Traefik Labs

An educational and technical deep dive into the federal cryptography standard, the September 2026 transition deadline, and what it means for your API infrastructure. In September 2026, a quiet deadline arrives that most engineering teams have never heard of, and that some of them will discover the hard way. Beginning Sept. 22, 2026, every remaining FIPS 140-2 certificate moves to the CMVP Historical List. Cryptographic modules that counted as current on Sept.

This week, Traefik crossed two milestones at once: 1,000 contributors on GitHub and 3.5 billion pulls of the official Docker image. And it happened as the project enters its second decade. I would love to tell you this is a story about longevity. It isn't. 2026 is on pace to be the most active year in Traefik's history, with more pull requests merged than in any year before. Ten years in, the project is not aging gracefully. It is accelerating.

For most of Traefik’s existence, every middleware has been attached to a router. That model works well for what it was built for: access control, rate limiting, CORS, redirects—things that describe the route’s policy. But some transformations have nothing to do with the route. They exist because a backend has its own contract, and every request reaching that backend needs to honor it.

Traefik Proxy 3.7, codenamed Langres, is the most consequential release we've shipped this year. It brings 85+ Ingress NGINX annotations now natively supported (and the experimental flag finally dropped), a brand-new certificates view in the dashboard, middlewares on services, full Gateway API v1.5 support, and retries and failover driven by HTTP status codes. If you're running Ingress NGINX today, Traefik Proxy v3.7 is your drop-in replacement.

Every migration story starts the same way: with a team staring at a production cluster, a long changelog of annotations, and a ConfigMap nobody has touched in three years. The gap between "we should migrate off Ingress NGINX" and "we know exactly what to do Monday morning" feels enormous. Opaque. Risky. Expensive. It isn't.

Large-scale AWS architectures rarely maintain homogeneity over time. They evolve through eras. A service might begin life on Amazon EC2 because the team needed full control over the OS kernel. Years later, a new initiative embraces Amazon EKS for microservices. Meanwhile, other teams deploy onto Amazon ECS or AWS Fargate because the bursty, event-driven nature of their workloads demands it. Individually, these are sound technical decisions.

Traefik Proxy 3.6 has arrived, and like the exquisite cheese 🧀-a rare specialty from France's Bugey region-this release achieves something unique. With native Knative integration completing the trilogy, Traefik becomes the only proxy capable of seamlessly handling Cloud Native workloads (containers), Traditional workloads (VMs), and Serverless workloads in one unified platform.

10 years ago on September 22nd, 2015, after months of research and hacking, I posted a link on Hacker News about this small project I'd been working on called Traefik. Honestly, I was just hoping a few fellow developers might find it useful for their own container routing headaches. Well, things escalated quickly... Early Days: The Microservices Wild West Let's be honest-2015 was a bit of a mess for anyone trying to manage microservices.

After years of working with organizations navigating the microservices evolution, we want to set the record straight. The API gateway you choose today could save your teams' sanity or haunt your architecture for years to come. As teams break apart monoliths into distributed services, the need for reliable API gateway strategies has become critical.

The Uncomfortable Reality of Maintenance Mode The Kubernetes ingress landscape faces an unprecedented crisis. With ingress-nginx officially projected to enter maintenance mode, thousands of organizations running critical production workloads suddenly find themselves at a crossroads. No new features. No major improvements. Just maintenance patches for a controller that powers much of the internet's Kubernetes traffic.