Skip to main content

Migrate from Traefik Proxy on Kubernetes

Before You Begin​

Before you begin the installation process, it is recommended that you have a basic understanding of Kubernetes. You should have access to a working Kubernetes cluster with Traefik Proxy v3+ installed, either on a cloud provider or on your own infrastructure.

Please make sure that you have the following:

  • Kubectl
  • Helm v3
  • Enabled communication between the Traefik Hub API Gateway and Traefik Hub SaaS for license validation. You can refer to the documentation on networking for more information.

Migrate with the Helm Chart​

Step 1: Store the Traefik Hub API Gateway token in a secret​

Log in to the Traefik Hub Online Dashboard and create a new Hub Gateway.

⚠️ Copy only the token.

Open a terminal and run the following commands to create a secret for the license:

# Create an environment variable which contains the token
export TRAEFIK_HUB_TOKEN=my-token-from-hub # Replace my-token-from-hub with the Token provided in the Dashboard
# Initialize the namespace and the secret that contains the token
kubectl create namespace traefik
kubectl create secret generic license --namespace traefik --from-literal=token=$TRAEFIK_HUB_TOKEN

To check the license has been created, use the following command:

kubectl -n traefik describe secrets license

Step 2: Add the token to the helm values​

Edit the Helm values.yaml to add the Hub API Gateway token and update the image for the gateway.

values.yaml
# Configure Hub API Gateway to read the token from the dedicated secret.
# Setting hub.token is enough: the chart automatically resolves the
# traefik-hub image (registry and repository) from it.
hub:
  token: license

# Optionally pin a specific image version
image:
  tag: "v3"
...
Specific version

To download a specific version, set the version with the following format: vMAJOR.MINOR.PATCH; for example v3.1.1.

API Management and image tags

Setting image.tag above your chart's default can decouple the gateway's Hub version from the chart's RBAC. This applies to any image variant. See Requirements for the permissions API Management needs and when you need to add them yourself.

FIPS 140-3 compliance

Traefik Hub can be used in a FIPS 140-3 compliant mode. Refer to the FIPS Compliance Reference document for details. Contact the Traefik Labs sales team to use the FIPS compliant Traefik Hub image.

Step 3: Replace Traefik Proxy with Traefik Hub API Gateways​

Use Helm to deploy the Traefik Hub API Gateway with the new values:

CLI
helm upgrade --install traefik -n traefik traefik/traefik --values values.yaml

Step 4: Check the new stack​

The Traefik Proxy Deployment has been replaced with a new Traefik Hub API Gateway Deployment. The Hub API Gateway configuration is fully compatible with the Traefik Proxy configuration and requires no change appart from the license token. You can check it using the following command:

kubectl -n traefik describe deployments.apps traefik

Traefik Hub API Gateway is exposed using the same Service as Traefik Proxy. You can check it using the following command:

kubectl -n traefik describe service traefik
No Traffic Interruption

During the migration, the Traefik Pods are replaced with the Traefik Hub API Gateway Pods using a RollingUpgrade mechanism. It allows you to migrate without interrupting the traffic management.

Related Content​