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/compress) The compress middleware lets you compress responses before sending them to the client. [ContentType\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/content-type) Traefik Hub's HTTP middleware automatically sets the \`Content-Type\` header value when it is not set by the backend. [DigestAuth\ ----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/digest-auth) HTTP DigestAuth middleware restricts access to your services to known users. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy [Error Pages\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/errors) The Errors middleware returns custom pages according to configured ranges of HTTP Status codes. [ForwardAuth\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/forward-auth) The HTTP ForwardAuth middleware delegates authentication to an external Service. [GrpcWeb\ -------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/grpc-web) GrpcWeb converts a gRPC Web requests to HTTP/2 gRPC requests. [Headers\ -------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/headers) The HTTP headers middleware manages the headers of requests and responses. [HTTP Middleware Overview\ ------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/http-overview) Controlling connections. [InFlightReq\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/in-flight-req) The InFlightReq HTTP middleware lets you limit the number of simultaneous in-flight requests. [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [OAuth 2.0 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-oauth-client-creds) The OAuth 2.0 Client Credentials Authentication middleware secures your applications using the client credentials flow [OAuth 2.0 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-api-introspection) Traefik Hub - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [RateLimit\ ---------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests [RedirectRegex\ -------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/redirect-regex) RedirectRegex redirecting clients to different locations. [RedirectScheme\ --------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/redirect-scheme) RedirectScheme redirects clients to different schemes/ports. [ReplacePath\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/replace-path) ReplacePath updates paths before forwarding requests. [ReplacePathRegex\ ----------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/replace-path-regex) ReplacePathRegex updates paths before forwarding requests, using a regex. [Retry\ -----](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/retry) Retry requests to a backend server until it succeeds. [StripPrefix\ -----------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/strip-prefix) StripPrefix removes prefixes from paths before forwarding requests. [StripPrefixRegex\ ----------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/strip-prefix-regex) StripPrefixRegex removes prefixes from paths before forwarding requests, using regex. Read the technical documentation. --- # Unknown openapi: 3.0.2 info: title: API Pastry - 2.0 version: 2.0.0 description: API definition of API Pastry sample app contact: name: Laurent Broudoux url: 'http://github.com/lbroudoux' email: laurent.broudoux@gmail.com license: name: MIT License url: 'https://opensource.org/licenses/MIT' paths: /pastry: summary: Global operations on pastries get: tags: - pastry responses: '200': content: application/json: schema: type: array items: $ref: '#/components/schemas/Pastry' examples: pastries\_json: value: - name: Baba Rhum description: Delicieux Baba au Rhum pas calorique du tout size: L price: 3.2 status: available - name: Divorces description: Delicieux Divorces pas calorique du tout size: M price: 2.8 status: available - name: Tartelette Fraise description: Delicieuse Tartelette aux Fraises fraiches size: S price: 2 status: available description: Get list of pastries operationId: GetPastries summary: Get list of pastries '/pastry/{name}': summary: Specific operation on pastry get: parameters: - examples: Eclair Cafe: value: Eclair Cafe Eclair Cafe Xml: value: Eclair Cafe Millefeuille: value: Millefeuille name: name description: pastry name schema: type: string in: path required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/Pastry' examples: Eclair Cafe: value: name: Eclair Cafe description: Delicieux Eclair au Cafe pas calorique du tout size: M price: 2.5 status: available Millefeuille: value: name: Millefeuille description: Delicieux Millefeuille pas calorique du tout size: L price: 4.4 status: available text/xml: schema: $ref: '#/components/schemas/Pastry' examples: {} description: Pastry with specified name operationId: GetPastryByName summary: Get Pastry by name description: Get Pastry by name patch: requestBody: content: application/json: schema: $ref: '#/components/schemas/Pastry' examples: Eclair Cafe: value: price: 2.6 text/xml: schema: $ref: '#/components/schemas/Pastry' examples: {} required: true parameters: - examples: Eclair Cafe: value: Eclair Cafe Eclair Cafe Xml: value: Eclair Cafe name: name description: pastry name schema: type: string in: