Traefik

Traefik is a widely-deployed cloud-native reverse proxy and load balancer with strong agent relevance for infrastructure management workloads. It auto-discovers services from Docker, Kubernetes, and Consul, configures routes dynamically without restarts, and exposes a REST API and dashboard for inspecting active routers, services, middlewares, and entrypoints. Agents managing containerized deployments can query Traefik's API to understand current routing state, detect misconfigured services, or verify TLS certificate status. Traefik is self-hosted and open-source (MIT); Traefik Enterprise adds commercial features. The API is read-oriented for introspection; configuration changes go through provider integration (labels, CRDs), not direct API writes. Confidence is docs-derived.

Traefik exposes a REST API at /api (disabled by default, must be explicitly enabled). Endpoints: GET /api/rawdata (full config snapshot), GET /api/http/routers, /api/http/services, /api/http/middlewares (list/detail), GET /api/entrypoints, GET /api/version. All return JSON. Authentication requires enabling the dashboard with auth middleware (basic auth, IP allowlist, or forward auth). The API is read-only; configuration changes are applied through provider config (Docker labels, Kubernetes Ingress/CRDs, file provider). Rate limiting and pagination are not documented for the API.

The Traefik API has no built-in auth by default — enabling it without protection exposes the full routing configuration. Production deployments MUST add auth middleware (BasicAuth, DigestAuth, or ForwardAuth) or restrict to private networks. Dashboard and API share the same auth configuration. TLS for the dashboard itself requires additional configuration. Agents accessing the Traefik API should be on the same internal network or use a forwarded auth flow.

Traefik's REST API returns standard HTTP status codes for the introspection endpoints. 404 for unknown routers/services, 200 with JSON for valid queries. The API is stateless and read-only, so errors are non-destructive. Traefik itself has robust health check and circuit breaker support for proxied services. A health endpoint (/ping) returns 200 if the proxy is operational. Readiness and liveness probes are Kubernetes-native. Error handling for the API is minimal — it either returns data or 404.

Documentation at doc.traefik.io is comprehensive: routing concepts, provider integration, middleware catalog, TLS configuration, and API reference. The API section describes all endpoints with example responses. Getting started guides cover Docker, Kubernetes, and bare-metal. Community support via the Traefik Community Forum and GitHub. Documentation quality is high for the core proxy features; the API reference section is complete but terse. Actively maintained; Traefik v3 docs are current.