Set Up Ask Your Gateway in the Administration UI

The Ask your gateway page of the Administration UI answers questions about your gateway in plain language, for example "Which AI models cost the most this week?". The Administration UI sends your question to a model. The model calls the tools of the Traefik MCP Server to read your live configuration and telemetry, then writes the answer. Asking a question does not change your configuration.

This guide deploys the Traefik MCP Server and connects the Administration UI to the server and to a model.

Prerequisites

• The Administration UI, installed and running.
• A gateway token that includes the ai-dashboard and mcp-server features. If the token lacks mcp-server, the Administration UI logs a warning at startup and turns off Ask your gateway.
• An AI route on your gateway that serves a model with tool calling. Routing the model through your gateway means the questions are priced, guarded, and measured like other AI traffic. The route can use the Chat Completion, Responses API, or Messages API middleware. The URL of the route must resolve from the Administration UI pod.
• Optional: a metrics store, such as the Prometheus from Set up Analytics. The Traefik MCP Server uses it to answer questions about traffic, latency, and cost. This guide uses Prometheus in its examples, and step 1 shows the settings for other stores.

Step 1: Deploy the Traefik MCP Server

The Traefik MCP Server gives the model read-only tools for your gateway. It reads the gateway API and, when you configure one, the metrics store.

1. Save the following manifest as traefik-mcp.yaml:

   traefik-mcp.yaml

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: traefik-mcp
     namespace: traefik # Replace with the namespace of your gateway. Change every namespace in this file.
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: traefik-mcp
     template:
       metadata:
         labels:
           app: traefik-mcp
       spec:
         containers:
           - name: mcp
             image: traefik/mcp-server:v0.2.1
             args:
               - -mcp.address=:8090
               - -traefik.api-url=http://traefik-hub-api.traefik.svc:8080
               - -prometheus.url=http://prometheus.monitoring.svc:9090 # Replace with the Prometheus HTTP API URL of your metrics store, or remove this argument.
               - -license.token-file=/etc/license/token
             ports:
               - name: mcp
                 containerPort: 8090
             volumeMounts:
               - name: license
                 mountPath: /etc/license
                 readOnly: true
         volumes:
           - name: license
             secret:
               secretName: traefik-hub-license
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: traefik-mcp
     namespace: traefik
   spec:
     selector:
       app: traefik-mcp
     ports:
       - name: mcp
         port: 8090
         targetPort: mcp

2. Replace the value of -prometheus.url with the Prometheus HTTP API URL of your metrics store, or remove the argument if you have no metrics store.

3. Apply the manifest and wait for the traefik-mcp deployment:

   kubectl apply -f traefik-mcp.yaml
   kubectl -n traefik rollout status deploy/traefik-mcp

4. Check the log of the server:

   kubectl -n traefik logs deploy/traefik-mcp

   The server is ready when the log contains licence accepted and serving MCP over Streamable HTTP.

If your telemetry goes to another store, replace or complete -prometheus.url with the arguments of that store. Dash0 and Datadog each cover metrics, traces, and access logs on their own. The Grafana stack takes one argument per signal.

Store	Arguments	Credentials
Grafana stack	-prometheus.url for metrics, -tempo.url for traces, -loki.url for access logs	For each signal (prometheus, tempo, loki), -<signal>.username and -<signal>.credential-file, plus -<signal>.tenant for a multi-tenant store
Dash0	-dash0.url with the API endpoint of your region, -dash0.dataset with the dataset to read	The DASH0_CREDENTIAL environment variable, or -dash0.credential-file
Datadog	-datadog.site with the API host of your region	The DD_API_KEY and DD_APP_KEY environment variables, or -datadog.api-key-file and -datadog.credential-file

If a Dash0 token is restricted to one dataset, set -dash0.dataset to that dataset. Otherwise the server starts and answers /healthz, but every question returns no data, because Dash0 refuses the request with 403.

The -traefik.api-url argument points at the traefik-hub-api service that you created in the installation. The server reads the gateway token from the same traefik-hub-license secret as your gateway.

Optional: let the server read the configuration of your gateway

The server can read the static configuration of your gateway, which tells it which signals your gateway exports. The server then tells an answer that is empty because of quiet traffic from one that is empty because your gateway doesn't export the signal.

