---
title: 'Addon: Ingress'
description: Canonical makes open source secure, reliable and easy to use, providing
  support for Ubuntu and a portfolio of enterprise-grade technologies. Founded in
  2004, Canonical operates globally with team members in over 80 countries.
url: https://canonical.com/microk8s/docs/addon-ingress?format=md
---

*Submit*

# Addon: Ingress

This addon adds a [Traefik Ingress Controller](https://traefik.io/traefik/) for MicroK8s. It is enabled by running the command:

```
microk8s enable ingress
```

> **Note:** Starting with MicroK8s 1.35, the ingress addon uses [Traefik](https://traefik.io/traefik/) as the default ingress controller. Prior versions (< 1.35) used [NGINX Ingress Controller](https://github.com/kubernetes/ingress-nginx). Existing Ingress resources with `ingressClassName: nginx` will continue to work. See the [Backward Compatibility](https://canonical.com/microk8s/docs/addon-ingress?format=md#backward-compatibility) section for details.

## [Options](https://canonical.com/microk8s/docs/addon-ingress?format=md#p-19981-options)

The addon supports the following options:

* `-V VERSION` - Traefik Helm chart version
* `-r REPOSITORY` - Traefik Helm chart repository
* `-g GW_VERSION` - Gateway API CRD version
* `--default-ssl-certificate NAMESPACE/NAME` - Kubernetes TLS Secret to use as Traefik’s default TLS certificate

## [Creating Ingress Resources](https://canonical.com/microk8s/docs/addon-ingress?format=md#p-19981-creating-ingress-resources)

With the Ingress addon enabled, HTTP/HTTPS ingress rules can be created with an Ingress resource. The addon provides three IngressClass options:

* `public` (default) - backward compatible with the previous NGINX setup
* `traefik` - standard Traefik ingress class
* `nginx` - for users migrating from nginx-based ingress resources

For example:

```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: http-ingress
spec:
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: some-service
            port:
              number: 80
```

## [Gateway API Support](https://canonical.com/microk8s/docs/addon-ingress?format=md#p-19981-gateway-api-support)

The addon also includes Gateway API support. You can create HTTPRoute resources for modern routing:

```
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-route
spec:
  parentRefs:
  - name: traefik-gateway
    namespace: ingress
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: some-service
      port: 80
```

## [Configuring Default TLS Certificate](https://canonical.com/microk8s/docs/addon-ingress?format=md#p-19981-configuring-default-tls-certificate)

To set a default TLS certificate for all HTTPS traffic:

```
microk8s enable ingress --default-ssl-certificate my-namespace/my-tls-secret
```

## [Backward Compatibility](https://canonical.com/microk8s/docs/addon-ingress?format=md#p-19981-backward-compatibility)

Users migrating from the previous NGINX-based ingress addon can continue using their existing Ingress resources. The addon includes:

* An `nginx` IngressClass that routes through Traefik
* Support for common NGINX ingress annotations via the `kubernetesIngressNginx` provider

If you encounter unexpected behavior with ingress routing, restarting the addon may resolve the issue:

```
microk8s disable ingress
microk8s enable ingress
```

## [Disabling the Addon](https://canonical.com/microk8s/docs/addon-ingress?format=md#p-19981-disabling-the-addon)

To disable the ingress addon:

```
microk8s disable ingress
```

This will remove Traefik, Gateway API CRDs, and clean up any legacy NGINX ingress resources.

Last updated 7 months ago. [Help improve this document in the forum](https://discuss.kubernetes.io/t/addon-ingress/11259).