### Configure and Start the Service

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

Deploy the configuration file and systemd service unit, then start the gateway.

```bash
sudo cp api-gateway/1-getting-started/linux/traefik-hub.toml /etc/traefik-hub/traefik-hub.toml  

sudo sed -i -e "s/PASTE_YOUR_TOKEN_HERE/$TRAEFIK_HUB_TOKEN/g" /etc/traefik-hub/traefik-hub.toml  

sudo cp api-gateway/1-getting-started/linux/traefik-hub.service /etc/systemd/system/traefik-hub.service  

sudo chown root:root /etc/systemd/system/traefik-hub.service  

sudo chmod 644 /etc/systemd/system/traefik-hub.service  

sudo systemctl daemon-reload  

sudo systemctl enable --now traefik-hub.service  
```

--------------------------------

### Download and Apply Installation Manifest

Source: https://doc.traefik.io/traefik-enterprise/installing/kubernetes/gitops

Fetch the installation manifest from the Traefik Enterprise installer service and apply it to the cluster.

```bash
curl "https://install.enterprise.traefik.io/v2.12" --output manifest.yaml

kubectl apply -f manifest.yaml
```

--------------------------------

### Install MkDocs dependencies

Source: https://doc.traefik.io/traefik-mesh/contributing/documentation

Install the required documentation dependencies using pip.

```bash
pip install --user -r requirements.txt
```

--------------------------------

### Start a Proxy Node

Source: https://doc.traefik.io/traefik-enterprise/references/cli/traefikee

Starts a proxy and joins it to an existing cluster using static peer discovery.

```bash
traefikee proxy --name="proxy-0" --discovery.static.peers=172.17.0.1:4242,172.17.0.3:4242,172.17.0.4:4242
```

--------------------------------

### Verify teectl installation

Source: https://doc.traefik.io/traefik-enterprise/getting-started

Confirm the installation by displaying the help menu.

```bash
teectl --help
```

```text
teectl    teectl is a controller for Traefik Enterprise (Enterprise Edition).
Complete documentation is available at https://doc.traefik.io.

Usage: teectl [command] [resource] [flags]

Use "teectl [command] --help" for help on any command.

Commands:
    apply      Apply configuration to a cluster
    get        Get resources
    create     Create resources
    delete     Delete resources
    recover    Recovers a cluster that has lost quorum
    setup      Setup a cluster to manage

    support-dump    Gather data from the cluster to assist in support
    backup          Backs up the configuration of a running Traefik Enterprise cluster
    restore         Restore a previously backed up cluster configuration
    version         Print version

Resources:
    acme-certs, ac
    nodes, n
    tls-certs, tc
    static-config, s
```

--------------------------------

### Install Docker and Docker Compose

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

Installs the necessary Docker packages on a Linux system.

```bash
sudo apt-get update  

sudo apt-get install -y docker.io docker-compose  
```

--------------------------------

### Middleware Configuration Example

Source: https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd

Example of a basic IngressRoute configuration with middleware and TLS options.

```yaml
  spec:
    entryPoints:
      - foo
    routes:
    - match: Host(`example.net`)
      kind: Rule
    tls:
      options: bar
    ...
```

--------------------------------

### YAML Static Configuration Example

Source: https://doc.traefik.io/traefik-enterprise/references/configuration/static

Example of various static configuration settings defined in YAML format.

```yaml
  initialConfigPropagationDelay: 42ns
  cleanup:
    gracePeriod: 42ns
  swarm:
    networkdiscovery: true
    labelExpression: foobar
apiportal:
  path: foobar
  hideServiceNames: true
mesh:
  acl: true
  ignoreNamespaces:
  - foobar
  - foobar
  defaultMode: foobar
  httpPortLimit: 42
  tcpPortLimit: 42
  udpPortLimit: 42
  log:
    level: foobar
    filePath: foobar
    format: foobar
  tracing:
    serviceName: foobar
    spanNameLimit: 42
    jaeger:
      samplingServerURL: foobar
      samplingType: foobar
      samplingParam: 42
      localAgentHostPort: foobar
      gen128Bit: true
      propagation: foobar
      traceContextHeaderName: foobar
      collector:
        endpoint: foobar
        user: foobar
        password: foobar
      disableAttemptReconnecting: true
    zipkin:
      httpEndpoint: foobar
      sameSpan: true
      id128Bit: true
      sampleRate: 42
    datadog:
      localAgentHostPort: foobar
      localAgentSocket: foobar
      globalTag: foobar
      globalTags:
        name0: foobar
        name1: foobar
      debug: true
      prioritySampling: true
      traceIDHeaderName: foobar
      parentIDHeaderName: foobar
      samplingPriorityHeaderName: foobar
      bagagePrefixHeaderName: foobar
    instana:
      localAgentHost: foobar
      localAgentPort: 42
      logLevel: foobar
      enableAutoProfile: true
    haystack:
      localAgentHost: foobar
      localAgentPort: 42
      globalTag: foobar
      traceIDHeaderName: foobar
      parentIDHeaderName: foobar
      spanIDHeaderName: foobar
      baggagePrefixHeaderName: foobar
    elastic:
      serverURL: foobar
      secretToken: foobar
      serviceEnvironment: foobar
  metrics:
    prometheus:
      buckets:
      - 42
      - 42
      addEntryPointsLabels: true
      addRoutersLabels: true
      addServicesLabels: true
      entryPoint: foobar
      manualRouting: true
      headerLabels:
        name0: foobar
        name1: foobar
    datadog:
      address: foobar
      pushInterval: 42s
      addEntryPointsLabels: true
      addRoutersLabels: true
      addServicesLabels: true
      prefix: foobar
    statsD:
      address: foobar
      pushInterval: 42s
      addEntryPointsLabels: true
      addRoutersLabels: true
      addServicesLabels: true
      prefix: foobar
    influxDB:
      address: foobar
      protocol: foobar
      pushInterval: 42s
      database: foobar
      retentionPolicy: foobar
      username: foobar
      password: foobar
      addEntryPointsLabels: true
      addRoutersLabels: true
      addServicesLabels: true
      additionalLabels:
        name0: foobar
        name1: foobar
    influxDB2:
      address: foobar
      token: foobar
      pushInterval: 42s
      org: foobar
      bucket: foobar
      addEntryPointsLabels: true
      addRoutersLabels: true
      addServicesLabels: true
      additionalLabels:
        name0: foobar
        name1: foobar
```

