Web / Traefik Interview questions
1. What is Traefik?
Traefik is an open-source edge router and reverse proxy written in Go, designed to route incoming traffic to the right backend service in dynamic, containerized environments. Unlike traditional reverse proxies, Traefik discovers services automatically by watching orchestrators and infrastructure ...
2. What are the main features of Traefik?
Traefik's core value comes from combining several jobs that usually need separate tools into one binary. Automatic service discovery from providers like Docker, Kubernetes, and Consul Dynamic configuration that updates without restarts Automatic HTTPS via Let's Encrypt Load balancing across multi...
3. What is the purpose of an entrypoint in Traefik?
An entrypoint defines the network entry point into Traefik: the port and protocol on which it listens for incoming traffic, such as port 80 for HTTP or port 443 for HTTPS. Every entrypoint is named (commonly web for port 80 and websecure for port 443) and configured in the static configuration, s...
4. What are routers in Traefik?
A router is the component that inspects an incoming request and decides which service should handle it, based on a matching rule such as the request's host, path, or headers. Each router defines a rule (for example Host(`api.example.com`) ), attaches to one or more entrypoints, optionally passes ...
5. What are services in Traefik?
A service in Traefik represents the actual backend that handles the request once a router has matched it, typically one or more instances of an application reachable over the network. Services define the load-balancing behavior across those instances, including the list of server URLs, the load-b...
6. What are middlewares in Traefik?
Middlewares sit between a router and a service, letting Traefik modify a request or response, or short-circuit it entirely, before it reaches the backend. Common examples include BasicAuth for authentication, RateLimit for throttling, Headers for adding security headers, StripPrefix for path rewr...
7. What are providers in Traefik?
Providers are the sources Traefik watches to build its routing configuration, connecting it to whatever infrastructure a team is already running. Common providers include the Docker provider, which reads container labels; the Kubernetes provider, which reads Ingress objects or the IngressRoute CR...
8. How do you enable the Traefik dashboard?
The dashboard is enabled in the static configuration by setting api.dashboard: true , then exposing it through a router just like any other service, since the dashboard itself is served as an internal Traefik service named api@internal . In production it should never be exposed without protection...
9. Define an IngressRoute in Traefik?
IngressRoute is a Kubernetes Custom Resource Definition (CRD) provided by Traefik that lets you define routers, middlewares references, and TLS settings directly as native Kubernetes objects, instead of relying only on the standard Ingress resource and annotations. It exposes Traefik-specific con...
10. What is the Traefik file provider?
The file provider lets you define Traefik's dynamic configuration (routers, services, middlewares, TLS options) directly in a YAML or TOML file, rather than pulling it from an orchestrator. It's commonly used for static backends that don't live in Docker or Kubernetes, or for defining reusable mi...
11. How do you configure Traefik using Docker labels?
When the Docker provider is enabled, Traefik reads labels attached to each container to build routers, services, and middlewares for that container, so routing configuration lives right next to the service definition. labels: - "traefik.enable=true" - "traefik.http.routers.myapp.rule=Host(`myapp....
12. What is the purpose of Let's Encrypt integration in Traefik?
Traefik integrates with Let's Encrypt through ACME (Automatic Certificate Management Environment) so it can request, validate, and renew TLS certificates automatically, without an operator manually generating and rotating them. A certificate resolver is configured with the ACME settings (email, c...
13. List the supported configuration providers in Traefik?
Traefik ships with a range of providers so it can plug into whatever platform a team already runs. Category Example providers Orchestrators Docker, Docker Swarm, Kubernetes (Ingress and IngressRoute CRD), Marathon, Nomad Key-value / service discovery Consul, Consul Catalog, etcd, ZooKeeper Static...
14. What is a certificate resolver in Traefik?
A certificate resolver is a named configuration block that tells Traefik how to obtain TLS certificates automatically, most commonly through Let's Encrypt via ACME. It specifies the ACME server, the contact email, where to persist the issued certificates (an acme.json file or a KV store), and whi...
15. What is a middleware chain in Traefik and why order it carefully?
A middleware chain is the ordered list of middlewares a router applies to a request before it reaches the service, and Traefik executes them strictly in the order they're listed. Because each middleware can modify, reject, or pass along the request, the order changes behavior: putting BasicAuth b...
16. Why is dynamic configuration preferred over static configuration for routing rules?
Static configuration in Traefik covers things that must exist before Traefik starts, like entrypoints and providers, and changing it requires a full restart. Dynamic configuration, by contrast, covers routers, services, and middlewares, and can be updated live by a provider (Docker labels, Kubern...
17. What is the difference between Path and PathPrefix routing rules?
Path matches a request only when the URL path is an exact match, while PathPrefix matches any request whose path starts with the given prefix, making it the far more common choice for routing to a service that owns everything under a base path. Path PathPrefix Matches the URL exactly, e.g. /statu...
18. What is the difference between Host and HostRegexp rules?
Host matches requests against one or more exact hostnames, for example Host(`api.example.com`) , and is the rule used for the vast majority of routing setups. HostRegexp , available via Traefik's regex matcher, matches hostnames against a regular expression, which is useful for wildcard-style pat...
