Traefik 3.0.0 → 3.1.0

Kubernetes Provider RBACs

Starting with v3.1, Traefik's Kubernetes Providers use the EndpointSlices API (requires Kubernetes >=v1.21) for service endpoint discovery. This change also introduces NodePort load-balancing capabilities.

The following RBAC updates are required for all Kubernetes providers:

• Remove endpoints permissions and add endpointslices:

# Remove this section from your RBAC
# - apiGroups: [""]
#   resources: ["endpoints"]
#   verbs: ["get", "list", "watch"]

# Add this section instead
- apiGroups:
    - discovery.k8s.io
  resources:
    - endpointslices
  verbs:
    - list
    - watch

• Add nodes permissions for NodePort support:

- apiGroups:
    - ""
  resources:
    - nodes
  verbs:
    - get
    - list
    - watch

Affected Providers

These changes apply to:

• KubernetesIngress provider
• KubernetesCRD provider
• KubernetesGateway provider

Gateway API: KubernetesGateway Provider

The KubernetesGateway Provider is no longer experimental in v3.1 and can be enabled without the experimental.kubernetesgateway option.

Deprecated Configuration:

Experimental kubernetesgateway option (deprecated)

File (YAML)

experimental:
  kubernetesgateway: true

File (TOML)

[experimental]
    kubernetesgateway=true

CLI

--experimental.kubernetesgateway=true

Migration Steps:

1. Remove the kubernetesgateway option from the experimental section
2. Configure the provider using the KubernetesGateway Provider documentation