Does Traefik support zero-downtime migration from Ingress NGINX?

Yes. Traefik can front both your existing Ingress NGINX workloads and new routes simultaneously during the transition, with no forced cutover window.

What happens to our WAF rules during an Ingress NGINX migration?

ModSecurity support is carried into the Ingress NGINX provider, so your WAF behavior is preserved from day one — not a post-migration project.

Can Traefik front VM-based services and Kubernetes workloads at the same time?

Yes. For example, the Nutanix Prism Central provider lets you discover and govern VM-based services without moving them into Kubernetes first. Migrate at your own pace.

Which Kubernetes distributions ship Traefik by default?

Traefik is the default ingress in Nutanix NKP, SUSE Rancher RKE2, K3s, and Canonical MicroK8s, and is validated on IBM IKS and leading NeoClouds including CoreWeave, Nebius, and Together AI.

Does Traefik support the Kubernetes Gateway API alongside IngressRoute?

Yes. Both Gateway API and IngressRoute are supported.

Can Traefik act as an AI gateway for OpenAI, Anthropic, and on-prem models?

Yes. Traefik's AI Gateway fronts any model (e.g., OpenAI, Anthropic, Bedrock, or on-prem) with consistent auth, token metering, and prompt safety applied before the request reaches the model.

What is an MCP Gateway and why does it need policy enforcement?

Model Context Protocol (MCP) is the emerging standard for how AI agents call tools and APIs. Without a gateway, MCP traffic is ungoverned (i.e., no auth, no audit trail, no rate limits). Traefik's MCP Gateway adds per-tool and per-task authorization (TBAC), a server registry, and structured refusals so blocked requests are handled as control flow, not crashes.

Why Traefik Request Demo

Unified Gateway for VMs, Containers, and AI

Traefik is the solution to fragmented operations caused by the VMware exodus, Ingress NGINX retirement, API sprawl, and Enterprise AI adoption.

Run Anywhere · Sovereign-by-Design · Infra-as-Code · Composable · Memory-safe

Get a Demo Get Started Free

TRAEFIK LABS IS TRUSTED BY LEADING ENTERPRISES WORLDWIDE

Migrate, Modernize, & Transform Any Workload, Across Any Environment.

Most teams are running VMs, containers, and AI workloads across separate stacks while navigating VMware price spikes, the Ingress NGINX retirement, and ungoverned AI. Traefik helps you address all this with a single, lightweight binary.

Migrate

Move Workloads, Not Risk.

Whether you're escaping VMware licensing, replacing Ingress NGINX, or switching cloud providers, Traefik is the safe landing.

Explore

VMware Migration, On Your Timeline
One unified gateway governs your VM workloads across any environment. Migrate to any hypervisor or container without changing policies.
Ingress NGINX Migration, Zero Configuration
90%+ of real-world Ingress NGINX annotations are supported natively. Bring your existing YAML, enable the provider, & ship. No rewrite required.
WAF Protection, Continued
ModSecurity support preserves your Ingress NGINX WAF behavior during migration for security parity from day one.

Modernize

Use One Gateway for VMs, Containers, and APIs

Stop running three control planes. Govern Kubernetes workloads, VM-based services, and any APIs, including AI endpoints, through one programmable and declarative gateway.

Explore

Kubernetes-Native, Actually
Traefik is the default ingress in NKP, RKE2, K3s, IKS, MicroK8s, & more; validated with top NeoClouds; & has full Gateway API & Ingress support. Deployed on-prem or with any hyperscaler, with the same control plane everywhere.
VMs & Containers, Side by Side
Most teams run both, so Traefik fronts VMs & Kubernetes simultaneously, all with the same routes, auth policies, & observability, so both modernized & legacy workloads are governed via a single control plane.
API Management, Built-In
API catalog, lifecycle, dev portal, & multi-cluster federation are all in one governed surface. OpenAPI schema validation is enforced at the gateway, so undocumented paths & malformed payloads are rejected before reaching services.

Transform

Govern AI and APIs via the Same Control Plane

Agents, models, and MCP traffic need runtime governance like APIs, but with specialized controls only a unified gateway can optimally enforce.

Explore

Triple Gate Architecture, in One
Traefik’s API Gateway, AI Gateway, & MCP Gateway are rolled into a single binary, so the same auth & observability that fronts your microservices also fronts your model & agentic traffic.
Cost & Safety Governed, at Runtime
Token rate limits & content guardrails are enforced before requests reach your models. Burst-tolerant token limits & parallel inspection ensure defense-in-depth without added latency.
Agent-Aware Refusals, by Default
Structured refusals are returned in the format the client expects: Chat Completions, Responses API, Messages API, raw text, or custom. Agents handle blocked requests as control flow, not a crash.

