Traefik & Kubernetes

The Kubernetes Ingress Controller, The Custom Resource Way.

Configuration Examples

Configuring KubernetesCRD and Deploying/Exposing Services

Resource Definition

  1. # All resources definition must be declared
  3. ---
  4. apiVersion: apiextensions.k8s.io/v1
  5. kind: CustomResourceDefinition
  6. metadata:
  7.   annotations:
  8.     controller-gen.kubebuilder.io/version: v0.6.2
  9.   creationTimestamp: null
  10.   name: ingressroutes.traefik.io
  11. spec:
  12.   group: traefik.io
  13.   names:
  14.     kind: IngressRoute
  15.     listKind: IngressRouteList
  16.     plural: ingressroutes
  17.     singular: ingressroute
  18.   scope: Namespaced
  19.   versions:
  20.   - name: v1alpha1
  21.     schema:
  22.       openAPIV3Schema:
  23.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  24.         properties:
  25.           apiVersion:
  26.             description: 'APIVersion defines the versioned schema of this representation
  27.               of an object. Servers should convert recognized schemas to the latest
  28.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  29.             type: string
  30.           kind:
  31.             description: 'Kind is a string value representing the REST resource this
  32.               object represents. Servers may infer this from the endpoint the client
  33.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  34.             type: string
  35.           metadata:
  36.             type: object
  37.           spec:
  38.             description: IngressRouteSpec defines the desired state of IngressRoute.
  39.             properties:
  40.               entryPoints:
  41.                 description: 'EntryPoints defines the list of entry point names to
  42.                   bind to. Entry points have to be configured in the static configuration.
  43.                   More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/
  44.                   Default: all.'
  45.                 items:
  46.                   type: string
  47.                 type: array
  48.               routes:
  49.                 description: Routes defines the list of routes.
  50.                 items:
  51.                   description: Route holds the HTTP route configuration.
  52.                   properties:
  53.                     kind:
  54.                       description: Kind defines the kind of the route. Rule is the
  55.                         only supported kind.
  56.                       enum:
  57.                       - Rule
  58.                       type: string
  59.                     match:
  60.                       description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#rule'
  61.                       type: string
  62.                     middlewares:
  63.                       description: 'Middlewares defines the list of references to
  64.                         Middleware resources. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-middleware'
  65.                       items:
  66.                         description: MiddlewareRef is a reference to a Middleware
  67.                           resource.
  68.                         properties:
  69.                           name:
  70.                             description: Name defines the name of the referenced Middleware
  71.                               resource.
  72.                             type: string
  73.                           namespace:
  74.                             description: Namespace defines the namespace of the referenced
  75.                               Middleware resource.
  76.                             type: string
  77.                         required:
  78.                         - name
  79.                         type: object
  80.                       type: array
  81.                     priority:
  82.                       description: 'Priority defines the router''s priority. More
  83.                         info: https://doc.traefik.io/traefik/v2.10/routing/routers/#priority'
  84.                       type: integer
  85.                     services:
  86.                       description: Services defines the list of Service. It can contain
  87.                         any combination of TraefikService and/or reference to a Kubernetes
  88.                         Service.
  89.                       items:
  90.                         description: Service defines an upstream HTTP service to proxy
  91.                           traffic to.
  92.                         properties:
  93.                           kind:
  94.                             description: Kind defines the kind of the Service.
  95.                             enum:
  96.                             - Service
  97.                             - TraefikService
  98.                             type: string
  99.                           name:
  100.                             description: Name defines the name of the referenced Kubernetes
  101.                               Service or TraefikService. The differentiation between
  102.                               the two is specified in the Kind field.
  103.                             type: string
  104.                           namespace:
  105.                             description: Namespace defines the namespace of the referenced
  106.                               Kubernetes Service or TraefikService.
  107.                             type: string
  108.                           nativeLB:
  109.                             description: NativeLB controls, when creating the load-balancer,
  110.                               whether the LB's children are directly the pods IPs
  111.                               or if the only child is the Kubernetes Service clusterIP.
  112.                               The Kubernetes Service itself does load-balance to the
  113.                               pods. By default, NativeLB is false.
  114.                             type: boolean
  115.                           passHostHeader:
  116.                             description: PassHostHeader defines whether the client
  117.                               Host header is forwarded to the upstream Kubernetes
  118.                               Service. By default, passHostHeader is true.
  119.                             type: boolean
  120.                           port:
  121.                             anyOf:
  122.                             - type: integer
  123.                             - type: string
  124.                             description: Port defines the port of a Kubernetes Service.
  125.                               This can be a reference to a named port.
  126.                             x-kubernetes-int-or-string: true
  127.                           responseForwarding:
  128.                             description: ResponseForwarding defines how Traefik forwards
  129.                               the response from the upstream Kubernetes Service to
  130.                               the client.
  131.                             properties:
  132.                               flushInterval:
  133.                                 description: 'FlushInterval defines the interval,
  134.                                   in milliseconds, in between flushes to the client
  135.                                   while copying the response body. A negative value
  136.                                   means to flush immediately after each write to the
  137.                                   client. This configuration is ignored when ReverseProxy
  138.                                   recognizes a response as a streaming response; for
  139.                                   such responses, writes are flushed to the client
  140.                                   immediately. Default: 100ms'
  141.                                 type: string
  142.                             type: object
  143.                           scheme:
  144.                             description: Scheme defines the scheme to use for the
  145.                               request to the upstream Kubernetes Service. It defaults
  146.                               to https when Kubernetes Service port is 443, http otherwise.
  147.                             type: string
  148.                           serversTransport:
  149.                             description: ServersTransport defines the name of ServersTransport
  150.                               resource to use. It allows to configure the transport
  151.                               between Traefik and your servers. Can only be used on
  152.                               a Kubernetes Service.
  153.                             type: string
  154.                           sticky:
  155.                             description: 'Sticky defines the sticky sessions configuration.
  156.                               More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  157.                             properties:
  158.                               cookie:
  159.                                 description: Cookie defines the sticky cookie configuration.
  160.                                 properties:
  161.                                   httpOnly:
  162.                                     description: HTTPOnly defines whether the cookie
  163.                                       can be accessed by client-side APIs, such as
  164.                                       JavaScript.
  165.                                     type: boolean
  166.                                   name:
  167.                                     description: Name defines the Cookie name.
  168.                                     type: string
  169.                                   sameSite:
  170.                                     description: 'SameSite defines the same site policy.
  171.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  172.                                     type: string
  173.                                   secure:
  174.                                     description: Secure defines whether the cookie
  175.                                       can only be transmitted over an encrypted connection
  176.                                       (i.e. HTTPS).
  177.                                     type: boolean
  178.                                 type: object
  179.                             type: object
  180.                           strategy:
  181.                             description: Strategy defines the load balancing strategy
  182.                               between the servers. RoundRobin is the only supported
  183.                               value at the moment.
  184.                             type: string
  185.                           weight:
  186.                             description: Weight defines the weight and should only
  187.                               be specified when Name references a TraefikService object
  188.                               (and to be precise, one that embeds a Weighted Round
  189.                               Robin).
  190.                             type: integer
  191.                         required:
  192.                         - name
  193.                         type: object
  194.                       type: array
  195.                   required:
  196.                   - kind
  197.                   - match
  198.                   type: object
  199.                 type: array
  200.               tls:
  201.                 description: 'TLS defines the TLS configuration. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#tls'
  202.                 properties:
  203.                   certResolver:
  204.                     description: 'CertResolver defines the name of the certificate
  205.                       resolver to use. Cert resolvers have to be configured in the
  206.                       static configuration. More info: https://doc.traefik.io/traefik/v2.10/https/acme/#certificate-resolvers'
  207.                     type: string
  208.                   domains:
  209.                     description: 'Domains defines the list of domains that will be
  210.                       used to issue certificates. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#domains'
  211.                     items:
  212.                       description: Domain holds a domain name with SANs.
  213.                       properties:
  214.                         main:
  215.                           description: Main defines the main domain name.
  216.                           type: string
  217.                         sans:
  218.                           description: SANs defines the subject alternative domain
  219.                             names.
  220.                           items:
  221.                             type: string
  222.                           type: array
  223.                       type: object
  224.                     type: array
  225.                   options:
  226.                     description: 'Options defines the reference to a TLSOption, that
  227.                       specifies the parameters of the TLS connection. If not defined,
  228.                       the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options'
  229.                     properties:
  230.                       name:
  231.                         description: 'Name defines the name of the referenced TLSOption.
  232.                           More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsoption'
  233.                         type: string
  234.                       namespace:
  235.                         description: 'Namespace defines the namespace of the referenced
  236.                           TLSOption. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsoption'
  237.                         type: string
  238.                     required:
  239.                     - name
  240.                     type: object
  241.                   secretName:
  242.                     description: SecretName is the name of the referenced Kubernetes
  243.                       Secret to specify the certificate details.
  244.                     type: string
  245.                   store:
  246.                     description: Store defines the reference to the TLSStore, that
  247.                       will be used to store certificates. Please note that only `default`
  248.                       TLSStore can be used.
  249.                     properties:
  250.                       name:
  251.                         description: 'Name defines the name of the referenced TLSStore.
  252.                           More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsstore'
  253.                         type: string
  254.                       namespace:
  255.                         description: 'Namespace defines the namespace of the referenced
  256.                           TLSStore. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsstore'
  257.                         type: string
  258.                     required:
  259.                     - name
  260.                     type: object
  261.                 type: object
  262.             required:
  263.             - routes
  264.             type: object
  265.         required:
  266.         - metadata
  267.         - spec
  268.         type: object
  269.     served: true
  270.     storage: true
  271. status:
  272.   acceptedNames:
  273.     kind: ""
  274.     plural: ""
  275.   conditions: []
  276.   storedVersions: []
  278. ---
  279. apiVersion: apiextensions.k8s.io/v1
  280. kind: CustomResourceDefinition
  281. metadata:
  282.   annotations:
  283.     controller-gen.kubebuilder.io/version: v0.6.2
  284.   creationTimestamp: null
  285.   name: ingressroutetcps.traefik.io
  286. spec:
  287.   group: traefik.io
  288.   names:
  289.     kind: IngressRouteTCP
  290.     listKind: IngressRouteTCPList
  291.     plural: ingressroutetcps
  292.     singular: ingressroutetcp
  293.   scope: Namespaced
  294.   versions:
  295.   - name: v1alpha1
  296.     schema:
  297.       openAPIV3Schema:
  298.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  299.         properties:
  300.           apiVersion:
  301.             description: 'APIVersion defines the versioned schema of this representation
  302.               of an object. Servers should convert recognized schemas to the latest
  303.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  304.             type: string
  305.           kind:
  306.             description: 'Kind is a string value representing the REST resource this
  307.               object represents. Servers may infer this from the endpoint the client
  308.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  309.             type: string
  310.           metadata:
  311.             type: object
  312.           spec:
  313.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  314.             properties:
  315.               entryPoints:
  316.                 description: 'EntryPoints defines the list of entry point names to
  317.                   bind to. Entry points have to be configured in the static configuration.
  318.                   More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/
  319.                   Default: all.'
  320.                 items:
  321.                   type: string
  322.                 type: array
  323.               routes:
  324.                 description: Routes defines the list of routes.
  325.                 items:
  326.                   description: RouteTCP holds the TCP route configuration.
  327.                   properties:
  328.                     match:
  329.                       description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#rule_1'
  330.                       type: string
  331.                     middlewares:
  332.                       description: Middlewares defines the list of references to MiddlewareTCP
  333.                         resources.
  334.                       items:
  335.                         description: ObjectReference is a generic reference to a Traefik
  336.                           resource.
  337.                         properties:
  338.                           name:
  339.                             description: Name defines the name of the referenced Traefik
  340.                               resource.
  341.                             type: string
  342.                           namespace:
  343.                             description: Namespace defines the namespace of the referenced
  344.                               Traefik resource.
  345.                             type: string
  346.                         required:
  347.                         - name
  348.                         type: object
  349.                       type: array
  350.                     priority:
  351.                       description: 'Priority defines the router''s priority. More
  352.                         info: https://doc.traefik.io/traefik/v2.10/routing/routers/#priority_1'
  353.                       type: integer
  354.                     services:
  355.                       description: Services defines the list of TCP services.
  356.                       items:
  357.                         description: ServiceTCP defines an upstream TCP service to
  358.                           proxy traffic to.
  359.                         properties:
  360.                           name:
  361.                             description: Name defines the name of the referenced Kubernetes
  362.                               Service.
  363.                             type: string
  364.                           namespace:
  365.                             description: Namespace defines the namespace of the referenced
  366.                               Kubernetes Service.
  367.                             type: string
  368.                           nativeLB:
  369.                             description: NativeLB controls, when creating the load-balancer,
  370.                               whether the LB's children are directly the pods IPs
  371.                               or if the only child is the Kubernetes Service clusterIP.
  372.                               The Kubernetes Service itself does load-balance to the
  373.                               pods. By default, NativeLB is false.
  374.                             type: boolean
  375.                           port:
  376.                             anyOf:
  377.                             - type: integer
  378.                             - type: string
  379.                             description: Port defines the port of a Kubernetes Service.
  380.                               This can be a reference to a named port.
  381.                             x-kubernetes-int-or-string: true
  382.                           proxyProtocol:
  383.                             description: 'ProxyProtocol defines the PROXY protocol
  384.                               configuration. More info: https://doc.traefik.io/traefik/v2.10/routing/services/#proxy-protocol'
  385.                             properties:
  386.                               version:
  387.                                 description: Version defines the PROXY Protocol version
  388.                                   to use.
  389.                                 type: integer
  390.                             type: object
  391.                           terminationDelay:
  392.                             description: TerminationDelay defines the deadline that
  393.                               the proxy sets, after one of its connected peers indicates
  394.                               it has closed the writing capability of its connection,
  395.                               to close the reading capability as well, hence fully
  396.                               terminating the connection. It is a duration in milliseconds,
  397.                               defaulting to 100. A negative value means an infinite
  398.                               deadline (i.e. the reading capability is never closed).
  399.                             type: integer
  400.                           weight:
  401.                             description: Weight defines the weight used when balancing
  402.                               requests between multiple Kubernetes Service.
  403.                             type: integer
  404.                         required:
  405.                         - name
  406.                         - port
  407.                         type: object
  408.                       type: array
  409.                   required:
  410.                   - match
  411.                   type: object
  412.                 type: array
  413.               tls:
  414.                 description: 'TLS defines the TLS configuration on a layer 4 / TCP
  415.                   Route. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#tls_1'
  416.                 properties:
  417.                   certResolver:
  418.                     description: 'CertResolver defines the name of the certificate
  419.                       resolver to use. Cert resolvers have to be configured in the
  420.                       static configuration. More info: https://doc.traefik.io/traefik/v2.10/https/acme/#certificate-resolvers'
  421.                     type: string
  422.                   domains:
  423.                     description: 'Domains defines the list of domains that will be
  424.                       used to issue certificates. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#domains'
  425.                     items:
  426.                       description: Domain holds a domain name with SANs.
  427.                       properties:
  428.                         main:
  429.                           description: Main defines the main domain name.
  430.                           type: string
  431.                         sans:
  432.                           description: SANs defines the subject alternative domain
  433.                             names.
  434.                           items:
  435.                             type: string
  436.                           type: array
  437.                       type: object
  438.                     type: array
  439.                   options:
  440.                     description: 'Options defines the reference to a TLSOption, that
  441.                       specifies the parameters of the TLS connection. If not defined,
  442.                       the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options'
  443.                     properties:
  444.                       name:
  445.                         description: Name defines the name of the referenced Traefik
  446.                           resource.
  447.                         type: string
  448.                       namespace:
  449.                         description: Namespace defines the namespace of the referenced
  450.                           Traefik resource.
  451.                         type: string
  452.                     required:
  453.                     - name
  454.                     type: object
  455.                   passthrough:
  456.                     description: Passthrough defines whether a TLS router will terminate
  457.                       the TLS connection.
  458.                     type: boolean
  459.                   secretName:
  460.                     description: SecretName is the name of the referenced Kubernetes
  461.                       Secret to specify the certificate details.
  462.                     type: string
  463.                   store:
  464.                     description: Store defines the reference to the TLSStore, that
  465.                       will be used to store certificates. Please note that only `default`
  466.                       TLSStore can be used.
  467.                     properties:
  468.                       name:
  469.                         description: Name defines the name of the referenced Traefik
  470.                           resource.
  471.                         type: string
  472.                       namespace:
  473.                         description: Namespace defines the namespace of the referenced
  474.                           Traefik resource.
  475.                         type: string
  476.                     required:
  477.                     - name
  478.                     type: object
  479.                 type: object
  480.             required:
  481.             - routes
  482.             type: object
  483.         required:
  484.         - metadata
  485.         - spec
  486.         type: object
  487.     served: true
  488.     storage: true
  489. status:
  490.   acceptedNames:
  491.     kind: ""
  492.     plural: ""
  493.   conditions: []
  494.   storedVersions: []
  496. ---
  497. apiVersion: apiextensions.k8s.io/v1
  498. kind: CustomResourceDefinition
  499. metadata:
  500.   annotations:
  501.     controller-gen.kubebuilder.io/version: v0.6.2
  502.   creationTimestamp: null
  503.   name: ingressrouteudps.traefik.io
  504. spec:
  505.   group: traefik.io
  506.   names:
  507.     kind: IngressRouteUDP
  508.     listKind: IngressRouteUDPList
  509.     plural: ingressrouteudps
  510.     singular: ingressrouteudp
  511.   scope: Namespaced
  512.   versions:
  513.   - name: v1alpha1
  514.     schema:
  515.       openAPIV3Schema:
  516.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  517.         properties:
  518.           apiVersion:
  519.             description: 'APIVersion defines the versioned schema of this representation
  520.               of an object. Servers should convert recognized schemas to the latest
  521.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  522.             type: string
  523.           kind:
  524.             description: 'Kind is a string value representing the REST resource this
  525.               object represents. Servers may infer this from the endpoint the client
  526.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  527.             type: string
  528.           metadata:
  529.             type: object
  530.           spec:
  531.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  532.             properties:
  533.               entryPoints:
  534.                 description: 'EntryPoints defines the list of entry point names to
  535.                   bind to. Entry points have to be configured in the static configuration.
  536.                   More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/
  537.                   Default: all.'
  538.                 items:
  539.                   type: string
  540.                 type: array
  541.               routes:
  542.                 description: Routes defines the list of routes.
  543.                 items:
  544.                   description: RouteUDP holds the UDP route configuration.
  545.                   properties:
  546.                     services:
  547.                       description: Services defines the list of UDP services.
  548.                       items:
  549.                         description: ServiceUDP defines an upstream UDP service to
  550.                           proxy traffic to.
  551.                         properties:
  552.                           name:
  553.                             description: Name defines the name of the referenced Kubernetes
  554.                               Service.
  555.                             type: string
  556.                           namespace:
  557.                             description: Namespace defines the namespace of the referenced
  558.                               Kubernetes Service.
  559.                             type: string
  560.                           nativeLB:
  561.                             description: NativeLB controls, when creating the load-balancer,
  562.                               whether the LB's children are directly the pods IPs
  563.                               or if the only child is the Kubernetes Service clusterIP.
  564.                               The Kubernetes Service itself does load-balance to the
  565.                               pods. By default, NativeLB is false.
  566.                             type: boolean
  567.                           port:
  568.                             anyOf:
  569.                             - type: integer
  570.                             - type: string
  571.                             description: Port defines the port of a Kubernetes Service.
  572.                               This can be a reference to a named port.
  573.                             x-kubernetes-int-or-string: true
  574.                           weight:
  575.                             description: Weight defines the weight used when balancing
  576.                               requests between multiple Kubernetes Service.
  577.                             type: integer
  578.                         required:
  579.                         - name
  580.                         - port
  581.                         type: object
  582.                       type: array
  583.                   type: object
  584.                 type: array
  585.             required:
  586.             - routes
  587.             type: object
  588.         required:
  589.         - metadata
  590.         - spec
  591.         type: object
  592.     served: true
  593.     storage: true
  594. status:
  595.   acceptedNames:
  596.     kind: ""
  597.     plural: ""
  598.   conditions: []
  599.   storedVersions: []
  601. ---
  602. apiVersion: apiextensions.k8s.io/v1
  603. kind: CustomResourceDefinition
  604. metadata:
  605.   annotations:
  606.     controller-gen.kubebuilder.io/version: v0.6.2
  607.   creationTimestamp: null
  608.   name: middlewares.traefik.io
  609. spec:
  610.   group: traefik.io
  611.   names:
  612.     kind: Middleware
  613.     listKind: MiddlewareList
  614.     plural: middlewares
  615.     singular: middleware
  616.   scope: Namespaced
  617.   versions:
  618.   - name: v1alpha1
  619.     schema:
  620.       openAPIV3Schema:
  621.         description: 'Middleware is the CRD implementation of a Traefik Middleware.
  622.           More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/overview/'
  623.         properties:
  624.           apiVersion:
  625.             description: 'APIVersion defines the versioned schema of this representation
  626.               of an object. Servers should convert recognized schemas to the latest
  627.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  628.             type: string
  629.           kind:
  630.             description: 'Kind is a string value representing the REST resource this
  631.               object represents. Servers may infer this from the endpoint the client
  632.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  633.             type: string
  634.           metadata:
  635.             type: object
  636.           spec:
  637.             description: MiddlewareSpec defines the desired state of a Middleware.
  638.             properties:
  639.               addPrefix:
  640.                 description: 'AddPrefix holds the add prefix middleware configuration.
  641.                   This middleware updates the path of a request before forwarding
  642.                   it. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/addprefix/'
  643.                 properties:
  644.                   prefix:
  645.                     description: Prefix is the string to add before the current path
  646.                       in the requested URL. It should include a leading slash (/).