path required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/Pastry' examples: Eclair Cafe: value: name: Eclair Cafe description: Delicieux Eclair au Cafe pas calorique du tout size: M price: 2.6 status: available text/xml: schema: $ref: '#/components/schemas/Pastry' examples: {} description: Changed pastry operationId: PatchPastry summary: Patch existing pastry parameters: - name: name description: pastry name schema: type: string in: path required: true components: schemas: Pastry: title: Root Type for Pastry description: The root of the Pastry type's schema. type: object properties: name: description: Name of this pastry type: string description: description: A short description of this pastry type: string size: description: 'Size of pastry (S, M, L)' type: string price: format: double description: Price (in USD) of this pastry type: number status: description: 'Status in stock (available, out\_of\_stock)' type: string example: name: My Pastry description: A short description os my pastry size: M price: 4.5 status: available tags: - name: pastry description: Pastry resource --- # Unknown ```json {"dashboards" :[{"dashboardId":"ocid1.managementdashboard.oc1..aaaaaaaa23fqi53tw6bfhn4cmtjysaicsh23tnayvzhugon3ofdxaftp666a","providerId":"APM","providerName":"APM","providerVersion":"3.0.0","tiles":[{"displayName":"Request (Total)","savedSearchId":"OOBSS-management-dashboard-123","row":0,"column":0,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_entrypoint_requests_total","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_entrypoint_requests_total","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_entrypoint_requests_total[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"API Request (Bytes)","savedSearchId":"OOBSS-management-dashboard-123","row":0,"column":4,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_hub_api_requests_bytes","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_hub_api_requests_bytes","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_hub_api_requests_bytes[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"Open Connections","savedSearchId":"OOBSS-management-dashboard-123","row":0,"column":8,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_open_connections","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_open_connections","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_open_connections[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"API Requests (Total)","savedSearchId":"OOBSS-management-dashboard-123","row":3,"column":0,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_hub_api_requests","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_hub_api_requests","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_hub_api_requests[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"API Request Duration","savedSearchId":"OOBSS-management-dashboard-123","row":3,"column":4,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_hub_api_requests_duration_milliseconds","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_hub_api_requests_duration_milliseconds","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_hub_api_requests_duration_milliseconds[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"IngressRoutes","savedSearchId":"OOBSS-management-dashboard-123","row":3,"column":8,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_hub_ingress_routes","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_hub_ingress_routes","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_hub_ingress_routes[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"API Plans","savedSearchId":"OOBSS-management-dashboard-123","row":6,"column":0,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_hub_api_plans","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_hub_api_plans","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_hub_api_plans[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"Requests TLS (Total)","savedSearchId":"OOBSS-management-dashboard-123","row":6,"column":4,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_service_requests_tls_total","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_service_requests_tls_total","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_service_requests_tls_total[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"Request per Endpoint","savedSearchId":"OOBSS-management-dashboard-123","row":6,"column":8,"height":3,"width":4,"nls":{},"uiConfig":{"internalKey":"OOBSS-management-dashboard-123","defaultDataSource":"oracle_apm_monitoring/traefik_entrypoint_requests_total","chartInfo":{"colorBy":"name","series":"name","value":"aggregatedDatapoints.value","group":"aggregatedDatapoints.timestamp","jetConfig":{"type":"line","timeAxisType":"enabled","xAxis":{"viewportMin":"$(params.time.start)","viewportMax":"$(params.time.end)"}}}},"dataConfig":[{"name":"oracle_apm_monitoring/traefik_entrypoint_requests_total","type":"monitoringDataSource","parameters":{"namespace":"oracle_apm_monitoring","mql":"traefik_entrypoint_requests_total[auto].grouping().mean()","compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","regionName":"$(params.regionName)"}}],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","regionName":"$(context.regionName)","compartmentId":"$(dashboard.params.compartmentId)"},"description":null},{"displayName":"__INHERIT__","savedSearchId":"ocid1.managementsavedsearch.oc1..aaaaaaaa4y66hadpn4mae6e5yfob4eht72a5pizqwvnfyp4ivsm54zfaewmq","row":9,"column":0,"height":3,"width":6,"nls":{},"uiConfig":{},"dataConfig":[],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","apmDomain":"$(dashboard.params.apmDomain)"},"description":null},{"displayName":"Response 