Traefik competes with HAProxy and Nginx after Ingress NGINX retirement

Performance and resource efficiency

HAProxy processed 42,000 requests per second in recent benchmarking tests. Traefik handled 19,000 requests per second. Envoy achieved 18,500 requests per second. Nginx Inc reached 15,200 requests per second. Nginx reached only 11,700 requests per second. While Traefik produced 1,342 error responses during stress testing, Envoy produced 19,503 error responses. Nginx produced 25,506 errors. HAProxy and Nginx Inc produced zero errors. HAProxy used 50% CPU. Traefik consumed 70% CPU. Envoy used 73% CPU. Nginx used 65% CPU. Nginx Inc stayed below 50% CPU. Users seeking extreme throughput for financial transactions might prefer HAProxy, but development teams often choose Traefik because its automatic service discovery simplifies the management of highly dynamic microservices. HAProxy leads performance.

Envoy maintains sub-10ms latency during pod scaling. HAProxy spikes to 25-second response times during similar operations. Netflix and Uber use Envoy to handle the chaos of dynamic service discovery. Traefik provides a consistent performance profile across varying loads. It handles 19,000 requests per second with stable resource consumption. HAProxy’s 2025 updates included ACME protocol support for automatic Let’s Encrypt integration. Recent performance improvements on multi-core systems showed 260% gains on ARM processors for certain algorithms.

Automating the migration from NGINX

The Ingress NGINX project announced its retirement in March 2026. Organizations face unmaintained software and security vulnerabilities after this deadline. Traefik provides a transition path through its NGINX Provider. This provider translates NGINX annotations into Traefik configuration. You avoid rewriting every configuration rule. Traefik handles many custom annotations natively. It supports nginx.ingress.kubernetes.io/enable-modsecurity and nginx.ingress.kubernetes.io/auth-url. It does not support nginx.ingress.kubernetes.io/auth-type. It also lacks support for nginx.ingress.kubernetes.io/auth-snippet.

You can deploy Traefik alongside NGINX to move traffic. This approach prevents downtime. Running both controllers against the same Ingresses creates contention on the status.loadBalancer.ingress[] field. Both controllers try to write to this field in a reconciliation loop. You disable publishService on Traefik to stop this behavior. Traefik uses Entrypoints, Routers, and Services. Entrypoints act as gateways. Routers bridge incoming requests and services. Services represent the applications. Traefik uses Let’s Encrypt for automatic certificate management. It supports multiple challenge types.

Traefik simplifies routing.

Organizations have 120 days to migrate after the retirement announcement. If you use ExternalDNS, the status race condition becomes a problem. The flapping status field affects anything that watches it, including GitOps tools like ArgoCD or Flux. These tools report a permanent drift on every affected Ingress. This migration requires Traefik v3.6.2 or later.

Selecting a controller for the workload

Choosing a controller requires looking at workload types. HAProxy suits high-traffic content delivery and gaming platforms like Roblox. It handles 2 million requests per second on a single AWS instance. Traefik fits microservice-heavy environments. It uses Let’s Encrypt for automatic TLS. Envoy fits service mesh architectures. It uses xDS APIs for real-time updates. You evaluate your traffic profile before choosing.

HAProxy provides 13 plus load balancing algorithms. These include round-robin and consistent hashing. Traefik keeps load balancing simple. It uses round-robin and weighted round-robin. Envoy focuses on intelligent traffic management. It uses circuit breaking and outlier detection. Service mesh handles east-west traffic between services. Ingress controllers handle north-south traffic from external clients.

Will Traefik eventually match HAProxy in raw speed?

Traefik wins on ease of use, but HAProxy wins on speed.