Co-authored-by: Kevin Pollet <pollet.kevin@gmail.com>
4 KiB
title | description |
---|---|
Traefik Migration Documentation | Learn the steps needed to migrate to new Traefik Proxy v3 versions. Read the technical documentation. |
Migration: Steps needed between the versions
v3.0 to v3.1
Kubernetes Provider RBACs
Starting with v3.1, the Kubernetes Providers now use the EndpointSlices API (Kubernetes >=v1.21) to discover service endpoint addresses. It also brings NodePort load-balancing which requires Nodes resources lookup.
Therefore, in the corresponding RBACs (see KubernetesIngress, KubernetesCRD, and KubernetesGateway provider RBACs):
- the
endpoints
right has to be removed and the followingendpointslices
right has to be added:
...
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
...
- the
nodes
right has to be added:
...
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- list
- watch
...
Gateway API: KubernetesGateway Provider
In v3.1, the KubernetesGateway Provider is no longer an experimental feature.
It can be enabled without the associated experimental.kubernetesgateway
option, which is now deprecated.
??? example "An example of the experimental kubernetesgateway
option"
```yaml tab="File (YAML)"
experimental:
kubernetesgateway: true
```
```toml tab="File (TOML)"
[experimental]
kubernetesgateway=true
```
```bash tab="CLI"
--experimental.kubernetesgateway=true
```
Remediation
The kubernetesgateway
option should be removed from the experimental section of the static configuration.
To configure kubernetesgateway
, please check out the KubernetesGateway Provider documentation.
v3.1.0 to v3.1.1
IngressClass Lookup
The Kubernetes Ingress provider option disableIngressClassLookup
has been deprecated in v3.1.1, and will be removed in the next major version.
Please use the disableClusterScopeResources
option instead to avoid cluster scope resources discovery (IngressClass, Nodes).
v3.1 to v3.2
Kubernetes Gateway Provider Standard Channel
Starting with v3.2, the Kubernetes Gateway Provider now supports GRPCRoute.
Therefore, in the corresponding RBACs (see KubernetesGateway provider RBACs),
the grcroutes
and grpcroutes/status
rights have to be added.
...
- apiGroups:
- gateway.networking.k8s.io
resources:
- grpcroutes
verbs:
- get
- list
- watch
- apiGroups:
- gateway.networking.k8s.io
resources:
- grpcroutes/status
verbs:
- update
...
Kubernetes Gateway Provider Experimental Channel
!!! warning "Breaking changes"
Because of a breaking change introduced in Kubernetes Gateway [v1.2.0-rc1](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.2.0-rc1),
Traefik v3.2 only supports Kubernetes Gateway v1.2.x when experimental channel features are enabled.
Starting with v3.2, the Kubernetes Gateway Provider now supports BackendTLSPolicy.
Therefore, in the corresponding RBACs (see KubernetesGateway provider RBACs),
the backendtlspolicies
and backendtlspolicies/status
rights have to be added.
...
- apiGroups:
- gateway.networking.k8s.io
resources:
- backendtlspolicies
verbs:
- get
- list
- watch
- apiGroups:
- gateway.networking.k8s.io
resources:
- backendtlspolicies/status
verbs:
- update
...