Introduction

To expose Traefik publicly on Google Kubernetes Engine, the important step is not the Ingress resource first. It is giving the Traefik controller itself an external entry point. On GKE, that usually means running Traefik behind a Kubernetes Service of type LoadBalancer, then pointing DNS to the allocated public IP.

Deploy Traefik with a Public Load Balancer

The cleanest path is usually Helm. A minimal install looks like this:

1helm repo add traefik https://traefik.github.io/charts
2helm repo update
3
4helm install traefik traefik/traefik \
5  --namespace traefik \
6  --create-namespace \
7  --set service.type=LoadBalancer

On GKE, a LoadBalancer Service causes Google Cloud to provision an external load balancer and assign a public IP. You can confirm that with:

kubectl get svc -n traefik

Wait until the EXTERNAL-IP field contains a real address rather than pending.

Understand the Traffic Flow

The traffic path is normally:

1. public IP on the Google load balancer
2. Traefik Service of type LoadBalancer
3. Traefik Pods
4. backend Kubernetes Services
5. application Pods

That means your application Services usually stay internal as ClusterIP. Traefik is the public edge, and it routes requests to those internal Services.

Expose an Application Through Traefik

Once Traefik is reachable, create an Ingress object that routes a hostname to your application Service:

1apiVersion: networking.k8s.io/v1
2kind: Ingress
3metadata:
4  name: demo-ingress
5  annotations:
6    traefik.ingress.kubernetes.io/router.entrypoints: web
7spec:
8  ingressClassName: traefik
9  rules:
10    - host: demo.example.com
11      http:
12        paths:
13          - path: /
14            pathType: Prefix
15            backend:
16              service:
17                name: demo-service
18                port:
19                  number: 80

This assumes your application Service already exists and listens on port 80.

If you want HTTPS, configure Traefik entrypoints and certificates, then route traffic to the secure entrypoint instead of plain web.

Attach DNS to the External IP

After the Traefik Service has an external IP, create a DNS A record for your hostname:

• 'demo.example.com points to the Traefik external IP'

Without DNS, the load balancer is public but users still have no memorable hostname. If you use a static IP in Google Cloud, you can reserve it first and bind it so redeployments do not change the address unexpectedly.

Keep the Controller Public, Not Every App

One common mistake is exposing every application with its own LoadBalancer Service. That works, but it defeats much of the purpose of an ingress controller. A better pattern is:

• one public Traefik entry point
• many internal application Services
• hostname or path routing inside Traefik

This keeps networking simpler and usually cheaper.

Verify from Both Kubernetes and the Network Edge

Use both cluster-side and client-side checks:

kubectl get svc -n traefik
kubectl get ingress
curl -H "Host: demo.example.com" http://EXTERNAL_IP/

The curl command is useful before DNS fully propagates. It lets you test Traefik routing by sending the intended host header directly to the load balancer IP.

Common Pitfalls

• Forgetting to set the Traefik Service type to LoadBalancer.
• Waiting on the Ingress resource while the Traefik controller itself is still private.
• Exposing backend applications directly instead of routing through Traefik.
• Omitting DNS and then wondering why the hostname does not resolve.
• Debugging application Pods when the real issue is that the Traefik external IP is still pending.

Summary

• On GKE, public Traefik exposure usually starts with a LoadBalancer Service for the Traefik controller.
• Your backend application Services can remain internal as ClusterIP.
• Ingress resources tell Traefik how to route hostnames and paths to those internal Services.
• Point DNS at the external IP once Google Cloud allocates it.
• Verify both the Service external IP and the actual host-based routing before blaming the application.