I have covered installing Traefik earlier, so I’ll fast forward to having a separate installation of traefik in the namespace traefik-internal, and a label on the pods app=traefik-internal, and configured my security policies exactly as for the old traefik namespace. But it also still works if I point portainer.engen.priv.no to an external facing load balancer ip address, as the external facing traefik instances haven’t been reconfigured yet. Even though Traefik in itself doesn’t know to handle portainer.engen.priv.no , the process and the container can still access the port, and if a malicious hacker gains access to the container through a security hole in traefik, he could potentially access the portainer service from there.