# Purpose of labelSelectors when running two instances of Traefik in k8s

**URL:** https://community.traefik.io/t/purpose-of-labelselectors-when-running-two-instances-of-traefik-in-k8s/30255
**Category:** Traefik v3 (latest)
**Tags:** kubernetes-crd, kubernetes-ingress
**Created:** [September 25, 2026, 7:32am UTC](https://community.traefik.io/t/purpose-of-labelselectors-when-running-two-instances-of-traefik-in-k8s/30255 "2026-09-25T07:32:23Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![jpi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jpi/32/11236_2.png) [@jpi](https://community.traefik.io/u/jpi)
#### Post date: [September 25, 2026, 7:32am UTC](https://community.traefik.io/t/purpose-of-labelselectors-when-running-two-instances-of-traefik-in-k8s/30255/1 "2026-09-25T07:32:24Z")

</div>

I'm running two Traefik instances, `traefik-internal` and `traefik-external`. These are running in EKS and deployed with Helm. `traefik-internal` is the default IngressClass via the Helm value `ingressClass.isDefaultClass: true`.

During my setup for this I saw the option in the chart's values to define `labelSelector` e.g. `providers.kubernetesIngress.labelSelector` and `providers.kubernetesCRD.labelSelector`. I've set these values to `"traefik-instance=external"` and `"traefik-instance=internal"` respectively.

My intent behind this was to ensure no Traefik `IngressRoute` or Kubernetes `Ingress` ever got picked up by the wrong Traefik instance. A user would need to be intentional and set a label on the their Traefik `IngressRoute` or Kubernetes `Ingress`. However, on either a Traefik `IngressRoute` or Kubernetes `Ingress` we're always setting `spec.ingressClassName` and specifying the desired in Traefik instance. In the event it's omitted we default to internal.

My question: Why implement `labelSelector` if we're explicitly setting `spec.ingressClassName`?

I noticed in the [docs](https://doc.traefik.io/traefik/v2.4/providers/kubernetes-crd/#labelselector) for labelselector it mentions "this applies only to Traefik Custom Resources":

> A label selector can be defined to filter on specific resource objects only, this applies only to Traefik [Custom Resources](https://doc.traefik.io/traefik/v2.4/routing/providers/kubernetes-crd/#custom-resource-definition-crd) and has no effect on Kubernetes `Secrets`, `Endpoints` and `Services`.

Perhaps using labels is useful to separate out other Traefik CRDs that do not implement something to associate them to a specific instance, like `Middleware`? I could see this being useful, having a `Middleware` that I'd only ever want to be used with say `traefik-external` and by setting the label `traefik-instance=external` an `Ingress` for example like below would be unable to leverage it.

```yaml
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: ext-ratelimit
  namespace: edge
  labels:
    traefik-instance: external
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web01
  namespace: web01
  labels:
    traefik-instance: internal
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: edge-ext-ratelimit@kubernetescrd

```

Thanks for the feedback!