Traefik v3.8.0-rc.1 expands Kubernetes Gateway API and HTTP/3 support

Traefik has released the v3.8.0-rc.1 pre-release of its cloud-native edge router. This update focuses heavily on deepening integration with the Kubernetes Gateway API, adding support for ListenerSet (GEP-1713), GatewayClass options, and various routing filters like CORS and retries.

Beyond Kubernetes improvements, the release enhances the HTTP/3 stack by updating the quic-go dependency and implementing dedicated transports per client connection. It also introduces new middleware features, such as a tap middleware and circuit breaker request minimums, alongside expanded authentication support for NTLM and Kerberos via ForwardAuth.

Technical improvements in Traefik v3.8.0-rc.1

• Kubernetes Gateway API: Adds support for ListenerSet, GatewayClass options, and BackendTLSPolicy for TLSRoute and gRPC backends, while dropping support for Gateway API v1.5.x.
• HTTP/3 and Networking: Implements read, idle, and max header byte timeouts for HTTP/3, and optimizes the stack by dedicating a transport per HTTP/3 client connection.
• Middleware and Routing: Introduces a new tap middleware, enables CORS filtering for HTTPRoute, and adds support for double wildcard matching in Host and HostSNI matchers.
• Security and Authentication: Expands ForwardAuth to support NTLM and Kerberos, and adds a reusePrivateKey option for ACME to streamline certificate management.
• Observability and Metrics: Adds the QUERY method to recognized HTTP methods for metrics labeling and optimizes OpenTelemetry (OTel) resource building.

Why it matters

This release is critical for platform engineers managing Kubernetes clusters, as it aligns Traefik more closely with evolving Gateway API standards. The improvements to HTTP/3 stability and expanded authentication protocols also provide more robust options for high-performance, secure edge routing in enterprise environments.