LoginSign Up
← Back to all sparks
T

Traefik

INFRA · APIS
Velocity5.0

Cloud-native reverse proxy and ingress controller with automatic service discovery

traefik.io ↗

Traefik v3.8 rc.1 is a Gateway API release; v2.11 keeps getting security patches.

reverse-proxykubernetesgateway-apisecuritymtls
◆Current state
Traefik runs two lines. v3.8.0-rc.2 (10 November) raises the minimum Gateway API version to v1.7.0, fixes several Ingress NGINX compatibility gaps, limits zstd encoder memory in the Compress middleware and carries the BasicAuth and path-segment hardening also shipped in 2.11.62. rc.1 in October added Gateway API ListenerSet, client certificate validation and backend TLS for gRPC and TLSRoute.
◆Where it's heading
Feature work sits entirely on v3, and Gateway API is its center: the release tracks upstream versions and drops older ones, so Traefik is betting on Gateway API as its main Kubernetes interface. v2.11 is a security branch; five advisories in 2.11.58 and a CVE in 2.11.60 show it still gets real fixes.
◆Prediction
Further 3.8 release candidates and then a final 3.8.0 are the likely next steps, with v2.11 patches continuing in parallel.

◆Recent moves

  1. 3d ago

    Traefik 3.8 rc.2 requires Gateway API v1.7 and hardens auth

    The second 3.8 candidate bumps Gateway API to v1.7.0 as the new minimum, closes Ingress NGINX annotation gaps and caps zstd memory, while carrying the BasicAuth and path fixes from 2.11.62. It keeps 3.8 centred on Gateway API and on easing migration from ingress-nginx.

    View source ↗
  2. 4d ago

    v2.11.62

    Another hardening patch on 2.11: BasicAuth passwords get a length limit, path dot-segments are resolved before routing, and Proxy-Authorization handles NTLM-style connection-bound schemes. It extends the NTLM and Kerberos work from the previous three patches.

    View source ↗
  3. 15d ago

    Traefik 3.8 rc.1: Gateway API ListenerSet and mTLS

    The first 3.8 candidate centers on Gateway API: ListenerSet, client certificate validation, backend TLS for gRPC and TLSRoute, and a move to TCPRoute v1 that drops Gateway API v1.5.x support. It is a release candidate, and the notes point to a migration guide.

    View source ↗
  4. 15d ago

    Traefik 2.11.61 caps header values, fixes NTLM/Kerberos leak

    Adds an entry-point option to cap the number of request header values and fixes a backend connection leak with NTLM and Kerberos authentication. It follows the NTLM and Kerberos work in 2.11.58 and 2.11.60.

    View source ↗
  5. 24d ago

    Traefik 2.11.60: CVE fix, NTLM/Kerberos in ForwardAuth

    Traefik 2.11.60 fixes a CVE and adds NTLM and Kerberos support to ForwardAuth on the 2.11 line.

    View source ↗
  6. 29d ago

    Traefik 2.11.59 rejects CONNECT requests earlier

    Rejects CONNECT requests regardless of HTTP version and before the muxer, with a golang.org/x/net bump.

    View source ↗