Error trying to use basicAuth middleware in an HTTPRoute, Kubernetes, Gateway

Traefik Traefik v3 (latest)
1

Hi,

Env

  • Kubernetes v1.34.1
  • Traefik Helm chart - v39.0.0
  • Traefik v3.6.8

I'm trying to add basic auth to the Traefik dashboard via a Middleware. The dashboard itself works fine, I've exposed it through an HTTPRoute via a Gateway.

The inclusion of the basicAuth middleware in the filters section of the HTTPRoute seems to be a problem.

Related Kubernetes manifests:

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: traefik-dashboard
spec:
  hostnames:
    - dashboard.example.com
  parentRefs:
    - name: traefik-gateway
      namespace: traefik
  rules:
    - backendRefs:
        - kind: TraefikService
          name: api@internal
          port: 8080
      matches:
        - path:
            type: RegularExpression
            value: "^/(dashboard|api)"
      filters:
        - type: ExtensionRef
          extensionRef:
            group: traefik.io
            kind: Middleware
            name: traefik-dashboard-auth
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: traefik-dashboard-auth
spec:
  basicAuth:
    secret: traefik-dashboard-auth-secret
---
apiVersion: v1
kind: Secret
metadata:
  name: traefik-dashboard-auth-secret
type: kubernetes.io/basic-auth
stringData:
  username: admin
  password: t0p-Secret

Helm values-override.yaml:

api:
  dashboard: true

The error I'm getting :

2026-02-19T11:08:36Z ERR Unable to load HTTPRoute filters error="loading ExtensionRef filter ExtensionRef: unsupported filter extension ref traefik.io/Middleware/traefik-dashboard-auth" http_route=traefik-dashboard namespace=traefik providerName=kubernetesgateway

Does anyone have any ideas?

Thanks,

2

Further investigation reveals a similar error message for the ipAllowList middleware:

traefik-65c576565f-pbc46 2026-02-20T08:58:34Z ERR Unable to load HTTPRoute filters error="loading ExtensionRef filter ExtensionRef: unsupported filter extension ref traefik.io/Middleware/traefik-dashboard-allowed-ips" http_route=traefik-dashboard namespace=traefik providerName=kubernetesgateway

...
        - type: ExtensionRef
          extensionRef:
            group: traefik.io
            kind: Middleware
            name: traefik-dashboard-allowed-ips
...

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: traefik-dashboard-allowed-ips
spec:
  ipAllowList:
    sourceRange:
      - 10.244.0.1/32
      - 10.244.0.128/32

So this seems to be a general problem with using middlewares in an HTTPRoute, or the way I’m doing it.

The error suggests that Treafik is building the full name of the middleware from the Kubernetes resource name (traefik.io/Middleware/traefik-dashboard-allowed-ips), which is not what it should be doing. It should be taking the name of the middleware from spec.ipAllowList in the middleware declaration.

I’ve checked the documentation, and other implementations of HTTPRoute, and I think my manifests are correct, which suggests this is a bug in Traefik.

3

I just experienced the same issue. And I’ve just managed to solve the issue.

You need to enable kubernetesCRD in your rke2-traefik-config

providers:
kubernetesCRD:
enabled: true
4

You’re a star! Thanks, this was it.

5

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.