Blog
Traefik Ingress: CORS headers via middleware, Kubernetes labels, and TCP versus HTTP routers
Attach CORS middleware to HTTP routers only; raw TCP services never see Origin headers from browsers.
1 min read
traefikkubernetescors
TLS and ACME
Automatic certificates must cover every hostname your SPA uses in Allow-Origin—wildcard certs simplify but widen blast radius.
HTTP-01 challenges may briefly serve different hosts—ensure CORS middleware applies during renewals.
Observability
Traefik access logs should include Origin for debugging preflight storms during incidents.
Metrics on middleware execution time help separate CORS CPU cost from upstream latency.