What access does Traefik Hub need?

Read-only access. On the vCenter path, a dedicated read-only user or a vCenter certificate, scoped to one inventory path. On the KubeVM Service path, a ServiceAccount in one vSphere Namespace. Traefik Hub writes nothing and creates no objects.

What does a move look like in configuration?

Two weight lines change in one TraefikService, kept in Git and reviewed like any other change. The route, the certificate, and the middlewares stay on the front door, in an IngressRoute that never changes.

How do I roll back a move?

With the same kind of change that made it: set the weights back at the gateway. The address, the certificate, and the policy never moved, so nothing else has to be undone.

Who published the reference architecture?

Broadcom has published "Traefik on vSphere Kubernetes Service on VMware Cloud Foundation" on vmware.com, validated by Traefik Labs on VCF 9.0.2 with VKS 3.7.0. Step-by-step guides and manifests are in the VMware VKS Validated Solutions repository on GitHub.

How does Traefik Hub deploy on VKS?

As one Helm chart on VKS, with two or more replicas. The vCenter provider points at one inventory path with a read-only user, and KubeVM Service and VKS workloads are reached through standard Kubernetes Services. Routes, certificates, and middlewares live as YAML in Git.

Does Traefik Hub support FIPS 140-3?

Yes. Traefik Hub offers application-level FIPS 140-3: a validated module in a compliant application. Hardened Distro Zero images are also available.

Can the same front door govern AI traffic?

Yes. The same Traefik Hub adds API management, an AI Gateway for model traffic, and an MCP Gateway for agent tool calls, configured the same way, as YAML in Git.

Traefik Hub and VMware by Broadcom logos

Traefik Hub on VMware Cloud Foundation

One Front Door for the Whole VCF Estate

Traefik Hub puts virtual machines in vCenter, KubeVMs through KubeVM Service, and containers on VMware vSphere Kubernetes Service (VKS) behind one gateway, so you modernize at your own pace.

Request Demo

Traefik Hub as the purple front door above VMware Cloud Foundation, linked to vCenter, KubeVM Service and VKS through the vCenter, Supervisor and Kubernetes APIs, read-only

VALIDATED REFERENCE ARCHITECTURE

Traefik on vSphere Kubernetes Service on VMware Cloud Foundation

Read the reference architecture →

TRAEFIK LABS IS TRUSTED BY LEADING ENTERPRISES WORLDWIDE

The Challenge

When Workloads Move, the Front Door Must Be Rebuilt

VCF runs VMs and containers side by side, run by two teams. Moving an application from one to the next becomes a project of its own, with plenty of room for error.

Without Traefik Hub

Every Move Starts from Scratch

Routes, certificates, policy, and dashboards belong to the old home, so each step up the stack rebuilds them for the new one. It’s a serious project every time.

Your gateway is rarely why a move happens, but it is often why it waits.

Today: the front door, a stack of routes, certificates, policy and dashboards, sits over the vCenter VM. Every move rebuilds it: once for KubeVM Service, then again for VKS

Four Questions Come Before Any Move

Question 01

Can one gateway reach VMs and containers alike?

Question 02

Can each team keep its own tools and credentials?

Question 03

Will users keep the same address and certificate?

Question 04

Can we cut over, and back, with one change?

The Solution

The Workload Moves. The Front Door Does Not.

Traefik Hub runs on VKS as one front door for VMs in vCenter, KubeVMs, and containers on VKS. Routes, certificates, policy, and dashboards live on the gateway, so moving a workload beneath it is one weight change.

With Traefik Hub: routes, certificates, policy and dashboards live on the Traefik Hub front door above all three estates; the workload moves beneath it with one weight change

See It In Action

The Whole Story, in Under Three Minutes

Chapters

How It Works

One Traefik Hub on VKS. Every Estate Behind It.

Traefik Hub finds every workload read-only, through the vCenter, Supervisor, and Kubernetes APIs. Each of the four moving questions now has answers:

Question 01

One Front Door?

VMs and containers share one route table.

Question 02

Own Tools?

Each estate is read through its own API, read-only.

Question 03

Same Address?

The route, certificate, and policy live on the front door.

Question 04

Way Back?