  647.                     type: string
  648.                 type: object
  649.               basicAuth:
  650.                 description: 'BasicAuth holds the basic auth middleware configuration.
  651.                   This middleware restricts access to your services to known users.
  652.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/'
  653.                 properties:
  654.                   headerField:
  655.                     description: 'HeaderField defines a header field to store the
  656.                       authenticated user. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/#headerfield'
  657.                     type: string
  658.                   realm:
  659.                     description: 'Realm allows the protected resources on a server
  660.                       to be partitioned into a set of protection spaces, each with
  661.                       its own authentication scheme. Default: traefik.'
  662.                     type: string
  663.                   removeHeader:
  664.                     description: 'RemoveHeader sets the removeHeader option to true
  665.                       to remove the authorization header before forwarding the request
  666.                       to your service. Default: false.'
  667.                     type: boolean
  668.                   secret:
  669.                     description: Secret is the name of the referenced Kubernetes Secret
  670.                       containing user credentials.
  671.                     type: string
  672.                 type: object
  673.               buffering:
  674.                 description: 'Buffering holds the buffering middleware configuration.
  675.                   This middleware retries or limits the size of requests that can
  676.                   be forwarded to backends. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/buffering/#maxrequestbodybytes'
  677.                 properties:
  678.                   maxRequestBodyBytes:
  679.                     description: 'MaxRequestBodyBytes defines the maximum allowed
  680.                       body size for the request (in bytes). If the request exceeds
  681.                       the allowed size, it is not forwarded to the service, and the
  682.                       client gets a 413 (Request Entity Too Large) response. Default:
  683.                       0 (no maximum).'
  684.                     format: int64
  685.                     type: integer
  686.                   maxResponseBodyBytes:
  687.                     description: 'MaxResponseBodyBytes defines the maximum allowed
  688.                       response size from the service (in bytes). If the response exceeds
  689.                       the allowed size, it is not forwarded to the client. The client
  690.                       gets a 500 (Internal Server Error) response instead. Default:
  691.                       0 (no maximum).'
  692.                     format: int64
  693.                     type: integer
  694.                   memRequestBodyBytes:
  695.                     description: 'MemRequestBodyBytes defines the threshold (in bytes)
  696.                       from which the request will be buffered on disk instead of in
  697.                       memory. Default: 1048576 (1Mi).'
  698.                     format: int64
  699.                     type: integer
  700.                   memResponseBodyBytes:
  701.                     description: 'MemResponseBodyBytes defines the threshold (in bytes)
  702.                       from which the response will be buffered on disk instead of
  703.                       in memory. Default: 1048576 (1Mi).'
  704.                     format: int64
  705.                     type: integer
  706.                   retryExpression:
  707.                     description: 'RetryExpression defines the retry conditions. It
  708.                       is a logical combination of functions with operators AND (&&)
  709.                       and OR (||). More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/buffering/#retryexpression'
  710.                     type: string
  711.                 type: object
  712.               chain:
  713.                 description: 'Chain holds the configuration of the chain middleware.
  714.                   This middleware enables to define reusable combinations of other
  715.                   pieces of middleware. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/chain/'
  716.                 properties:
  717.                   middlewares:
  718.                     description: Middlewares is the list of MiddlewareRef which composes
  719.                       the chain.
  720.                     items:
  721.                       description: MiddlewareRef is a reference to a Middleware resource.
  722.                       properties:
  723.                         name:
  724.                           description: Name defines the name of the referenced Middleware
  725.                             resource.
  726.                           type: string
  727.                         namespace:
  728.                           description: Namespace defines the namespace of the referenced
  729.                             Middleware resource.
  730.                           type: string
  731.                       required:
  732.                       - name
  733.                       type: object
  734.                     type: array
  735.                 type: object
  736.               circuitBreaker:
  737.                 description: CircuitBreaker holds the circuit breaker configuration.
  738.                 properties:
  739.                   checkPeriod:
  740.                     anyOf:
  741.                     - type: integer
  742.                     - type: string
  743.                     description: CheckPeriod is the interval between successive checks
  744.                       of the circuit breaker condition (when in standby state).
  745.                     x-kubernetes-int-or-string: true
  746.                   expression:
  747.                     description: Expression is the condition that triggers the tripped
  748.                       state.
  749.                     type: string
  750.                   fallbackDuration:
  751.                     anyOf:
  752.                     - type: integer
  753.                     - type: string
  754.                     description: FallbackDuration is the duration for which the circuit
  755.                       breaker will wait before trying to recover (from a tripped state).
  756.                     x-kubernetes-int-or-string: true
  757.                   recoveryDuration:
  758.                     anyOf:
  759.                     - type: integer
  760.                     - type: string
  761.                     description: RecoveryDuration is the duration for which the circuit
  762.                       breaker will try to recover (as soon as it is in recovering
  763.                       state).
  764.                     x-kubernetes-int-or-string: true
  765.                 type: object
  766.               compress:
  767.                 description: 'Compress holds the compress middleware configuration.
  768.                   This middleware compresses responses before sending them to the
  769.                   client, using gzip compression. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/compress/'
  770.                 properties:
  771.                   excludedContentTypes:
  772.                     description: ExcludedContentTypes defines the list of content
  773.                       types to compare the Content-Type header of the incoming requests
  774.                       and responses before compressing.
  775.                     items:
  776.                       type: string
  777.                     type: array
  778.                   minResponseBodyBytes:
  779.                     description: 'MinResponseBodyBytes defines the minimum amount
  780.                       of bytes a response body must have to be compressed. Default:
  781.                       1024.'
  782.                     type: integer
  783.                 type: object
  784.               contentType:
  785.                 description: ContentType holds the content-type middleware configuration.
  786.                   This middleware exists to enable the correct behavior until at least
  787.                   the default one can be changed in a future version.
  788.                 properties:
  789.                   autoDetect:
  790.                     description: AutoDetect specifies whether to let the `Content-Type`
  791.                       header, if it has not been set by the backend, be automatically
  792.                       set to a value derived from the contents of the response. As
  793.                       a proxy, the default behavior should be to leave the header
  794.                       alone, regardless of what the backend did with it. However,
  795.                       the historic default was to always auto-detect and set the header
  796.                       if it was nil, and it is going to be kept that way in order
  797.                       to support users currently relying on it.
  798.                     type: boolean
  799.                 type: object
  800.               digestAuth:
  801.                 description: 'DigestAuth holds the digest auth middleware configuration.
  802.                   This middleware restricts access to your services to known users.
  803.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/digestauth/'
  804.                 properties:
  805.                   headerField:
  806.                     description: 'HeaderField defines a header field to store the
  807.                       authenticated user. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/#headerfield'
  808.                     type: string
  809.                   realm:
  810.                     description: 'Realm allows the protected resources on a server
  811.                       to be partitioned into a set of protection spaces, each with
  812.                       its own authentication scheme. Default: traefik.'
  813.                     type: string
  814.                   removeHeader:
  815.                     description: RemoveHeader defines whether to remove the authorization
  816.                       header before forwarding the request to the backend.
  817.                     type: boolean
  818.                   secret:
  819.                     description: Secret is the name of the referenced Kubernetes Secret
  820.                       containing user credentials.
  821.                     type: string
  822.                 type: object
  823.               errors:
  824.                 description: 'ErrorPage holds the custom error middleware configuration.
  825.                   This middleware returns a custom page in lieu of the default, according
  826.                   to configured ranges of HTTP Status codes. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/errorpages/'
  827.                 properties:
  828.                   query:
  829.                     description: Query defines the URL for the error page (hosted
  830.                       by service). The {status} variable can be used in order to insert
  831.                       the status code in the URL.
  832.                     type: string
  833.                   service:
  834.                     description: 'Service defines the reference to a Kubernetes Service
  835.                       that will serve the error page. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/errorpages/#service'
  836.                     properties:
  837.                       kind:
  838.                         description: Kind defines the kind of the Service.
  839.                         enum:
  840.                         - Service
  841.                         - TraefikService
  842.                         type: string
  843.                       name:
  844.                         description: Name defines the name of the referenced Kubernetes
  845.                           Service or TraefikService. The differentiation between the
  846.                           two is specified in the Kind field.
  847.                         type: string
  848.                       namespace:
  849.                         description: Namespace defines the namespace of the referenced
  850.                           Kubernetes Service or TraefikService.
  851.                         type: string
  852.                       nativeLB:
  853.                         description: NativeLB controls, when creating the load-balancer,
  854.                           whether the LB's children are directly the pods IPs or if
  855.                           the only child is the Kubernetes Service clusterIP. The
  856.                           Kubernetes Service itself does load-balance to the pods.
  857.                           By default, NativeLB is false.
  858.                         type: boolean
  859.                       passHostHeader:
  860.                         description: PassHostHeader defines whether the client Host
  861.                           header is forwarded to the upstream Kubernetes Service.
  862.                           By default, passHostHeader is true.
  863.                         type: boolean
  864.                       port:
  865.                         anyOf:
  866.                         - type: integer
  867.                         - type: string
  868.                         description: Port defines the port of a Kubernetes Service.
  869.                           This can be a reference to a named port.
  870.                         x-kubernetes-int-or-string: true
  871.                       responseForwarding:
  872.                         description: ResponseForwarding defines how Traefik forwards
  873.                           the response from the upstream Kubernetes Service to the
  874.                           client.
  875.                         properties:
  876.                           flushInterval:
  877.                             description: 'FlushInterval defines the interval, in milliseconds,
  878.                               in between flushes to the client while copying the response
  879.                               body. A negative value means to flush immediately after
  880.                               each write to the client. This configuration is ignored
  881.                               when ReverseProxy recognizes a response as a streaming
  882.                               response; for such responses, writes are flushed to
  883.                               the client immediately. Default: 100ms'
  884.                             type: string
  885.                         type: object
  886.                       scheme:
  887.                         description: Scheme defines the scheme to use for the request
  888.                           to the upstream Kubernetes Service. It defaults to https
  889.                           when Kubernetes Service port is 443, http otherwise.
  890.                         type: string
  891.                       serversTransport:
  892.                         description: ServersTransport defines the name of ServersTransport
  893.                           resource to use. It allows to configure the transport between
  894.                           Traefik and your servers. Can only be used on a Kubernetes
  895.                           Service.
  896.                         type: string
  897.                       sticky:
  898.                         description: 'Sticky defines the sticky sessions configuration.
  899.                           More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  900.                         properties:
  901.                           cookie:
  902.                             description: Cookie defines the sticky cookie configuration.
  903.                             properties:
  904.                               httpOnly:
  905.                                 description: HTTPOnly defines whether the cookie can
  906.                                   be accessed by client-side APIs, such as JavaScript.
  907.                                 type: boolean
  908.                               name:
  909.                                 description: Name defines the Cookie name.
  910.                                 type: string
  911.                               sameSite:
  912.                                 description: 'SameSite defines the same site policy.
  913.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  914.                                 type: string
  915.                               secure:
  916.                                 description: Secure defines whether the cookie can
  917.                                   only be transmitted over an encrypted connection
  918.                                   (i.e. HTTPS).
  919.                                 type: boolean
  920.                             type: object
  921.                         type: object
  922.                       strategy:
  923.                         description: Strategy defines the load balancing strategy
  924.                           between the servers. RoundRobin is the only supported value
  925.                           at the moment.
  926.                         type: string
  927.                       weight:
  928.                         description: Weight defines the weight and should only be
  929.                           specified when Name references a TraefikService object (and
  930.                           to be precise, one that embeds a Weighted Round Robin).
  931.                         type: integer
  932.                     required:
  933.                     - name
  934.                     type: object
  935.                   status:
  936.                     description: Status defines which status or range of statuses
  937.                       should result in an error page. It can be either a status code
  938.                       as a number (500), as multiple comma-separated numbers (500,502),
  939.                       as ranges by separating two codes with a dash (500-599), or
  940.                       a combination of the two (404,418,500-599).
  941.                     items:
  942.                       type: string
  943.                     type: array
  944.                 type: object
  945.               forwardAuth:
  946.                 description: 'ForwardAuth holds the forward auth middleware configuration.
  947.                   This middleware delegates the request authentication to a Service.
  948.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/forwardauth/'
  949.                 properties:
  950.                   address:
  951.                     description: Address defines the authentication server address.
  952.                     type: string
  953.                   authRequestHeaders:
  954.                     description: AuthRequestHeaders defines the list of the headers
  955.                       to copy from the request to the authentication server. If not
  956.                       set or empty then all request headers are passed.
  957.                     items:
  958.                       type: string
  959.                     type: array
  960.                   authResponseHeaders:
  961.                     description: AuthResponseHeaders defines the list of headers to
  962.                       copy from the authentication server response and set on forwarded
  963.                       request, replacing any existing conflicting headers.
  964.                     items:
  965.                       type: string
  966.                     type: array
  967.                   authResponseHeadersRegex:
  968.                     description: 'AuthResponseHeadersRegex defines the regex to match
  969.                       headers to copy from the authentication server response and
  970.                       set on forwarded request, after stripping all headers that match
  971.                       the regex. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/forwardauth/#authresponseheadersregex'
  972.                     type: string
  973.                   tls:
  974.                     description: TLS defines the configuration used to secure the
  975.                       connection to the authentication server.
  976.                     properties:
  977.                       caOptional:
  978.                         type: boolean
  979.                       caSecret:
  980.                         description: CASecret is the name of the referenced Kubernetes
  981.                           Secret containing the CA to validate the server certificate.
  982.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  983.                         type: string
  984.                       certSecret:
  985.                         description: CertSecret is the name of the referenced Kubernetes
  986.                           Secret containing the client certificate. The client certificate
  987.                           is extracted from the keys `tls.crt` and `tls.key`.
  988.                         type: string
  989.                       insecureSkipVerify:
  990.                         description: InsecureSkipVerify defines whether the server
  991.                           certificates should be validated.
  992.                         type: boolean
  993.                     type: object
  994.                   trustForwardHeader:
  995.                     description: 'TrustForwardHeader defines whether to trust (ie:
  996.                       forward) all X-Forwarded-* headers.'
  997.                     type: boolean
  998.                 type: object
  999.               headers:
  1000.                 description: 'Headers holds the headers middleware configuration.
  1001.                   This middleware manages the requests and responses headers. More
  1002.                   info: https://doc.traefik.io/traefik/v2.10/middlewares/http/headers/#customrequestheaders'
  1003.                 properties:
  1004.                   accessControlAllowCredentials:
  1005.                     description: AccessControlAllowCredentials defines whether the
  1006.                       request can include user credentials.
  1007.                     type: boolean
  1008.                   accessControlAllowHeaders:
  1009.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  1010.                       values sent in preflight response.
  1011.                     items:
  1012.                       type: string
  1013.                     type: array
  1014.                   accessControlAllowMethods:
  1015.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  1016.                       values sent in preflight response.
  1017.                     items:
  1018.                       type: string
  1019.                     type: array
  1020.                   accessControlAllowOriginList:
  1021.                     description: AccessControlAllowOriginList is a list of allowable
  1022.                       origins. Can also be a wildcard origin "*".
  1023.                     items:
  1024.                       type: string
  1025.                     type: array
  1026.                   accessControlAllowOriginListRegex:
  1027.                     description: AccessControlAllowOriginListRegex is a list of allowable
  1028.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  1029.                     items:
  1030.                       type: string
  1031.                     type: array
  1032.                   accessControlExposeHeaders:
  1033.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  1034.                       values sent in preflight response.
  1035.                     items:
  1036.                       type: string
  1037.                     type: array
  1038.                   accessControlMaxAge:
  1039.                     description: AccessControlMaxAge defines the time that a preflight
  1040.                       request may be cached.
  1041.                     format: int64
  1042.                     type: integer
  1043.                   addVaryHeader:
  1044.                     description: AddVaryHeader defines whether the Vary header is
  1045.                       automatically added/updated when the AccessControlAllowOriginList
  1046.                       is set.
  1047.                     type: boolean
  1048.                   allowedHosts:
  1049.                     description: AllowedHosts defines the fully qualified list of
  1050.                       allowed domain names.
  1051.                     items:
  1052.                       type: string
  1053.                     type: array
  1054.                   browserXssFilter:
  1055.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  1056.                       header with the value 1; mode=block.
  1057.                     type: boolean
  1058.                   contentSecurityPolicy:
  1059.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  1060.                       header value.
  1061.                     type: string
  1062.                   contentTypeNosniff:
  1063.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  1064.                       header with the nosniff value.
  1065.                     type: boolean
  1066.                   customBrowserXSSValue:
  1067.                     description: CustomBrowserXSSValue defines the X-XSS-Protection
  1068.                       header value. This overrides the BrowserXssFilter option.
  1069.                     type: string
  1070.                   customFrameOptionsValue:
  1071.                     description: CustomFrameOptionsValue defines the X-Frame-Options
  1072.                       header value. This overrides the FrameDeny option.
  1073.                     type: string
  1074.                   customRequestHeaders:
  1075.                     additionalProperties:
  1076.                       type: string
  1077.                     description: CustomRequestHeaders defines the header names and
  1078.                       values to apply to the request.
  1079.                     type: object
  1080.                   customResponseHeaders:
  1081.                     additionalProperties:
  1082.                       type: string
  1083.                     description: CustomResponseHeaders defines the header names and
  1084.                       values to apply to the response.
  1085.                     type: object
  1086.                   featurePolicy:
  1087.                     description: 'Deprecated: use PermissionsPolicy instead.'
  1088.                     type: string
  1089.                   forceSTSHeader:
  1090.                     description: ForceSTSHeader defines whether to add the STS header
  1091.                       even when the connection is HTTP.
  1092.                     type: boolean
  1093.                   frameDeny:
  1094.                     description: FrameDeny defines whether to add the X-Frame-Options
  1095.                       header with the DENY value.
  1096.                     type: boolean
  1097.                   hostsProxyHeaders:
  1098.                     description: HostsProxyHeaders defines the header keys that may
  1099.                       hold a proxied hostname value for the request.
  1100.                     items:
  1101.                       type: string
  1102.                     type: array
  1103.                   isDevelopment:
  1104.                     description: IsDevelopment defines whether to mitigate the unwanted
  1105.                       effects of the AllowedHosts, SSL, and STS options when developing.
  1106.                       Usually testing takes place using HTTP, not HTTPS, and on localhost,
  1107.                       not your production domain. If you would like your development
  1108.                       environment to mimic production with complete Host blocking,
  1109.                       SSL redirects, and STS headers, leave this as false.
  1110.                     type: boolean
  1111.                   permissionsPolicy:
  1112.                     description: PermissionsPolicy defines the Permissions-Policy
  1113.                       header value. This allows sites to control browser features.
  1114.                     type: string
  1115.                   publicKey:
  1116.                     description: PublicKey is the public key that implements HPKP
  1117.                       to prevent MITM attacks with forged certificates.
  1118.                     type: string
  1119.                   referrerPolicy:
  1120.                     description: ReferrerPolicy defines the Referrer-Policy header
  1121.                       value. This allows sites to control whether browsers forward
  1122.                       the Referer header to other sites.
  1123.                     type: string
  1124.                   sslForceHost:
  1125.                     description: 'Deprecated: use RedirectRegex instead.'
  1126.                     type: boolean
  1127.                   sslHost:
  1128.                     description: 'Deprecated: use RedirectRegex instead.'
  1129.                     type: string
  1130.                   sslProxyHeaders:
  1131.                     additionalProperties:
  1132.                       type: string
  1133.                     description: 'SSLProxyHeaders defines the header keys with associated
  1134.                       values that would indicate a valid HTTPS request. It can be
  1135.                       useful when using other proxies (example: "X-Forwarded-Proto":
  1136.                       "https").'
  1137.                     type: object
  1138.                   sslRedirect:
  1139.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  1140.                       instead.'
  1141.                     type: boolean
  1142.                   sslTemporaryRedirect:
  1143.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  1144.                       instead.'
  1145.                     type: boolean
  1146.                   stsIncludeSubdomains:
  1147.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  1148.                       directive is appended to the Strict-Transport-Security header.
  1149.                     type: boolean
  1150.                   stsPreload:
  1151.                     description: STSPreload defines whether the preload flag is appended
  1152.                       to the Strict-Transport-Security header.
  1153.                     type: boolean
  1154.                   stsSeconds:
  1155.                     description: STSSeconds defines the max-age of the Strict-Transport-Security
  1156.                       header. If set to 0, the header is not set.
  1157.                     format: int64
  1158.                     type: integer
  1159.                 type: object
  1160.               inFlightReq:
  1161.                 description: 'InFlightReq holds the in-flight request middleware configuration.
  1162.                   This middleware limits the number of requests being processed and
  1163.                   served concurrently. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/inflightreq/'
  1164.                 properties:
  1165.                   amount:
  1166.                     description: Amount defines the maximum amount of allowed simultaneous
  1167.                       in-flight request. The middleware responds with HTTP 429 Too
  1168.                       Many Requests if there are already amount requests in progress
  1169.                       (based on the same sourceCriterion strategy).
  1170.                     format: int64
  1171.                     type: integer
  1172.                   sourceCriterion:
  1173.                     description: 'SourceCriterion defines what criterion is used to
  1174.                       group requests as originating from a common source. If several
  1175.                       strategies are defined at the same time, an error will be raised.
  1176.                       If none are set, the default is to use the requestHost. More
  1177.                       info: https://doc.traefik.io/traefik/v2.10/middlewares/http/inflightreq/#sourcecriterion'
  1178.                     properties:
  1179.                       ipStrategy:
  1180.                         description: 'IPStrategy holds the IP strategy configuration
  1181.                           used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy'
  1182.                         properties:
  1183.                           depth:
  1184.                             description: Depth tells Traefik to use the X-Forwarded-For
  1185.                               header and take the IP located at the depth position
  1186.                               (starting from the right).
  1187.                             type: integer
  1188.                           excludedIPs:
  1189.                             description: ExcludedIPs configures Traefik to scan the
  1190.                               X-Forwarded-For header and select the first IP not in
  1191.                               the list.