404","savedSearchId":"ocid1.managementsavedsearch.oc1..aaaaaaaaht3nm3tlfhfylyfv4lp2i2xz4uzkhigcmacnuywfpbbwtx4n2jsq","row":9,"column":6,"height":3,"width":6,"nls":{},"uiConfig":{},"dataConfig":[],"state":"DEFAULT","drilldownConfig":[],"parametersMap":{"time":"$(dashboard.params.time)","apmDomain":"$(dashboard.params.apmDomain)"},"description":null}],"displayName":"Traefik Dashboard","description":"Monitoring Dashboard for Traefik Hub","compartmentId":"ocid1.tenancy.oc1..aaaaaaaafbtoilsgqspgjre2mcl54d6svufqa4ljvfarz5emdtdlpw4caxma","isOobDashboard":false,"isShowInHome":false,"metadataVersion":"2.0","isShowDescription":true,"screenImage":"todo: provide value[mandatory]","nls":{},"uiConfig":{"isFilteringEnabled":false,"isTimeRangeEnabled":true,"isRefreshEnabled":true},"dataConfig":[],"type":"normal","isFavorite":false,"savedSearches":[{"id":"ocid1.managementsavedsearch.oc1..aaaaaaaaht3nm3tlfhfylyfv4lp2i2xz4uzkhigcmacnuywfpbbwtx4n2jsq","displayName":"Return Code 404","providerId":"APM","providerVersion":"3.0.0","providerName":"APM","compartmentId":"ocid1.tenancy.oc1..aaaaaaaafbtoilsgqspgjre2mcl54d6svufqa4ljvfarz5emdtdlpw4caxma","isOobSavedSearch":false,"description":"HTTP Response Code 404","nls":{},"type":"WIDGET_SHOW_IN_DASHBOARD","uiConfig":{"vizType":"table","tableInfo":{"cols":[{"val":"ServiceName","header":{"name":"ServiceName"},"sortable":"disable"},{"val":"OperationName","header":{"name":"OperationName"},"sortable":"disable"},{"val":"StartTime","header":{"name":"StartTime"},"sortable":"disable"},{"val":"SpanDuration","header":{"name":"SpanDuration"},"sortable":"disable"}]},"defaultDataSource":"traceData"},"dataConfig":[{"name":"traceData","type":"tracesDataSource","parameters":{"compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","apmDomain":"$(params.apmDomain)","maxDesiredDataPoints":320,"dimensionFilters":"$(params.flex)","apmQuery":"show spans * where \"http.response.status_code\" = 404","simplifyDataSource":true}}],"screenImage":"...","metadataVersion":"2.0","widgetTemplate":"visualizations/chartWidgetTemplate.html","widgetVM":"visualizations/chartWidget","freeformTags":{},"definedTags":{},"parametersConfig":[{"name":"time","displayName":"Time","required":true,"defaultFilterIds":["OOBSS-management-dashboard-time-selector-filter"],"editUi":{"inputType":"savedSearch","filterTile":{"filterId":"OOBSS-management-dashboard-time-selector-filter"}}},{"name":"apmDomain","displayName":"Apm Domain","required":true,"defaultFilterIds":["OOBSS-APM-domain-filter"],"editUi":{"filterTile":{"filterId":"OOBSS-APM-domain-filter"}}},{"name":"flex"}],"featuresConfig":{"crossService":{"shared":true},"dependencies":[{"libProviderId":"APM","version":"1.5.0"}],"serviceTypes":["APM"]},"drilldownConfig":[]},{"id":"ocid1.managementsavedsearch.oc1..aaaaaaaa4y66hadpn4mae6e5yfob4eht72a5pizqwvnfyp4ivsm54zfaewmq","displayName":"Response 200","providerId":"APM","providerVersion":"3.0.0","providerName":"APM","compartmentId":"ocid1.tenancy.oc1..aaaaaaaafbtoilsgqspgjre2mcl54d6svufqa4ljvfarz5emdtdlpw4caxma","isOobSavedSearch":false,"description":"HTTP Response code 200","nls":{},"type":"WIDGET_SHOW_IN_DASHBOARD","uiConfig":{"vizType":"table","tableInfo":{"cols":[{"val":"ServiceName","header":{"name":"ServiceName"},"sortable":"disable"},{"val":"OperationName","header":{"name":"OperationName"},"sortable":"disable"},{"val":"StartTime","header":{"name":"StartTime"},"sortable":"disable"},{"val":"SpanDuration","header":{"name":"SpanDuration"},"sortable":"disable"}]},"defaultDataSource":"traceData"},"dataConfig":[{"name":"traceData","type":"tracesDataSource","parameters":{"compartmentId":"$(params.compartmentId)","startTime":"$(params.time.start)","endTime":"$(params.time.end)","apmDomain":"$(params.apmDomain)","maxDesiredDataPoints":320,"dimensionFilters":"$(params.flex)","apmQuery":"show spans * where \"http.response.status_code\" = 200","simplifyDataSource":true}}],"screenImage":"...","metadataVersion":"2.0","widgetTemplate":"visualizations/chartWidgetTemplate.html","widgetVM":"visualizations/chartWidget","freeformTags":{},"definedTags":{},"parametersConfig":[{"name":"time","displayName":"Time","required":true,"defaultFilterIds":["OOBSS-management-dashboard-time-selector-filter"],"editUi":{"inputType":"savedSearch","filterTile":{"filterId":"OOBSS-management-dashboard-time-selector-filter"}}},{"name":"apmDomain","displayName":"Apm