A move is one weight change, and so is the way back.

From the First VM to Containers on VKS

orders-route.yamltoday

kind: TraefikService  weighted:    services:      # the VM in vCenter      - name: orders@vcenter        kind: TraefikService        weight: 100      # the KubeVM Service VM      - name: orders-kubevm        weight: 0      # the containers on VKS      - name: orders        weight: 0

Step 01

The App Runs on a VM in vCenter

The infrastructure team keeps its templates and change control. Traefik Hub reads the VM’s routing from its own metadata.

Step 1: Traefik Hub, the front door for orders.example.com, above VMware Cloud Foundation; all traffic goes to the VM in vCenter (100 percent); KubeVM Service and VKS wait at 0 percent

orders-route.yamltoday

kind: TraefikService  weighted:    services:      # the VM in vCenter      - name: orders@vcenter        kind: TraefikService        weight: 100      # the KubeVM Service VM      - name: orders-kubevm        weight: 0      # the containers on VKS      - name: orders        weight: 0

Step 02

The App Moves to a KubeVM

The platform team runs it in YAML and Git. A test slice goes first, then all of it.

Step 2: the same Traefik Hub front door; the app moves to the KubeVM Service VM, 10 percent first, then 100 percent, while the vCenter VM goes from 90 to 0 percent; VKS is at 0 percent

orders-route.yamlgit diff

kind: TraefikService  weighted:    services:      # the VM in vCenter      - name: orders@vcenter        kind: TraefikService-       weight: 100+       weight: 0      # the KubeVM Service VM      - name: orders-kubevm-       weight: 0+       weight: 100      # the containers on VKS      - name: orders        weight: 0

Step 03

The App Becomes Containers on VKS

All traffic moves to the containers. If anything looks wrong, the same change sends it back.

Step 3: the same Traefik Hub front door; the app moves to containers on VKS, 10 percent first, then 100 percent, while the KubeVM Service VM goes from 90 to 0 percent; the vCenter VM is at 0 percent; read-only discovery through the vCenter, Supervisor and Kubernetes APIs

orders-route.yamlgit diff

kind: TraefikService  weighted:    services:      # the VM in vCenter      - name: orders@vcenter        kind: TraefikService        weight: 0      # the KubeVM Service VM      - name: orders-kubevm-       weight: 100+       weight: 0      # the containers on VKS      - name: orders-       weight: 0+       weight: 100

One Change

The route, the TLS certificate, and the middlewares live on the gateway, so shifting the application is a weight change.

See the move on your own VCF estate.

Request Demo

The Benefits

Modernize at the Pace Your Business Sets

Move When the Business Is Ready
The gateway never sets the schedule.
Keep Each Team on Its Own Tools
vCenter for infrastructure. YAML and Git for the platform team.
Move Without Users Noticing
Same address, same certificate, same policy.
Cut Over, and Back, With One Change
Try a slice first. Reverse it the same way.
Add API and AI Governance When You Need It
API management, the AI Gateway, and the MCP Gateway can all be added to the same binary.

VALIDATED REFERENCE ARCHITECTURE

Traefik on vSphere Kubernetes Service on VMware Cloud Foundation

Read the reference architecture →

Customers modernize at the pace their business sets, and the tools they depend on need to be ready when they are. Through this reference architecture and validation of Traefik Hub for VMware vSphere Kubernetes Service, teams have a prescriptive path to bringing Traefik Labs' traffic management, API management, and AI governance into their VCF environments.

Ahmar Mohammad

Vice President, Container Platform, Advanced Services, and Partner Ecosystem, VMware Cloud Foundation Division, Broadcom

Most enterprises will run virtual machines and containers side by side for years, and they shouldn't need a different front door for each. Broadcom's validated reference architecture puts Traefik Hub in front of the whole VMware Cloud Foundation estate, so teams can move an application from a VM to a container at their own pace while the address, the certificate, and the policy stay the same. When they bring agents onto VCF, the same gateway governs that traffic too.

Sudeep Goswami

CEO, Traefik Labs

Frequently Asked Questions

No. A vCenter VM declares its services in its own metadata, and a KubeVM Service VM through its VirtualMachineService. The applications stay as they are, and clients keep the address they already use.