--------------------------------

### Provide Data Examples

Source: https://doc.traefik.io/traefik-hub/reference/specs/openapi

Include request and response examples to help developers understand expected data formats.

```yaml
paths:  

  /forecast:  

    get:  

      responses:  

        '200':  

          description: "Success"  

          content:  

            application/json:  

              schema:  

                $ref: "#/components/schemas/Forecast"  

              example:  

                - location: "London"  

                  temperature: 18  

                  conditions: "Cloudy"  

                - location: "Paris"  

                  temperature: 22  

                  conditions: "Sunny"  

  

components:  

  schemas:  

    Forecast:  

      type: object  

      properties:  

        location:  

          type: string  

          example: "London"  

        temperature:  

          type: integer  

          example: 18  

        conditions:  

          type: string  

          example: "Cloudy"
```

--------------------------------

### Get Plugins with teectl

Source: https://doc.traefik.io/traefik-enterprise/references/cli/teectl

Retrieves the plugins installed in the cluster.

```bash
teectl get plugins
teectl get pl
```

--------------------------------

### Build and serve documentation with Docker

Source: https://doc.traefik.io/traefik-mesh/contributing/documentation

Use the make serve target to build the documentation image and start a local server with live reloading.

```bash
$ make serve
docker build -t traefik-mesh-docs -f docs.Dockerfile ./
# […]
docker run  --rm -v /home/user/traefik-mesh/docs:/mkdocs  -p 8000:8000 traefik-mesh-docs mkdocs serve
# […]
INFO    -  Building documentation...
INFO    -  Cleaning site directory
[I 200408 14:36:33 server:296] Serving on http://0.0.0.0:8000
[I 200408 14:36:33 handlers:62] Start watching changes
[I 200408 14:36:33 handlers:64] Start detecting changes
```

--------------------------------

### Configure HTTP Services with Failover

Source: https://doc.traefik.io/traefik/reference/routing-configuration/http/load-balancing/service

Example configuration for a failover service setup using YAML.

```yaml
http:
  services:
    app:
      failover:
        healthCheck: {}
        service: main
        fallback: backup

    main:
      loadBalancer:
        healthCheck:
          path: /status
          interval: 10s
          timeout: 3s
        servers:
        - url: "http://private-ip-server-1/"

    backup:
      loadBalancer:
        healthCheck:
          path: /status
          interval: 10s
          timeout: 3s
        servers:
        - url: "http://private-ip-server-2/"
```

--------------------------------

### Serve documentation with MkDocs

Source: https://doc.traefik.io/traefik-mesh/contributing/documentation

Start the local documentation server directly using the mkdocs command.

```bash
$ mkdocs serve
INFO    -  Building documentation...
INFO    -  Cleaning site directory
[I 160505 22:31:24 server:281] Serving on http://127.0.0.1:8000
[I 160505 22:31:24 handlers:59] Start watching changes
[I 160505 22:31:24 handlers:61] Start detecting changes
```

--------------------------------

### Apply Path Rewrite in IngressRoute

Source: https://doc.traefik.io/traefik-hub/ai-gateway/guides/nvidia-nims-integration

Example of placing the path rewrite middleware at the start of the middleware chain.

```yaml
middlewares:  

  - name: ai-openai-pathrewrite # Must be first to rewrite path before processing  

  - name: topic-control-guard  

  - name: jailbreak-detection-guard  

  - name: content-safety-guard  

  - name: chat-completion  
```