Domain","required":true,"defaultFilterIds":["OOBSS-APM-domain-filter"],"editUi":{"filterTile":{"filterId":"OOBSS-APM-domain-filter"}}},{"name":"flex"}],"featuresConfig":{"crossService":{"shared":true},"dependencies":[{"libProviderId":"APM","version":"1.5.0"}],"serviceTypes":["APM"]},"drilldownConfig":[]}],"parametersConfig":[{"savedSearchId":"OOBSS-management-dashboard-compartment-filter","width":2,"state":"DEFAULT","parametersMap":{"isStoreInLocalStorage":false,"isActiveCompartment":"true"},"name":"compartmentId","localStorageKey":"compartmentId"},{"savedSearchId":"OOBSS-APM-domain-filter","width":2,"state":"DEFAULT","parametersMap":{"isStoreInLocalStorage":true,"compartmentId":"$(dashboard.params.compartmentId)"},"name":"apmDomain","localStorageKey":"apmDomain"},{"name":"time","displayName":"$(bundle.globalSavedSearch.TIME)","src":"$(context.time)"}],"featuresConfig":{"crossService":{"shared":true},"serviceTypes":["APM"]},"drilldownConfig":[],"freeformTags":{},"definedTags":{}}]} ``` --- # 4 docs tagged with "Authentication" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-poc/tags/authentication#__docusaurus_skipToContent_fallback) [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-api-key) Traefik Hub - API Key authentication middleware. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [OAuth 2.0 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-api-introspection) Traefik Hub - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub-poc/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. --- # One doc tagged with "API Key Introspection" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/api-key-introspection#__docusaurus_skipToContent_fallback) [OAuth 2.0 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-introspection) Traefik Hub - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server. --- # One doc tagged with "API Key" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/api-key#__docusaurus_skipToContent_fallback) [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-key) Traefik Hub - API Key authentication middleware. --- # One doc tagged with "OIDC" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/oidc#__docusaurus_skipToContent_fallback) [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. --- # 3 docs tagged with "TCP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/tcp#__docusaurus_skipToContent_fallback) [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/tcp/tcp-ip-allow-ist) Use IPAllowList in TCP middleware for limiting clients to specific IPs in Traefik Proxy. [InFlightConn\ ------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/tcp/in-flight-conn) Limiting the number of simultaneous connections. [TCP Middleware Overview\ -----------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/tcp/tcp-overview) TCP Middleware Overview. --- # 4 docs tagged with "Authentication" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/authentication#__docusaurus_skipToContent_fallback) [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-key) Traefik Hub - API Key authentication middleware. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [OAuth 2.0 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-introspection) Traefik Hub - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. --- # One doc tagged with "Tutorial" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/tutorial#__docusaurus_skipToContent_fallback) [Publish an API through the dashboard\ ------------------------------------](https://doc.traefik.io/traefik-hub-v2/tutorials/api-management/ui/publish-an-api-through-the-ui) Traefik Hub - How to publish an API through the dashboard. --- # One doc tagged with "Group" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/group#__docusaurus_skipToContent_fallback) [Internal IdP\ ------------](https://doc.traefik.io/traefik-hub-v2/authentication-authorization/internal-idp) This page describes how to manage user and user groups using Traefik Hub as IdP. --- # One doc tagged with "Custom Certificates" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/custom-certificates#__docusaurus_skipToContent_fallback) [Custom Certificates\ -------------------](https://doc.traefik.io/traefik-hub-v2/operations/custom-certificates) This page explains how to attach a custom certificate to an API. --- # One doc tagged with "Prometheus" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/prometheus#__docusaurus_skipToContent_fallback) [Prometheus\ ----------](https://doc.traefik.io/traefik-hub-v2/operations/prometheus) This page describes how you can utilize Prometheus for Traefik Hub metrics collected by OpenTelemetry. --- # Networking | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/networking#__docusaurus_skipToContent_fallback) On this page Documentation about networking details related to Traefik Hub. * * * Internet Address Requirements[​](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/networking#internet-address-requirements "Direct link to Internet Address Requirements") ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The Traefik Hub API Gateway needs to be able to communicate with the Traefik Hub platform. Please make sure to allow **outgoing requests** to all IPs listed on our [IP overview page](https://hub.traefik.io/ips "Link to IP overview list") on all ports (1-65535). There will be **no** incoming requests from the listed IPs! note The [list of IPs](https://hub.traefik.io/ips "Link to IP overview list") is dynamic and changes over time. * [Internet Address Requirements](https://doc.traefik.io/traefik-hub-v2/api-gateway/setup/networking#internet-address-requirements) --- # 33 docs tagged with "Middleware" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/middleware#__docusaurus_skipToContent_fallback) [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/tcp/tcp-ip-allow-ist) Use IPAllowList in TCP middleware for limiting clients to specific IPs in Traefik Proxy. [AddPrefix\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/add-prefix) Learn how to implement the HTTP AddPrefix middleware in Traefik Hub to update request paths before being forwarded. