Sticky Sessions not working in Kubernetes

Traefik Traefik v3 (latest)
,
1

I have Traefik version 3.6.6 deployed via Helm into an Azure Kubernetes Service cluster.

I am unable to get basic example sticky session setup from the Traefik documentation to work in my cluster. I have followed the configuration steps described in Kubernetes - Traefik but when I access the whoami application multiple times I can see a different hostname being returned, even though the sticky cookie is being set and submitted correctly.

With debug logging turned on for Traefik I can see the Weighted Round Robin selecting a different service each time

2026-01-19T16:32:56Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:83 > Accepting IP 10.10.0.10 middlewareName=default-ip-allowlist@kubernetescrd middlewareType=IPAllowLister

2026-01-19T16:32:56Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:176 > Service selected by WRR: default-whoami-sticky@kubernetescrd

2026-01-19T16:32:56Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:176 > Service selected by WRR: http://10.10.0.42:80

10.10.0.10 - - [19/Jan/2026:16:32:56 +0000] "GET / HTTP/2.0" 200 1152 "-" "-" 165 "httproute-default-whoami-gw-default-traefik-gateway-ep-websecure-1-a78c67874fb1ba915ceb@kubernetesgateway" "http://10.10.0.42:80" 0ms


2026-01-19T16:32:57Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:83 > Accepting IP 10.10.0.10 middlewareName=default-ip-allowlist@kubernetescrd middlewareType=IPAllowLister

2026-01-19T16:32:57Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:176 > Service selected by WRR: default-whoami-sticky@kubernetescrd

2026-01-19T16:32:57Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:176 > Service selected by WRR: http://10.10.0.76:80

10.10.0.10 - - [19/Jan/2026:16:32:57 +0000] "GET / HTTP/2.0" 200 1152 "-" "-" 167 "httproute-default-whoami-gw-default-traefik-gateway-ep-websecure-1-a78c67874fb1ba915ceb@kubernetesgateway" "http://10.10.0.76:80" 2ms


2026-01-19T16:32:59Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:83 > Accepting IP 10.10.0.10 middlewareName=default-ip-allowlist@kubernetescrd middlewareType=IPAllowLister

2026-01-19T16:32:59Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:176 > Service selected by WRR: default-whoami-sticky@kubernetescrd

2026-01-19T16:32:59Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:176 > Service selected by WRR: http://10.10.0.76:80

10.10.0.10 - - [19/Jan/2026:16:32:59 +0000] "GET / HTTP/2.0" 200 1152 "-" "-" 169 "httproute-default-whoami-gw-default-traefik-gateway-ep-websecure-1-a78c67874fb1ba915ceb@kubernetesgateway" "http://10.10.0.76:80" 0ms

Is it possible that there is some extra configuration required that is not mentioned in the example in the documentation? Or an extra parameter that is required to be passed into the Helm chart?

2

Well, how about you share your exact configuration?

3

Sure, here is my config
I deployed Traefik using Helm with these values:

ingressClass:
  enabled: false

providers:
  kubernetesIngress:
    enabled: false
  kubernetesGateway:
    enabled: true

service:
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-resource-group: [RESOURCE_GROUP_NAME]
    service.beta.kubernetes.io/azure-pip-name: [NAME_OF_PUBLIC_IP_IN_RESOURCE_GROUP]

logs:
  format: json
  general:
    level: DEBUG
  access:
    enabled: true

metrics:
  prometheus:
    enabled: true

The whoami application was deployed with this yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
      - name: whoami
        image: traefik/whoami
        ports:
        - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default
spec:
  selector:
    app: whoami
  ports:
  - port: 80

I defined a TraefikService to use sticky sessions:

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: whoami-sticky
  namespace: default
spec:
  weighted:
    services:
      - name: whoami
        port: 80
        weight: 1
    sticky:
      cookie:
        name: sticky_cookie
        secure: true
        httpOnly: true

And referenced it in my HTTPRoute

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: whoami
  namespace: default
spec:
  parentRefs:
  - name: traefik-gateway
    sectionName: web
  hostnames:
  - [APPLICATION_HOSTNAME]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - group: traefik.io
      kind: TraefikService
      name: whoami-sticky