How do I set up a Traefik catch-all ingress for custom domains on k3s?

Below is an explanation and a sample configuration based on Kubernetes’ built‑in Ingress behavior.

Default (Catch‑All) Route in Ingress

Kubernetes Ingress rules match requests based on the Host header. When you omit the host field from a rule, that rule becomes a catch‑all—meaning any request that doesn’t match another more specific host rule will be directed to that backend. In other words, rather than trying to use a regex like HostRegexp({catchall:.*}), you can simply define a rule without the host field.

Example Updated Ingress

When using Traefik on k3s, you can define one rule with your specific domain and another rule without a host that catches all other custom domains. For example:

YAMLCopied
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress
  namespace: prod
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  rules:
    - host: mydomain.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: webapp-service
                port:
                  number: 3000
    # This rule acts as a default catch-all since it has no host defined
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: webapp-service
                port:
                  number: 3000
  tls:
    - hosts:
        - mydomain.com
      secretName: cloudflare-cert
    # Note: TLS blocks in Ingress only support explicitly listed hostnames.

Important Notes

• Omitting the host field: By not including a host in the second rule, any request with a Host header other than the one defined by the first rule (mydomain.com) will be matched by this rule.
• TLS configuration: The Ingress TLS section only supports explicit hostnames and does not accept "*" as valid syntax. You must list each domain that needs a TLS certificate. In this example, TLS is only defined for mydomain.com.
• Traefik behavior: If you require regex‑like behavior (for example, using Cloudflare for SaaS scenarios), consider using Traefik’s custom resources (like IngressRoutes) where you can leverage more advanced routing rules.

This approach aligns with the Kubernetes documentation on Ingress, which notes that creating an Ingress without any hosts defined lets any web traffic hitting your Ingress controller be matched.