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-key) Traefik Hub - API Key authentication middleware. [BasicAuth\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/basic-auth) The HTTP basic authentication (BasicAuth) middleware in Traefik Hub restricts access to Services to known users. [Buffering\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/buffering) The HTTP buffering middleware in Traefik Hub limits the size of requests that can be forwarded to Services. [Chain\ -----](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [CircuitBreaker\ --------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/circuitbreaker) The HTTP circuit breaker prevents stacking requests to unhealthy Services, resulting in cascading failures. [Compress\ --------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/compress) The compress middleware lets you compress responses before sending them to the client. [ContentType\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/content-type) Traefik Hub's HTTP middleware automatically sets the \`Content-Type\` header value when it is not set by the backend. [DigestAuth\ ----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/digest-auth) HTTP DigestAuth middleware restricts access to your services to known users. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy [Error Pages\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/errors) The Errors middleware returns custom pages according to configured ranges of HTTP Status codes. [ForwardAuth\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/forward-auth) The HTTP ForwardAuth middleware delegates authentication to an external Service. [GrpcWeb\ -------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/grpc-web) GrpcWeb converts a gRPC Web requests to HTTP/2 gRPC requests. [Headers\ -------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/headers) The HTTP headers middleware manages the headers of requests and responses. [HTTP Middleware Overview\ ------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/http-overview) Controlling connections. [InFlightConn\ ------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/tcp/in-flight-conn) Limiting the number of simultaneous connections. [InFlightReq\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/in-flight-req) The InFlightReq HTTP middleware lets you limit the number of simultaneous in-flight requests. [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [OAuth 2.0 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-oauth-client-creds) The OAuth 2.0 Client Credentials Authentication middleware secures your applications using the client credentials flow [OAuth 2.0 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-introspection) Traefik Hub - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [RateLimit\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests [RedirectRegex\ -------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/redirect-regex) RedirectRegex redirecting clients to different locations. [RedirectScheme\ --------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/redirect-scheme) RedirectScheme redirects clients to different schemes/ports. [ReplacePath\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/replace-path) ReplacePath updates paths before forwarding requests. [ReplacePathRegex\ ----------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/replace-path-regex) ReplacePathRegex updates paths before forwarding requests, using a regex. [Retry\ -----](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/retry) Retry requests to a backend server until it succeeds. [StripPrefix\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/strip-prefix) StripPrefix removes prefixes from paths before forwarding requests. [StripPrefixRegex\ ----------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/strip-prefix-regex) StripPrefixRegex removes prefixes from paths before forwarding requests, using regex. Read the technical documentation. [TCP Middleware Overview\ -----------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/tcp/tcp-overview) TCP Middleware Overview. --- # 30 docs tagged with "HTTP" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/http#__docusaurus_skipToContent_fallback) [AddPrefix\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/add-prefix) Learn how to implement the HTTP AddPrefix middleware in Traefik Hub to update request paths before being forwarded. [API Key Authentication\ ----------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-key) Traefik Hub - API Key authentication middleware. [BasicAuth\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/basic-auth) The