Runtime Fabric: Traefik for Kubernetes gateway API

Prerequisites

• A running Kubernetes cluster with MuleSoft RTF 3.x installed.
• kubectl and helm installed and configured.
• openssl for certificate generation.

Step 1: Install Gateway API CRDs & Traefik RBAC

The Gateway API is an extension and must be installed manually. You must also grant Traefik the necessary permissions to manage these resources.

# Install standard Gateway API CRDs (v1.2.1)
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml

# Install Traefik RBAC for Gateway API
kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.1/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml

Step 2: Prepare Namespace & TLS Certificate

Create the namespace and the TLS secret first to ensure the Gateway initializes in a healthy state.

# 1. Create the target namespace
kubectl create namespace traefik

# 2. Generate a self-signed certificate 
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes -subj "/CN=your-mule-rtf.local"

# 3. Store the certificate as a Kubernetes Secret
kubectl create secret tls traefik-default-cert \
  --cert=cert.pem \
  --key=key.pem \
  -n traefik

Step 3: Install Traefik via Helm

Create a values.yaml file to map Traefik's internal non-root ports to standard external ports and apply your custom certificate.

providers:
  kubernetesGateway:
    enabled: true
  kubernetesIngress:
    enabled: false 

api:
  dashboard: true
  insecure: true      

ports:
  traefik:
    port: 9000          
    expose:
      default: false    
  web:
    port: 8000          
    exposedPort: 80     
    expose:
      default: true
    protocol: TCP
  websecure:
    port: 8443          
    exposedPort: 443    
    expose:
      default: true
    protocol: TCP

gateway:
  enabled: true
  listeners:
    web:
      port: 8000        
      protocol: HTTP
      name: web
      namespacePolicy:
        from: All       
    websecure:
      port: 8443        
      protocol: HTTPS
      name: websecure
      namespacePolicy:
        from: All
      mode: Terminate
      certificateRefs:  
        - kind: Secret
          name: traefik-default-cert 
          group: ""

tlsStore:
  default:
    defaultCertificate:
      secretName: traefik-default-cert 

Run Helm Installation

# Add and update the Traefik Helm repository
helm repo add traefik https://traefik.github.io/charts
helm repo update

# Install Traefik using the validated chart version
helm install traefik traefik/traefik \
  --namespace traefik \
  --version 39.0.1 \
  -f values.yaml

Step 4: Grant MuleSoft RTF Agent Permissions

The RTF agent requires permission to manage httproutes. Ensure the namespace for the ServiceAccount matches your RTF deployment (e.g., rtf or rtf-argo).

#rtf-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: rtf-agent-gateway-api-role
rules:
  - apiGroups:
      - "gateway.networking.k8s.io"
    resources:
      - "httproutes"
    verbs:
      - "get", "list", "watch", "create", "update", "patch", "delete"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: rtf-agent-gateway-api-binding
subjects:
  - kind: ServiceAccount
    name: rtf-agent
    namespace: rtf-argo  
roleRef:
  kind: ClusterRole
  name: rtf-agent-gateway-api-role
  apiGroup: rbac.authorization.k8s.io

Step 5: Define the HTTPRouteTemplate for RTF

The HTTPRouteTemplate dynamically generates routing objects when you deploy a Mule application.

#rtf-template.yaml
apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: traefik-gateway-template
  namespace: rtf  
spec:
  baseEndpoints:
    - https://*.your-mule-rtf.local
  resources:
    - |
      apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: {{ .ResourceName }}
        namespace: {{ .Namespace }}
      spec:
        parentRefs:
          - name: traefik-gateway
            namespace: traefik
        hostnames:
          - {{ .Host }}
        rules:
          - matches:
              - path:
                  type: PathPrefix
                  value: {{ .Path }}
            backendRefs:
              - name: {{ .Service.Name }}
                port: {{ .Service.Port }}

kubectl apply -f rtf-template.yaml

Final Verification

1. Check Gateway Status: kubectl get gateway traefik-gateway -n traefik Status should be Programmed: True.
2. Access Traefik Dashboard: kubectl port-forward deployment/traefik -n traefik 9000:9000 Visit [http://localhost:9000/dashboard/.](http://localhost:9000/dashboard/.)
3. Deploy Application: In Anypoint Runtime Manager, select the endpoint under the Ingress tab during app deployment.
4. Check for http-route is created for the Mule Application deployed from Anypoint Control Plane.