19. How does Traefik handle load balancing across multiple service instances?
When a service has multiple server URLs, Traefik distributes incoming requests across them using a load-balancing algorithm, with weighted round robin as the default behavior for HTTP services. Each server can be assigned a weight to send it proportionally more or less traffic, which is the same ...
20. Why would you use sticky sessions in Traefik?
Sticky sessions bind a client to the same backend instance across multiple requests, using a cookie the load balancer sets and reads, instead of letting round robin send each request to a different instance. They matter for applications that keep state in the process serving the request, such as ...
21. How do health checks work in Traefik?
Traefik can actively probe each backend server on a service by periodically sending a request to a configured path and expecting a healthy HTTP status back within a timeout. http: services: myapp: loadBalancer: healthCheck: path: /healthz interval: 10s timeout: 3s If a server fails enough consecu...
22. What is the difference between Traefik's Ingress support and the IngressRoute CRD?
Traefik can act as an Ingress controller for standard Kubernetes Ingress resources, interpreting the common rules and tls fields, plus Traefik-specific behavior added through annotations. Ingress IngressRoute (CRD) Portable across any Ingress controller Traefik-specific, not portable to other con...
23. How does the ForwardAuth middleware work?
ForwardAuth delegates the authentication decision to an external service: before forwarding the original request to its backend, Traefik first sends a request to the configured auth server and waits for its response. http: middlewares: my-auth: forwardAuth: address: "https://auth.example.com/veri...
24. Why is middleware chaining order important in Traefik?
Traefik executes a router's middlewares strictly in the order listed, and each one can transform, reject, or pass along the request, so the same set of middlewares can produce different outcomes depending on their sequence. A concrete example: chaining StripPrefix before ForwardAuth means the aut...
25. How do you configure CORS headers with Traefik middleware?
Cross-Origin Resource Sharing is handled with the Headers middleware, which can set Access-Control-Allow-Origin , allowed methods, allowed headers, and whether credentials are permitted, and can also automatically respond to preflight OPTIONS requests. http: middlewares: cors: headers: accessCont...
26. What is the difference between HTTP-01 and DNS-01 challenge types in Let's Encrypt?
Both are ways Traefik proves domain ownership to Let's Encrypt before it will issue a certificate, but they verify that ownership differently. HTTP-01 DNS-01 Proves ownership by serving a file on port 80 Proves ownership by creating a DNS TXT record Requires the domain to be publicly reachable on...
27. How does Traefik implement weighted round robin for canary deployments?
A canary rollout is expressed as a weighted service , a service made up of multiple underlying services (say, app-stable and app-canary ) each given a numeric weight that determines its share of traffic. http: services: app-canary-split: weighted: services: - name: app-stable weight: 90 - name: a...
28. When should you use the RateLimit middleware?
RateLimit throttles how many requests a client can send in a given time window, protecting backends from being overwhelmed by traffic spikes, abusive clients, or runaway retry loops from a misbehaving caller. http: middlewares: limit: rateLimit: average: 100 burst: 50 average sets the steady-stat...
29. How does the Retry middleware behave with failing backends?
Retry automatically resends a request to another available server in the same service when the original attempt fails at the network level, up to a configured attempt limit. http: middlewares: retry-mw: retry: attempts: 3 initialInterval: 100ms It only retries on connection-level failures, such a...
30. What is the difference between Traefik and Nginx as reverse proxies?
Both can terminate TLS, load balance, and route by host or path, but they differ most in how configuration gets applied and how they fit into dynamic infrastructure. Traefik Nginx Auto-discovers services from Docker/Kubernetes/etc. Requires manually written or templated config files Reloads confi...
31. How do you configure basic authentication in Traefik?
The BasicAuth middleware protects a router with HTTP Basic Auth, checking credentials against a list of username/hashed-password pairs before letting the request continue. http: middlewares: auth: basicAuth: users: - "admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/" Passwords must be pre-hashed, typi...
32. Why does Traefik require the exposedByDefault setting to be handled carefully in Docker?
exposedByDefault controls whether every running container is automatically exposed through Traefik, or whether containers must explicitly opt in with traefik.enable=true . With the default of true , any container on a network Traefik watches becomes reachable the moment it starts, which is conven...
33. How does SNI-based routing work in Traefik?
Server Name Indication (SNI) is the hostname a TLS client sends during the handshake, before the connection is even decrypted, and Traefik reads it to decide which router and certificate to use for that connection. This lets a single Traefik instance terminate TLS for multiple domains on the same...
34. What is the difference between a router's priority and its rule matching?
Rule matching determines whether a router is eligible to handle a given request at all, based on conditions like host or path; priority determines which router wins when more than one eligible rule matches the same request. By default, Traefik assigns higher priority to more specific rules automa...
35. How do you redirect HTTP traffic to HTTPS using Traefik middleware?
The RedirectScheme middleware rewrites the request's scheme, typically from http to https , and issues a redirect response instead of letting the request continue unencrypted. http: middlewares: https-redirect: redirectScheme: scheme: https permanent: true routers: web: rule: "Host(`example.com`)...
