Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Traefik

Traefik replaces ingress-nginx as the cluster’s ingress controller. ingress-nginx was retired and reached end-of-life in March 2026.

Why Traefik?

Traefik is the most established drop-in replacement that supports the kubernetesIngressNGINX provider, meaning existing Ingress resources continue working without changes. As a secondary benefit, Traefik handles proxy-protocol natively per entrypoint, which removes the in-cluster HAProxy sidecar that was needed to bridge the gap between LAN traffic (no proxy-protocol) and VPS traffic (with proxy-protocol).

Intranet / Internet split

The two-instance architecture was carried over from ingress-nginx and serves two purposes:

Security isolation: The internet-facing instance is exposed to untrusted traffic from the wider internet. If it were ever compromised, the intranet instance and its connected backends would remain unaffected: an attacker would still need to find a separate path into internal services. The split also limits the blast radius of misconfigurations: a mistake in the external HTTPS redirect or rate limiting won’t affect internal traffic.

Different traffic profiles: Internet traffic arrives via the VPS with proxy-protocol enabled and must be redirected from HTTP to HTTPS. LAN traffic arrives directly via iptables without proxy-protocol and should not require HTTPS termination for local clients. Each instance can be tuned for its own load profile, resource limits, and security policies without impacting the other.

The two instances use distinct ingress class names so Ingress resources explicitly opt into one or the other:

  • traefik-intranet: k8s.io/ingress-nginx-intranet for LAN traffic
  • traefik-internet: k8s.io/ingress-nginx-internet for traffic from the VPS

Both read from the same shared base configuration and are deployed via separate Flux HelmReleases with per-instance value overrides.

Error pages

Custom HTTP error pages are served from the errorpages-system namespace, covering 4xx and 5xx status codes. The tarampampam/error-pages project provides the content, using the connection theme: it’s clean and gives end users a clear indication of where to look when something goes wrong.