  1192.                             items:
  1193.                               type: string
  1194.                             type: array
  1195.                         type: object
  1196.                       requestHeaderName:
  1197.                         description: RequestHeaderName defines the name of the header
  1198.                           used to group incoming requests.
  1199.                         type: string
  1200.                       requestHost:
  1201.                         description: RequestHost defines whether to consider the request
  1202.                           Host as the source.
  1203.                         type: boolean
  1204.                     type: object
  1205.                 type: object
  1206.               ipWhiteList:
  1207.                 description: 'IPWhiteList holds the IP whitelist middleware configuration.
  1208.                   This middleware accepts / refuses requests based on the client IP.
  1209.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/'
  1210.                 properties:
  1211.                   ipStrategy:
  1212.                     description: 'IPStrategy holds the IP strategy configuration used
  1213.                       by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy'
  1214.                     properties:
  1215.                       depth:
  1216.                         description: Depth tells Traefik to use the X-Forwarded-For
  1217.                           header and take the IP located at the depth position (starting
  1218.                           from the right).
  1219.                         type: integer
  1220.                       excludedIPs:
  1221.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1222.                           header and select the first IP not in the list.
  1223.                         items:
  1224.                           type: string
  1225.                         type: array
  1226.                     type: object
  1227.                   sourceRange:
  1228.                     description: SourceRange defines the set of allowed IPs (or ranges
  1229.                       of allowed IPs by using CIDR notation).
  1230.                     items:
  1231.                       type: string
  1232.                     type: array
  1233.                 type: object
  1234.               passTLSClientCert:
  1235.                 description: 'PassTLSClientCert holds the pass TLS client cert middleware
  1236.                   configuration. This middleware adds the selected data from the passed
  1237.                   client TLS certificate to a header. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/passtlsclientcert/'
  1238.                 properties:
  1239.                   info:
  1240.                     description: Info selects the specific client certificate details
  1241.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1242.                     properties:
  1243.                       issuer:
  1244.                         description: Issuer defines the client certificate issuer
  1245.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1246.                         properties:
  1247.                           commonName:
  1248.                             description: CommonName defines whether to add the organizationalUnit
  1249.                               information into the issuer.
  1250.                             type: boolean
  1251.                           country:
  1252.                             description: Country defines whether to add the country
  1253.                               information into the issuer.
  1254.                             type: boolean
  1255.                           domainComponent:
  1256.                             description: DomainComponent defines whether to add the
  1257.                               domainComponent information into the issuer.
  1258.                             type: boolean
  1259.                           locality:
  1260.                             description: Locality defines whether to add the locality
  1261.                               information into the issuer.
  1262.                             type: boolean
  1263.                           organization:
  1264.                             description: Organization defines whether to add the organization
  1265.                               information into the issuer.
  1266.                             type: boolean
  1267.                           province:
  1268.                             description: Province defines whether to add the province
  1269.                               information into the issuer.
  1270.                             type: boolean
  1271.                           serialNumber:
  1272.                             description: SerialNumber defines whether to add the serialNumber
  1273.                               information into the issuer.
  1274.                             type: boolean
  1275.                         type: object
  1276.                       notAfter:
  1277.                         description: NotAfter defines whether to add the Not After
  1278.                           information from the Validity part.
  1279.                         type: boolean
  1280.                       notBefore:
  1281.                         description: NotBefore defines whether to add the Not Before
  1282.                           information from the Validity part.
  1283.                         type: boolean
  1284.                       sans:
  1285.                         description: Sans defines whether to add the Subject Alternative
  1286.                           Name information from the Subject Alternative Name part.
  1287.                         type: boolean
  1288.                       serialNumber:
  1289.                         description: SerialNumber defines whether to add the client
  1290.                           serialNumber information.
  1291.                         type: boolean
  1292.                       subject:
  1293.                         description: Subject defines the client certificate subject
  1294.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1295.                         properties:
  1296.                           commonName:
  1297.                             description: CommonName defines whether to add the organizationalUnit
  1298.                               information into the subject.
  1299.                             type: boolean
  1300.                           country:
  1301.                             description: Country defines whether to add the country
  1302.                               information into the subject.
  1303.                             type: boolean
  1304.                           domainComponent:
  1305.                             description: DomainComponent defines whether to add the
  1306.                               domainComponent information into the subject.
  1307.                             type: boolean
  1308.                           locality:
  1309.                             description: Locality defines whether to add the locality
  1310.                               information into the subject.
  1311.                             type: boolean
  1312.                           organization:
  1313.                             description: Organization defines whether to add the organization
  1314.                               information into the subject.
  1315.                             type: boolean
  1316.                           organizationalUnit:
  1317.                             description: OrganizationalUnit defines whether to add
  1318.                               the organizationalUnit information into the subject.
  1319.                             type: boolean
  1320.                           province:
  1321.                             description: Province defines whether to add the province
  1322.                               information into the subject.
  1323.                             type: boolean
  1324.                           serialNumber:
  1325.                             description: SerialNumber defines whether to add the serialNumber
  1326.                               information into the subject.
  1327.                             type: boolean
  1328.                         type: object
  1329.                     type: object
  1330.                   pem:
  1331.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  1332.                       the certificate.
  1333.                     type: boolean
  1334.                 type: object
  1335.               plugin:
  1336.                 additionalProperties:
  1337.                   x-kubernetes-preserve-unknown-fields: true
  1338.                 description: 'Plugin defines the middleware plugin configuration.
  1339.                   More info: https://doc.traefik.io/traefik/plugins/'
  1340.                 type: object
  1341.               rateLimit:
  1342.                 description: 'RateLimit holds the rate limit configuration. This middleware
  1343.                   ensures that services will receive a fair amount of requests, and
  1344.                   allows one to define what fair is. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ratelimit/'
  1345.                 properties:
  1346.                   average:
  1347.                     description: Average is the maximum rate, by default in requests/s,
  1348.                       allowed for the given source. It defaults to 0, which means
  1349.                       no rate limiting. The rate is actually defined by dividing Average
  1350.                       by Period. So for a rate below 1req/s, one needs to define a
  1351.                       Period larger than a second.
  1352.                     format: int64
  1353.                     type: integer
  1354.                   burst:
  1355.                     description: Burst is the maximum number of requests allowed to
  1356.                       arrive in the same arbitrarily small period of time. It defaults
  1357.                       to 1.
  1358.                     format: int64
  1359.                     type: integer
  1360.                   period:
  1361.                     anyOf:
  1362.                     - type: integer
  1363.                     - type: string
  1364.                     description: 'Period, in combination with Average, defines the
  1365.                       actual maximum rate, such as: r = Average / Period. It defaults
  1366.                       to a second.'
  1367.                     x-kubernetes-int-or-string: true
  1368.                   sourceCriterion:
  1369.                     description: SourceCriterion defines what criterion is used to
  1370.                       group requests as originating from a common source. If several
  1371.                       strategies are defined at the same time, an error will be raised.
  1372.                       If none are set, the default is to use the request's remote
  1373.                       address field (as an ipStrategy).
  1374.                     properties:
  1375.                       ipStrategy:
  1376.                         description: 'IPStrategy holds the IP strategy configuration
  1377.                           used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy'
  1378.                         properties:
  1379.                           depth:
  1380.                             description: Depth tells Traefik to use the X-Forwarded-For
  1381.                               header and take the IP located at the depth position
  1382.                               (starting from the right).
  1383.                             type: integer
  1384.                           excludedIPs:
  1385.                             description: ExcludedIPs configures Traefik to scan the
  1386.                               X-Forwarded-For header and select the first IP not in
  1387.                               the list.
  1388.                             items:
  1389.                               type: string
  1390.                             type: array
  1391.                         type: object
  1392.                       requestHeaderName:
  1393.                         description: RequestHeaderName defines the name of the header
  1394.                           used to group incoming requests.
  1395.                         type: string
  1396.                       requestHost:
  1397.                         description: RequestHost defines whether to consider the request
  1398.                           Host as the source.
  1399.                         type: boolean
  1400.                     type: object
  1401.                 type: object
  1402.               redirectRegex:
  1403.                 description: 'RedirectRegex holds the redirect regex middleware configuration.
  1404.                   This middleware redirects a request using regex matching and replacement.
  1405.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/redirectregex/#regex'
  1406.                 properties:
  1407.                   permanent:
  1408.                     description: Permanent defines whether the redirection is permanent
  1409.                       (301).
  1410.                     type: boolean
  1411.                   regex:
  1412.                     description: Regex defines the regex used to match and capture
  1413.                       elements from the request URL.
  1414.                     type: string
  1415.                   replacement:
  1416.                     description: Replacement defines how to modify the URL to have
  1417.                       the new target URL.
  1418.                     type: string
  1419.                 type: object
  1420.               redirectScheme:
  1421.                 description: 'RedirectScheme holds the redirect scheme middleware
  1422.                   configuration. This middleware redirects requests from a scheme/port
  1423.                   to another. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/redirectscheme/'
  1424.                 properties:
  1425.                   permanent:
  1426.                     description: Permanent defines whether the redirection is permanent
  1427.                       (301).
  1428.                     type: boolean
  1429.                   port:
  1430.                     description: Port defines the port of the new URL.
  1431.                     type: string
  1432.                   scheme:
  1433.                     description: Scheme defines the scheme of the new URL.
  1434.                     type: string
  1435.                 type: object
  1436.               replacePath:
  1437.                 description: 'ReplacePath holds the replace path middleware configuration.
  1438.                   This middleware replaces the path of the request URL and store the
  1439.                   original path in an X-Replaced-Path header. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/replacepath/'
  1440.                 properties:
  1441.                   path:
  1442.                     description: Path defines the path to use as replacement in the
  1443.                       request URL.
  1444.                     type: string
  1445.                 type: object
  1446.               replacePathRegex:
  1447.                 description: 'ReplacePathRegex holds the replace path regex middleware
  1448.                   configuration. This middleware replaces the path of a URL using
  1449.                   regex matching and replacement. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/replacepathregex/'
  1450.                 properties:
  1451.                   regex:
  1452.                     description: Regex defines the regular expression used to match
  1453.                       and capture the path from the request URL.
  1454.                     type: string
  1455.                   replacement:
  1456.                     description: Replacement defines the replacement path format,
  1457.                       which can include captured variables.
  1458.                     type: string
  1459.                 type: object
  1460.               retry:
  1461.                 description: 'Retry holds the retry middleware configuration. This
  1462.                   middleware reissues requests a given number of times to a backend
  1463.                   server if that server does not reply. As soon as the server answers,
  1464.                   the middleware stops retrying, regardless of the response status.
  1465.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/retry/'
  1466.                 properties:
  1467.                   attempts:
  1468.                     description: Attempts defines how many times the request should
  1469.                       be retried.
  1470.                     type: integer
  1471.                   initialInterval:
  1472.                     anyOf:
  1473.                     - type: integer
  1474.                     - type: string
  1475.                     description: InitialInterval defines the first wait time in the
  1476.                       exponential backoff series. The maximum interval is calculated
  1477.                       as twice the initialInterval. If unspecified, requests will
  1478.                       be retried immediately. The value of initialInterval should
  1479.                       be provided in seconds or as a valid duration format, see https://pkg.go.dev/time#ParseDuration.
  1480.                     x-kubernetes-int-or-string: true
  1481.                 type: object
  1482.               stripPrefix:
  1483.                 description: 'StripPrefix holds the strip prefix middleware configuration.
  1484.                   This middleware removes the specified prefixes from the URL path.
  1485.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/stripprefix/'
  1486.                 properties:
  1487.                   forceSlash:
  1488.                     description: 'ForceSlash ensures that the resulting stripped path
  1489.                       is not the empty string, by replacing it with / when necessary.
  1490.                       Default: true.'
  1491.                     type: boolean
  1492.                   prefixes:
  1493.                     description: Prefixes defines the prefixes to strip from the request
  1494.                       URL.
  1495.                     items:
  1496.                       type: string
  1497.                     type: array
  1498.                 type: object
  1499.               stripPrefixRegex:
  1500.                 description: 'StripPrefixRegex holds the strip prefix regex middleware
  1501.                   configuration. This middleware removes the matching prefixes from
  1502.                   the URL path. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/stripprefixregex/'
  1503.                 properties:
  1504.                   regex:
  1505.                     description: Regex defines the regular expression to match the
  1506.                       path prefix from the request URL.
  1507.                     items:
  1508.                       type: string
  1509.                     type: array
  1510.                 type: object
  1511.             type: object
  1512.         required:
  1513.         - metadata
  1514.         - spec
  1515.         type: object
  1516.     served: true
  1517.     storage: true
  1518. status:
  1519.   acceptedNames:
  1520.     kind: ""
  1521.     plural: ""
  1522.   conditions: []
  1523.   storedVersions: []
  1525. ---
  1526. apiVersion: apiextensions.k8s.io/v1
  1527. kind: CustomResourceDefinition
  1528. metadata:
  1529.   annotations:
  1530.     controller-gen.kubebuilder.io/version: v0.6.2
  1531.   creationTimestamp: null
  1532.   name: middlewaretcps.traefik.io
  1533. spec:
  1534.   group: traefik.io
  1535.   names:
  1536.     kind: MiddlewareTCP
  1537.     listKind: MiddlewareTCPList
  1538.     plural: middlewaretcps
  1539.     singular: middlewaretcp
  1540.   scope: Namespaced
  1541.   versions:
  1542.   - name: v1alpha1
  1543.     schema:
  1544.       openAPIV3Schema:
  1545.         description: 'MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  1546.           More info: https://doc.traefik.io/traefik/v2.10/middlewares/overview/'
  1547.         properties:
  1548.           apiVersion:
  1549.             description: 'APIVersion defines the versioned schema of this representation
  1550.               of an object. Servers should convert recognized schemas to the latest
  1551.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1552.             type: string
  1553.           kind:
  1554.             description: 'Kind is a string value representing the REST resource this
  1555.               object represents. Servers may infer this from the endpoint the client
  1556.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1557.             type: string
  1558.           metadata:
  1559.             type: object
  1560.           spec:
  1561.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  1562.             properties:
  1563.               inFlightConn:
  1564.                 description: InFlightConn defines the InFlightConn middleware configuration.
  1565.                 properties:
  1566.                   amount:
  1567.                     description: Amount defines the maximum amount of allowed simultaneous
  1568.                       connections. The middleware closes the connection if there are
  1569.                       already amount connections opened.
  1570.                     format: int64
  1571.                     type: integer
  1572.                 type: object
  1573.               ipWhiteList:
  1574.                 description: IPWhiteList defines the IPWhiteList middleware configuration.
  1575.                 properties:
  1576.                   sourceRange:
  1577.                     description: SourceRange defines the allowed IPs (or ranges of
  1578.                       allowed IPs by using CIDR notation).
  1579.                     items:
  1580.                       type: string
  1581.                     type: array
  1582.                 type: object
  1583.             type: object
  1584.         required:
  1585.         - metadata
  1586.         - spec
  1587.         type: object
  1588.     served: true
  1589.     storage: true
  1590. status:
  1591.   acceptedNames:
  1592.     kind: ""
  1593.     plural: ""
  1594.   conditions: []
  1595.   storedVersions: []
  1597. ---
  1598. apiVersion: apiextensions.k8s.io/v1
  1599. kind: CustomResourceDefinition
  1600. metadata:
  1601.   annotations:
  1602.     controller-gen.kubebuilder.io/version: v0.6.2
  1603.   creationTimestamp: null
  1604.   name: serverstransports.traefik.io
  1605. spec:
  1606.   group: traefik.io
  1607.   names:
  1608.     kind: ServersTransport
  1609.     listKind: ServersTransportList
  1610.     plural: serverstransports
  1611.     singular: serverstransport
  1612.   scope: Namespaced
  1613.   versions:
  1614.   - name: v1alpha1
  1615.     schema:
  1616.       openAPIV3Schema:
  1617.         description: 'ServersTransport is the CRD implementation of a ServersTransport.
  1618.           If no serversTransport is specified, the [email protected] will be used.
  1619.           The [email protected] serversTransport is created from the static configuration.
  1620.           More info: https://doc.traefik.io/traefik/v2.10/routing/services/#serverstransport_1'
  1621.         properties:
  1622.           apiVersion:
  1623.             description: 'APIVersion defines the versioned schema of this representation
  1624.               of an object. Servers should convert recognized schemas to the latest
  1625.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1626.             type: string
  1627.           kind:
  1628.             description: 'Kind is a string value representing the REST resource this
  1629.               object represents. Servers may infer this from the endpoint the client
  1630.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1631.             type: string
  1632.           metadata:
  1633.             type: object
  1634.           spec:
  1635.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  1636.             properties:
  1637.               certificatesSecrets:
  1638.                 description: CertificatesSecrets defines a list of secret storing
  1639.                   client certificates for mTLS.
  1640.                 items:
  1641.                   type: string
  1642.                 type: array
  1643.               disableHTTP2:
  1644.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  1645.                   servers.
  1646.                 type: boolean
  1647.               forwardingTimeouts:
  1648.                 description: ForwardingTimeouts defines the timeouts for requests
  1649.                   forwarded to the backend servers.
  1650.                 properties:
  1651.                   dialTimeout:
  1652.                     anyOf:
  1653.                     - type: integer
  1654.                     - type: string
  1655.                     description: DialTimeout is the amount of time to wait until a
  1656.                       connection to a backend server can be established.
  1657.                     x-kubernetes-int-or-string: true
  1658.                   idleConnTimeout:
  1659.                     anyOf:
  1660.                     - type: integer
  1661.                     - type: string
  1662.                     description: IdleConnTimeout is the maximum period for which an
  1663.                       idle HTTP keep-alive connection will remain open before closing
  1664.                       itself.
  1665.                     x-kubernetes-int-or-string: true
  1666.                   pingTimeout:
  1667.                     anyOf:
  1668.                     - type: integer
  1669.                     - type: string
  1670.                     description: PingTimeout is the timeout after which the HTTP/2
  1671.                       connection will be closed if a response to ping is not received.
  1672.                     x-kubernetes-int-or-string: true
  1673.                   readIdleTimeout:
  1674.                     anyOf:
  1675.                     - type: integer
  1676.                     - type: string
  1677.                     description: ReadIdleTimeout is the timeout after which a health
  1678.                       check using ping frame will be carried out if no frame is received
  1679.                       on the HTTP/2 connection.
  1680.                     x-kubernetes-int-or-string: true
  1681.                   responseHeaderTimeout:
  1682.                     anyOf:
  1683.                     - type: integer
  1684.                     - type: string
  1685.                     description: ResponseHeaderTimeout is the amount of time to wait
  1686.                       for a server's response headers after fully writing the request
  1687.                       (including its body, if any).
  1688.                     x-kubernetes-int-or-string: true
  1689.                 type: object
  1690.               insecureSkipVerify:
  1691.                 description: InsecureSkipVerify disables SSL certificate verification.
  1692.                 type: boolean
  1693.               maxIdleConnsPerHost:
  1694.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  1695.                   to keep per-host.
  1696.                 type: integer
  1697.               peerCertURI:
  1698.                 description: PeerCertURI defines the peer cert URI used to match against
  1699.                   SAN URI during the peer certificate verification.
  1700.                 type: string
  1701.               rootCAsSecrets:
  1702.                 description: RootCAsSecrets defines a list of CA secret used to validate
  1703.                   self-signed certificate.
  1704.                 items:
  1705.                   type: string
  1706.                 type: array
  1707.               serverName:
  1708.                 description: ServerName defines the server name used to contact the
  1709.                   server.
  1710.                 type: string
  1711.             type: object
  1712.         required:
  1713.         - metadata
  1714.         - spec
  1715.         type: object
  1716.     served: true
  1717.     storage: true
  1718. status:
  1719.   acceptedNames:
  1720.     kind: ""
  1721.     plural: ""
  1722.   conditions: []
  1723.   storedVersions: []
  1725. ---
  1726. apiVersion: apiextensions.k8s.io/v1
  1727. kind: CustomResourceDefinition
  1728. metadata:
  1729.   annotations:
  1730.     controller-gen.kubebuilder.io/version: v0.6.2
  1731.   creationTimestamp: null
  1732.   name: tlsoptions.traefik.io
  1733. spec:
  1734.   group: traefik.io
  1735.   names:
  1736.     kind: TLSOption
  1737.     listKind: TLSOptionList
  1738.     plural: tlsoptions
  1739.     singular: tlsoption
  1740.   scope: Namespaced
  1741.   versions:
  1742.   - name: v1alpha1
  1743.     schema:
  1744.       openAPIV3Schema:
  1745.         description: 'TLSOption is the CRD implementation of a Traefik TLS Option,
  1746.           allowing to configure some parameters of the TLS connection. More info:
  1747.           https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options'
  1748.         properties:
  1749.           apiVersion:
  1750.             description: 'APIVersion defines the versioned schema of this representation
  1751.               of an object. Servers should convert recognized schemas to the latest
  1752.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1753.             type: string
  1754.           kind:
  1755.             description: 'Kind is a string value representing the REST resource this
  1756.               object represents. Servers may infer this from the endpoint the client
  1757.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1758.             type: string
  1759.           metadata:
  1760.             type: object
  1761.           spec:
  1762.             description: TLSOptionSpec defines the desired state of a TLSOption.
  1763.             properties:
  1764.               alpnProtocols:
  1765.                 description: 'ALPNProtocols defines the list of supported application
  1766.                   level protocols for the TLS handshake, in order of preference. More
  1767.                   info: https://doc.traefik.io/traefik/v2.10/https/tls/#alpn-protocols'
  1768.                 items:
  1769.                   type: string
  1770.                 type: array
  1771.               cipherSuites:
  1772.                 description: 'CipherSuites defines the list of supported cipher suites
  1773.                   for TLS versions up to TLS 1.2. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#cipher-suites'
  1774.                 items:
  1775.                   type: string
  1776.                 type: array
  1777.               clientAuth:
  1778.                 description: ClientAuth defines the server's policy for TLS Client
  1779.                   Authentication.
  1780.                 properties:
  1781.                   clientAuthType:
  1782.                     description: ClientAuthType defines the client authentication
  1783.                       type to apply.
