<p>I have a situation, where I am planning to use two separate traefik ingress controller inside the Kubernetes cluster.</p>

<p>I have a few URLs which I want to be accessible through VPN only, and few which can be publicly accessible.  </p>

<p>In the current architecture, I have one traefik-ingress controller, and two separate ALBs, one internal and one internet-facing, both pointing to traefik.<br>
Let's say, I have a URL <code>public.example.com</code> and <code>private.example.com</code>. <code>public.example.com</code> is pointing to internet-facing ALB, and <code>private.example.com</code> is pointing to internal ALB. But what if someone get to know the pointing of <code>public.example.com</code> and points <code>private.example.com</code> to same pointing in his <code>/etc/hosts</code>, he will be able to access my private website.  </p>

<p>To avoid this, I am planning to run two separate traefik-ingress-controller, one which will be serving only private URL and one public URL. Can this be done? Or is there any other way to avoid this </p>

<p>To deploy two separate traefik-ingress controller, to serve private and public traffic separately, I used <code>kubernetes.ingressclass=traefik</code> args.</p>

<p>This is what documentation has to say for <code>kubernetes.ingressclass</code>:</p>

<pre><code>--kubernetes.ingressclass  Value of kubernetes.io/ingress.class annotation to watch for
</code></pre>

<p>I created two deployment, having separate value for <code>kubernetes.ingressclass</code>.</p>

<p>One with <code>kubernetes.ingressclass=traefik</code>, which was behind a public ALB and <code>kubernetes.ingressclass=traefik-internal</code>, which was behind a private/internal ALB</p>

<p>For services, which I want to serve privately, I use the following annotations in ingress objects :</p>

<pre><code>annotations:
    kubernetes.io/ingress.class: traefik-internal
</code></pre>

<p>and for public</p>

<pre><code>annotations:
  kubernetes.io/ingress.class: traefik
</code></pre>

<p>My deployment.yaml</p>

<pre><code>---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik-internal-ingress-controller
  namespace: kube-system
  labels:
    k8s-app: traefik-internal-ingress-lb
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: traefik-internal-ingress-lb
  template:
    metadata:
      labels:
        k8s-app: traefik-internal-ingress-lb
    spec:
      serviceAccountName: traefik-internal-ingress-controller
      terminationGracePeriodSeconds: 60
      containers:
      - image: traefik:v1.7
        name: traefik-internal-ingress-lb
        ports:
        - name: http
          containerPort: 80
        - name: admin
          containerPort: 8080
        args:
        - --api
        - --kubernetes
        - --logLevel=INFO
        - --accesslog=true
        - --kubernetes.ingressclass=traefik-internal ##this makes it to watch only for ingress objects with annotaion "kubernetes.io/ingress.class: traefik-internal"
</code></pre>

<p>Hope this helps someone.</p>
