Traefik Hub and SUSE AI Factory
One Factory. One Runtime. Every Call Governed.
SUSE and Traefik Labs bring runtime governance to the AI factory. SUSE AI Factory runs it. Traefik Hub governs every model call and every agent action inside it, delivered as a SUSE AI Factory blueprint.
AI Gateway
MCP Gateway
API Gateway with WAF
One-Click Blueprint
Policy as Code
TRAEFIK LABS IS TRUSTED BY LEADING ENTERPRISES WORLDWIDE
The Challenge
Every Enterprise is its Own AI Factory. Scaling it Takes Governance.
Employees use assistants, teams build applications on models, and agents act on your systems on SUSE AI Factory. As usage grows, every call needs an identity, policy, budget, and record.
The Foundation
SUSE AI Factory runs the AI factory
Chat for every employee
Built on models
Tools, no human in the loop
GPU clusters and a catalog of one-click blueprints
Managed in Rancher, rolled out by Fleet
Data and models kept sovereign
The Missing Piece
Every Call Takes its Own Path, Governed in Pieces, or Not at All
The factory is only the foundation. Once it goes live, every call takes its own path to models, tools, and data.
An API key in one app
A proxy for one team
Rules hard-coded in agents
Token limits per tool, or none
The Solution
How Traefik Hub Brings Governance to SUSE AI Factory
Traefik Hub governs every call with a single gateway. It checks who is calling, decides what they may use, screens the content, meters the tokens, routes to a model or a tool, and records the decision.
Identify
The identity provider's token is checked on every request, groups and all.
Keycloak JWT · Groups claim
Authorize
Models by group. MCP tools by identity, filtered before the agent sees the list.
Model policy · MCP-policy
Protect
Mask personal data and secrets both ways. Llama Guard and a jailbreak judge run side by side.
Content-Guard · AI-guards
Meter
Token budgets per user and per team. Repeated questions answered from the semantic cache.
Redis budgets · Milvus cache
Route
To the entitled model on Ollama or vLLM, or to the MCP tool server.
AI-gateway · MCP-gateway
Record
Every allow, refuse, and mask decision, traced with the caller's identity.
Access log · OpenTelemetry
Together, every model call and every agent action are governed.
Traefik Hub in the SUSE AI Factory with NVIDIA Stack
Traefik Hub sits between the AI blueprints and NVIDIA AI Enterprise, so every model call and every agent action passes through it, with the NVIDIA NemoGuard NIM microservices and NVIDIA NeMo Switchyard working at the gateway. Around NVIDIA OpenShell sandboxes, it governs who gets in and what agents reach. And Traefik Hub is certified for SUSE AI Factory with NVIDIA.
Traefik Hub in the SUSE AI Factory with NVIDIA stack: the runtime governance layer between AI blueprints and NVIDIA AI Enterprise, and at NVIDIA OpenShell sandboxes
How it works
Three Steps, One Gateway
01 | Platform team
The Wiring
Governance ships as a SUSE AI Factory blueprint. The platform team adds Traefik Hub the same way it deploys any SUSE AI stack, before a single prompt is sent.
A Traefik catalog inside SUSE AI Factory, synced by Fleet
One-click install to every selected cluster
The SUSE AI applications stay stock
Every policy in one Helm chart: plain YAML, versioned, upgraded by Fleet
02 | People and Apps
The Proof
A developer and an admin open the same chat application, and Traefik Hub gives each of them a different answer. The application lists every model and decides nothing. The gateway decides.
The developer is refused an admin-only model before any inference
A personal e-mail address in the admin's prompt comes back masked
An unsafe request is blocked with no tokens spent
03 | AI agents
The Agentic Workflow
Agents call tools with no human in the loop. An agent does not sign in to a web page. It speaks the Model Context Protocol, and the only way to the tool server is through the MCP Gateway. Same agent, same server, two tokens.
Admin token: five tools, and a privileged restart succeeds
Developer token: three read tools; the privileged ones do not exist for it
The restart is refused at the gateway, and the server never sees the call
Every AI factory will eventually have governance. The only question is where it lives. Put it in the runtime on day one, and it is a blueprint install. Put it off until fifty applications each hold their own keys and their own rules, and it becomes a migration project.
Sudeep Goswami
Chief Executive Officer, Traefik Labs
FAQs
Frequently Asked Questions
No. Applications and agents point at the gateway instead of the model or the MCP server. They hold no model keys and no authorization code, and they are governed from the first request.
What Users Have to Say