  1784.                     enum:
  1785.                     - NoClientCert
  1786.                     - RequestClientCert
  1787.                     - RequireAnyClientCert
  1788.                     - VerifyClientCertIfGiven
  1789.                     - RequireAndVerifyClientCert
  1790.                     type: string
  1791.                   secretNames:
  1792.                     description: SecretNames defines the names of the referenced Kubernetes
  1793.                       Secret storing certificate details.
  1794.                     items:
  1795.                       type: string
  1796.                     type: array
  1797.                 type: object
  1798.               curvePreferences:
  1799.                 description: 'CurvePreferences defines the preferred elliptic curves
  1800.                   in a specific order. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#curve-preferences'
  1801.                 items:
  1802.                   type: string
  1803.                 type: array
  1804.               maxVersion:
  1805.                 description: 'MaxVersion defines the maximum TLS version that Traefik
  1806.                   will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
  1807.                   VersionTLS13. Default: None.'
  1808.                 type: string
  1809.               minVersion:
  1810.                 description: 'MinVersion defines the minimum TLS version that Traefik
  1811.                   will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
  1812.                   VersionTLS13. Default: VersionTLS10.'
  1813.                 type: string
  1814.               preferServerCipherSuites:
  1815.                 description: 'PreferServerCipherSuites defines whether the server
  1816.                   chooses a cipher suite among his own instead of among the client''s.
  1817.                   It is enabled automatically when minVersion or maxVersion is set.
  1818.                   Deprecated: https://github.com/golang/go/issues/45430'
  1819.                 type: boolean
  1820.               sniStrict:
  1821.                 description: SniStrict defines whether Traefik allows connections
  1822.                   from clients connections that do not specify a server_name extension.
  1823.                 type: boolean
  1824.             type: object
  1825.         required:
  1826.         - metadata
  1827.         - spec
  1828.         type: object
  1829.     served: true
  1830.     storage: true
  1831. status:
  1832.   acceptedNames:
  1833.     kind: ""
  1834.     plural: ""
  1835.   conditions: []
  1836.   storedVersions: []
  1838. ---
  1839. apiVersion: apiextensions.k8s.io/v1
  1840. kind: CustomResourceDefinition
  1841. metadata:
  1842.   annotations:
  1843.     controller-gen.kubebuilder.io/version: v0.6.2
  1844.   creationTimestamp: null
  1845.   name: tlsstores.traefik.io
  1846. spec:
  1847.   group: traefik.io
  1848.   names:
  1849.     kind: TLSStore
  1850.     listKind: TLSStoreList
  1851.     plural: tlsstores
  1852.     singular: tlsstore
  1853.   scope: Namespaced
  1854.   versions:
  1855.   - name: v1alpha1
  1856.     schema:
  1857.       openAPIV3Schema:
  1858.         description: 'TLSStore is the CRD implementation of a Traefik TLS Store. For
  1859.           the time being, only the TLSStore named default is supported. This means
  1860.           that you cannot have two stores that are named default in different Kubernetes
  1861.           namespaces. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#certificates-stores'
  1862.         properties:
  1863.           apiVersion:
  1864.             description: 'APIVersion defines the versioned schema of this representation
  1865.               of an object. Servers should convert recognized schemas to the latest
  1866.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1867.             type: string
  1868.           kind:
  1869.             description: 'Kind is a string value representing the REST resource this
  1870.               object represents. Servers may infer this from the endpoint the client
  1871.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1872.             type: string
  1873.           metadata:
  1874.             type: object
  1875.           spec:
  1876.             description: TLSStoreSpec defines the desired state of a TLSStore.
  1877.             properties:
  1878.               certificates:
  1879.                 description: Certificates is a list of secret names, each secret holding
  1880.                   a key/certificate pair to add to the store.
  1881.                 items:
  1882.                   description: Certificate holds a secret name for the TLSStore resource.
  1883.                   properties:
  1884.                     secretName:
  1885.                       description: SecretName is the name of the referenced Kubernetes
  1886.                         Secret to specify the certificate details.
  1887.                       type: string
  1888.                   required:
  1889.                   - secretName
  1890.                   type: object
  1891.                 type: array
  1892.               defaultCertificate:
  1893.                 description: DefaultCertificate defines the default certificate configuration.
  1894.                 properties:
  1895.                   secretName:
  1896.                     description: SecretName is the name of the referenced Kubernetes
  1897.                       Secret to specify the certificate details.
  1898.                     type: string
  1899.                 required:
  1900.                 - secretName
  1901.                 type: object
  1902.               defaultGeneratedCert:
  1903.                 description: DefaultGeneratedCert defines the default generated certificate
  1904.                   configuration.
  1905.                 properties:
  1906.                   domain:
  1907.                     description: Domain is the domain definition for the DefaultCertificate.
  1908.                     properties:
  1909.                       main:
  1910.                         description: Main defines the main domain name.
  1911.                         type: string
  1912.                       sans:
  1913.                         description: SANs defines the subject alternative domain names.
  1914.                         items:
  1915.                           type: string
  1916.                         type: array
  1917.                     type: object
  1918.                   resolver:
  1919.                     description: Resolver is the name of the resolver that will be
  1920.                       used to issue the DefaultCertificate.
  1921.                     type: string
  1922.                 type: object
  1923.             type: object
  1924.         required:
  1925.         - metadata
  1926.         - spec
  1927.         type: object
  1928.     served: true
  1929.     storage: true
  1930. status:
  1931.   acceptedNames:
  1932.     kind: ""
  1933.     plural: ""
  1934.   conditions: []
  1935.   storedVersions: []
  1937. ---
  1938. apiVersion: apiextensions.k8s.io/v1
  1939. kind: CustomResourceDefinition
  1940. metadata:
  1941.   annotations:
  1942.     controller-gen.kubebuilder.io/version: v0.6.2
  1943.   creationTimestamp: null
  1944.   name: traefikservices.traefik.io
  1945. spec:
  1946.   group: traefik.io
  1947.   names:
  1948.     kind: TraefikService
  1949.     listKind: TraefikServiceList
  1950.     plural: traefikservices
  1951.     singular: traefikservice
  1952.   scope: Namespaced
  1953.   versions:
  1954.   - name: v1alpha1
  1955.     schema:
  1956.       openAPIV3Schema:
  1957.         description: 'TraefikService is the CRD implementation of a Traefik Service.
  1958.           TraefikService object allows to: - Apply weight to Services on load-balancing
  1959.           - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-traefikservice'
  1960.         properties:
  1961.           apiVersion:
  1962.             description: 'APIVersion defines the versioned schema of this representation
  1963.               of an object. Servers should convert recognized schemas to the latest
  1964.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1965.             type: string
  1966.           kind:
  1967.             description: 'Kind is a string value representing the REST resource this
  1968.               object represents. Servers may infer this from the endpoint the client
  1969.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1970.             type: string
  1971.           metadata:
  1972.             type: object
  1973.           spec:
  1974.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  1975.             properties:
  1976.               mirroring:
  1977.                 description: Mirroring defines the Mirroring service configuration.
  1978.                 properties:
  1979.                   kind:
  1980.                     description: Kind defines the kind of the Service.
  1981.                     enum:
  1982.                     - Service
  1983.                     - TraefikService
  1984.                     type: string
  1985.                   maxBodySize:
  1986.                     description: MaxBodySize defines the maximum size allowed for
  1987.                       the body of the request. If the body is larger, the request
  1988.                       is not mirrored. Default value is -1, which means unlimited
  1989.                       size.
  1990.                     format: int64
  1991.                     type: integer
  1992.                   mirrors:
  1993.                     description: Mirrors defines the list of mirrors where Traefik
  1994.                       will duplicate the traffic.
  1995.                     items:
  1996.                       description: MirrorService holds the mirror configuration.
  1997.                       properties:
  1998.                         kind:
  1999.                           description: Kind defines the kind of the Service.
  2000.                           enum:
  2001.                           - Service
  2002.                           - TraefikService
  2003.                           type: string
  2004.                         name:
  2005.                           description: Name defines the name of the referenced Kubernetes
  2006.                             Service or TraefikService. The differentiation between
  2007.                             the two is specified in the Kind field.
  2008.                           type: string
  2009.                         namespace:
  2010.                           description: Namespace defines the namespace of the referenced
  2011.                             Kubernetes Service or TraefikService.
  2012.                           type: string
  2013.                         nativeLB:
  2014.                           description: NativeLB controls, when creating the load-balancer,
  2015.                             whether the LB's children are directly the pods IPs or
  2016.                             if the only child is the Kubernetes Service clusterIP.
  2017.                             The Kubernetes Service itself does load-balance to the
  2018.                             pods. By default, NativeLB is false.
  2019.                           type: boolean
  2020.                         passHostHeader:
  2021.                           description: PassHostHeader defines whether the client Host
  2022.                             header is forwarded to the upstream Kubernetes Service.
  2023.                             By default, passHostHeader is true.
  2024.                           type: boolean
  2025.                         percent:
  2026.                           description: 'Percent defines the part of the traffic to
  2027.                             mirror. Supported values: 0 to 100.'
  2028.                           type: integer
  2029.                         port:
  2030.                           anyOf:
  2031.                           - type: integer
  2032.                           - type: string
  2033.                           description: Port defines the port of a Kubernetes Service.
  2034.                             This can be a reference to a named port.
  2035.                           x-kubernetes-int-or-string: true
  2036.                         responseForwarding:
  2037.                           description: ResponseForwarding defines how Traefik forwards
  2038.                             the response from the upstream Kubernetes Service to the
  2039.                             client.
  2040.                           properties:
  2041.                             flushInterval:
  2042.                               description: 'FlushInterval defines the interval, in
  2043.                                 milliseconds, in between flushes to the client while
  2044.                                 copying the response body. A negative value means
  2045.                                 to flush immediately after each write to the client.
  2046.                                 This configuration is ignored when ReverseProxy recognizes
  2047.                                 a response as a streaming response; for such responses,
  2048.                                 writes are flushed to the client immediately. Default:
  2049.                                 100ms'
  2050.                               type: string
  2051.                           type: object
  2052.                         scheme:
  2053.                           description: Scheme defines the scheme to use for the request
  2054.                             to the upstream Kubernetes Service. It defaults to https
  2055.                             when Kubernetes Service port is 443, http otherwise.
  2056.                           type: string
  2057.                         serversTransport:
  2058.                           description: ServersTransport defines the name of ServersTransport
  2059.                             resource to use. It allows to configure the transport
  2060.                             between Traefik and your servers. Can only be used on
  2061.                             a Kubernetes Service.
  2062.                           type: string
  2063.                         sticky:
  2064.                           description: 'Sticky defines the sticky sessions configuration.
  2065.                             More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  2066.                           properties:
  2067.                             cookie:
  2068.                               description: Cookie defines the sticky cookie configuration.
  2069.                               properties:
  2070.                                 httpOnly:
  2071.                                   description: HTTPOnly defines whether the cookie
  2072.                                     can be accessed by client-side APIs, such as JavaScript.
  2073.                                   type: boolean
  2074.                                 name:
  2075.                                   description: Name defines the Cookie name.
  2076.                                   type: string
  2077.                                 sameSite:
  2078.                                   description: 'SameSite defines the same site policy.
  2079.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2080.                                   type: string
  2081.                                 secure:
  2082.                                   description: Secure defines whether the cookie can
  2083.                                     only be transmitted over an encrypted connection
  2084.                                     (i.e. HTTPS).
  2085.                                   type: boolean
  2086.                               type: object
  2087.                           type: object
  2088.                         strategy:
  2089.                           description: Strategy defines the load balancing strategy
  2090.                             between the servers. RoundRobin is the only supported
  2091.                             value at the moment.
  2092.                           type: string
  2093.                         weight:
  2094.                           description: Weight defines the weight and should only be
  2095.                             specified when Name references a TraefikService object
  2096.                             (and to be precise, one that embeds a Weighted Round Robin).
  2097.                           type: integer
  2098.                       required:
  2099.                       - name
  2100.                       type: object
  2101.                     type: array
  2102.                   name:
  2103.                     description: Name defines the name of the referenced Kubernetes
  2104.                       Service or TraefikService. The differentiation between the two
  2105.                       is specified in the Kind field.
  2106.                     type: string
  2107.                   namespace:
  2108.                     description: Namespace defines the namespace of the referenced
  2109.                       Kubernetes Service or TraefikService.
  2110.                     type: string
  2111.                   nativeLB:
  2112.                     description: NativeLB controls, when creating the load-balancer,
  2113.                       whether the LB's children are directly the pods IPs or if the
  2114.                       only child is the Kubernetes Service clusterIP. The Kubernetes
  2115.                       Service itself does load-balance to the pods. By default, NativeLB
  2116.                       is false.
  2117.                     type: boolean
  2118.                   passHostHeader:
  2119.                     description: PassHostHeader defines whether the client Host header
  2120.                       is forwarded to the upstream Kubernetes Service. By default,
  2121.                       passHostHeader is true.
  2122.                     type: boolean
  2123.                   port:
  2124.                     anyOf:
  2125.                     - type: integer
  2126.                     - type: string
  2127.                     description: Port defines the port of a Kubernetes Service. This
  2128.                       can be a reference to a named port.
  2129.                     x-kubernetes-int-or-string: true
  2130.                   responseForwarding:
  2131.                     description: ResponseForwarding defines how Traefik forwards the
  2132.                       response from the upstream Kubernetes Service to the client.
  2133.                     properties:
  2134.                       flushInterval:
  2135.                         description: 'FlushInterval defines the interval, in milliseconds,
  2136.                           in between flushes to the client while copying the response
  2137.                           body. A negative value means to flush immediately after
  2138.                           each write to the client. This configuration is ignored
  2139.                           when ReverseProxy recognizes a response as a streaming response;
  2140.                           for such responses, writes are flushed to the client immediately.
  2141.                           Default: 100ms'
  2142.                         type: string
  2143.                     type: object
  2144.                   scheme:
  2145.                     description: Scheme defines the scheme to use for the request
  2146.                       to the upstream Kubernetes Service. It defaults to https when
  2147.                       Kubernetes Service port is 443, http otherwise.
  2148.                     type: string
  2149.                   serversTransport:
  2150.                     description: ServersTransport defines the name of ServersTransport
  2151.                       resource to use. It allows to configure the transport between
  2152.                       Traefik and your servers. Can only be used on a Kubernetes Service.
  2153.                     type: string
  2154.                   sticky:
  2155.                     description: 'Sticky defines the sticky sessions configuration.
  2156.                       More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  2157.                     properties:
  2158.                       cookie:
  2159.                         description: Cookie defines the sticky cookie configuration.
  2160.                         properties:
  2161.                           httpOnly:
  2162.                             description: HTTPOnly defines whether the cookie can be
  2163.                               accessed by client-side APIs, such as JavaScript.
  2164.                             type: boolean
  2165.                           name:
  2166.                             description: Name defines the Cookie name.
  2167.                             type: string
  2168.                           sameSite:
  2169.                             description: 'SameSite defines the same site policy. More
  2170.                               info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2171.                             type: string
  2172.                           secure:
  2173.                             description: Secure defines whether the cookie can only
  2174.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2175.                             type: boolean
  2176.                         type: object
  2177.                     type: object
  2178.                   strategy:
  2179.                     description: Strategy defines the load balancing strategy between
  2180.                       the servers. RoundRobin is the only supported value at the moment.
  2181.                     type: string
  2182.                   weight:
  2183.                     description: Weight defines the weight and should only be specified
  2184.                       when Name references a TraefikService object (and to be precise,
  2185.                       one that embeds a Weighted Round Robin).
  2186.                     type: integer
  2187.                 required:
  2188.                 - name
  2189.                 type: object
  2190.               weighted:
  2191.                 description: Weighted defines the Weighted Round Robin configuration.
  2192.                 properties:
  2193.                   services:
  2194.                     description: Services defines the list of Kubernetes Service and/or
  2195.                       TraefikService to load-balance, with weight.
  2196.                     items:
  2197.                       description: Service defines an upstream HTTP service to proxy
  2198.                         traffic to.
  2199.                       properties:
  2200.                         kind:
  2201.                           description: Kind defines the kind of the Service.
  2202.                           enum:
  2203.                           - Service
  2204.                           - TraefikService
  2205.                           type: string
  2206.                         name:
  2207.                           description: Name defines the name of the referenced Kubernetes
  2208.                             Service or TraefikService. The differentiation between
  2209.                             the two is specified in the Kind field.
  2210.                           type: string
  2211.                         namespace:
  2212.                           description: Namespace defines the namespace of the referenced
  2213.                             Kubernetes Service or TraefikService.
  2214.                           type: string
  2215.                         nativeLB:
  2216.                           description: NativeLB controls, when creating the load-balancer,
  2217.                             whether the LB's children are directly the pods IPs or
  2218.                             if the only child is the Kubernetes Service clusterIP.
  2219.                             The Kubernetes Service itself does load-balance to the
  2220.                             pods. By default, NativeLB is false.
  2221.                           type: boolean
  2222.                         passHostHeader:
  2223.                           description: PassHostHeader defines whether the client Host
  2224.                             header is forwarded to the upstream Kubernetes Service.
  2225.                             By default, passHostHeader is true.
  2226.                           type: boolean
  2227.                         port:
  2228.                           anyOf:
  2229.                           - type: integer
  2230.                           - type: string
  2231.                           description: Port defines the port of a Kubernetes Service.
  2232.                             This can be a reference to a named port.
  2233.                           x-kubernetes-int-or-string: true
  2234.                         responseForwarding:
  2235.                           description: ResponseForwarding defines how Traefik forwards
  2236.                             the response from the upstream Kubernetes Service to the
  2237.                             client.
  2238.                           properties:
  2239.                             flushInterval:
  2240.                               description: 'FlushInterval defines the interval, in
  2241.                                 milliseconds, in between flushes to the client while
  2242.                                 copying the response body. A negative value means
  2243.                                 to flush immediately after each write to the client.
  2244.                                 This configuration is ignored when ReverseProxy recognizes
  2245.                                 a response as a streaming response; for such responses,
  2246.                                 writes are flushed to the client immediately. Default:
  2247.                                 100ms'
  2248.                               type: string
  2249.                           type: object
  2250.                         scheme:
  2251.                           description: Scheme defines the scheme to use for the request
  2252.                             to the upstream Kubernetes Service. It defaults to https
  2253.                             when Kubernetes Service port is 443, http otherwise.
  2254.                           type: string
  2255.                         serversTransport:
  2256.                           description: ServersTransport defines the name of ServersTransport
  2257.                             resource to use. It allows to configure the transport
  2258.                             between Traefik and your servers. Can only be used on
  2259.                             a Kubernetes Service.
  2260.                           type: string
  2261.                         sticky:
  2262.                           description: 'Sticky defines the sticky sessions configuration.
  2263.                             More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  2264.                           properties:
  2265.                             cookie:
  2266.                               description: Cookie defines the sticky cookie configuration.
  2267.                               properties:
  2268.                                 httpOnly:
  2269.                                   description: HTTPOnly defines whether the cookie
  2270.                                     can be accessed by client-side APIs, such as JavaScript.
  2271.                                   type: boolean
  2272.                                 name:
  2273.                                   description: Name defines the Cookie name.
  2274.                                   type: string
  2275.                                 sameSite:
  2276.                                   description: 'SameSite defines the same site policy.
  2277.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2278.                                   type: string
  2279.                                 secure:
  2280.                                   description: Secure defines whether the cookie can
  2281.                                     only be transmitted over an encrypted connection
  2282.                                     (i.e. HTTPS).
  2283.                                   type: boolean
  2284.                               type: object
  2285.                           type: object
  2286.                         strategy:
  2287.                           description: Strategy defines the load balancing strategy
  2288.                             between the servers. RoundRobin is the only supported
  2289.                             value at the moment.
  2290.                           type: string
  2291.                         weight:
  2292.                           description: Weight defines the weight and should only be
  2293.                             specified when Name references a TraefikService object
  2294.                             (and to be precise, one that embeds a Weighted Round Robin).
  2295.                           type: integer
  2296.                       required:
  2297.                       - name
  2298.                       type: object
  2299.                     type: array
  2300.                   sticky:
  2301.                     description: 'Sticky defines whether sticky sessions are enabled.
  2302.                       More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#stickiness-and-load-balancing'
  2303.                     properties:
  2304.                       cookie:
  2305.                         description: Cookie defines the sticky cookie configuration.
  2306.                         properties:
  2307.                           httpOnly:
  2308.                             description: HTTPOnly defines whether the cookie can be
  2309.                               accessed by client-side APIs, such as JavaScript.
  2310.                             type: boolean
  2311.                           name:
  2312.                             description: Name defines the Cookie name.