The gateway logs its static configuration only at the debug level, so the server runs as a container in the gateway pod, next to the log file. Debug logging writes a large log file, so use this setup where you can afford it. Without it, the server registers every tool and works as in the previous steps.

1. Add the following to the Helm values of your gateway. Helm replaces a list instead of merging it, so repeat any entries that your values already have under additionalVolumeMounts, deployment.additionalVolumes, and deployment.additionalContainers:

   values.yaml

   log:
     level: DEBUG
     format: json
     filePath: /var/log/traefik/traefik.log
   additionalVolumeMounts:
     - name: traefik-logs
       mountPath: /var/log/traefik
   deployment:
     additionalVolumes:
       - name: traefik-logs
         emptyDir: {}
       - name: license
         secret:
           secretName: traefik-hub-license
     additionalContainers:
       - name: mcp
         image: traefik/mcp-server:v0.2.1
         args:
           - -mcp.address=:8090
           - -traefik.api-url=http://localhost:8080 # The gateway API, inside the same pod.
           - -traefik.app-log=/var/log/traefik/traefik.log # The log file of the gateway.
           - -prometheus.url=http://prometheus.monitoring.svc:9090 # Replace with the Prometheus HTTP API URL of your metrics store, or remove this argument.
           - -license.token-file=/etc/license/token
         ports:
           - name: mcp
             containerPort: 8090
         volumeMounts:
           - name: traefik-logs
             mountPath: /var/log/traefik
             readOnly: true
           - name: license
             mountPath: /etc/license
             readOnly: true

2. Upgrade the Helm release, as in step 1 of the installation:

   helm upgrade traefik traefik/traefik --namespace traefik --reuse-values --values values.yaml

3. Point the traefik-mcp service at the gateway pods, and remove the separate deployment. Replace traefik-traefik with the <release>-<namespace> of your Helm release:

   kubectl -n traefik patch service traefik-mcp --type=merge \
     -p '{"spec":{"selector":{"app":null,"app.kubernetes.io/name":"traefik","app.kubernetes.io/instance":"traefik-traefik"}}}'
   kubectl -n traefik delete deployment traefik-mcp

4. Check the log of the server in the gateway pod:

   kubectl -n traefik logs -l app.kubernetes.io/name=traefik -c mcp

   The server read the configuration when the log contains detected capabilities from static config.

Step 2: Choose the model route

The Administration UI sends its prompts to the base URL of an AI route. With the default provider, for a route at https://ai.example.com/v1, the Administration UI calls https://ai.example.com/v1/chat/completions. Set TRAEFIK_HUB_DASHBOARD_AGENT_LLM_PROVIDER to the API format the route serves:

Provider	API format	Gateway middleware
anthropic	Anthropic Messages API	messages-api
openai-compatible (default)	Chat completions	chat-completion
responses	OpenAI Responses API	responses-api

The Administration UI can also call a hosted provider directly, without a gateway route: openai, anthropic, gemini, ollama, mistral, deepseek, groq, llamacpp, or zai. A direct call isn't guarded or measured by your gateway, and the credential lives in the Administration UI configuration. Set the key in the usual variable of the provider, for example OPENAI_API_KEY.

Step 3: Connect the Administration UI

1. Add the following environment variables to the admin-ui container in your admin-ui.yaml:

   admin-ui.yaml

   - name: TRAEFIK_HUB_DASHBOARD_AGENT_LLM_URL
     value: https://ai.example.com/v1 # Replace with the base URL of your AI route.
   - name: TRAEFIK_HUB_DASHBOARD_AGENT_LLM_MODEL
     value: <model> # Replace with the model of your AI route.
   - name: TRAEFIK_HUB_DASHBOARD_AGENT_MCP_URL
     value: http://traefik-mcp.traefik.svc:8090/mcp # Replace the namespace if the traefik-mcp service runs in another namespace.

2. Replace the URL and the model with the values of your AI route.

3. If an authentication middleware protects the AI route, send its credential with every request. Store the credential in a secret, and add the following variables:

   admin-ui.yaml

   - name: AGENT_TOKEN
     valueFrom:
       secretKeyRef:
         name: admin-agent # Replace with the name of your secret.
         key: token # Replace with the key that holds the credential.
   - name: TRAEFIK_HUB_DASHBOARD_AGENT_LLM_HTTPCLIENT_HEADERS_AUTHORIZATION
     value: "Bearer $(AGENT_TOKEN)"

4. Apply the manifest and wait for the traefik-hub-admin-ui deployment:

   kubectl apply -f admin-ui.yaml
   kubectl -n traefik rollout status deploy/traefik-hub-admin-ui

By default, the Administration UI passes the Authorization header of each question on to the Traefik MCP Server and to the model route, so that both can authorize the user who asks.