36. Explain the execution flow of a request through Traefik's router, middleware, and service chain?
A request first arrives at an entrypoint , the listening port and protocol Traefik was configured to accept traffic on. If the entrypoint terminates TLS, the handshake, including SNI-based certificate selection, happens here before anything else. Traefik then evaluates the routers attached to tha...
37. How does Traefik's hot-reload mechanism detect and apply dynamic configuration changes?
Each enabled provider runs its own watch loop appropriate to its source: the Docker provider listens to the Docker event stream, the Kubernetes provider watches the API server for object changes, and the File provider uses filesystem notifications when watch is enabled. Whenever a provider detect...
38. Explain how mutual TLS (mTLS) is configured between Traefik and backend services?
mTLS in Traefik applies in two distinct directions, and each is configured separately: client-to-Traefik mTLS, where Traefik verifies certificates presented by incoming clients, and Traefik-to-backend mTLS, where Traefik presents its own client certificate to the backend. For client-facing mTLS, ...
39. How do you write and load a custom Traefik plugin using Yaegi?
Traefik plugins are written in Go but run through Yaegi , an embedded Go interpreter, rather than being compiled into the Traefik binary, which lets plugins load and update without rebuilding or restarting Traefik itself. A plugin implements a standard interface: a constructor function and a Serv...
40. What is the difference between TCP routers and HTTP routers in Traefik?
HTTP routers operate on the application layer, matching rules against parsed HTTP data like Host , Path , or headers, and can attach the full range of HTTP middlewares. HTTP Router TCP Router Matches on Host, Path, Headers, Method Matches mainly on SNI (for TLS) or accepts all traffic (HostSNI(`*...
41. How do you troubleshoot a 404 'page not found' response in Traefik when the backend is healthy?
A 404 from Traefik itself (not the backend) almost always means no router matched the request, so the first step is checking the dashboard's Routers view to confirm the expected router even exists and is in a success state rather than showing a provider error. Next, verify the rule syntax against...
42. Explain how Traefik integrates with OpenTelemetry for distributed tracing?
Traefik can act as an OpenTelemetry-instrumented component in a request's trace, creating spans for the routing, middleware, and proxying work it performs, and propagating trace context headers to the backend it forwards the request to. tracing: otlp: http: endpoint: "http://otel-collector:4318/v...
43. How can you optimize Traefik for high-availability deployments?
Traefik itself is stateless with respect to routing decisions, so horizontal scaling starts with running multiple replicas behind a Layer 4 load balancer (or as a Kubernetes Deployment with multiple pods), each independently watching the same providers and converging on the same dynamic configura...
44. Explain the internal working of ServersTransport in Traefik?
ServersTransport configures the HTTP client Traefik uses internally when it connects to a backend server, as opposed to the router/entrypoint settings that govern the client-facing side of the connection. http: serversTransports: mytransport: serverName: backend.internal insecureSkipVerify: false...
45. What is the difference between Traefik's Gateway API support and the traditional IngressRoute CRD?
The Kubernetes Gateway API is a vendor-neutral, upstream Kubernetes API for describing traffic routing (via resources like Gateway and HTTPRoute ), designed as the eventual successor to both Ingress and controller-specific CRDs across the ecosystem. IngressRoute CRD Gateway API Traefik-specific, ...
46. Explain the lifecycle of a Let's Encrypt certificate managed by Traefik?
The lifecycle begins when a router references a certificate resolver in its TLS settings for a domain that has no existing valid certificate on file; Traefik then initiates an ACME order with Let's Encrypt for that domain. Depending on the configured challenge (HTTP-01, TLS-ALPN-01, or DNS-01), T...
47. How does Traefik expose metrics for Prometheus scraping?
When the Prometheus metrics provider is enabled in the static configuration, Traefik exposes a /metrics endpoint (served on a dedicated entrypoint, by default) in the Prometheus exposition format. metrics: prometheus: entryPoint: metrics addEntryPointsLabels: true addServicesLabels: true The expo...
48. Explain how HTTP/3 support works in Traefik and its requirements?
HTTP/3 runs over QUIC, which itself runs over UDP rather than TCP, so enabling it means an entrypoint must additionally listen for UDP traffic on the same port as its TLS-enabled TCP listener, since a client first connects over TCP/TLS and gets advertised HTTP/3 availability via an Alt-Svc header...
49. How do you debug middleware ordering issues causing unexpected routing behavior?
Start with the Traefik dashboard's router detail view, which lists the exact middleware chain attached to a router in the order it will execute, since a misremembered order in a YAML file is a common source of the bug in the first place. Raise the log level to DEBUG temporarily; Traefik logs whic...
50. Explain the internal working of Traefik's provider aggregation across multiple sources?
Each enabled provider (Docker, Kubernetes, File, Consul, and so on) runs independently, translating its own source of truth into Traefik's internal dynamic configuration schema, a common representation of routers, services, middlewares, and TLS options regardless of where the data originated. Pro...