  2313.                             type: string
  2314.                           sameSite:
  2315.                             description: 'SameSite defines the same site policy. More
  2316.                               info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2317.                             type: string
  2318.                           secure:
  2319.                             description: Secure defines whether the cookie can only
  2320.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2321.                             type: boolean
  2322.                         type: object
  2323.                     type: object
  2324.                 type: object
  2325.             type: object
  2326.         required:
  2327.         - metadata
  2328.         - spec
  2329.         type: object
  2330.     served: true
  2331.     storage: true
  2332. status:
  2333.   acceptedNames:
  2334.     kind: ""
  2335.     plural: ""
  2336.   conditions: []
  2337.   storedVersions: []
  2339. ---
  2340. apiVersion: apiextensions.k8s.io/v1
  2341. kind: CustomResourceDefinition
  2342. metadata:
  2343.   annotations:
  2344.     controller-gen.kubebuilder.io/version: v0.6.2
  2345.   creationTimestamp: null
  2346.   name: ingressroutes.traefik.containo.us
  2347. spec:
  2348.   group: traefik.containo.us
  2349.   names:
  2350.     kind: IngressRoute
  2351.     listKind: IngressRouteList
  2352.     plural: ingressroutes
  2353.     singular: ingressroute
  2354.   scope: Namespaced
  2355.   versions:
  2356.   - name: v1alpha1
  2357.     schema:
  2358.       openAPIV3Schema:
  2359.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  2360.         properties:
  2361.           apiVersion:
  2362.             description: 'APIVersion defines the versioned schema of this representation
  2363.               of an object. Servers should convert recognized schemas to the latest
  2364.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2365.             type: string
  2366.           kind:
  2367.             description: 'Kind is a string value representing the REST resource this
  2368.               object represents. Servers may infer this from the endpoint the client
  2369.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2370.             type: string
  2371.           metadata:
  2372.             type: object
  2373.           spec:
  2374.             description: IngressRouteSpec defines the desired state of IngressRoute.
  2375.             properties:
  2376.               entryPoints:
  2377.                 description: 'EntryPoints defines the list of entry point names to
  2378.                   bind to. Entry points have to be configured in the static configuration.
  2379.                   More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/
  2380.                   Default: all.'
  2381.                 items:
  2382.                   type: string
  2383.                 type: array
  2384.               routes:
  2385.                 description: Routes defines the list of routes.
  2386.                 items:
  2387.                   description: Route holds the HTTP route configuration.
  2388.                   properties:
  2389.                     kind:
  2390.                       description: Kind defines the kind of the route. Rule is the
  2391.                         only supported kind.
  2392.                       enum:
  2393.                       - Rule
  2394.                       type: string
  2395.                     match:
  2396.                       description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#rule'
  2397.                       type: string
  2398.                     middlewares:
  2399.                       description: 'Middlewares defines the list of references to
  2400.                         Middleware resources. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-middleware'
  2401.                       items:
  2402.                         description: MiddlewareRef is a reference to a Middleware
  2403.                           resource.
  2404.                         properties:
  2405.                           name:
  2406.                             description: Name defines the name of the referenced Middleware
  2407.                               resource.
  2408.                             type: string
  2409.                           namespace:
  2410.                             description: Namespace defines the namespace of the referenced
  2411.                               Middleware resource.
  2412.                             type: string
  2413.                         required:
  2414.                         - name
  2415.                         type: object
  2416.                       type: array
  2417.                     priority:
  2418.                       description: 'Priority defines the router''s priority. More
  2419.                         info: https://doc.traefik.io/traefik/v2.10/routing/routers/#priority'
  2420.                       type: integer
  2421.                     services:
  2422.                       description: Services defines the list of Service. It can contain
  2423.                         any combination of TraefikService and/or reference to a Kubernetes
  2424.                         Service.
  2425.                       items:
  2426.                         description: Service defines an upstream HTTP service to proxy
  2427.                           traffic to.
  2428.                         properties:
  2429.                           kind:
  2430.                             description: Kind defines the kind of the Service.
  2431.                             enum:
  2432.                             - Service
  2433.                             - TraefikService
  2434.                             type: string
  2435.                           name:
  2436.                             description: Name defines the name of the referenced Kubernetes
  2437.                               Service or TraefikService. The differentiation between
  2438.                               the two is specified in the Kind field.
  2439.                             type: string
  2440.                           namespace:
  2441.                             description: Namespace defines the namespace of the referenced
  2442.                               Kubernetes Service or TraefikService.
  2443.                             type: string
  2444.                           nativeLB:
  2445.                             description: NativeLB controls, when creating the load-balancer,
  2446.                               whether the LB's children are directly the pods IPs
  2447.                               or if the only child is the Kubernetes Service clusterIP.
  2448.                               The Kubernetes Service itself does load-balance to the
  2449.                               pods. By default, NativeLB is false.
  2450.                             type: boolean
  2451.                           passHostHeader:
  2452.                             description: PassHostHeader defines whether the client
  2453.                               Host header is forwarded to the upstream Kubernetes
  2454.                               Service. By default, passHostHeader is true.
  2455.                             type: boolean
  2456.                           port:
  2457.                             anyOf:
  2458.                             - type: integer
  2459.                             - type: string
  2460.                             description: Port defines the port of a Kubernetes Service.
  2461.                               This can be a reference to a named port.
  2462.                             x-kubernetes-int-or-string: true
  2463.                           responseForwarding:
  2464.                             description: ResponseForwarding defines how Traefik forwards
  2465.                               the response from the upstream Kubernetes Service to
  2466.                               the client.
  2467.                             properties:
  2468.                               flushInterval:
  2469.                                 description: 'FlushInterval defines the interval,
  2470.                                   in milliseconds, in between flushes to the client
  2471.                                   while copying the response body. A negative value
  2472.                                   means to flush immediately after each write to the
  2473.                                   client. This configuration is ignored when ReverseProxy
  2474.                                   recognizes a response as a streaming response; for
  2475.                                   such responses, writes are flushed to the client
  2476.                                   immediately. Default: 100ms'
  2477.                                 type: string
  2478.                             type: object
  2479.                           scheme:
  2480.                             description: Scheme defines the scheme to use for the
  2481.                               request to the upstream Kubernetes Service. It defaults
  2482.                               to https when Kubernetes Service port is 443, http otherwise.
  2483.                             type: string
  2484.                           serversTransport:
  2485.                             description: ServersTransport defines the name of ServersTransport
  2486.                               resource to use. It allows to configure the transport
  2487.                               between Traefik and your servers. Can only be used on
  2488.                               a Kubernetes Service.
  2489.                             type: string
  2490.                           sticky:
  2491.                             description: 'Sticky defines the sticky sessions configuration.
  2492.                               More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  2493.                             properties:
  2494.                               cookie:
  2495.                                 description: Cookie defines the sticky cookie configuration.
  2496.                                 properties:
  2497.                                   httpOnly:
  2498.                                     description: HTTPOnly defines whether the cookie
  2499.                                       can be accessed by client-side APIs, such as
  2500.                                       JavaScript.
  2501.                                     type: boolean
  2502.                                   name:
  2503.                                     description: Name defines the Cookie name.
  2504.                                     type: string
  2505.                                   sameSite:
  2506.                                     description: 'SameSite defines the same site policy.
  2507.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2508.                                     type: string
  2509.                                   secure:
  2510.                                     description: Secure defines whether the cookie
  2511.                                       can only be transmitted over an encrypted connection
  2512.                                       (i.e. HTTPS).
  2513.                                     type: boolean
  2514.                                 type: object
  2515.                             type: object
  2516.                           strategy:
  2517.                             description: Strategy defines the load balancing strategy
  2518.                               between the servers. RoundRobin is the only supported
  2519.                               value at the moment.
  2520.                             type: string
  2521.                           weight:
  2522.                             description: Weight defines the weight and should only
  2523.                               be specified when Name references a TraefikService object
  2524.                               (and to be precise, one that embeds a Weighted Round
  2525.                               Robin).
  2526.                             type: integer
  2527.                         required:
  2528.                         - name
  2529.                         type: object
  2530.                       type: array
  2531.                   required:
  2532.                   - kind
  2533.                   - match
  2534.                   type: object
  2535.                 type: array
  2536.               tls:
  2537.                 description: 'TLS defines the TLS configuration. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#tls'
  2538.                 properties:
  2539.                   certResolver:
  2540.                     description: 'CertResolver defines the name of the certificate
  2541.                       resolver to use. Cert resolvers have to be configured in the
  2542.                       static configuration. More info: https://doc.traefik.io/traefik/v2.10/https/acme/#certificate-resolvers'
  2543.                     type: string
  2544.                   domains:
  2545.                     description: 'Domains defines the list of domains that will be
  2546.                       used to issue certificates. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#domains'
  2547.                     items:
  2548.                       description: Domain holds a domain name with SANs.
  2549.                       properties:
  2550.                         main:
  2551.                           description: Main defines the main domain name.
  2552.                           type: string
  2553.                         sans:
  2554.                           description: SANs defines the subject alternative domain
  2555.                             names.
  2556.                           items:
  2557.                             type: string
  2558.                           type: array
  2559.                       type: object
  2560.                     type: array
  2561.                   options:
  2562.                     description: 'Options defines the reference to a TLSOption, that
  2563.                       specifies the parameters of the TLS connection. If not defined,
  2564.                       the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options'
  2565.                     properties:
  2566.                       name:
  2567.                         description: 'Name defines the name of the referenced TLSOption.
  2568.                           More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsoption'
  2569.                         type: string
  2570.                       namespace:
  2571.                         description: 'Namespace defines the namespace of the referenced
  2572.                           TLSOption. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsoption'
  2573.                         type: string
  2574.                     required:
  2575.                     - name
  2576.                     type: object
  2577.                   secretName:
  2578.                     description: SecretName is the name of the referenced Kubernetes
  2579.                       Secret to specify the certificate details.
  2580.                     type: string
  2581.                   store:
  2582.                     description: Store defines the reference to the TLSStore, that
  2583.                       will be used to store certificates. Please note that only `default`
  2584.                       TLSStore can be used.
  2585.                     properties:
  2586.                       name:
  2587.                         description: 'Name defines the name of the referenced TLSStore.
  2588.                           More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsstore'
  2589.                         type: string
  2590.                       namespace:
  2591.                         description: 'Namespace defines the namespace of the referenced
  2592.                           TLSStore. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsstore'
  2593.                         type: string
  2594.                     required:
  2595.                     - name
  2596.                     type: object
  2597.                 type: object
  2598.             required:
  2599.             - routes
  2600.             type: object
  2601.         required:
  2602.         - metadata
  2603.         - spec
  2604.         type: object
  2605.     served: true
  2606.     storage: true
  2607. status:
  2608.   acceptedNames:
  2609.     kind: ""
  2610.     plural: ""
  2611.   conditions: []
  2612.   storedVersions: []
  2614. ---
  2615. apiVersion: apiextensions.k8s.io/v1
  2616. kind: CustomResourceDefinition
  2617. metadata:
  2618.   annotations:
  2619.     controller-gen.kubebuilder.io/version: v0.6.2
  2620.   creationTimestamp: null
  2621.   name: ingressroutetcps.traefik.containo.us
  2622. spec:
  2623.   group: traefik.containo.us
  2624.   names:
  2625.     kind: IngressRouteTCP
  2626.     listKind: IngressRouteTCPList
  2627.     plural: ingressroutetcps
  2628.     singular: ingressroutetcp
  2629.   scope: Namespaced
  2630.   versions:
  2631.   - name: v1alpha1
  2632.     schema:
  2633.       openAPIV3Schema:
  2634.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  2635.         properties:
  2636.           apiVersion:
  2637.             description: 'APIVersion defines the versioned schema of this representation
  2638.               of an object. Servers should convert recognized schemas to the latest
  2639.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2640.             type: string
  2641.           kind:
  2642.             description: 'Kind is a string value representing the REST resource this
  2643.               object represents. Servers may infer this from the endpoint the client
  2644.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2645.             type: string
  2646.           metadata:
  2647.             type: object
  2648.           spec:
  2649.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  2650.             properties:
  2651.               entryPoints:
  2652.                 description: 'EntryPoints defines the list of entry point names to
  2653.                   bind to. Entry points have to be configured in the static configuration.
  2654.                   More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/
  2655.                   Default: all.'
  2656.                 items:
  2657.                   type: string
  2658.                 type: array
  2659.               routes:
  2660.                 description: Routes defines the list of routes.
  2661.                 items:
  2662.                   description: RouteTCP holds the TCP route configuration.
  2663.                   properties:
  2664.                     match:
  2665.                       description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#rule_1'
  2666.                       type: string
  2667.                     middlewares:
  2668.                       description: Middlewares defines the list of references to MiddlewareTCP
  2669.                         resources.
  2670.                       items:
  2671.                         description: ObjectReference is a generic reference to a Traefik
  2672.                           resource.
  2673.                         properties:
  2674.                           name:
  2675.                             description: Name defines the name of the referenced Traefik
  2676.                               resource.
  2677.                             type: string
  2678.                           namespace:
  2679.                             description: Namespace defines the namespace of the referenced
  2680.                               Traefik resource.
  2681.                             type: string
  2682.                         required:
  2683.                         - name
  2684.                         type: object
  2685.                       type: array
  2686.                     priority:
  2687.                       description: 'Priority defines the router''s priority. More
  2688.                         info: https://doc.traefik.io/traefik/v2.10/routing/routers/#priority_1'
  2689.                       type: integer
  2690.                     services:
  2691.                       description: Services defines the list of TCP services.
  2692.                       items:
  2693.                         description: ServiceTCP defines an upstream TCP service to
  2694.                           proxy traffic to.
  2695.                         properties:
  2696.                           name:
  2697.                             description: Name defines the name of the referenced Kubernetes
  2698.                               Service.
  2699.                             type: string
  2700.                           namespace:
  2701.                             description: Namespace defines the namespace of the referenced
  2702.                               Kubernetes Service.
  2703.                             type: string
  2704.                           nativeLB:
  2705.                             description: NativeLB controls, when creating the load-balancer,
  2706.                               whether the LB's children are directly the pods IPs
  2707.                               or if the only child is the Kubernetes Service clusterIP.
  2708.                               The Kubernetes Service itself does load-balance to the
  2709.                               pods. By default, NativeLB is false.
  2710.                             type: boolean
  2711.                           port:
  2712.                             anyOf:
  2713.                             - type: integer
  2714.                             - type: string
  2715.                             description: Port defines the port of a Kubernetes Service.
  2716.                               This can be a reference to a named port.
  2717.                             x-kubernetes-int-or-string: true
  2718.                           proxyProtocol:
  2719.                             description: 'ProxyProtocol defines the PROXY protocol
  2720.                               configuration. More info: https://doc.traefik.io/traefik/v2.10/routing/services/#proxy-protocol'
  2721.                             properties:
  2722.                               version:
  2723.                                 description: Version defines the PROXY Protocol version
  2724.                                   to use.
  2725.                                 type: integer
  2726.                             type: object
  2727.                           terminationDelay:
  2728.                             description: TerminationDelay defines the deadline that
  2729.                               the proxy sets, after one of its connected peers indicates
  2730.                               it has closed the writing capability of its connection,
  2731.                               to close the reading capability as well, hence fully
  2732.                               terminating the connection. It is a duration in milliseconds,
  2733.                               defaulting to 100. A negative value means an infinite
  2734.                               deadline (i.e. the reading capability is never closed).
  2735.                             type: integer
  2736.                           weight:
  2737.                             description: Weight defines the weight used when balancing
  2738.                               requests between multiple Kubernetes Service.
  2739.                             type: integer
  2740.                         required:
  2741.                         - name
  2742.                         - port
  2743.                         type: object
  2744.                       type: array
  2745.                   required:
  2746.                   - match
  2747.                   type: object
  2748.                 type: array
  2749.               tls:
  2750.                 description: 'TLS defines the TLS configuration on a layer 4 / TCP
  2751.                   Route. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#tls_1'
  2752.                 properties:
  2753.                   certResolver:
  2754.                     description: 'CertResolver defines the name of the certificate
  2755.                       resolver to use. Cert resolvers have to be configured in the
  2756.                       static configuration. More info: https://doc.traefik.io/traefik/v2.10/https/acme/#certificate-resolvers'
  2757.                     type: string
  2758.                   domains:
  2759.                     description: 'Domains defines the list of domains that will be
  2760.                       used to issue certificates. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#domains'
  2761.                     items:
  2762.                       description: Domain holds a domain name with SANs.
  2763.                       properties:
  2764.                         main:
  2765.                           description: Main defines the main domain name.
  2766.                           type: string
  2767.                         sans:
  2768.                           description: SANs defines the subject alternative domain
  2769.                             names.
  2770.                           items:
  2771.                             type: string
  2772.                           type: array
  2773.                       type: object
  2774.                     type: array
  2775.                   options:
  2776.                     description: 'Options defines the reference to a TLSOption, that
  2777.                       specifies the parameters of the TLS connection. If not defined,
  2778.                       the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options'
  2779.                     properties:
  2780.                       name:
  2781.                         description: Name defines the name of the referenced Traefik
  2782.                           resource.
  2783.                         type: string
  2784.                       namespace:
  2785.                         description: Namespace defines the namespace of the referenced
  2786.                           Traefik resource.
  2787.                         type: string
  2788.                     required:
  2789.                     - name
  2790.                     type: object
  2791.                   passthrough:
  2792.                     description: Passthrough defines whether a TLS router will terminate
  2793.                       the TLS connection.
  2794.                     type: boolean
  2795.                   secretName:
  2796.                     description: SecretName is the name of the referenced Kubernetes
  2797.                       Secret to specify the certificate details.
  2798.                     type: string
  2799.                   store:
  2800.                     description: Store defines the reference to the TLSStore, that
  2801.                       will be used to store certificates. Please note that only `default`
  2802.                       TLSStore can be used.
  2803.                     properties:
  2804.                       name:
  2805.                         description: Name defines the name of the referenced Traefik
  2806.                           resource.
  2807.                         type: string
  2808.                       namespace:
  2809.                         description: Namespace defines the namespace of the referenced
  2810.                           Traefik resource.
  2811.                         type: string
  2812.                     required:
  2813.                     - name
  2814.                     type: object
  2815.                 type: object
  2816.             required:
  2817.             - routes
  2818.             type: object
  2819.         required:
  2820.         - metadata
  2821.         - spec
  2822.         type: object
  2823.     served: true
  2824.     storage: true
  2825. status:
  2826.   acceptedNames:
  2827.     kind: ""
  2828.     plural: ""
  2829.   conditions: []
  2830.   storedVersions: []
  2832. ---
  2833. apiVersion: apiextensions.k8s.io/v1
  2834. kind: CustomResourceDefinition
  2835. metadata:
  2836.   annotations:
  2837.     controller-gen.kubebuilder.io/version: v0.6.2
  2838.   creationTimestamp: null
  2839.   name: ingressrouteudps.traefik.containo.us
  2840. spec:
  2841.   group: traefik.containo.us
  2842.   names:
  2843.     kind: IngressRouteUDP
  2844.     listKind: IngressRouteUDPList
  2845.     plural: ingressrouteudps
  2846.     singular: ingressrouteudp
  2847.   scope: Namespaced
  2848.   versions:
  2849.   - name: v1alpha1
  2850.     schema:
  2851.       openAPIV3Schema:
  2852.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  2853.         properties:
  2854.           apiVersion:
  2855.             description: 'APIVersion defines the versioned schema of this representation
  2856.               of an object. Servers should convert recognized schemas to the latest
  2857.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2858.             type: string
  2859.           kind:
  2860.             description: 'Kind is a string value representing the REST resource this
  2861.               object represents. Servers may infer this from the endpoint the client
  2862.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2863.             type: string
  2864.           metadata:
  2865.             type: object
  2866.           spec:
  2867.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  2868.             properties:
  2869.               entryPoints:
  2870.                 description: 'EntryPoints defines the list of entry point names to
  2871.                   bind to. Entry points have to be configured in the static configuration.
  2872.                   More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/
  2873.                   Default: all.'
  2874.                 items:
  2875.                   type: string
  2876.                 type: array
  2877.               routes:
  2878.                 description: Routes defines the list of routes.
  2879.                 items:
  2880.                   description: RouteUDP holds the UDP route configuration.
  2881.                   properties:
  2882.                     services:
  2883.                       description: Services defines the list of UDP services.
  2884.                       items:
  2885.                         description: ServiceUDP defines an upstream UDP service to
  2886.                           proxy traffic to.
  2887.                         properties:
  2888.                           name:
  2889.                             description: Name defines the name of the referenced Kubernetes
  2890.                               Service.
  2891.                             type: string
  2892.                           namespace:
  2893.                             description: Namespace defines the namespace of the referenced
  2894.                               Kubernetes Service.
  2895.                             type: string
  2896.                           nativeLB:
  2897.                             description: NativeLB controls, when creating the load-balancer,
  2898.                               whether the LB's children are directly the pods IPs
  2899.                               or if the only child is the Kubernetes Service clusterIP.
  2900.                               The Kubernetes Service itself does load-balance to the
  2901.                               pods. By default, NativeLB is false.
  2902.                             type: boolean
  2903.                           port:
  2904.                             anyOf:
  2905.                             - type: integer
  2906.                             - type: string
  2907.                             description: Port defines the port of a Kubernetes Service.
  2908.                               This can be a reference to a named port.
  2909.                             x-kubernetes-int-or-string: true
  2910.                           weight:
  2911.                             description: Weight defines the weight used when balancing
  2912.                               requests between multiple Kubernetes Service.
  2913.                             type: integer
  2914.                         required:
  2915.                         - name
  2916.                         - port
  2917.                         type: object
  2918.                       type: array
  2919.                   type: object
  2920.                 type: array
  2921.             required:
  2922.             - routes
  2923.             type: object
  2924.         required:
  2925.         - metadata
  2926.         - spec
  2927.         type: object
  2928.     served: true
  2929.     storage: true
  2930. status:
  2931.   acceptedNames:
  2932.     kind: ""
  2933.     plural: ""
  2934.   conditions: []
  2935.   storedVersions: []
  2937. ---
  2938. apiVersion: apiextensions.k8s.io/v1
  2939. kind: CustomResourceDefinition
  2940. metadata:
  2941.   annotations:
  2942.     controller-gen.kubebuilder.io/version: v0.6.2
  2943.   creationTimestamp: null
  2944.   name: middlewares.traefik.containo.us
  2945. spec:
  2946.   group: traefik.containo.us
  2947.   names:
  2948.     kind: Middleware
  2949.     listKind: MiddlewareList
  2950.     plural: middlewares
  2951.     singular: middleware
  2952.   scope: Namespaced
  2953.   versions:
  2954.   - name: v1alpha1
  2955.     schema:
  2956.       openAPIV3Schema:
  2957.         description: 'Middleware is the CRD implementation of a Traefik Middleware.
