How traefik is put together
Traefik v3 is a cloud-native HTTP/TCP/UDP reverse proxy and load balancer written in Go (module github.com/traefik/traefik/v3). It follows a provider-based architecture: 'provider' components (Docker, Kubernetes CRD/Gateway API, ECS, Consul, Etcd, Redis, ZooKeeper, Nomad, file) watch infrastructure APIs and emit a dynamic configuration that is merged (pkg/provider/merge.go), watched (pkg/server/configurationwatcher.go), and turned into routers/load-balancers (pkg/server/routerfactory.go) behind configurable entrypoints. Traffic passes through middleware chains (pkg/middlewares, vulcand/oxy) to backend proxies (pkg/proxy), while a REST API and embedded React dashboard (webui/, served via webui/embed.go) expose runtime state. Plugins extend middleware/providers either interpreted via yaegi or compiled as WASM via wazero.
Languages
Frameworks
Infrastructure
Major components
cmd/traefik + cmd/
CLI entrypoint that loads static configuration from flags/files/env (via traefik/paerser loaders) and boots the server, healthcheck subcommand, and version command.
pkg/provider
Discovers backends from orchestrators/registries (Docker, Kubernetes, ECS, Consul, Etcd, Redis, ZooKeeper, Nomad, file) and merges their dynamic configurations.
pkg/server
Watches merged dynamic configuration and builds HTTP/TCP/UDP router factories, entrypoint listeners, and connection contexts.
pkg/api
Implements the REST API handlers for overview, entrypoints, HTTP/TCP/UDP routers/services/middlewares, certificates, support dump, and debug endpoints.
pkg/middlewares + pkg/rules + pkg/muxer
Middleware chain construction (auth, headers, rate limit, retries) and request-rule parsing/matching for routing.
pkg/proxy
Builds backend proxy handlers (smart builder) forwarding traffic to upstream services over HTTP/TCP/UDP including QUIC/WebSocket/gRPC.
pkg/plugins
Downloads and runs plugins as yaegi-interpreted Go or WASM modules, building middleware and provider instances.
webui
React/TypeScript dashboard (built with Vite into ./static and embedded via embed.go) visualizing routers, services, middlewares, and certificates.
A quiet week with a single test fix to round out recent Kubernetes naming work.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet week with a single test fix to round out recent Kubernetes naming work.
Week of 2026-08-17
Three patch releases shipped alongside new forwarding timeout options and a Kubernetes safe-naming feature.
Week of 2026-08-10
A busy week of Kubernetes provider improvements, including better service naming and namespace restrictions, plus three release preparations.
Week of 2026-08-03
Gateway API and Kubernetes CRD providers received significant correctness fixes, including path handling and TLS options deduplication.
Week of 2026-07-27
The busiest week of the month: three releases shipped, plus collision fixes across Gateway API and CRD providers and numerous dependency upgrades.
Over the past month, Traefik's development focused heavily on hardening its Kubernetes integrations, with a series of fixes to prevent generated name collisions across the CRD, ingress-nginx, and Gateway API providers. The team also shipped three patch releases (v3.7.11, v3.6.26, and v2.11.55) while merging maintenance branches and bumping dependencies. Documentation improvements rounded out the work, clarifying TLS behavior, timeouts, and access log details for users.
Week by week
2026-08-24A quiet week with a single test fix to round out recent Kubernetes naming work.latest1 change
Chore
Fixed a missing test case
The safeNaming test was updated to cover read and timeout scenarios that had been left out.
2026-08-17Three patch releases shipped alongside new forwarding timeout options and a Kubernetes safe-naming feature.6 changes
Feature
New forwarding timeouts in ServersTransport
Users can now configure additional timeout settings that control how long Traefik waits when passing requests to backend servers.
Feature
Safe naming option for Kubernetes CRD provider
A new option prevents different Kubernetes resources from accidentally generating the same internal names in Traefik.
Chore
Releases v3.7.11 and v2.11.55 prepared
Patch releases were cut for both supported versions after merging fixes down from newer branches.
Docs
Redis keyspace notifications documented
Documentation now explains the Redis setting required for Traefik's Redis-based features to work correctly.
Chore
Dependency updates
The QUIC networking library was upgraded to v0.61.0 along with several core Go dependencies.
Docs
Systemd socket activation docs restored
Documentation on starting Traefik via systemd socket activation was brought back after being removed.
2026-08-10A busy week of Kubernetes provider improvements, including better service naming and namespace restrictions, plus three release preparations.6 changes
Fix
Failover services named after their Kubernetes Service
Automatically created failover services now take their names from the Kubernetes Service they reference, making them easier to identify.
Fix
Scoped generated Kubernetes Service names
Names auto-generated by the CRD provider are now tied to their parent resource to avoid clashes between similar resources.
Feature
Namespace restriction for default TLS resources
A new option lets administrators limit which namespaces Traefik looks in for its default TLS certificates and options.
Fix
Middleware applied to ingress default backends
Authentication, header customization, custom error pages, and HTTPS redirects now also apply to an ingress's default backend.
Docs
TLS clarification in router docs
Documentation now makes clear that enabling TLS on a router overrides the entrypoint-level TLS settings.
Chore
Releases v3.7.11, v3.6.26, and v2.11.55 prepared
Patch releases were staged across all three maintained versions as fixes were merged down the branch chain.
2026-08-03Gateway API and Kubernetes CRD providers received significant correctness fixes, including path handling and TLS options deduplication.6 changes
Fix
Preserved encoded path segments in Gateway API
URL rewrites and redirects through the Gateway API no longer mangle specially encoded characters in URLs.
Fix
Fixed Gateway API router rules
Corrections were made to how routing rules from Gateway API resources are translated into Traefik routers.
Fix
Deduplicated client-auth TLS options
Multiple ingresses sharing the same host now reuse one set of certificate-verification settings instead of creating conflicting duplicates.
Feature
Option to disable fallback to default TLS options
Administrators can now stop Traefik from silently substituting default TLS settings when a named TLS option is unavailable.
Fix
Rejected invalid status codes in FastProxy
Backend servers returning impossible HTTP status codes (outside 100–599) are now rejected rather than passed through.
Chore
Gateway API version support updated
Traefik now consumes TCPRoute through its stable v1 version and dropped support for the older Gateway API v1.5.x releases.
2026-07-27The busiest week of the month: three releases shipped, plus collision fixes across Gateway API and CRD providers and numerous dependency upgrades.6 changes
Chore
Releases v3.7.10, v3.6.25, and v2.11.54 prepared
All three maintained versions received patch releases incorporating accumulated fixes.
Fix
Avoided router name collisions in Gateway API provider
Routers created from Gateway API resources now get unique names so similarly configured routes don't overwrite each other.
Fix
Fixed cross-namespace service references in CRD provider
A security-relevant check was corrected so services in other Kubernetes namespaces are properly validated before use.
Fix
Fixed auth singleflight key collision
Concurrent authentication requests that happened to share a cache key no longer interfere with each other.
Chore
Gateway API bumped to v1.6.1
Traefik's support for the Kubernetes Gateway API standard moved up to the latest specification release.
Chore
Dependency upgrades
Several underlying libraries were refreshed, including the ACME certificate tooling (lego), compression library, tracing integration, and Go text/net packages.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required