diff --git a/helm/draft-annotations-api/templates/IngressRoute.yaml b/helm/draft-annotations-api/templates/IngressRoute.yaml
new file mode 100644
index 0000000..075b387
--- /dev/null
+++ b/helm/draft-annotations-api/templates/IngressRoute.yaml
@@ -0,0 +1,55 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ .Values.service.name }}
+  namespace: default
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: HostRegexp(`{subdomain:[a-zA-Z0-9-]+}.upp.ft.com`) && PathPrefix(`/__{{ .Values.service.name }}/`)
+      middlewares:
+      - name: basic-auth
+        namespace: default
+      - name: replace-path-{{ .Values.service.name }}
+        namespace: default
+      services:
+      - kind: Service
+        namespace: default
+        name: {{ .Values.service.name }}
+        port: 8080
+        passHostHeader: true
+        responseForwarding:
+          flushInterval: 100ms
+        strategy: RoundRobin
+    - kind: Rule
+      match: HostRegexp(`{subdomain:[a-zA-Z0-9-]+}.upp.ft.com`) && Path(`/drafts/content/{.*}/annotations`)
+      priority: 4
+      middlewares:
+      - name: basic-auth
+        namespace: default
+      services:
+      - kind: Service
+        name: {{ .Values.service.name }}
+        namespace: default
+        passHostHeader: true
+        port: 8080
+        responseForwarding:
+          flushInterval: 100ms
+        strategy: RoundRobin
+    - kind: Rule
+      match: HostRegexp(`{subdomain:[a-zA-Z0-9-]+}.upp.ft.com`) && PathPrefix(`/drafts/content/{.*}/annotations/{.*}`)
+      priority: 5
+      middlewares:
+      - name: basic-auth
+        namespace: default
+      services:
+      - kind: Service
+        name: {{ .Values.service.name }}
+        namespace: default
+        passHostHeader: true
+        port: 8080
+        responseForwarding:
+          flushInterval: 100ms
+        strategy: RoundRobin
diff --git a/helm/draft-annotations-api/templates/admin-ingress.yaml b/helm/draft-annotations-api/templates/admin-ingress.yaml
deleted file mode 100644
index 1848336..0000000
--- a/helm/draft-annotations-api/templates/admin-ingress.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  name: {{.Values.service.name}}-admin-ingress
-  annotations:
-    # type of authentication
-    ingress.kubernetes.io/auth-type: basic
-    # name of the secret that contains the user/password definitions
-    ingress.kubernetes.io/auth-secret: basic-auth
-    # message to display with an appropriate context why the authentication is required
-    ingress.kubernetes.io/auth-realm: "Authentication Required"
-    ingress.kubernetes.io/rewrite-target: /
-
-spec:
-  rules:
-    - host: "*.ft.com"
-      http:
-        paths:
-        - path: /__{{.Values.service.name}}/
-          backend:
-            serviceName: {{.Values.service.name}}
-            servicePort: 8080
-    - host: "*.upp.ft.com"
-      http:
-        paths:
-        - path: /__{{.Values.service.name}}/
-          backend:
-            serviceName: {{.Values.service.name}}
-            servicePort: 8080
diff --git a/helm/draft-annotations-api/templates/ingress.yaml b/helm/draft-annotations-api/templates/ingress.yaml
deleted file mode 100644
index b1b18b4..0000000
--- a/helm/draft-annotations-api/templates/ingress.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  name: {{.Values.service.name}}-ingress
-  annotations:
-    # type of authentication
-    ingress.kubernetes.io/auth-type: basic
-    # name of the secret that contains the user/password definitions
-    ingress.kubernetes.io/auth-secret: basic-auth
-    # message to display with an appropriate context why the authentication is required
-    ingress.kubernetes.io/auth-realm: "Authentication Required"
-    # to interpret the wildcard in path as a regex
-    ingress.kubernetes.io/rewrite-target: /drafts/content/
-spec:
-  rules:
-    - host: "*.ft.com"
-      http:
-        paths:
-        - path: /drafts/content/.*/annotations
-          backend:
-            serviceName: {{.Values.service.name}}
-            servicePort: 8080
-        - path: /drafts/content/.*/annotations/.*
-          backend:
-            serviceName: {{.Values.service.name}}
-            servicePort: 8080
-    - host: "*.upp.ft.com"
-      http:
-        paths:
-        - path: /drafts/content/.*/annotations
-          backend:
-            serviceName: {{.Values.service.name}}
-            servicePort: 8080
-        - path: /drafts/content/.*/annotations/.*
-          backend:
-            serviceName: {{.Values.service.name}}
-            servicePort: 8080
diff --git a/helm/draft-annotations-api/templates/traefik-middlewares.yaml b/helm/draft-annotations-api/templates/traefik-middlewares.yaml
new file mode 100644
index 0000000..66cb41e
--- /dev/null
+++ b/helm/draft-annotations-api/templates/traefik-middlewares.yaml
@@ -0,0 +1,9 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: replace-path-{{ .Values.service.name }}
+  namespace: default
+spec:
+  replacePathRegex:
+    regex: ^/__{{ .Values.service.name }}/(.*)
+    replacement: /$1