  2958.           More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/overview/'
  2959.         properties:
  2960.           apiVersion:
  2961.             description: 'APIVersion defines the versioned schema of this representation
  2962.               of an object. Servers should convert recognized schemas to the latest
  2963.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  2964.             type: string
  2965.           kind:
  2966.             description: 'Kind is a string value representing the REST resource this
  2967.               object represents. Servers may infer this from the endpoint the client
  2968.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  2969.             type: string
  2970.           metadata:
  2971.             type: object
  2972.           spec:
  2973.             description: MiddlewareSpec defines the desired state of a Middleware.
  2974.             properties:
  2975.               addPrefix:
  2976.                 description: 'AddPrefix holds the add prefix middleware configuration.
  2977.                   This middleware updates the path of a request before forwarding
  2978.                   it. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/addprefix/'
  2979.                 properties:
  2980.                   prefix:
  2981.                     description: Prefix is the string to add before the current path
  2982.                       in the requested URL. It should include a leading slash (/).
  2983.                     type: string
  2984.                 type: object
  2985.               basicAuth:
  2986.                 description: 'BasicAuth holds the basic auth middleware configuration.
  2987.                   This middleware restricts access to your services to known users.
  2988.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/'
  2989.                 properties:
  2990.                   headerField:
  2991.                     description: 'HeaderField defines a header field to store the
  2992.                       authenticated user. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/#headerfield'
  2993.                     type: string
  2994.                   realm:
  2995.                     description: 'Realm allows the protected resources on a server
  2996.                       to be partitioned into a set of protection spaces, each with
  2997.                       its own authentication scheme. Default: traefik.'
  2998.                     type: string
  2999.                   removeHeader:
  3000.                     description: 'RemoveHeader sets the removeHeader option to true
  3001.                       to remove the authorization header before forwarding the request
  3002.                       to your service. Default: false.'
  3003.                     type: boolean
  3004.                   secret:
  3005.                     description: Secret is the name of the referenced Kubernetes Secret
  3006.                       containing user credentials.
  3007.                     type: string
  3008.                 type: object
  3009.               buffering:
  3010.                 description: 'Buffering holds the buffering middleware configuration.
  3011.                   This middleware retries or limits the size of requests that can
  3012.                   be forwarded to backends. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/buffering/#maxrequestbodybytes'
  3013.                 properties:
  3014.                   maxRequestBodyBytes:
  3015.                     description: 'MaxRequestBodyBytes defines the maximum allowed
  3016.                       body size for the request (in bytes). If the request exceeds
  3017.                       the allowed size, it is not forwarded to the service, and the
  3018.                       client gets a 413 (Request Entity Too Large) response. Default:
  3019.                       0 (no maximum).'
  3020.                     format: int64
  3021.                     type: integer
  3022.                   maxResponseBodyBytes:
  3023.                     description: 'MaxResponseBodyBytes defines the maximum allowed
  3024.                       response size from the service (in bytes). If the response exceeds
  3025.                       the allowed size, it is not forwarded to the client. The client
  3026.                       gets a 500 (Internal Server Error) response instead. Default:
  3027.                       0 (no maximum).'
  3028.                     format: int64
  3029.                     type: integer
  3030.                   memRequestBodyBytes:
  3031.                     description: 'MemRequestBodyBytes defines the threshold (in bytes)
  3032.                       from which the request will be buffered on disk instead of in
  3033.                       memory. Default: 1048576 (1Mi).'
  3034.                     format: int64
  3035.                     type: integer
  3036.                   memResponseBodyBytes:
  3037.                     description: 'MemResponseBodyBytes defines the threshold (in bytes)
  3038.                       from which the response will be buffered on disk instead of
  3039.                       in memory. Default: 1048576 (1Mi).'
  3040.                     format: int64
  3041.                     type: integer
  3042.                   retryExpression:
  3043.                     description: 'RetryExpression defines the retry conditions. It
  3044.                       is a logical combination of functions with operators AND (&&)
  3045.                       and OR (||). More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/buffering/#retryexpression'
  3046.                     type: string
  3047.                 type: object
  3048.               chain:
  3049.                 description: 'Chain holds the configuration of the chain middleware.
  3050.                   This middleware enables to define reusable combinations of other
  3051.                   pieces of middleware. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/chain/'
  3052.                 properties:
  3053.                   middlewares:
  3054.                     description: Middlewares is the list of MiddlewareRef which composes
  3055.                       the chain.
  3056.                     items:
  3057.                       description: MiddlewareRef is a reference to a Middleware resource.
  3058.                       properties:
  3059.                         name:
  3060.                           description: Name defines the name of the referenced Middleware
  3061.                             resource.
  3062.                           type: string
  3063.                         namespace:
  3064.                           description: Namespace defines the namespace of the referenced
  3065.                             Middleware resource.
  3066.                           type: string
  3067.                       required:
  3068.                       - name
  3069.                       type: object
  3070.                     type: array
  3071.                 type: object
  3072.               circuitBreaker:
  3073.                 description: CircuitBreaker holds the circuit breaker configuration.
  3074.                 properties:
  3075.                   checkPeriod:
  3076.                     anyOf:
  3077.                     - type: integer
  3078.                     - type: string
  3079.                     description: CheckPeriod is the interval between successive checks
  3080.                       of the circuit breaker condition (when in standby state).
  3081.                     x-kubernetes-int-or-string: true
  3082.                   expression:
  3083.                     description: Expression is the condition that triggers the tripped
  3084.                       state.
  3085.                     type: string
  3086.                   fallbackDuration:
  3087.                     anyOf:
  3088.                     - type: integer
  3089.                     - type: string
  3090.                     description: FallbackDuration is the duration for which the circuit
  3091.                       breaker will wait before trying to recover (from a tripped state).
  3092.                     x-kubernetes-int-or-string: true
  3093.                   recoveryDuration:
  3094.                     anyOf:
  3095.                     - type: integer
  3096.                     - type: string
  3097.                     description: RecoveryDuration is the duration for which the circuit
  3098.                       breaker will try to recover (as soon as it is in recovering
  3099.                       state).
  3100.                     x-kubernetes-int-or-string: true
  3101.                 type: object
  3102.               compress:
  3103.                 description: 'Compress holds the compress middleware configuration.
  3104.                   This middleware compresses responses before sending them to the
  3105.                   client, using gzip compression. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/compress/'
  3106.                 properties:
  3107.                   excludedContentTypes:
  3108.                     description: ExcludedContentTypes defines the list of content
  3109.                       types to compare the Content-Type header of the incoming requests
  3110.                       and responses before compressing.
  3111.                     items:
  3112.                       type: string
  3113.                     type: array
  3114.                   minResponseBodyBytes:
  3115.                     description: 'MinResponseBodyBytes defines the minimum amount
  3116.                       of bytes a response body must have to be compressed. Default:
  3117.                       1024.'
  3118.                     type: integer
  3119.                 type: object
  3120.               contentType:
  3121.                 description: ContentType holds the content-type middleware configuration.
  3122.                   This middleware exists to enable the correct behavior until at least
  3123.                   the default one can be changed in a future version.
  3124.                 properties:
  3125.                   autoDetect:
  3126.                     description: AutoDetect specifies whether to let the `Content-Type`
  3127.                       header, if it has not been set by the backend, be automatically
  3128.                       set to a value derived from the contents of the response. As
  3129.                       a proxy, the default behavior should be to leave the header
  3130.                       alone, regardless of what the backend did with it. However,
  3131.                       the historic default was to always auto-detect and set the header
  3132.                       if it was nil, and it is going to be kept that way in order
  3133.                       to support users currently relying on it.
  3134.                     type: boolean
  3135.                 type: object
  3136.               digestAuth:
  3137.                 description: 'DigestAuth holds the digest auth middleware configuration.
  3138.                   This middleware restricts access to your services to known users.
  3139.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/digestauth/'
  3140.                 properties:
  3141.                   headerField:
  3142.                     description: 'HeaderField defines a header field to store the
  3143.                       authenticated user. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/#headerfield'
  3144.                     type: string
  3145.                   realm:
  3146.                     description: 'Realm allows the protected resources on a server
  3147.                       to be partitioned into a set of protection spaces, each with
  3148.                       its own authentication scheme. Default: traefik.'
  3149.                     type: string
  3150.                   removeHeader:
  3151.                     description: RemoveHeader defines whether to remove the authorization
  3152.                       header before forwarding the request to the backend.
  3153.                     type: boolean
  3154.                   secret:
  3155.                     description: Secret is the name of the referenced Kubernetes Secret
  3156.                       containing user credentials.
  3157.                     type: string
  3158.                 type: object
  3159.               errors:
  3160.                 description: 'ErrorPage holds the custom error middleware configuration.
  3161.                   This middleware returns a custom page in lieu of the default, according
  3162.                   to configured ranges of HTTP Status codes. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/errorpages/'
  3163.                 properties:
  3164.                   query:
  3165.                     description: Query defines the URL for the error page (hosted
  3166.                       by service). The {status} variable can be used in order to insert
  3167.                       the status code in the URL.
  3168.                     type: string
  3169.                   service:
  3170.                     description: 'Service defines the reference to a Kubernetes Service
  3171.                       that will serve the error page. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/errorpages/#service'
  3172.                     properties:
  3173.                       kind:
  3174.                         description: Kind defines the kind of the Service.
  3175.                         enum:
  3176.                         - Service
  3177.                         - TraefikService
  3178.                         type: string
  3179.                       name:
  3180.                         description: Name defines the name of the referenced Kubernetes
  3181.                           Service or TraefikService. The differentiation between the
  3182.                           two is specified in the Kind field.
  3183.                         type: string
  3184.                       namespace:
  3185.                         description: Namespace defines the namespace of the referenced
  3186.                           Kubernetes Service or TraefikService.
  3187.                         type: string
  3188.                       nativeLB:
  3189.                         description: NativeLB controls, when creating the load-balancer,
  3190.                           whether the LB's children are directly the pods IPs or if
  3191.                           the only child is the Kubernetes Service clusterIP. The
  3192.                           Kubernetes Service itself does load-balance to the pods.
  3193.                           By default, NativeLB is false.
  3194.                         type: boolean
  3195.                       passHostHeader:
  3196.                         description: PassHostHeader defines whether the client Host
  3197.                           header is forwarded to the upstream Kubernetes Service.
  3198.                           By default, passHostHeader is true.
  3199.                         type: boolean
  3200.                       port:
  3201.                         anyOf:
  3202.                         - type: integer
  3203.                         - type: string
  3204.                         description: Port defines the port of a Kubernetes Service.
  3205.                           This can be a reference to a named port.
  3206.                         x-kubernetes-int-or-string: true
  3207.                       responseForwarding:
  3208.                         description: ResponseForwarding defines how Traefik forwards
  3209.                           the response from the upstream Kubernetes Service to the
  3210.                           client.
  3211.                         properties:
  3212.                           flushInterval:
  3213.                             description: 'FlushInterval defines the interval, in milliseconds,
  3214.                               in between flushes to the client while copying the response
  3215.                               body. A negative value means to flush immediately after
  3216.                               each write to the client. This configuration is ignored
  3217.                               when ReverseProxy recognizes a response as a streaming
  3218.                               response; for such responses, writes are flushed to
  3219.                               the client immediately. Default: 100ms'
  3220.                             type: string
  3221.                         type: object
  3222.                       scheme:
  3223.                         description: Scheme defines the scheme to use for the request
  3224.                           to the upstream Kubernetes Service. It defaults to https
  3225.                           when Kubernetes Service port is 443, http otherwise.
  3226.                         type: string
  3227.                       serversTransport:
  3228.                         description: ServersTransport defines the name of ServersTransport
  3229.                           resource to use. It allows to configure the transport between
  3230.                           Traefik and your servers. Can only be used on a Kubernetes
  3231.                           Service.
  3232.                         type: string
  3233.                       sticky:
  3234.                         description: 'Sticky defines the sticky sessions configuration.
  3235.                           More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  3236.                         properties:
  3237.                           cookie:
  3238.                             description: Cookie defines the sticky cookie configuration.
  3239.                             properties:
  3240.                               httpOnly:
  3241.                                 description: HTTPOnly defines whether the cookie can
  3242.                                   be accessed by client-side APIs, such as JavaScript.
  3243.                                 type: boolean
  3244.                               name:
  3245.                                 description: Name defines the Cookie name.
  3246.                                 type: string
  3247.                               sameSite:
  3248.                                 description: 'SameSite defines the same site policy.
  3249.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  3250.                                 type: string
  3251.                               secure:
  3252.                                 description: Secure defines whether the cookie can
  3253.                                   only be transmitted over an encrypted connection
  3254.                                   (i.e. HTTPS).
  3255.                                 type: boolean
  3256.                             type: object
  3257.                         type: object
  3258.                       strategy:
  3259.                         description: Strategy defines the load balancing strategy
  3260.                           between the servers. RoundRobin is the only supported value
  3261.                           at the moment.
  3262.                         type: string
  3263.                       weight:
  3264.                         description: Weight defines the weight and should only be
  3265.                           specified when Name references a TraefikService object (and
  3266.                           to be precise, one that embeds a Weighted Round Robin).
  3267.                         type: integer
  3268.                     required:
  3269.                     - name
  3270.                     type: object
  3271.                   status:
  3272.                     description: Status defines which status or range of statuses
  3273.                       should result in an error page. It can be either a status code
  3274.                       as a number (500), as multiple comma-separated numbers (500,502),
  3275.                       as ranges by separating two codes with a dash (500-599), or
  3276.                       a combination of the two (404,418,500-599).
  3277.                     items:
  3278.                       type: string
  3279.                     type: array
  3280.                 type: object
  3281.               forwardAuth:
  3282.                 description: 'ForwardAuth holds the forward auth middleware configuration.
  3283.                   This middleware delegates the request authentication to a Service.
  3284.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/forwardauth/'
  3285.                 properties:
  3286.                   address:
  3287.                     description: Address defines the authentication server address.
  3288.                     type: string
  3289.                   authRequestHeaders:
  3290.                     description: AuthRequestHeaders defines the list of the headers
  3291.                       to copy from the request to the authentication server. If not
  3292.                       set or empty then all request headers are passed.
  3293.                     items:
  3294.                       type: string
  3295.                     type: array
  3296.                   authResponseHeaders:
  3297.                     description: AuthResponseHeaders defines the list of headers to
  3298.                       copy from the authentication server response and set on forwarded
  3299.                       request, replacing any existing conflicting headers.
  3300.                     items:
  3301.                       type: string
  3302.                     type: array
  3303.                   authResponseHeadersRegex:
  3304.                     description: 'AuthResponseHeadersRegex defines the regex to match
  3305.                       headers to copy from the authentication server response and
  3306.                       set on forwarded request, after stripping all headers that match
  3307.                       the regex. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/forwardauth/#authresponseheadersregex'
  3308.                     type: string
  3309.                   tls:
  3310.                     description: TLS defines the configuration used to secure the
  3311.                       connection to the authentication server.
  3312.                     properties:
  3313.                       caOptional:
  3314.                         type: boolean
  3315.                       caSecret:
  3316.                         description: CASecret is the name of the referenced Kubernetes
  3317.                           Secret containing the CA to validate the server certificate.
  3318.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  3319.                         type: string
  3320.                       certSecret:
  3321.                         description: CertSecret is the name of the referenced Kubernetes
  3322.                           Secret containing the client certificate. The client certificate
  3323.                           is extracted from the keys `tls.crt` and `tls.key`.
  3324.                         type: string
  3325.                       insecureSkipVerify:
  3326.                         description: InsecureSkipVerify defines whether the server
  3327.                           certificates should be validated.
  3328.                         type: boolean
  3329.                     type: object
  3330.                   trustForwardHeader:
  3331.                     description: 'TrustForwardHeader defines whether to trust (ie:
  3332.                       forward) all X-Forwarded-* headers.'
  3333.                     type: boolean
  3334.                 type: object
  3335.               headers:
  3336.                 description: 'Headers holds the headers middleware configuration.
  3337.                   This middleware manages the requests and responses headers. More
  3338.                   info: https://doc.traefik.io/traefik/v2.10/middlewares/http/headers/#customrequestheaders'
  3339.                 properties:
  3340.                   accessControlAllowCredentials:
  3341.                     description: AccessControlAllowCredentials defines whether the
  3342.                       request can include user credentials.
  3343.                     type: boolean
  3344.                   accessControlAllowHeaders:
  3345.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  3346.                       values sent in preflight response.
  3347.                     items:
  3348.                       type: string
  3349.                     type: array
  3350.                   accessControlAllowMethods:
  3351.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  3352.                       values sent in preflight response.
  3353.                     items:
  3354.                       type: string
  3355.                     type: array
  3356.                   accessControlAllowOriginList:
  3357.                     description: AccessControlAllowOriginList is a list of allowable
  3358.                       origins. Can also be a wildcard origin "*".
  3359.                     items:
  3360.                       type: string
  3361.                     type: array
  3362.                   accessControlAllowOriginListRegex:
  3363.                     description: AccessControlAllowOriginListRegex is a list of allowable
  3364.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  3365.                     items:
  3366.                       type: string
  3367.                     type: array
  3368.                   accessControlExposeHeaders:
  3369.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  3370.                       values sent in preflight response.
  3371.                     items:
  3372.                       type: string
  3373.                     type: array
  3374.                   accessControlMaxAge:
  3375.                     description: AccessControlMaxAge defines the time that a preflight
  3376.                       request may be cached.
  3377.                     format: int64
  3378.                     type: integer
  3379.                   addVaryHeader:
  3380.                     description: AddVaryHeader defines whether the Vary header is
  3381.                       automatically added/updated when the AccessControlAllowOriginList
  3382.                       is set.
  3383.                     type: boolean
  3384.                   allowedHosts:
  3385.                     description: AllowedHosts defines the fully qualified list of
  3386.                       allowed domain names.
  3387.                     items:
  3388.                       type: string
  3389.                     type: array
  3390.                   browserXssFilter:
  3391.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  3392.                       header with the value 1; mode=block.
  3393.                     type: boolean
  3394.                   contentSecurityPolicy:
  3395.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  3396.                       header value.
  3397.                     type: string
  3398.                   contentTypeNosniff:
  3399.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  3400.                       header with the nosniff value.
  3401.                     type: boolean
  3402.                   customBrowserXSSValue:
  3403.                     description: CustomBrowserXSSValue defines the X-XSS-Protection
  3404.                       header value. This overrides the BrowserXssFilter option.
  3405.                     type: string
  3406.                   customFrameOptionsValue:
  3407.                     description: CustomFrameOptionsValue defines the X-Frame-Options
  3408.                       header value. This overrides the FrameDeny option.
  3409.                     type: string
  3410.                   customRequestHeaders:
  3411.                     additionalProperties:
  3412.                       type: string
  3413.                     description: CustomRequestHeaders defines the header names and
  3414.                       values to apply to the request.
  3415.                     type: object
  3416.                   customResponseHeaders:
  3417.                     additionalProperties:
  3418.                       type: string
  3419.                     description: CustomResponseHeaders defines the header names and
  3420.                       values to apply to the response.
  3421.                     type: object
  3422.                   featurePolicy:
  3423.                     description: 'Deprecated: use PermissionsPolicy instead.'
  3424.                     type: string
  3425.                   forceSTSHeader:
  3426.                     description: ForceSTSHeader defines whether to add the STS header
  3427.                       even when the connection is HTTP.
  3428.                     type: boolean
  3429.                   frameDeny:
  3430.                     description: FrameDeny defines whether to add the X-Frame-Options
  3431.                       header with the DENY value.
  3432.                     type: boolean
  3433.                   hostsProxyHeaders:
  3434.                     description: HostsProxyHeaders defines the header keys that may
  3435.                       hold a proxied hostname value for the request.
  3436.                     items:
  3437.                       type: string
  3438.                     type: array
  3439.                   isDevelopment:
  3440.                     description: IsDevelopment defines whether to mitigate the unwanted
  3441.                       effects of the AllowedHosts, SSL, and STS options when developing.
  3442.                       Usually testing takes place using HTTP, not HTTPS, and on localhost,
  3443.                       not your production domain. If you would like your development
  3444.                       environment to mimic production with complete Host blocking,
  3445.                       SSL redirects, and STS headers, leave this as false.
  3446.                     type: boolean
  3447.                   permissionsPolicy:
  3448.                     description: PermissionsPolicy defines the Permissions-Policy
  3449.                       header value. This allows sites to control browser features.
  3450.                     type: string
  3451.                   publicKey:
  3452.                     description: PublicKey is the public key that implements HPKP
  3453.                       to prevent MITM attacks with forged certificates.
  3454.                     type: string
  3455.                   referrerPolicy:
  3456.                     description: ReferrerPolicy defines the Referrer-Policy header
  3457.                       value. This allows sites to control whether browsers forward
  3458.                       the Referer header to other sites.
  3459.                     type: string
  3460.                   sslForceHost:
  3461.                     description: 'Deprecated: use RedirectRegex instead.'
  3462.                     type: boolean
  3463.                   sslHost:
  3464.                     description: 'Deprecated: use RedirectRegex instead.'
  3465.                     type: string
  3466.                   sslProxyHeaders:
  3467.                     additionalProperties:
  3468.                       type: string
  3469.                     description: 'SSLProxyHeaders defines the header keys with associated
  3470.                       values that would indicate a valid HTTPS request. It can be
  3471.                       useful when using other proxies (example: "X-Forwarded-Proto":
  3472.                       "https").'
  3473.                     type: object
  3474.                   sslRedirect:
  3475.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  3476.                       instead.'
  3477.                     type: boolean
  3478.                   sslTemporaryRedirect:
  3479.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  3480.                       instead.'