--------------------------------

### Proxy Startup Logs

Source: https://doc.traefik.io/traefik-enterprise/installing/on-premise

Example output showing a successful proxy node startup and cluster join process.

```text
INFO[2020-01-20T15:09:47-03:00] Applying a new static configuration           node=proxy-0 role=proxy module=server
INFO[2020-01-20T15:09:47-03:00] Using static discovery                        node=proxy-0 role=proxy peers="10.0.0.1:4242"
INFO[2020-01-20T15:09:47-03:00] Discovering controllers                       node=proxy-0 role=proxy
INFO[2020-01-20T15:09:47-03:00] Found controllers [10.0.0.1:4242]             node=proxy-0 role=proxy
INFO[2020-01-20T15:09:47-03:00] Waiting for the join tokens to be available   node=proxy-0 role=proxy
INFO[2020-01-20T15:09:47-03:00] Looking for a reachable peer                  role=proxy node=proxy-0
INFO[2020-01-20T15:09:47-03:00] Joining cluster                               role=proxy joined-peer="10.0.0.1:4242" node=proxy-0
INFO[2020-01-20T15:09:47-03:00] Node started                                  node=proxy-0 role=proxy
INFO[2020-01-20T15:09:47-03:00] Node is ready                                 node=proxy-0 role=proxy
```

--------------------------------

### Configure Uplink EntryPoints

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-uplink-entrypoints

Configuration examples for defining uplink entry points on child clusters using Helm charts or static install configurations.

```yaml
ports:  
  multicluster:  
    port: 9443  
    uplink: true  
    asDefault: true  
    expose:  
      default: true  
    http:  
      tls:  
        enabled: true  
```

```yaml
hub:  
  uplinkEntryPoints:  
    multicluster:  
      address: ":9443"  
      asDefault: true  
      http:  
        tls: {}  
```

--------------------------------

### Create User and Directories

Source: https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/linux

Sets up the dedicated system user, configuration directory, and log file for the service.

```bash
sudo useradd -r traefik-hub -s /usr/sbin/nologin  

sudo mkdir /etc/traefik-hub  

sudo touch /var/log/traefik-hub.log  

sudo chown traefik-hub: /var/log/traefik-hub.log  
```

--------------------------------

### Configure OpenTelemetry Logs with Endpoints

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/install/observability/ref-logs

Examples for configuring OTLP log exports using either Helm additional arguments or direct install configuration.

```yaml
additionalArguments:  

  - --experimental.otlpLogs=true  

  - --log.otlp.http.endpoint=https://collector:4318/v1/logs  

  - --log.otlp.http.headers.Authorization=Bearer auth_asKXRhIMplM7El1JENjrotGouS1LYRdL  
```

```yaml
experimental:  

  otlpLogs: true  

  

log:  

  otlp:  

    http:  

      endpoint: https://collector:4318/v1/logs  
```

--------------------------------

### Create System Resources

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

Set up a dedicated system user, configuration directory, and log file for the gateway.

```bash
# Create a user  

sudo groupadd --system traefik-hub  

sudo useradd \  

  -g traefik-hub --no-user-group \  

  --home-dir /var/www --no-create-home \  

  --shell /usr/sbin/nologin \  

  --system traefik-hub  

# Create a config directory  

sudo mkdir -p /etc/traefik-hub/dynamic  

sudo chown root:root /etc/traefik-hub  

sudo chown traefik-hub:traefik-hub /etc/traefik-hub/dynamic  

# Create a log file  

sudo touch /var/log/traefik-hub.log  

sudo chown traefik-hub:traefik-hub /var/log/traefik-hub.log  
```

--------------------------------

### Configure Consul Catalog Enterprise Provider

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-consul-catalog-enterprise

Examples for enabling and configuring the Consul Catalog Enterprise provider via Helm Chart and Install Configuration.

```yaml
hub:  

  providers:  

    consulCatalogEnterprise:  

      enabled: true  

      endpoint:  

        address: "127.0.0.1:8500"  

      partition: "myPartition"  
```

```yaml
hub:  

  providers:  

    consulCatalogEnterprise:  

      endpoint:  

        address: "127.0.0.1:8500"  

      partition: "myPartition"  
```

--------------------------------

### Configure EntryPoint and Provider Settings

Source: https://doc.traefik.io/traefik-enterprise/references/configuration/static

