What Radar Shows
Topology: Full Traefik routing path - IngressRoute → Middleware → Service (or TraefikService → Service) with TLS and transport configuration edges. See how traffic flows from entrypoints through middleware chains and weighted/mirroring TraefikServices to backend Kubernetes Services. Both Resources and Traffic view modes are supported. IngressRoute / IngressRouteTCP / IngressRouteUDP Detail View:- Entry points and TLS configuration (secret, cert resolver, TLS options/stores)
- Route match expressions with priority and kind badges
- Per-route services with port, weight, and ServersTransport links
- Per-route middleware references with cross-namespace indicators
- Aggregated middleware chain with numbered ordering
- Alert banners for no-route or no-service configurations
chain links its member middlewares, auth middlewares (basicAuth/digestAuth/forwardAuth) show secret references only, never values, errors shows its service and status mapping, and unknown/plugin types fall back to a key/value view with nested credential keys redacted.
TraefikService Detail View: weighted backends with weight bars, mirroring (primary plus mirrors with percentages), and the load-balancing strategy.
TLSOption Detail View: minimum/maximum TLS versions, cipher suites, and client-auth configuration.
ServersTransport / ServersTransportTCP Detail View: SNI, an insecureSkipVerify warning banner, CA/client-cert secret references, and timeouts.
Secret safety: inline credentials in a Traefik CRD spec are redacted in the AI/MCP context (get_resource) - credential keys and high-confidence secret patterns are masked - and the Middleware detail renderer shows secret references only, never values. Reference names (secretName, basicAuth.secret, rootCAsSecrets) are preserved so you can still diagnose a bad reference. The raw YAML view still shows the object as stored in the cluster.
Cluster Audit checks
Traefik ships no admission webhook or linter, so a typo’d reference is accepted silently and the route or middleware just doesn’t do what you wrote. Radar’s Cluster Audit catches the common dangling-reference cases as Reliability checks:| Check | What it catches |
|---|---|
traefikRouteMissingService | An IngressRoute referencing a Service or TraefikService that doesn’t exist |
traefikRouteMissingMiddleware | An IngressRoute referencing a Middleware that doesn’t exist |
traefikChainMissingMiddleware | A chain Middleware listing a member Middleware that doesn’t exist |
traefikErrorsMissingService | An errors Middleware whose errors.service references a Service that doesn’t exist |
traefik.io reference is not satisfied by a traefik.containo.us object - and cross-namespace references resolve correctly.
Supported CRDs
| CRD | Group | Topology | Detail View | AI Summary |
|---|---|---|---|---|
| IngressRoute | traefik.io/v1alpha1 | Yes | Yes | - |
| IngressRouteTCP | traefik.io/v1alpha1 | Yes | Yes | - |
| IngressRouteUDP | traefik.io/v1alpha1 | Yes | Yes | - |
| Middleware | traefik.io/v1alpha1 | Yes | Yes | - |
| MiddlewareTCP | traefik.io/v1alpha1 | Yes | Yes | - |
| TraefikService | traefik.io/v1alpha1 | Yes | Yes | - |
| ServersTransport | traefik.io/v1alpha1 | Yes | Yes | - |
| ServersTransportTCP | traefik.io/v1alpha1 | Yes | Yes | - |
| TLSOption | traefik.io/v1alpha1 | Yes | Yes | - |
| TLSStore | traefik.io/v1alpha1 | Yes | Generic | - |
traefik.containo.us API group (pre-v2.11) is warm-listed alongside traefik.io so older clusters don’t pay first-list latency.