  3481.                     type: boolean
  3482.                   stsIncludeSubdomains:
  3483.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  3484.                       directive is appended to the Strict-Transport-Security header.
  3485.                     type: boolean
  3486.                   stsPreload:
  3487.                     description: STSPreload defines whether the preload flag is appended
  3488.                       to the Strict-Transport-Security header.
  3489.                     type: boolean
  3490.                   stsSeconds:
  3491.                     description: STSSeconds defines the max-age of the Strict-Transport-Security
  3492.                       header. If set to 0, the header is not set.
  3493.                     format: int64
  3494.                     type: integer
  3495.                 type: object
  3496.               inFlightReq:
  3497.                 description: 'InFlightReq holds the in-flight request middleware configuration.
  3498.                   This middleware limits the number of requests being processed and
  3499.                   served concurrently. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/inflightreq/'
  3500.                 properties:
  3501.                   amount:
  3502.                     description: Amount defines the maximum amount of allowed simultaneous
  3503.                       in-flight request. The middleware responds with HTTP 429 Too
  3504.                       Many Requests if there are already amount requests in progress
  3505.                       (based on the same sourceCriterion strategy).
  3506.                     format: int64
  3507.                     type: integer
  3508.                   sourceCriterion:
  3509.                     description: 'SourceCriterion defines what criterion is used to
  3510.                       group requests as originating from a common source. If several
  3511.                       strategies are defined at the same time, an error will be raised.
  3512.                       If none are set, the default is to use the requestHost. More
  3513.                       info: https://doc.traefik.io/traefik/v2.10/middlewares/http/inflightreq/#sourcecriterion'
  3514.                     properties:
  3515.                       ipStrategy:
  3516.                         description: 'IPStrategy holds the IP strategy configuration
  3517.                           used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy'
  3518.                         properties:
  3519.                           depth:
  3520.                             description: Depth tells Traefik to use the X-Forwarded-For
  3521.                               header and take the IP located at the depth position
  3522.                               (starting from the right).
  3523.                             type: integer
  3524.                           excludedIPs:
  3525.                             description: ExcludedIPs configures Traefik to scan the
  3526.                               X-Forwarded-For header and select the first IP not in
  3527.                               the list.
  3528.                             items:
  3529.                               type: string
  3530.                             type: array
  3531.                         type: object
  3532.                       requestHeaderName:
  3533.                         description: RequestHeaderName defines the name of the header
  3534.                           used to group incoming requests.
  3535.                         type: string
  3536.                       requestHost:
  3537.                         description: RequestHost defines whether to consider the request
  3538.                           Host as the source.
  3539.                         type: boolean
  3540.                     type: object
  3541.                 type: object
  3542.               ipWhiteList:
  3543.                 description: 'IPWhiteList holds the IP whitelist middleware configuration.
  3544.                   This middleware accepts / refuses requests based on the client IP.
  3545.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/'
  3546.                 properties:
  3547.                   ipStrategy:
  3548.                     description: 'IPStrategy holds the IP strategy configuration used
  3549.                       by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy'
  3550.                     properties:
  3551.                       depth:
  3552.                         description: Depth tells Traefik to use the X-Forwarded-For
  3553.                           header and take the IP located at the depth position (starting
  3554.                           from the right).
  3555.                         type: integer
  3556.                       excludedIPs:
  3557.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  3558.                           header and select the first IP not in the list.
  3559.                         items:
  3560.                           type: string
  3561.                         type: array
  3562.                     type: object
  3563.                   sourceRange:
  3564.                     description: SourceRange defines the set of allowed IPs (or ranges
  3565.                       of allowed IPs by using CIDR notation).
  3566.                     items:
  3567.                       type: string
  3568.                     type: array
  3569.                 type: object
  3570.               passTLSClientCert:
  3571.                 description: 'PassTLSClientCert holds the pass TLS client cert middleware
  3572.                   configuration. This middleware adds the selected data from the passed
  3573.                   client TLS certificate to a header. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/passtlsclientcert/'
  3574.                 properties:
  3575.                   info:
  3576.                     description: Info selects the specific client certificate details
  3577.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  3578.                     properties:
  3579.                       issuer:
  3580.                         description: Issuer defines the client certificate issuer
  3581.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  3582.                         properties:
  3583.                           commonName:
  3584.                             description: CommonName defines whether to add the organizationalUnit
  3585.                               information into the issuer.
  3586.                             type: boolean
  3587.                           country:
  3588.                             description: Country defines whether to add the country
  3589.                               information into the issuer.
  3590.                             type: boolean
  3591.                           domainComponent:
  3592.                             description: DomainComponent defines whether to add the
  3593.                               domainComponent information into the issuer.
  3594.                             type: boolean
  3595.                           locality:
  3596.                             description: Locality defines whether to add the locality
  3597.                               information into the issuer.
  3598.                             type: boolean
  3599.                           organization:
  3600.                             description: Organization defines whether to add the organization
  3601.                               information into the issuer.
  3602.                             type: boolean
  3603.                           province:
  3604.                             description: Province defines whether to add the province
  3605.                               information into the issuer.
  3606.                             type: boolean
  3607.                           serialNumber:
  3608.                             description: SerialNumber defines whether to add the serialNumber
  3609.                               information into the issuer.
  3610.                             type: boolean
  3611.                         type: object
  3612.                       notAfter:
  3613.                         description: NotAfter defines whether to add the Not After
  3614.                           information from the Validity part.
  3615.                         type: boolean
  3616.                       notBefore:
  3617.                         description: NotBefore defines whether to add the Not Before
  3618.                           information from the Validity part.
  3619.                         type: boolean
  3620.                       sans:
  3621.                         description: Sans defines whether to add the Subject Alternative
  3622.                           Name information from the Subject Alternative Name part.
  3623.                         type: boolean
  3624.                       serialNumber:
  3625.                         description: SerialNumber defines whether to add the client
  3626.                           serialNumber information.
  3627.                         type: boolean
  3628.                       subject:
  3629.                         description: Subject defines the client certificate subject
  3630.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  3631.                         properties:
  3632.                           commonName:
  3633.                             description: CommonName defines whether to add the organizationalUnit
  3634.                               information into the subject.
  3635.                             type: boolean
  3636.                           country:
  3637.                             description: Country defines whether to add the country
  3638.                               information into the subject.
  3639.                             type: boolean
  3640.                           domainComponent:
  3641.                             description: DomainComponent defines whether to add the
  3642.                               domainComponent information into the subject.
  3643.                             type: boolean
  3644.                           locality:
  3645.                             description: Locality defines whether to add the locality
  3646.                               information into the subject.
  3647.                             type: boolean
  3648.                           organization:
  3649.                             description: Organization defines whether to add the organization
  3650.                               information into the subject.
  3651.                             type: boolean
  3652.                           organizationalUnit:
  3653.                             description: OrganizationalUnit defines whether to add
  3654.                               the organizationalUnit information into the subject.
  3655.                             type: boolean
  3656.                           province:
  3657.                             description: Province defines whether to add the province
  3658.                               information into the subject.
  3659.                             type: boolean
  3660.                           serialNumber:
  3661.                             description: SerialNumber defines whether to add the serialNumber
  3662.                               information into the subject.
  3663.                             type: boolean
  3664.                         type: object
  3665.                     type: object
  3666.                   pem:
  3667.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  3668.                       the certificate.
  3669.                     type: boolean
  3670.                 type: object
  3671.               plugin:
  3672.                 additionalProperties:
  3673.                   x-kubernetes-preserve-unknown-fields: true
  3674.                 description: 'Plugin defines the middleware plugin configuration.
  3675.                   More info: https://doc.traefik.io/traefik/plugins/'
  3676.                 type: object
  3677.               rateLimit:
  3678.                 description: 'RateLimit holds the rate limit configuration. This middleware
  3679.                   ensures that services will receive a fair amount of requests, and
  3680.                   allows one to define what fair is. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ratelimit/'
  3681.                 properties:
  3682.                   average:
  3683.                     description: Average is the maximum rate, by default in requests/s,
  3684.                       allowed for the given source. It defaults to 0, which means
  3685.                       no rate limiting. The rate is actually defined by dividing Average
  3686.                       by Period. So for a rate below 1req/s, one needs to define a
  3687.                       Period larger than a second.
  3688.                     format: int64
  3689.                     type: integer
  3690.                   burst:
  3691.                     description: Burst is the maximum number of requests allowed to
  3692.                       arrive in the same arbitrarily small period of time. It defaults
  3693.                       to 1.
  3694.                     format: int64
  3695.                     type: integer
  3696.                   period:
  3697.                     anyOf:
  3698.                     - type: integer
  3699.                     - type: string
  3700.                     description: 'Period, in combination with Average, defines the
  3701.                       actual maximum rate, such as: r = Average / Period. It defaults
  3702.                       to a second.'
  3703.                     x-kubernetes-int-or-string: true
  3704.                   sourceCriterion:
  3705.                     description: SourceCriterion defines what criterion is used to
  3706.                       group requests as originating from a common source. If several
  3707.                       strategies are defined at the same time, an error will be raised.
  3708.                       If none are set, the default is to use the request's remote
  3709.                       address field (as an ipStrategy).
  3710.                     properties:
  3711.                       ipStrategy:
  3712.                         description: 'IPStrategy holds the IP strategy configuration
  3713.                           used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy'
  3714.                         properties:
  3715.                           depth:
  3716.                             description: Depth tells Traefik to use the X-Forwarded-For
  3717.                               header and take the IP located at the depth position
  3718.                               (starting from the right).
  3719.                             type: integer
  3720.                           excludedIPs:
  3721.                             description: ExcludedIPs configures Traefik to scan the
  3722.                               X-Forwarded-For header and select the first IP not in
  3723.                               the list.
  3724.                             items:
  3725.                               type: string
  3726.                             type: array
  3727.                         type: object
  3728.                       requestHeaderName:
  3729.                         description: RequestHeaderName defines the name of the header
  3730.                           used to group incoming requests.
  3731.                         type: string
  3732.                       requestHost:
  3733.                         description: RequestHost defines whether to consider the request
  3734.                           Host as the source.
  3735.                         type: boolean
  3736.                     type: object
  3737.                 type: object
  3738.               redirectRegex:
  3739.                 description: 'RedirectRegex holds the redirect regex middleware configuration.
  3740.                   This middleware redirects a request using regex matching and replacement.
  3741.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/redirectregex/#regex'
  3742.                 properties:
  3743.                   permanent:
  3744.                     description: Permanent defines whether the redirection is permanent
  3745.                       (301).
  3746.                     type: boolean
  3747.                   regex:
  3748.                     description: Regex defines the regex used to match and capture
  3749.                       elements from the request URL.
  3750.                     type: string
  3751.                   replacement:
  3752.                     description: Replacement defines how to modify the URL to have
  3753.                       the new target URL.
  3754.                     type: string
  3755.                 type: object
  3756.               redirectScheme:
  3757.                 description: 'RedirectScheme holds the redirect scheme middleware
  3758.                   configuration. This middleware redirects requests from a scheme/port
  3759.                   to another. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/redirectscheme/'
  3760.                 properties:
  3761.                   permanent:
  3762.                     description: Permanent defines whether the redirection is permanent
  3763.                       (301).
  3764.                     type: boolean
  3765.                   port:
  3766.                     description: Port defines the port of the new URL.
  3767.                     type: string
  3768.                   scheme:
  3769.                     description: Scheme defines the scheme of the new URL.
  3770.                     type: string
  3771.                 type: object
  3772.               replacePath:
  3773.                 description: 'ReplacePath holds the replace path middleware configuration.
  3774.                   This middleware replaces the path of the request URL and store the
  3775.                   original path in an X-Replaced-Path header. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/replacepath/'
  3776.                 properties:
  3777.                   path:
  3778.                     description: Path defines the path to use as replacement in the
  3779.                       request URL.
  3780.                     type: string
  3781.                 type: object
  3782.               replacePathRegex:
  3783.                 description: 'ReplacePathRegex holds the replace path regex middleware
  3784.                   configuration. This middleware replaces the path of a URL using
  3785.                   regex matching and replacement. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/replacepathregex/'
  3786.                 properties:
  3787.                   regex:
  3788.                     description: Regex defines the regular expression used to match
  3789.                       and capture the path from the request URL.
  3790.                     type: string
  3791.                   replacement:
  3792.                     description: Replacement defines the replacement path format,
  3793.                       which can include captured variables.
  3794.                     type: string
  3795.                 type: object
  3796.               retry:
  3797.                 description: 'Retry holds the retry middleware configuration. This
  3798.                   middleware reissues requests a given number of times to a backend
  3799.                   server if that server does not reply. As soon as the server answers,
  3800.                   the middleware stops retrying, regardless of the response status.
  3801.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/retry/'
  3802.                 properties:
  3803.                   attempts:
  3804.                     description: Attempts defines how many times the request should
  3805.                       be retried.
  3806.                     type: integer
  3807.                   initialInterval:
  3808.                     anyOf:
  3809.                     - type: integer
  3810.                     - type: string
  3811.                     description: InitialInterval defines the first wait time in the
  3812.                       exponential backoff series. The maximum interval is calculated
  3813.                       as twice the initialInterval. If unspecified, requests will
  3814.                       be retried immediately. The value of initialInterval should
  3815.                       be provided in seconds or as a valid duration format, see https://pkg.go.dev/time#ParseDuration.
  3816.                     x-kubernetes-int-or-string: true
  3817.                 type: object
  3818.               stripPrefix:
  3819.                 description: 'StripPrefix holds the strip prefix middleware configuration.
  3820.                   This middleware removes the specified prefixes from the URL path.
  3821.                   More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/stripprefix/'
  3822.                 properties:
  3823.                   forceSlash:
  3824.                     description: 'ForceSlash ensures that the resulting stripped path
  3825.                       is not the empty string, by replacing it with / when necessary.
  3826.                       Default: true.'
  3827.                     type: boolean
  3828.                   prefixes:
  3829.                     description: Prefixes defines the prefixes to strip from the request
  3830.                       URL.
  3831.                     items:
  3832.                       type: string
  3833.                     type: array
  3834.                 type: object
  3835.               stripPrefixRegex:
  3836.                 description: 'StripPrefixRegex holds the strip prefix regex middleware
  3837.                   configuration. This middleware removes the matching prefixes from
  3838.                   the URL path. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/stripprefixregex/'
  3839.                 properties:
  3840.                   regex:
  3841.                     description: Regex defines the regular expression to match the
  3842.                       path prefix from the request URL.
  3843.                     items:
  3844.                       type: string
  3845.                     type: array
  3846.                 type: object
  3847.             type: object
  3848.         required:
  3849.         - metadata
  3850.         - spec
  3851.         type: object
  3852.     served: true
  3853.     storage: true
  3854. status:
  3855.   acceptedNames:
  3856.     kind: ""
  3857.     plural: ""
  3858.   conditions: []
  3859.   storedVersions: []
  3861. ---
  3862. apiVersion: apiextensions.k8s.io/v1
  3863. kind: CustomResourceDefinition
  3864. metadata:
  3865.   annotations:
  3866.     controller-gen.kubebuilder.io/version: v0.6.2
  3867.   creationTimestamp: null
  3868.   name: middlewaretcps.traefik.containo.us
  3869. spec:
  3870.   group: traefik.containo.us
  3871.   names:
  3872.     kind: MiddlewareTCP
  3873.     listKind: MiddlewareTCPList
  3874.     plural: middlewaretcps
  3875.     singular: middlewaretcp
  3876.   scope: Namespaced
  3877.   versions:
  3878.   - name: v1alpha1
  3879.     schema:
  3880.       openAPIV3Schema:
  3881.         description: 'MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  3882.           More info: https://doc.traefik.io/traefik/v2.10/middlewares/overview/'
  3883.         properties:
  3884.           apiVersion:
  3885.             description: 'APIVersion defines the versioned schema of this representation
  3886.               of an object. Servers should convert recognized schemas to the latest
  3887.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  3888.             type: string
  3889.           kind:
  3890.             description: 'Kind is a string value representing the REST resource this
  3891.               object represents. Servers may infer this from the endpoint the client
  3892.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  3893.             type: string
  3894.           metadata:
  3895.             type: object
  3896.           spec:
  3897.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  3898.             properties:
  3899.               inFlightConn:
  3900.                 description: InFlightConn defines the InFlightConn middleware configuration.
  3901.                 properties:
  3902.                   amount:
  3903.                     description: Amount defines the maximum amount of allowed simultaneous
  3904.                       connections. The middleware closes the connection if there are
  3905.                       already amount connections opened.
  3906.                     format: int64
  3907.                     type: integer
  3908.                 type: object
  3909.               ipWhiteList:
  3910.                 description: IPWhiteList defines the IPWhiteList middleware configuration.
  3911.                 properties:
  3912.                   sourceRange:
  3913.                     description: SourceRange defines the allowed IPs (or ranges of
  3914.                       allowed IPs by using CIDR notation).
  3915.                     items:
  3916.                       type: string
  3917.                     type: array
  3918.                 type: object
  3919.             type: object
  3920.         required:
  3921.         - metadata
  3922.         - spec
  3923.         type: object
  3924.     served: true
  3925.     storage: true
  3926. status:
  3927.   acceptedNames:
  3928.     kind: ""
  3929.     plural: ""
  3930.   conditions: []
  3931.   storedVersions: []
  3933. ---
  3934. apiVersion: apiextensions.k8s.io/v1
  3935. kind: CustomResourceDefinition
  3936. metadata:
  3937.   annotations:
  3938.     controller-gen.kubebuilder.io/version: v0.6.2
  3939.   creationTimestamp: null
  3940.   name: serverstransports.traefik.containo.us
  3941. spec:
  3942.   group: traefik.containo.us
  3943.   names:
  3944.     kind: ServersTransport
  3945.     listKind: ServersTransportList
  3946.     plural: serverstransports
  3947.     singular: serverstransport
  3948.   scope: Namespaced
  3949.   versions:
  3950.   - name: v1alpha1
  3951.     schema:
  3952.       openAPIV3Schema:
  3953.         description: 'ServersTransport is the CRD implementation of a ServersTransport.
  3954.           If no serversTransport is specified, the [email protected] will be used.
  3955.           The [email protected] serversTransport is created from the static configuration.
  3956.           More info: https://doc.traefik.io/traefik/v2.10/routing/services/#serverstransport_1'
  3957.         properties:
  3958.           apiVersion:
  3959.             description: 'APIVersion defines the versioned schema of this representation
  3960.               of an object. Servers should convert recognized schemas to the latest
  3961.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  3962.             type: string
  3963.           kind:
  3964.             description: 'Kind is a string value representing the REST resource this
  3965.               object represents. Servers may infer this from the endpoint the client
  3966.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  3967.             type: string
  3968.           metadata:
  3969.             type: object
  3970.           spec:
  3971.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  3972.             properties:
  3973.               certificatesSecrets:
  3974.                 description: CertificatesSecrets defines a list of secret storing
  3975.                   client certificates for mTLS.
  3976.                 items:
  3977.                   type: string
  3978.                 type: array
  3979.               disableHTTP2:
  3980.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  3981.                   servers.
  3982.                 type: boolean
  3983.               forwardingTimeouts:
  3984.                 description: ForwardingTimeouts defines the timeouts for requests
  3985.                   forwarded to the backend servers.
  3986.                 properties:
  3987.                   dialTimeout:
  3988.                     anyOf:
  3989.                     - type: integer
  3990.                     - type: string
  3991.                     description: DialTimeout is the amount of time to wait until a
  3992.                       connection to a backend server can be established.
  3993.                     x-kubernetes-int-or-string: true
  3994.                   idleConnTimeout:
  3995.                     anyOf:
  3996.                     - type: integer
  3997.                     - type: string
  3998.                     description: IdleConnTimeout is the maximum period for which an
  3999.                       idle HTTP keep-alive connection will remain open before closing
  4000.                       itself.
  4001.                     x-kubernetes-int-or-string: true
  4002.                   pingTimeout:
  4003.                     anyOf:
  4004.                     - type: integer
  4005.                     - type: string
  4006.                     description: PingTimeout is the timeout after which the HTTP/2
  4007.                       connection will be closed if a response to ping is not received.
  4008.                     x-kubernetes-int-or-string: true
  4009.                   readIdleTimeout:
  4010.                     anyOf:
  4011.                     - type: integer
  4012.                     - type: string
  4013.                     description: ReadIdleTimeout is the timeout after which a health
  4014.                       check using ping frame will be carried out if no frame is received
  4015.                       on the HTTP/2 connection.
  4016.                     x-kubernetes-int-or-string: true
  4017.                   responseHeaderTimeout:
  4018.                     anyOf:
  4019.                     - type: integer
  4020.                     - type: string
  4021.                     description: ResponseHeaderTimeout is the amount of time to wait
  4022.                       for a server's response headers after fully writing the request
  4023.                       (including its body, if any).
  4024.                     x-kubernetes-int-or-string: true
  4025.                 type: object
  4026.               insecureSkipVerify:
  4027.                 description: InsecureSkipVerify disables SSL certificate verification.
  4028.                 type: boolean
  4029.               maxIdleConnsPerHost:
  4030.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  4031.                   to keep per-host.
  4032.                 type: integer
  4033.               peerCertURI:
  4034.                 description: PeerCertURI defines the peer cert URI used to match against
  4035.                   SAN URI during the peer certificate verification.
  4036.                 type: string
  4037.               rootCAsSecrets:
  4038.                 description: RootCAsSecrets defines a list of CA secret used to validate
  4039.                   self-signed certificate.
  4040.                 items:
  4041.                   type: string
  4042.                 type: array
  4043.               serverName:
  4044.                 description: ServerName defines the server name used to contact the
  4045.                   server.