Example configuration for entry point TLS, HTTP settings, and various service providers like Docker, Kubernetes, and Consul.

```toml
        [[entryPoints.EntryPoint0.http.tls.domains]]
          main = "foobar"
          sans = ["foobar", "foobar"]
      [entryPoints.EntryPoint0.http.encodedCharacters]
        allowEncodedSlash = true
        allowEncodedBackSlash = true
        allowEncodedNullCharacter = true
        allowEncodedSemicolon = true
        allowEncodedPercent = true
        allowEncodedQuestionMark = true
        allowEncodedHash = true
    [entryPoints.EntryPoint0.http2]
      maxConcurrentStreams = 42
    [entryPoints.EntryPoint0.http3]
      advertisedPort = 42
    [entryPoints.EntryPoint0.udp]
      timeout = "42s"

[providers]
  providersThrottleDuration = "42s"
  [providers.docker]
    constraints = "foobar"
    watch = true
    endpoint = "foobar"
    defaultRule = "foobar"
    exposedByDefault = true
    useBindPortIP = true
    swarmMode = true
    network = "foobar"
    swarmModeRefreshSeconds = "42s"
    httpClientTimeout = "42s"
    allowEmptyServices = true
    [providers.docker.tls]
      ca = "foobar"
      caOptional = true
      cert = "foobar"
      key = "foobar"
      insecureSkipVerify = true
  [providers.file]
    directory = "foobar"
    watch = true
    filename = "foobar"
    debugLogGeneratedTemplate = true
  [providers.marathon]
    constraints = "foobar"
    trace = true
    watch = true
    endpoint = "foobar"
    defaultRule = "foobar"
    exposedByDefault = true
    dcosToken = "foobar"
    dialerTimeout = "42s"
    responseHeaderTimeout = "42s"
    tlsHandshakeTimeout = "42s"
    keepAlive = "42s"
    forceTaskHostname = true
    respectReadinessChecks = true
    [providers.marathon.tls]
      ca = "foobar"
      caOptional = true
      cert = "foobar"
      key = "foobar"
      insecureSkipVerify = true
    [providers.marathon.basic]
      httpBasicAuthUser = "foobar"
      httpBasicPassword = "foobar"
  [providers.kubernetesIngress]
    endpoint = "foobar"
    token = "foobar"
    certAuthFilePath = "foobar"
    namespaces = ["foobar", "foobar"]
    labelSelector = "foobar"
    ingressClass = "foobar"
    throttleDuration = "42s"
    allowEmptyServices = true
    allowExternalNameServices = true
    nativeLBByDefault = true
    crossProviderNamespaces = ["foobar", "foobar"]
    [providers.kubernetesIngress.ingressEndpoint]
      ip = "foobar"
      hostname = "foobar"
      publishedService = "foobar"
  [providers.kubernetesCRD]
    endpoint = "foobar"
    token = "foobar"
    certAuthFilePath = "foobar"
    namespaces = ["foobar", "foobar"]
    allowCrossNamespace = true
    allowExternalNameServices = true
    crossProviderNamespaces = ["foobar", "foobar"]
    labelSelector = "foobar"
    ingressClass = "foobar"
    throttleDuration = "42s"
    allowEmptyServices = true
    nativeLBByDefault = true
  [providers.kubernetesGateway]
    endpoint = "foobar"
    token = "foobar"
    certAuthFilePath = "foobar"
    namespaces = ["foobar", "foobar"]
    labelSelector = "foobar"
    throttleDuration = "42s"
    crossProviderNamespaces = ["foobar", "foobar"]
  [providers.rest]
    insecure = true
  [providers.rancher]
    constraints = "foobar"
    watch = true
    defaultRule = "foobar"
    exposedByDefault = true
    enableServiceHealthFilter = true
    refreshSeconds = 42
    intervalPoll = true
    prefix = "foobar"
  [providers.consulCatalog]
    constraints = "foobar"
    prefix = "foobar"
    refreshInterval = "42s"
    requireConsistent = true
    stale = true
    cache = true
    exposedByDefault = true
    defaultRule = "foobar"
    connectAware = true
    connectByDefault = true
    serviceName = "foobar"
    watch = true
    namespace = "foobar"
    namespaces = ["foobar", "foobar"]
    [providers.consulCatalog.endpoint]
      address = "foobar"
      scheme = "foobar"
      datacenter = "foobar"
      token = "foobar"
      endpointWaitTime = "42s"
      [providers.consulCatalog.endpoint.tls]
        ca = "foobar"
        caOptional = true
        cert = "foobar"
        key = "foobar"
        insecureSkipVerify = true
      [providers.consulCatalog.endpoint.httpAuth]
        username = "foobar"
        password = "foobar"
  [providers.nomad]
    defaultRule = "foobar"
    constraints = "foobar"
    prefix = "foobar"
    stale = true
    exposedByDefault = true
    refreshInterval = "42s"
    namespace = "foobar"
    namespaces = ["foobar", "foobar"]
    [providers.nomad.endpoint]
      address = "foobar"
      region = "foobar"
      token = "foobar"
      endpointWaitTime = "42s"
      [providers.nomad.endpoint.tls]
        ca = "foobar"
        caOptional = true
        cert = "foobar"
        key = "foobar"
        insecureSkipVerify = true
  [providers.ecs]
    constraints = "foobar"
    exposedByDefault = true
    refreshSeconds = 42
    defaultRule = "foobar"
    clusters = ["foobar", "foobar"]
    autoDiscoverClusters = true
    ecsAnywhere = true
    region = "foobar"
    accessKeyID = "foobar"
    secretAccessKey = "foobar"
  [providers.consul]
```

--------------------------------

### Nutanix Prism Central Provider Configuration

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/install/providers/ref-provider-nutanix-prism-central

Configuration examples for the Nutanix Prism Central provider using YAML format for standard installation and Helm chart values.

```yaml
providers:  

  nutanixPrismCentral:  

    endpoint: https://prism-central.example.com:9440  

    apiKey: your-api-key-here  

    filename: /etc/traefik/nutanix-base-config.yaml  

    pollInterval: 30s  

    pollTimeout: 5s  

    serviceNameCategoryKey: TraefikServiceName  

    allowedVPCs:  

      - uuid: a1b2c3d4-e5f6-7890-abcd-ef1234567890  

      - uuid: b2c3d4e5-f6g7-8901-bcde-f12345678901  

    tls:  

      ca: /etc/traefik/certs/prism-central-ca.pem  

      cert: /etc/traefik/certs/client.pem  

      key: /etc/traefik/certs/client-key.pem  

      insecureSkipVerify: false
```

```yaml
providers:  

  nutanixPrismCentral:  

    enabled: true  

    endpoint: https://prism-central.example.com:9440  

    apiKey: your-api-key-here  

    filename: /etc/traefik/nutanix-base-config.yaml  

    pollInterval: 30s  

    pollTimeout: 5s  

    serviceNameCategoryKey: TraefikServiceName  

    allowedVPCs:  

      - uuid: a1b2c3d4-e5f6-7890-abcd-ef1234567890  

      - uuid: b2c3d4e5-f6g7-8901-bcde-f12345678901  

    tls:  

      ca: /etc/traefik/certs/prism-central-ca.pem  

      cert: /etc/traefik/certs/client.pem  

      key: /etc/traefik/certs/client-key.pem  

      insecureSkipVerify: false
```