With BasicAuth, the forwarded header holds the username and password, and both receive them whether or not they accept them. Set removeHeader: true on the BasicAuth middleware, as in Protect the Administration UI, so that the Administration UI has no header to forward.

If the model route or the Traefik MCP Server requires authentication, set a fixed Authorization header instead. For the model route, use the TRAEFIK_HUB_DASHBOARD_AGENT_LLM_HTTPCLIENT_HEADERS_AUTHORIZATION variable from step 3. For the Traefik MCP Server, use TRAEFIK_HUB_DASHBOARD_AGENT_MCP_HTTPCLIENT_HEADERS_AUTHORIZATION. A header you set this way replaces the one the Administration UI receives.

For every setting of the model and the server connection, see the Administration UI configuration reference.

Step 4: Ask a question

1. Open Ask your gateway. The status at the top of the page changes from Connecting... to Connected.
2. Enter a question, for example Which AI models cost the most in the last hour?, and send it with the Enter key.

While the model works, the page lists the tools it calls, such as list_routers or query_metrics. When the answer arrives, the page displays the time, the tokens used, and the number of model calls it took.

Limits

The Administration UI bounds the work behind each answer, so that a single question can't call the model without end or run indefinitely. In v3.21 the limits are fixed and have no setting.

Limit	Value
Model calls per answer	8
Time per answer	5 minutes
Size of a tool result the model reads	60 kB. The Administration UI cuts a larger result and marks it as cut.
Earlier turns sent with a question	20

The Administration UI doesn't store your conversation. With each new question, your browser sends the earlier questions and answers to the Administration UI, which passes them to the model together with the new question.

Conversation length in v3.21

In v3.21, the Administration UI doesn't trim the conversation. After 21 answered questions, new questions fail with the history exceeds 20 turns. Select New conversation to continue.

Troubleshooting

The status stays on "Connecting..."

Problem: The page never leaves the Connecting... status.

Cause: The Administration UI started without the agent settings, so the page has no agent to connect to. When the agent isn't enabled, or the gateway token lacks the mcp-server feature, the Ask your gateway item in the navigation is disabled and its tooltip states the reason. The page stays reachable at the /#/ask URL, where it never leaves Connecting....

Solution: Set TRAEFIK_HUB_DASHBOARD_AGENT_LLM_URL, TRAEFIK_HUB_DASHBOARD_AGENT_LLM_MODEL, and TRAEFIK_HUB_DASHBOARD_AGENT_MCP_URL as described in step 3, and restart the traefik-hub-admin-ui deployment. If the settings are present, check the log of the Administration UI. The Administration UI turns off the agent and logs a warning when the gateway token lacks the mcp-server feature.

The status shows "Server unreachable" or "Not licensed"

Error: The status at the top of the page shows Server unreachable or Not licensed.

Cause: Server unreachable means the Administration UI can't reach the Traefik MCP Server. Not licensed means the server refused the gateway token.

Solution: Check that the value of TRAEFIK_HUB_DASHBOARD_AGENT_MCP_URL points at the traefik-mcp service, then read the log of the server with kubectl -n traefik logs deploy/traefik-mcp. The log states the reason when the server refuses the token.

A question fails after the status shows "Connected"

Problem: The status shows Connected, but a question fails.

Cause: The Administration UI can't reach the model route, or the route rejects the request.

Solution: Check that the host of TRAEFIK_HUB_DASHBOARD_AGENT_LLM_URL resolves from the Administration UI pod, and that the route's authentication accepts the credential you set in step 3.

An answer ends with "stopped after 8 rounds of tool calls"

Error: The answer ends with stopped after 8 rounds of tool calls without a final answer.

Cause: The question needed more model calls than one answer allows. A question that asks for a configuration or a generated dashboard reaches the limit more often than a question about a single object.

Solution: Ask the same question again, or split it in two. The limit applies to each answer, so a new question starts with a fresh count.

Next steps

• Administration UI configuration reference for every setting of the agent.
• Chat Completion middleware to create the AI route for the model.