One Binary. Six Dimensions. Zero Lock-In.

All six share the same declarative config model, governance as a first-class primitive, and a unified control plane. Start with Proxy and add capabilities seamlessly when you're ready. Same routes. No rewrites.

Routing & Traffic
Dynamic L4/L7 routing, traffic shifting, canaries, blue/green, request mirroring, & retry/failover across VMs & containers.
- HTTP/2, HTTP/3, gRPC
- TCP / UDP / mTLS
- Weighted + header-based routing
Auth & Policy
OAuth2/OIDC, JWT, mTLS, OPA-compatible authorization at the edge. Rate limits, quotas, & header transformations included.
- IdP-agnostic
- Per-route policy
- Fine-grained authZ
Observability
First-class OpenTelemetry: metrics, traces, & structured access logs with OTel-conformant trace context. Correlate gateway & service behavior in one pane.
- OTel native
- Streaming OTLP + stdio access logs
- Any observability tool (Prometheus, Grafana, Datadog, Dash0, etc.)
API Management
Catalog, lifecycle, versioning, & developer portal for internal & external APIs. Multi-cluster federation brings them into a single governed surface.
- API catalog + portal
- OpenAPI schema validation at the gateway
- Multi-cluster federation
AI Governance
One gateway for every model creates consistent auth, token metering, & prompt safety. Reject oversized or over-budget prompts before they reach the model.
- AI Token Rate Limit & Quota
- Parallel LLM Guard middleware
- Content Guard Regex & NLP Engine
MCP Governance
Govern MCP traffic the way you govern APIs. Discoverable, observable, & policy-bound from day one, where refusals are returned as control flow, not crashes.
- MCP server registry
- TBAC for per-tool & per-task AuthZ
- Observability for Audit + replay

What Users Have to Say.

When you're managing authentication and API access across 80 companies with different identity providers, you need a solution that's both flexible and robust. This is why we chose Traefik Hub. The API management layer with operation sets, managed subscriptions, and configuration as code gave us the tools to properly govern who can see and consume our APIs at scale

Traefik has been a game-changer for us. Its ease of configuration, scalability, and seamless support have exceeded our expectations. Traefik is a strategic tool that has transformed how we manage traffic across our infrastructure. I would highly recommend Traefik to any organization looking to modernize their Kubernetes environment.

I would absolutely recommend Traefik's API gateway.

Users most likely to recommend, Summer 2026

Frequently Asked Questions

Yes. Traefik supports 90%+ of Ingress NGINX annotations used in production natively. Enable the Ingress NGINX provider, bring your existing manifests, and ship. No rewrite required.

Ready to See Traefik's Runtime Platform in Action?

Get a Demo Get Started Free

Unified Gateway for VMs, Containers, and AI

TRAEFIK LABS IS TRUSTED BY LEADING ENTERPRISES WORLDWIDE

Migrate, Modernize, & Transform Any Workload, Across Any Environment.

Move Workloads, Not Risk.

VMware Migration, On Your Timeline

Ingress NGINX Migration, Zero Configuration

WAF Protection, Continued

Use One Gateway for VMs, Containers, and APIs

Kubernetes-Native, Actually

VMs & Containers, Side by Side

API Management, Built-In

Govern AI and APIs via the Same Control Plane

Triple Gate Architecture, in One

Cost & Safety Governed, at Runtime

Agent-Aware Refusals, by Default

One Binary. Six Dimensions. Zero Lock-In.

Routing & Traffic

Auth & Policy

Observability

API Management

AI Governance

MCP Governance

What Users Have to Say.

Frequently Asked Questions

Can I migrate from Ingress NGINX without rewriting my existing YAML?

Does Traefik support zero-downtime migration from Ingress NGINX?

What happens to our WAF rules during an Ingress NGINX migration?

Can Traefik front VM-based services and Kubernetes workloads at the same time?

Which Kubernetes distributions ship Traefik by default?

Does Traefik support the Kubernetes Gateway API alongside IngressRoute?

Can Traefik act as an AI gateway for OpenAI, Anthropic, and on-prem models?

What is an MCP Gateway and why does it need policy enforcement?

Ready to See Traefik's Runtime Platform in Action?