--------------------------------

### Start a Plugin Registry

Source: https://doc.traefik.io/traefik-enterprise/references/cli/traefikee

Initializes a plugin registry and joins it to the cluster.

```bash
traefikee plugin-registry --name="registry" --discovery.static.peers=172.17.0.1:4242,172.17.0.3:4242,172.17.0.4:4242 --token=8QHrhfoLOjcE2w
```

--------------------------------

### Traefik Static Configuration Example

Source: https://doc.traefik.io/traefik-hub/assets/files/traefik-dashboard-0d98b017050133fe4f6dc1c51072da32.json

A basic Traefik static configuration file. This defines the entry points, providers, and API settings for the Traefik instance. Static configuration is essential for Traefik to start.

```yaml
log:
  level: "INFO"

api:
  dashboard: true

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: "/etc/traefik/conf.d/"
    watch: true

```

--------------------------------

### Configure EntryPoints

Source: https://doc.traefik.io/traefik/reference/install-configuration/entrypoints

Examples for defining entry points and their associated HTTP settings, redirections, and observability options.

```yaml
entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
    observability:
      accessLogs: false
      metrics: false
      tracing: false

  websecure:
    address: :443
    http:
      tls: {}
      middlewares:
        - default-auth@kubernetescrd
        - default-strip@kubernetescrd
```

```toml
[entryPoints]
  [entryPoints.web]
    address = ":80"
    [entryPoints.web.http]
      [entryPoints.web.http.redirections.entryPoint]
        to = "websecure"
        scheme = "https"
        permanent = true
    [entryPoints.web.observability]
      accessLogs = false
      metrics = false
      tracing = false

  [entryPoints.websecure]
    address = ":443"
    [entryPoints.websecure.http]
      middlewares = ["default-auth@kubernetescrd", "default-strip@kubernetescrd"]
      [entryPoints.websecure.http.tls]
```

```yaml
## Values file
ports:
  web:
    port: :80
  websecure:
    port: :443
    tls:
      enabled: true
    middlewares:
      - default-auth@kubernetescrd
      - default-strip@kubernetescrd
additionalArguments:
  - --entryPoints.web.http.redirections.entryPoint.to=websecure
  - --entryPoints.web.http.redirections.entryPoint.scheme=https
  - --entryPoints.web.http.redirections.entryPoint.permanent=true
  - --entryPoints.web.observability.accessLogs=false
  - --entryPoints.web.observability.metrics=false
  - --entryPoints.web.observability.tracing=false
```

--------------------------------

### Deploy Sample Application

Source: https://doc.traefik.io/traefik/getting-started/docker

Docker Compose configuration for the whoami service with Traefik routing labels.

```yaml
# whoami.yml
services:
  whoami:
    image: traefik/whoami
    labels:
      - "traefik.http.routers.whoami.rule=Host(`whoami.localhost`)"
```

--------------------------------

### Test traefikee installation

Source: https://doc.traefik.io/traefik-enterprise/installing/on-premise

Verify the installation by running the help command.

```bash
traefikee --help
```

```text
traefikee    Traefik Enterprise (Enterprise Edition) is a Cloud Native Edge Routing Platform based on Traefik Proxy,
a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
Complete documentation is available at https://doc.traefik.io.

Usage: traefikee [command] [resource] [flags]

Use "traefikee [command] --help" for help on any command.

Commands:
    controller    Start a new controller
    proxy         Start a new proxy
    tokens        Get tokens from the cluster
    version       Print version
```

--------------------------------

### Start the Plugin Registry

Source: https://doc.traefik.io/traefik-enterprise/installing/on-premise

Initializes the plugin registry using a static discovery method and a join token.

```bash
traefikee plugin-registry --token="<pre-shared-token>" --jointoken.value="$PROXY_NODE_TOKEN" --discovery.static.peers="10.0.0.1:4242"
```

--------------------------------

### Traefik Healthcheck CLI Example

Source: https://doc.traefik.io/traefik/reference/install-configuration/observability/healthcheck

Example output of the healthcheck command.

```bash
$ traefik healthcheck
OK: http://:8082/ping
```

