Acing Cloud Networking with Traefik Enterprise
Networking in cloud native environments is complex. As modern applications become more distributed and microservice-based, the choice of tools to handle that complexity becomes even more critical.
At the center of these environments is the ingress controller or reverse proxy that acts as the entrypoint to all of your backend services. An ideal solution will deploy to a variety of infrastructure types, support service discovery from an array of providers, and allow users to modify traffic with a full suite of middlewares.
For some enterprises deploying applications at scale, a simple ingress tool isn’t enough to manage all network calls. A powerful, unified networking stack that combines ingress with API management and service mesh, like Traefik Enterprise becomes necessary.
As a Solutions Architect at Traefik Labs, I get the opportunity to speak with lots of different companies as they navigate the world of ingress and API gateways. From these conversations, here are some of the main reasons I’ve seen users benefit from Traefik Enterprise as their unified ingress solution.
Authentication and authorization
As companies move from monolith to microservices, controlling access across a newly distributed application stack remains critical while becoming more complex. In addition to the authentication options like BasicAuth, DigestAuth, and ForwardAuth found in Traefik Proxy, Traefik Enterprise includes a wider range of industry-standard methods.
Organizations that have adopted standard approaches like OpenID Connect, JWT, and Open Policy Agent can use the tailor-made enterprise middlewares that conform to these specifications and natively integrate with the existing identity and access management (IAM) resources in their infrastructure. In doing so, companies centralize their authentication and authorization at Traefik Enterprise, enhancing their security posture and reducing maintenance effort across services.
TLS certificate management
One fundamental function of a reverse proxy or ingress controller is handling TLS certificates and terminating the TLS connection with clients. Traefik Proxy includes a number of ways to streamline the management of these certificates so that connections remain secure without additional administrative effort. Notably, it includes out-of-the-box support for automating certificate issuance and renewal through Let’s Encrypt or other ACME providers, without making you install an additional tool to negotiate those challenges.
Traefik Enterprise expands on those capabilities in a few ways. First, it supports distributed Let’s Encrypt, so users can leverage that same automation while running multiple proxy instances in a highly available configuration. Users can even leverage a dedicated agent to distribute Let’s Encrypt certificates across multiple Traefik Enterprise clusters to cut down on multi-cluster administrative effort. For organizations that don’t want to use an ACME protocol provider for their certificates, Traefik Enterprise allows users to bring their own existing certificates and store them in a built-in TLS store or HashiCorp Vault, or otherwise use Vault’s PKI engine to automate certificates without relying on an ACME provider.
This variety of options means that Traefik Enterprise can handle and add efficiency to a wide variety of existing certificate management workflows.
Flexible routing options
One of Traefik’s benefits is its flexibility across different containerized and legacy environments. This flexibility is generated in large part by its list of supported providers that enable service discovery. As the complexity of cloud native networking grows, some scenarios require traffic to be routed across multiple clusters, even of different orchestrator types. In this case, Traefik can handle multiple levels of routing by deploying two layers of proxy instances — one in front of the clusters and one inside each cluster — and leveraging the relevant provider for each.
While this approach works well, it does require configuring services in multiple places. To reduce this duplicated effort, Traefik Enterprise includes a dedicated Traefik provider that automatically syncs the routing configuration of the in-cluster Traefik instances up to the pre-cluster instance. This routing capability dramatically cuts down on management effort and reduces the risk of configuration errors. Whether the underlying infrastructure is part of a temporary migration effort across clusters or a permanent multi-cluster setup, Traefik Enterprise can easily handle routing across the varied network topology.
Enterprise support
Of course, the value of these additional capabilities is only fully realized with proper implementation and maintenance. For that, Traefik Enterprise includes enterprise support, which gives organizations access to a team of Traefik experts. For companies that rely on Traefik as a critical part of their networking stack, this support can provide peace of mind and mitigation of risk, ensuring that any issues are quickly resolved.
Summary
Modern cloud native architectures require powerful networking solutions. Migration to this distributed world requires flexibility in routing rules, service discovery, and installation options to address a variety of use cases.
For those organizations that want to leverage these capabilities along with additional features like enhanced IAM options, certificate management, and support for complex routing, all supported by the Traefik Labs team, Traefik Enterprise is a great fit.
Learn more about how Traefik Enterprise fits your use, and request a demo or start a free trial today.
