Replace ingress-nginx with Traefik as recommended ingress controller

[welteki]

Description

Replace all ingress-nginx references with Traefik across the documentation:

• Update recommended ingress controller from ingress-nginx to Traefik
• Switch installation commands to arkade install traefik2
• Replace nginx-specific annotations and configuration with Traefik equivalents
• Update ingressClassName from nginx to traefik
• Update FunctionIngress ingressType from nginx to traefik
• Update service names and namespaces for Traefik
• Add a Traefik timeout configuration guide with Helm values and arkade examples

Motivation and Context

The Ingress Nginx project will be retired in March 2026. This change updates the documentation to recommend Traefik as the default ingress controller going forward.

• I have raised an issue to propose this change (required)

How Has This Been Tested?

Documentation changes reviewed for correctness of Traefik configuration, service names, and command references.

Testing of updated examples is in progress.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have signed-off my commits with git commit -s

[reviewfn]

AI Pull Request Overview

Summary

• Updates documentation to replace ingress-nginx with Traefik as the recommended ingress controller due to ingress-nginx project retirement in March 2026
• Changes include installation commands, service names, ingress configurations, and timeout settings across 6 files
• Adds new Traefik timeout configuration guide
• Updates FunctionIngress ingressType and ingressClassName values

Approval rating (1-10)

7

Summary per file

Summary per file

File path	Summary
docs/architecture/production.md	Updated ingress controller recommendation from nginx to Traefik and corrected documentation link
docs/deployment/kubernetes.md	Changed arkade installation command from ingress-nginx to traefik and updated TLS configuration link
docs/reference/tls-functions.md	Updated service discovery command, changed FunctionIngress ingressType to traefik, and corrected domain variable usage
docs/reference/tls-openfaas.md	Comprehensive update: changed recommendation, installation commands, service namespace, ingressClassName, removed nginx-specific annotations, and added timeout guidance reference
docs/tutorials/expanded-timeouts.md	Added detailed Traefik timeout configuration guide with Helm values and arkade examples
docs/tutorials/local-kind-ingress.md	Updated tutorial to use Traefik instead of ingress-nginx

Overall Assessment

This PR implements a necessary migration from the retiring ingress-nginx controller to Traefik, which is appropriate given the ingress-nginx project's announced end-of-life. The changes are comprehensive, covering installation, configuration, and usage examples across the documentation. The addition of Traefik-specific timeout guidance is particularly valuable for users dealing with long-running functions.

However, there are technical inaccuracies in the specified service namespaces that could lead to user confusion and failed commands. The migration represents a breaking change for existing users but is justified by the upstream project changes.

Detailed Review

Detailed Review

Namespace Inconsistencies (Critical)

Files: docs/reference/tls-functions.md, docs/reference/tls-openfaas.md

Issue: The kubectl get svc/traefik commands specify -n kube-system, but arkade installs Traefik in the traefik namespace by default. This inconsistency will cause command failures for users following the documentation.

Impact: Users will encounter "service not found" errors when trying to find the Traefik service IP.

Suggestion: Correct all references to use -n traefik to match the actual installation namespace.

FunctionIngress Support Verification Needed

Files: docs/reference/tls-functions.md

Issue: The PR changes ingressType from "nginx" to "traefik" in FunctionIngress resources. While this seems logical, it should be verified that OpenFaaS actually supports "traefik" as a valid ingressType value.

Impact: Potential runtime errors if the ingressType is not recognized.

Suggestion: Confirm with OpenFaaS codebase or documentation that "traefik" is a supported ingressType, or provide fallback guidance.

Timeout Configuration Clarity

Files: docs/reference/tls-openfaas.md, docs/tutorials/expanded-timeouts.md

Issue: The removal of nginx-specific timeout annotations is appropriate, but the transition to Traefik's EntryPoint-based timeout configuration may not be immediately clear to users migrating from ingress-nginx.

Positive: The new expanded timeouts guide provides excellent coverage of Traefik timeout configuration.

Suggestion: Consider adding a brief migration note in tls-openfaas.md explaining that Traefik timeouts are configured differently (at EntryPoint level vs per-Ingress annotations).

Domain Variable Usage

Files: docs/reference/tls-functions.md

Issue: The example uses $DOMAIN but defines DOMAIN="env.example.com" - this creates inconsistency in variable usage.

Impact: Minor, but could confuse users copying examples.

Suggestion: Use consistent variable syntax throughout the example (either $DOMAIN or ${DOMAIN}).

Migration Impact Assessment

Overall Impact: This represents a breaking change for existing OpenFaaS users currently using ingress-nginx. Users will need to:

• Uninstall ingress-nginx
• Install Traefik
• Update all Ingress and FunctionIngress resources to use ingressClassName: traefik
• Reconfigure timeout settings

Risk: Potential service disruption during migration if not planned carefully.

Suggestion: Consider adding a migration guide or checklist in the PR description or as a new documentation section.

Testing Coverage

Issue: PR description mentions "Testing of updated examples is in progress" - this indicates incomplete validation.

Suggestion: Ensure all installation commands, service discovery, and configuration examples are tested before merge.

Consistency Checks

• Positive: Changes are consistent across files in terms of replacing nginx references with traefik
• Positive: Installation command updates (arkade install traefik2) are correct
• Positive: ingressClassName updates are appropriate

Security/Performance Considerations

No security or performance issues identified. The migration maintains TLS capabilities and the Traefik timeout configurations appear reasonable for production use.

AI agent details.

Agent processing time: 52.743s
Environment preparation time: 6.201s
Total time from webhook: 1m3.492s

[alexellis]

arkade install traefik2

I feel like we should switch completely to fully formed helm commands and maintain this ourselves.

An AI agent could probably do this for you quickly.

[alexellis]

I think this needs to remain, perhaps with a warning that it's being deprecated.

[alexellis]

Same as other feedback. Keep it but caveat it.

[alexellis]

We can remove this.