--------------------------------

### Controller Initialization Log Output

Source: https://doc.traefik.io/traefik-enterprise/installing/on-premise

Example log output generated upon successful controller startup.

```text
INFO[2020-01-20T15:00:35-03:00] Using static discovery to discover other controllers  node=controller-0 role=controller
INFO[2020-01-20T15:00:35-03:00] Initializing a new node                       role=controller node=controller-0
INFO[2020-01-20T15:00:35-03:00] Discovering cluster                           node=controller-0 role=controller
INFO[2020-01-20T15:00:35-03:00] Found peers [10.0.0.1:4242]                    node=controller-0 role=controller
INFO[2020-01-20T15:00:35-03:00] Initial leader runs at 10.0.0.1:4242           node=controller-0 role=controller
INFO[2020-01-20T15:00:35-03:00] Initializing a new Traefik Enterprise cluster          node=controller-0 role=controller
INFO[2020-01-20T15:00:35-03:00] API started                                   role=controller node=controller-0
INFO[2020-01-20T15:00:35-03:00] Node started                                  role=controller node=controller-0
INFO[2020-01-20T15:00:36-03:00] Node is ready                                 node=controller-0 role=controller
INFO[2020-01-20T15:00:36-03:00] Running the cluster info controller           service=provider node=controller-0 role=controller
INFO[2020-01-20T15:00:36-03:00] Running the cluster license controller with frequency "24h0m0s"  node=controller-0 role=controller service=cleanup
INFO[2020-01-20T15:00:36-03:00] Running the cluster cleanup controller        role=controller node=controller-0 service=cleanup
```

--------------------------------

### Install jwt-cli

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Installation commands for jwt-cli across different package managers.

```bash
# Using Homebrew (macOS/Linux)
brew install mike-engel/jwt-cli/jwt-cli

# Using cargo
cargo install jwt-cli

# Using Manjaro/Arch:
sudo pacman -S jwt-cli
```

--------------------------------

### Perform In-Place Upgrade

Source: https://doc.traefik.io/traefik-hub/api-gateway/setup/linux/api-gateway-upgrading-linux

Steps to download the new binary, swap it with the existing one, and restart the service.

```bash
# 1. Download the new binary  
sudo curl -L -o /usr/local/bin/traefik-hub.new \
  https://github.com/traefik/traefik-hub/releases/download/v3.16.0/traefik-hub_linux_amd64  
sudo chmod +x /usr/local/bin/traefik-hub.new  
  
# 2. Swap binaries atomically  
sudo mv /usr/local/bin/traefik-hub /usr/local/bin/traefik-hub.old  
sudo mv /usr/local/bin/traefik-hub.new /usr/local/bin/traefik-hub  
  
# 3. Reload & restart gracefully  
sudo systemctl daemon-reload  
sudo systemctl restart traefik-hub.service  
  
# 4. Verify  
journalctl -u traefik-hub -f  
```

--------------------------------

### Verify Traefik Mesh Installation

Source: https://doc.traefik.io/traefik-mesh/quickstart

Expected output after running the Helm install command.

```text
[...]

NOTES:
Thank you for installing traefik-mesh.

Your release is named traefik-mesh.

To learn more about the release, try:

  $ helm status traefik-mesh
  $ helm get traefik-mesh
```

--------------------------------

### Start Additional Controllers

Source: https://doc.traefik.io/traefik-enterprise/installing/on-premise

Commands to initialize additional controllers using static peer discovery or DNS discovery methods.

```bash
traefikee controller --advertise="10.0.0.1:4242" --license="<your-license-key>" --api.bundle="<path-to>/bundle.zip" --discovery.static.peers="10.0.0.1:4242,10.0.0.2:4242,10.0.0.3:4242" --plugin.url="https://plugins.mydomain" --plugin.token="<pre-shared-token>" --jointoken.value="${CONTROLLER_NODE_TOKEN}"
```

```bash
traefikee controller --advertise="10.0.0.1:4242" --license="<your-license-key>" --api.bundle="<path-to>/bundle.zip" --discovery.dns.domain="traefikee.mydomain" --discovery.dns.port="4242" --discovery.dns.bootstrapexpected=2 --plugin.url="https://plugins.mydomain" --plugin.token="<pre-shared-token>" --jointoken.value="${CONTROLLER_NODE_TOKEN}"
```

--------------------------------

### Install k8s-extension

Source: https://doc.traefik.io/traefik-hub/operations/azure/azure-arc-apim

Installs the Azure CLI extension required for managing Kubernetes extensions.

```bash
az extension add --name k8s-extension
```

--------------------------------

### Initialize Plugin Repository

Source: https://doc.traefik.io/traefik-hub/api-gateway/guides/plugin-development-guide

Commands to create a local directory, initialize a git repository, and create a remote repository on GitHub or GitLab.

```bash
# Create a new directory for your plugin  

mkdir my-plugin  

cd my-plugin  

  

# Initialize git repository  

git init  

  

# Create on GitHub (using gh CLI)  

# For public plugins (Plugin Catalog):  

gh repo create my-org/my-plugin --public --source=. --remote=origin  

  

# For private plugins:  

gh repo create my-org/my-plugin --private --source=. --remote=origin
```

```bash
# Create a new directory for your plugin  

mkdir my-plugin  

cd my-plugin  

  

# Initialize git repository  

git init  

  

# Create on GitLab (using glab CLI)  

# GitLab repositories can only be used for private plugins  

glab repo create my-org/my-plugin --private
```

--------------------------------

### Correct Prefix Ordering Example

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/middlewares/ref-strip-prefix

Demonstrates the correct configuration by placing the most specific prefix first.

```yaml
spec:  

  stripPrefix:  

    prefixes:  

      - /foo2   # this is checked first, it matches /foo2, and strips correctly  

      - /foo  

      - /test  
```