HTTP basic authentication (BasicAuth) middleware in Traefik Hub restricts access to Services to known users. [Buffering\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/buffering) The HTTP buffering middleware in Traefik Hub limits the size of requests that can be forwarded to Services. [Chain\ -----](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/chain) The HTTP chain middleware lets you define reusable combinations of other middleware, to reuse the same groups. [CircuitBreaker\ --------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/circuitbreaker) The HTTP circuit breaker prevents stacking requests to unhealthy Services, resulting in cascading failures. [Compress\ --------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/compress) The compress middleware lets you compress responses before sending them to the client. [ContentType\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/content-type) Traefik Hub's HTTP middleware automatically sets the \`Content-Type\` header value when it is not set by the backend. [DigestAuth\ ----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/digest-auth) HTTP DigestAuth middleware restricts access to your services to known users. [Distributed RateLimit\ ---------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/distributed-rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy [Error Pages\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/errors) The Errors middleware returns custom pages according to configured ranges of HTTP Status codes. [ForwardAuth\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/forward-auth) The HTTP ForwardAuth middleware delegates authentication to an external Service. [GrpcWeb\ -------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/grpc-web) GrpcWeb converts a gRPC Web requests to HTTP/2 gRPC requests. [Headers\ -------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/headers) The HTTP headers middleware manages the headers of requests and responses. [HTTP Middleware Overview\ ------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/http-overview) Controlling connections. [InFlightReq\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/in-flight-req) The InFlightReq HTTP middleware lets you limit the number of simultaneous in-flight requests. [IPAllowList\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/ip-allow-list) Learn how to use IPAllowList in HTTP middleware for limiting clients to specific IPs. [JWT Authentication\ ------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-jwt) Traefik Hub - Learn how to configure the JWT Authentication middleware for Ingress management. [OAuth 2.0 Client Credentials Authentication\ -------------------------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-oauth-client-creds) The OAuth 2.0 Client Credentials Authentication middleware secures your applications using the client credentials flow [OAuth 2.0 Token Introspection Authentication\ --------------------------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-api-introspection) Traefik Hub - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server. [OpenID Connect Authentication\ -----------------------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/api-gateway-middleware-oidc) Traefik Hub - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider. [PassTLSClientCert\ -----------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/pass-tls-client-cert) The PassTLSClientCert adds selected data from passed client TLS certificates to headers. [RateLimit\ ---------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/rate-limit) HTTP RateLimit middleware ensures Services receive fair amounts of requests [RedirectRegex\ -------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/redirect-regex) RedirectRegex redirecting clients to different locations. [RedirectScheme\ --------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/redirect-scheme) RedirectScheme redirects clients to different schemes/ports. [ReplacePath\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/replace-path) ReplacePath updates paths before forwarding requests. [ReplacePathRegex\ ----------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/replace-path-regex) ReplacePathRegex updates paths before forwarding requests, using a regex. [Retry\ -----](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/retry) Retry requests to a backend server until it succeeds. [StripPrefix\ -----------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/strip-prefix) StripPrefix removes prefixes from paths before forwarding requests. [StripPrefixRegex\ ----------------](https://doc.traefik.io/traefik-hub-v2/api-gateway/configuration/middleware/http/strip-prefix-regex) StripPrefixRegex removes prefixes from paths before forwarding requests, using regex. Read the technical documentation. --- # One doc tagged with "API Versioning" | Traefik Hub Documentation [Skip to main content](https://doc.traefik.io/traefik-hub-v2/tags/api-versioning#__docusaurus_skipToContent_fallback) [API Version\ -----------](https://doc.traefik.io/traefik-hub-v2/api-management/api-version) API versioning with Traefik Hub. ---