How I put Keycloak login in front of Prometheus, Alertmanager, the Traefik dashboard and other UIs with no login of their own: what Traefik's forwardAuth sends and does with the answer, the Middleware and annotation that make up the integration, and the ClusterRoles of URL patterns that decide which group sees which hostname.
Why the servers I manage authenticate to services in Kubernetes with the certificate their Puppet agent already holds: the Traefik TLSOption and CA Secret, RequireAndVerifyClientCert versus VerifyClientCertIfGiven, the passTLSClientCert header the app reads, and the seven months a stale CA bundle rejected every server without anyone noticing.
The questions I should have asked before copying my first Middleware: how Traefik differs from NGINX beyond the YAML, which traffic it actually sees, what happens to a request between the entrypoint and the pod, why some changes need a restart, what a TLS 1.3 handshake really does with the certificate, and why we run more than one instance per cluster.
How to move a cluster off the retired ingress-nginx by running Traefik next to it on the same Ingress objects: what the Kubernetes Ingress NGINX provider translates and what it does not, the parallel run and DNS cutover step by step, the IngressClass you must not let Helm delete, and the things I would tell anyone operating Traefik for the first time.
Why I run two Traefik instances per cluster instead of one Traefik with an auth middleware: how the IngressClass flag keeps them apart, the Helm values for each, how the internal one is reached over a mesh VPN, and the three-tier variant with an IP allow-list in the middle.