--------------------------------

### ReplacePath Configuration Examples

Source: https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/replacepath

Configuration examples for the ReplacePath middleware across various formats including YAML, TOML, labels, tags, and Kubernetes.

```yaml
# Replace the path with /foo
http:
  middlewares:
    test-replacepath:
      replacePath:
        path: "/foo"
```

```toml
# Replace the path with /foo
[http.middlewares]
  [http.middlewares.test-replacepath.replacePath]
    path = "/foo"
```

```labels
# Replace the path with /foo
labels:
  - "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
```

```json
// Replace the path with /foo
{
  // ...
  "Tags" : [
    "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
  ]
} 
```

```yaml
# Replace the path with /foo
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: test-replacepath
spec:
  replacePath:
    path: "/foo"
```

--------------------------------

### OpenAPISpecUpdated Event Example

Source: https://doc.traefik.io/traefik-hub/reference/api-management-conditions-and-events

Example output for a successful OpenAPI specification update event.

```text

Type:    Normal  

Reason:  OpenAPISpecUpdated  

Message: OpenAPI specification has been updated  


```

--------------------------------

### Plugin Configuration Examples

Source: https://doc.traefik.io/traefik-enterprise/references/configuration/dynamic/traefikee

TOML configuration blocks for various authentication and utility plugins.

```toml
    [http.middlewares.Plugin0]
      [http.middlewares.Plugin0.plugin]
        [http.middlewares.Plugin0.plugin.hmacAuth]
          enforcedHeaders = ["foobar", "foobar"]
          source = "foobar"
          validateDigest = true
    [http.middlewares.Plugin1]
      [http.middlewares.Plugin1.plugin]
        [http.middlewares.Plugin1.plugin.ldapAuth]
          attribute = "foobar"
          baseDN = "foobar"
          forwardAuthorization = true
          forwardUsername = true
          forwardUsernameHeader = "foobar"
          searchFilter = "foobar"
          source = "foobar"
          wwwAuthenticateHeader = true
          wwwAuthenticateHeaderRealm = "foobar"
    [http.middlewares.Plugin2]
      [http.middlewares.Plugin2.plugin]
        [http.middlewares.Plugin2.plugin.jwtAuth]
          claims = "foobar"
          forwardAuthorization = true
          source = "foobar"
          tokenKey = "foobar"
          tokenQueryKey = "foobar"
          username = "foobar"
          [http.middlewares.Plugin2.plugin.jwtAuth.forwardHeaders]
            name0 = "foobar"
            name1 = "foobar"
    [http.middlewares.Plugin3]
      [http.middlewares.Plugin3.plugin]
        [http.middlewares.Plugin3.plugin.oAuthIntrospection]
          claims = "foobar"
          forwardAuthorization = true
          source = "foobar"
          tokenQueryKey = "foobar"
          tokenTypeHint = "foobar"
          username = "foobar"
          [http.middlewares.Plugin3.plugin.oAuthIntrospection.forwardHeaders]
            name0 = "foobar"
            name1 = "foobar"
    [http.middlewares.Plugin4]
      [http.middlewares.Plugin4.plugin]
        [http.middlewares.Plugin4.plugin.oidcAuth]
          backchannelLogoutSessionsRequired = true
          backchannelLogoutUrl = "foobar"
          claims = "foobar"
          disableLogin = true
          loginUrl = "foobar"
          logoutUrl = "foobar"
          postLoginRedirectUrl = "foobar"
          postLogoutRedirectUrl = "foobar"
          redirectUrl = "foobar"
          scopes = ["foobar", "foobar"]
          source = "foobar"
          username = "foobar"
          [http.middlewares.Plugin4.plugin.oidcAuth.authParams]
            name0 = "foobar"
            name1 = "foobar"
          [http.middlewares.Plugin4.plugin.oidcAuth.csrf]
            headerName = "foobar"
            secure = true
          [http.middlewares.Plugin4.plugin.oidcAuth.forwardHeaders]
            name0 = "foobar"
            name1 = "foobar"
          [http.middlewares.Plugin4.plugin.oidcAuth.session]
            domain = "foobar"
            expiry = 42
            httpOnly = true
            name = "foobar"
            path = "foobar"
            refresh = true
            sameSite = "foobar"
            secret = "foobar"
            secure = true
            sliding = true
            store = "foobar"
          [http.middlewares.Plugin4.plugin.oidcAuth.stateCookie]
            domain = "foobar"
            httpOnly = true
            maxAge = 42
            name = "foobar"
            path = "foobar"
            sameSite = "foobar"
            secret = "foobar"
            secure = true
    [http.middlewares.Plugin5]
      [http.middlewares.Plugin5.plugin]
        [http.middlewares.Plugin5.plugin.inFlightReq]
          amount = 42
```

--------------------------------

### Example JWKs URI

Source: https://doc.traefik.io/traefik-hub/authentication-authorization/oracle/oci-iam-identity-domain

An example of the JWKs URI format retrieved from the OpenID configuration.

```text
https://idcs-****.identity.oraclecloud.com:443/admin/v1/SigningCert/jwk
```

--------------------------------

### Configure Static Settings

Source: https://doc.traefik.io/traefik-enterprise/references/configuration/static

Example configuration for tracing, host resolution, certificate resolvers, experimental features, and authentication sources.

```yaml
    logLevel: foobar
    enableAutoProfile: true
  haystack:
    localAgentHost: foobar
    localAgentPort: 42
    globalTag: foobar
    traceIDHeaderName: foobar
    parentIDHeaderName: foobar
    spanIDHeaderName: foobar
    baggagePrefixHeaderName: foobar
  elastic:
    serverURL: foobar
    secretToken: foobar
    serviceEnvironment: foobar
hostResolver:
  cnameFlattening: true
  resolvConfig: foobar
  resolvDepth: 42
certificatesResolvers:
  CertificateResolver0:
    acme:
      email: foobar
      caServer: foobar
      preferredChain: foobar
      storage: foobar
      keyType: foobar
      eab:
        kid: foobar
        hmacEncoded: foobar
      certificatesDuration: 42
      dnsChallenge:
        provider: foobar
        delayBeforeCheck: 42s
        resolvers:
        - foobar
        - foobar
        disablePropagationCheck: true
      httpChallenge:
        entryPoint: foobar
      tlsChallenge: {}
    distributedACME:
      url: foobar
      tls:
        cert: foobar
        key: foobar
        ca: foobar
    vault:
      url: foobar
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
      token: foobar
      auth:
        token: foobar
        appRole:
          roleID: foobar
          secretID: foobar
          path: foobar
        kubernetes:
          role: foobar
          path: foobar
      namespace: foobar
      enginePath: foobar
      role: foobar
  CertificateResolver1:
    acme:
      email: foobar
      caServer: foobar
      preferredChain: foobar
      storage: foobar
      keyType: foobar
      eab:
        kid: foobar
        hmacEncoded: foobar
      certificatesDuration: 42
      dnsChallenge:
        provider: foobar
        delayBeforeCheck: 42s
        resolvers:
        - foobar
        - foobar
        disablePropagationCheck: true
      httpChallenge:
        entryPoint: foobar
      tlsChallenge: {}
    distributedACME:
      url: foobar
      tls:
        cert: foobar
        key: foobar
        ca: foobar
    vault:
      url: foobar
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
      token: foobar
      auth:
        token: foobar
        appRole:
          roleID: foobar
          secretID: foobar
          path: foobar
        kubernetes:
          role: foobar
          path: foobar
      namespace: foobar
      enginePath: foobar
      role: foobar
pilot:
  token: foobar
  dashboard: true
experimental:
  plugins:
    Descriptor0:
      moduleName: foobar
      version: foobar
    Descriptor1:
      moduleName: foobar
      version: foobar
  localPlugins:
    LocalDescriptor0:
      moduleName: foobar
    LocalDescriptor1:
      moduleName: foobar
  kubernetesGateway: true
  http3: true
authSources:
  Source0:
    ldap:
      url: foobar
      startTLS: true
      certificateAuthority: foobar
      insecureSkipVerify: true
      bindDN: foobar
      bindPassword: foobar
      connPool:
        size: 42
        burst: 42
        ttl: 42s
    jwt:
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
      timeout: 42s
      maxRetries: 42
      signingSecret: foobar
      signingSecretBase64Encoded: true
      publicKey: foobar
      jwksFile: foobar
      jwksUrl: foobar
    oAuthIntrospection:
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
      timeout: 42s
      maxRetries: 42
      url: foobar
      authorizationHeader: foobar
      customHeaders:
        name0: foobar
        name1: foobar
    oAuthClientCredentials:
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
      timeout: 42s
      maxRetries: 42
      clientID: foobar
      clientSecret: foobar
      url: foobar
    hmac:
      inline:
      - id: foobar
        key: foobar
      - id: foobar
        key: foobar
    oidc:
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
      timeout: 42s
      maxRetries: 42
      issuer: foobar
      issuerHost: foobar
      clientID: foobar
      clientSecret: foobar
      pkce: true
      discoveryParams:
        name0: foobar
        name1: foobar
  Source1:
    ldap:
      url: foobar
      startTLS: true
      certificateAuthority: foobar
      insecureSkipVerify: true
      bindDN: foobar
      bindPassword: foobar
      connPool:
        size: 42
        burst: 42
        ttl: 42s
    jwt:
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
      timeout: 42s
      maxRetries: 42
      signingSecret: foobar
      signingSecretBase64Encoded: true
      publicKey: foobar
      jwksFile: foobar
      jwksUrl: foobar
    oAuthIntrospection:
      tls:
        caBundle: foobar
        cert: foobar
        key: foobar
        insecureSkipVerify: true
```

--------------------------------

### Authorization Header Example

Source: https://doc.traefik.io/traefik-enterprise/middlewares/hmac

An example of the Authorization header format required for HMAC authentication.

```http
Authorization: Hmac keyId="secret-id-1",algorithm="hmac-sha256",headers="(request-target) (created) (expires) host x-example",signature="c29tZXNpZ25hdHVyZQ==",created="1584453022",expires="1584453032"
```

--------------------------------

### Setup a Cluster Connection

Source: https://doc.traefik.io/traefik-enterprise/references/cli/teectl

Initializes a cluster connection configuration and generates a bundle.zip file for secure communication.

```bash
teectl setup --cluster="mycluster" --kubernetes
```