  4046.                 type: string
  4047.             type: object
  4048.         required:
  4049.         - metadata
  4050.         - spec
  4051.         type: object
  4052.     served: true
  4053.     storage: true
  4054. status:
  4055.   acceptedNames:
  4056.     kind: ""
  4057.     plural: ""
  4058.   conditions: []
  4059.   storedVersions: []
  4061. ---
  4062. apiVersion: apiextensions.k8s.io/v1
  4063. kind: CustomResourceDefinition
  4064. metadata:
  4065.   annotations:
  4066.     controller-gen.kubebuilder.io/version: v0.6.2
  4067.   creationTimestamp: null
  4068.   name: tlsoptions.traefik.containo.us
  4069. spec:
  4070.   group: traefik.containo.us
  4071.   names:
  4072.     kind: TLSOption
  4073.     listKind: TLSOptionList
  4074.     plural: tlsoptions
  4075.     singular: tlsoption
  4076.   scope: Namespaced
  4077.   versions:
  4078.   - name: v1alpha1
  4079.     schema:
  4080.       openAPIV3Schema:
  4081.         description: 'TLSOption is the CRD implementation of a Traefik TLS Option,
  4082.           allowing to configure some parameters of the TLS connection. More info:
  4083.           https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options'
  4084.         properties:
  4085.           apiVersion:
  4086.             description: 'APIVersion defines the versioned schema of this representation
  4087.               of an object. Servers should convert recognized schemas to the latest
  4088.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  4089.             type: string
  4090.           kind:
  4091.             description: 'Kind is a string value representing the REST resource this
  4092.               object represents. Servers may infer this from the endpoint the client
  4093.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  4094.             type: string
  4095.           metadata:
  4096.             type: object
  4097.           spec:
  4098.             description: TLSOptionSpec defines the desired state of a TLSOption.
  4099.             properties:
  4100.               alpnProtocols:
  4101.                 description: 'ALPNProtocols defines the list of supported application
  4102.                   level protocols for the TLS handshake, in order of preference. More
  4103.                   info: https://doc.traefik.io/traefik/v2.10/https/tls/#alpn-protocols'
  4104.                 items:
  4105.                   type: string
  4106.                 type: array
  4107.               cipherSuites:
  4108.                 description: 'CipherSuites defines the list of supported cipher suites
  4109.                   for TLS versions up to TLS 1.2. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#cipher-suites'
  4110.                 items:
  4111.                   type: string
  4112.                 type: array
  4113.               clientAuth:
  4114.                 description: ClientAuth defines the server's policy for TLS Client
  4115.                   Authentication.
  4116.                 properties:
  4117.                   clientAuthType:
  4118.                     description: ClientAuthType defines the client authentication
  4119.                       type to apply.
  4120.                     enum:
  4121.                     - NoClientCert
  4122.                     - RequestClientCert
  4123.                     - RequireAnyClientCert
  4124.                     - VerifyClientCertIfGiven
  4125.                     - RequireAndVerifyClientCert
  4126.                     type: string
  4127.                   secretNames:
  4128.                     description: SecretNames defines the names of the referenced Kubernetes
  4129.                       Secret storing certificate details.
  4130.                     items:
  4131.                       type: string
  4132.                     type: array
  4133.                 type: object
  4134.               curvePreferences:
  4135.                 description: 'CurvePreferences defines the preferred elliptic curves
  4136.                   in a specific order. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#curve-preferences'
  4137.                 items:
  4138.                   type: string
  4139.                 type: array
  4140.               maxVersion:
  4141.                 description: 'MaxVersion defines the maximum TLS version that Traefik
  4142.                   will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
  4143.                   VersionTLS13. Default: None.'
  4144.                 type: string
  4145.               minVersion:
  4146.                 description: 'MinVersion defines the minimum TLS version that Traefik
  4147.                   will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
  4148.                   VersionTLS13. Default: VersionTLS10.'
  4149.                 type: string
  4150.               preferServerCipherSuites:
  4151.                 description: 'PreferServerCipherSuites defines whether the server
  4152.                   chooses a cipher suite among his own instead of among the client''s.
  4153.                   It is enabled automatically when minVersion or maxVersion is set.
  4154.                   Deprecated: https://github.com/golang/go/issues/45430'
  4155.                 type: boolean
  4156.               sniStrict:
  4157.                 description: SniStrict defines whether Traefik allows connections
  4158.                   from clients connections that do not specify a server_name extension.
  4159.                 type: boolean
  4160.             type: object
  4161.         required:
  4162.         - metadata
  4163.         - spec
  4164.         type: object
  4165.     served: true
  4166.     storage: true
  4167. status:
  4168.   acceptedNames:
  4169.     kind: ""
  4170.     plural: ""
  4171.   conditions: []
  4172.   storedVersions: []
  4174. ---
  4175. apiVersion: apiextensions.k8s.io/v1
  4176. kind: CustomResourceDefinition
  4177. metadata:
  4178.   annotations:
  4179.     controller-gen.kubebuilder.io/version: v0.6.2
  4180.   creationTimestamp: null
  4181.   name: tlsstores.traefik.containo.us
  4182. spec:
  4183.   group: traefik.containo.us
  4184.   names:
  4185.     kind: TLSStore
  4186.     listKind: TLSStoreList
  4187.     plural: tlsstores
  4188.     singular: tlsstore
  4189.   scope: Namespaced
  4190.   versions:
  4191.   - name: v1alpha1
  4192.     schema:
  4193.       openAPIV3Schema:
  4194.         description: 'TLSStore is the CRD implementation of a Traefik TLS Store. For
  4195.           the time being, only the TLSStore named default is supported. This means
  4196.           that you cannot have two stores that are named default in different Kubernetes
  4197.           namespaces. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#certificates-stores'
  4198.         properties:
  4199.           apiVersion:
  4200.             description: 'APIVersion defines the versioned schema of this representation
  4201.               of an object. Servers should convert recognized schemas to the latest
  4202.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  4203.             type: string
  4204.           kind:
  4205.             description: 'Kind is a string value representing the REST resource this
  4206.               object represents. Servers may infer this from the endpoint the client
  4207.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  4208.             type: string
  4209.           metadata:
  4210.             type: object
  4211.           spec:
  4212.             description: TLSStoreSpec defines the desired state of a TLSStore.
  4213.             properties:
  4214.               certificates:
  4215.                 description: Certificates is a list of secret names, each secret holding
  4216.                   a key/certificate pair to add to the store.
  4217.                 items:
  4218.                   description: Certificate holds a secret name for the TLSStore resource.
  4219.                   properties:
  4220.                     secretName:
  4221.                       description: SecretName is the name of the referenced Kubernetes
  4222.                         Secret to specify the certificate details.
  4223.                       type: string
  4224.                   required:
  4225.                   - secretName
  4226.                   type: object
  4227.                 type: array
  4228.               defaultCertificate:
  4229.                 description: DefaultCertificate defines the default certificate configuration.
  4230.                 properties:
  4231.                   secretName:
  4232.                     description: SecretName is the name of the referenced Kubernetes
  4233.                       Secret to specify the certificate details.
  4234.                     type: string
  4235.                 required:
  4236.                 - secretName
  4237.                 type: object
  4238.               defaultGeneratedCert:
  4239.                 description: DefaultGeneratedCert defines the default generated certificate
  4240.                   configuration.
  4241.                 properties:
  4242.                   domain:
  4243.                     description: Domain is the domain definition for the DefaultCertificate.
  4244.                     properties:
  4245.                       main:
  4246.                         description: Main defines the main domain name.
  4247.                         type: string
  4248.                       sans:
  4249.                         description: SANs defines the subject alternative domain names.
  4250.                         items:
  4251.                           type: string
  4252.                         type: array
  4253.                     type: object
  4254.                   resolver:
  4255.                     description: Resolver is the name of the resolver that will be
  4256.                       used to issue the DefaultCertificate.
  4257.                     type: string
  4258.                 type: object
  4259.             type: object
  4260.         required:
  4261.         - metadata
  4262.         - spec
  4263.         type: object
  4264.     served: true
  4265.     storage: true
  4266. status:
  4267.   acceptedNames:
  4268.     kind: ""
  4269.     plural: ""
  4270.   conditions: []
  4271.   storedVersions: []
  4273. ---
  4274. apiVersion: apiextensions.k8s.io/v1
  4275. kind: CustomResourceDefinition
  4276. metadata:
  4277.   annotations:
  4278.     controller-gen.kubebuilder.io/version: v0.6.2
  4279.   creationTimestamp: null
  4280.   name: traefikservices.traefik.containo.us
  4281. spec:
  4282.   group: traefik.containo.us
  4283.   names:
  4284.     kind: TraefikService
  4285.     listKind: TraefikServiceList
  4286.     plural: traefikservices
  4287.     singular: traefikservice
  4288.   scope: Namespaced
  4289.   versions:
  4290.   - name: v1alpha1
  4291.     schema:
  4292.       openAPIV3Schema:
  4293.         description: 'TraefikService is the CRD implementation of a Traefik Service.
  4294.           TraefikService object allows to: - Apply weight to Services on load-balancing
  4295.           - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-traefikservice'
  4296.         properties:
  4297.           apiVersion:
  4298.             description: 'APIVersion defines the versioned schema of this representation
  4299.               of an object. Servers should convert recognized schemas to the latest
  4300.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  4301.             type: string
  4302.           kind:
  4303.             description: 'Kind is a string value representing the REST resource this
  4304.               object represents. Servers may infer this from the endpoint the client
  4305.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  4306.             type: string
  4307.           metadata:
  4308.             type: object
  4309.           spec:
  4310.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  4311.             properties:
  4312.               mirroring:
  4313.                 description: Mirroring defines the Mirroring service configuration.
  4314.                 properties:
  4315.                   kind:
  4316.                     description: Kind defines the kind of the Service.
  4317.                     enum:
  4318.                     - Service
  4319.                     - TraefikService
  4320.                     type: string
  4321.                   maxBodySize:
  4322.                     description: MaxBodySize defines the maximum size allowed for
  4323.                       the body of the request. If the body is larger, the request
  4324.                       is not mirrored. Default value is -1, which means unlimited
  4325.                       size.
  4326.                     format: int64
  4327.                     type: integer
  4328.                   mirrors:
  4329.                     description: Mirrors defines the list of mirrors where Traefik
  4330.                       will duplicate the traffic.
  4331.                     items:
  4332.                       description: MirrorService holds the mirror configuration.
  4333.                       properties:
  4334.                         kind:
  4335.                           description: Kind defines the kind of the Service.
  4336.                           enum:
  4337.                           - Service
  4338.                           - TraefikService
  4339.                           type: string
  4340.                         name:
  4341.                           description: Name defines the name of the referenced Kubernetes
  4342.                             Service or TraefikService. The differentiation between
  4343.                             the two is specified in the Kind field.
  4344.                           type: string
  4345.                         namespace:
  4346.                           description: Namespace defines the namespace of the referenced
  4347.                             Kubernetes Service or TraefikService.
  4348.                           type: string
  4349.                         nativeLB:
  4350.                           description: NativeLB controls, when creating the load-balancer,
  4351.                             whether the LB's children are directly the pods IPs or
  4352.                             if the only child is the Kubernetes Service clusterIP.
  4353.                             The Kubernetes Service itself does load-balance to the
  4354.                             pods. By default, NativeLB is false.
  4355.                           type: boolean
  4356.                         passHostHeader:
  4357.                           description: PassHostHeader defines whether the client Host
  4358.                             header is forwarded to the upstream Kubernetes Service.
  4359.                             By default, passHostHeader is true.
  4360.                           type: boolean
  4361.                         percent:
  4362.                           description: 'Percent defines the part of the traffic to
  4363.                             mirror. Supported values: 0 to 100.'
  4364.                           type: integer
  4365.                         port:
  4366.                           anyOf:
  4367.                           - type: integer
  4368.                           - type: string
  4369.                           description: Port defines the port of a Kubernetes Service.
  4370.                             This can be a reference to a named port.
  4371.                           x-kubernetes-int-or-string: true
  4372.                         responseForwarding:
  4373.                           description: ResponseForwarding defines how Traefik forwards
  4374.                             the response from the upstream Kubernetes Service to the
  4375.                             client.
  4376.                           properties:
  4377.                             flushInterval:
  4378.                               description: 'FlushInterval defines the interval, in
  4379.                                 milliseconds, in between flushes to the client while
  4380.                                 copying the response body. A negative value means
  4381.                                 to flush immediately after each write to the client.
  4382.                                 This configuration is ignored when ReverseProxy recognizes
  4383.                                 a response as a streaming response; for such responses,
  4384.                                 writes are flushed to the client immediately. Default:
  4385.                                 100ms'
  4386.                               type: string
  4387.                           type: object
  4388.                         scheme:
  4389.                           description: Scheme defines the scheme to use for the request
  4390.                             to the upstream Kubernetes Service. It defaults to https
  4391.                             when Kubernetes Service port is 443, http otherwise.
  4392.                           type: string
  4393.                         serversTransport:
  4394.                           description: ServersTransport defines the name of ServersTransport
  4395.                             resource to use. It allows to configure the transport
  4396.                             between Traefik and your servers. Can only be used on
  4397.                             a Kubernetes Service.
  4398.                           type: string
  4399.                         sticky:
  4400.                           description: 'Sticky defines the sticky sessions configuration.
  4401.                             More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  4402.                           properties:
  4403.                             cookie:
  4404.                               description: Cookie defines the sticky cookie configuration.
  4405.                               properties:
  4406.                                 httpOnly:
  4407.                                   description: HTTPOnly defines whether the cookie
  4408.                                     can be accessed by client-side APIs, such as JavaScript.
  4409.                                   type: boolean
  4410.                                 name:
  4411.                                   description: Name defines the Cookie name.
  4412.                                   type: string
  4413.                                 sameSite:
  4414.                                   description: 'SameSite defines the same site policy.
  4415.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  4416.                                   type: string
  4417.                                 secure:
  4418.                                   description: Secure defines whether the cookie can
  4419.                                     only be transmitted over an encrypted connection
  4420.                                     (i.e. HTTPS).
  4421.                                   type: boolean
  4422.                               type: object
  4423.                           type: object
  4424.                         strategy:
  4425.                           description: Strategy defines the load balancing strategy
  4426.                             between the servers. RoundRobin is the only supported
  4427.                             value at the moment.
  4428.                           type: string
  4429.                         weight:
  4430.                           description: Weight defines the weight and should only be
  4431.                             specified when Name references a TraefikService object
  4432.                             (and to be precise, one that embeds a Weighted Round Robin).
  4433.                           type: integer
  4434.                       required:
  4435.                       - name
  4436.                       type: object
  4437.                     type: array
  4438.                   name:
  4439.                     description: Name defines the name of the referenced Kubernetes
  4440.                       Service or TraefikService. The differentiation between the two
  4441.                       is specified in the Kind field.
  4442.                     type: string
  4443.                   namespace:
  4444.                     description: Namespace defines the namespace of the referenced
  4445.                       Kubernetes Service or TraefikService.
  4446.                     type: string
  4447.                   nativeLB:
  4448.                     description: NativeLB controls, when creating the load-balancer,
  4449.                       whether the LB's children are directly the pods IPs or if the
  4450.                       only child is the Kubernetes Service clusterIP. The Kubernetes
  4451.                       Service itself does load-balance to the pods. By default, NativeLB
  4452.                       is false.
  4453.                     type: boolean
  4454.                   passHostHeader:
  4455.                     description: PassHostHeader defines whether the client Host header
  4456.                       is forwarded to the upstream Kubernetes Service. By default,
  4457.                       passHostHeader is true.
  4458.                     type: boolean
  4459.                   port:
  4460.                     anyOf:
  4461.                     - type: integer
  4462.                     - type: string
  4463.                     description: Port defines the port of a Kubernetes Service. This
  4464.                       can be a reference to a named port.
  4465.                     x-kubernetes-int-or-string: true
  4466.                   responseForwarding:
  4467.                     description: ResponseForwarding defines how Traefik forwards the
  4468.                       response from the upstream Kubernetes Service to the client.
  4469.                     properties:
  4470.                       flushInterval:
  4471.                         description: 'FlushInterval defines the interval, in milliseconds,
  4472.                           in between flushes to the client while copying the response
  4473.                           body. A negative value means to flush immediately after
  4474.                           each write to the client. This configuration is ignored
  4475.                           when ReverseProxy recognizes a response as a streaming response;
  4476.                           for such responses, writes are flushed to the client immediately.
  4477.                           Default: 100ms'
  4478.                         type: string
  4479.                     type: object
  4480.                   scheme:
  4481.                     description: Scheme defines the scheme to use for the request
  4482.                       to the upstream Kubernetes Service. It defaults to https when
  4483.                       Kubernetes Service port is 443, http otherwise.
  4484.                     type: string
  4485.                   serversTransport:
  4486.                     description: ServersTransport defines the name of ServersTransport
  4487.                       resource to use. It allows to configure the transport between
  4488.                       Traefik and your servers. Can only be used on a Kubernetes Service.
  4489.                     type: string
  4490.                   sticky:
  4491.                     description: 'Sticky defines the sticky sessions configuration.
  4492.                       More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  4493.                     properties:
  4494.                       cookie:
  4495.                         description: Cookie defines the sticky cookie configuration.
  4496.                         properties:
  4497.                           httpOnly:
  4498.                             description: HTTPOnly defines whether the cookie can be
  4499.                               accessed by client-side APIs, such as JavaScript.
  4500.                             type: boolean
  4501.                           name:
  4502.                             description: Name defines the Cookie name.
  4503.                             type: string
  4504.                           sameSite:
  4505.                             description: 'SameSite defines the same site policy. More
  4506.                               info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  4507.                             type: string
  4508.                           secure:
  4509.                             description: Secure defines whether the cookie can only
  4510.                               be transmitted over an encrypted connection (i.e. HTTPS).
  4511.                             type: boolean
  4512.                         type: object
  4513.                     type: object
  4514.                   strategy:
  4515.                     description: Strategy defines the load balancing strategy between
  4516.                       the servers. RoundRobin is the only supported value at the moment.
  4517.                     type: string
  4518.                   weight:
  4519.                     description: Weight defines the weight and should only be specified
  4520.                       when Name references a TraefikService object (and to be precise,
  4521.                       one that embeds a Weighted Round Robin).
  4522.                     type: integer
  4523.                 required:
  4524.                 - name
  4525.                 type: object
  4526.               weighted:
  4527.                 description: Weighted defines the Weighted Round Robin configuration.
  4528.                 properties:
  4529.                   services:
  4530.                     description: Services defines the list of Kubernetes Service and/or
  4531.                       TraefikService to load-balance, with weight.
  4532.                     items:
  4533.                       description: Service defines an upstream HTTP service to proxy
  4534.                         traffic to.
  4535.                       properties:
  4536.                         kind:
  4537.                           description: Kind defines the kind of the Service.
  4538.                           enum:
  4539.                           - Service
  4540.                           - TraefikService
  4541.                           type: string
  4542.                         name:
  4543.                           description: Name defines the name of the referenced Kubernetes
  4544.                             Service or TraefikService. The differentiation between
  4545.                             the two is specified in the Kind field.
  4546.                           type: string
  4547.                         namespace:
  4548.                           description: Namespace defines the namespace of the referenced
  4549.                             Kubernetes Service or TraefikService.
  4550.                           type: string
  4551.                         nativeLB:
  4552.                           description: NativeLB controls, when creating the load-balancer,
  4553.                             whether the LB's children are directly the pods IPs or
  4554.                             if the only child is the Kubernetes Service clusterIP.
  4555.                             The Kubernetes Service itself does load-balance to the
  4556.                             pods. By default, NativeLB is false.
  4557.                           type: boolean
  4558.                         passHostHeader:
  4559.                           description: PassHostHeader defines whether the client Host
  4560.                             header is forwarded to the upstream Kubernetes Service.
  4561.                             By default, passHostHeader is true.
  4562.                           type: boolean
  4563.                         port:
  4564.                           anyOf:
  4565.                           - type: integer
  4566.                           - type: string
  4567.                           description: Port defines the port of a Kubernetes Service.
  4568.                             This can be a reference to a named port.
  4569.                           x-kubernetes-int-or-string: true
  4570.                         responseForwarding:
  4571.                           description: ResponseForwarding defines how Traefik forwards
  4572.                             the response from the upstream Kubernetes Service to the
  4573.                             client.
  4574.                           properties:
  4575.                             flushInterval:
  4576.                               description: 'FlushInterval defines the interval, in
  4577.                                 milliseconds, in between flushes to the client while
  4578.                                 copying the response body. A negative value means
  4579.                                 to flush immediately after each write to the client.
  4580.                                 This configuration is ignored when ReverseProxy recognizes
  4581.                                 a response as a streaming response; for such responses,
  4582.                                 writes are flushed to the client immediately. Default:
  4583.                                 100ms'
  4584.                               type: string
  4585.                           type: object
  4586.                         scheme:
  4587.                           description: Scheme defines the scheme to use for the request
  4588.                             to the upstream Kubernetes Service. It defaults to https
  4589.                             when Kubernetes Service port is 443, http otherwise.
  4590.                           type: string
  4591.                         serversTransport:
  4592.                           description: ServersTransport defines the name of ServersTransport
  4593.                             resource to use. It allows to configure the transport
  4594.                             between Traefik and your servers. Can only be used on
  4595.                             a Kubernetes Service.
  4596.                           type: string
  4597.                         sticky:
  4598.                           description: 'Sticky defines the sticky sessions configuration.
  4599.                             More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions'
  4600.                           properties:
  4601.                             cookie:
  4602.                               description: Cookie defines the sticky cookie configuration.
  4603.                               properties:
  4604.                                 httpOnly:
  4605.                                   description: HTTPOnly defines whether the cookie
  4606.                                     can be accessed by client-side APIs, such as JavaScript.
  4607.                                   type: boolean
  4608.                                 name:
  4609.                                   description: Name defines the Cookie name.
  4610.                                   type: string
  4611.                                 sameSite:
  4612.                                   description: 'SameSite defines the same site policy.
  4613.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  4614.                                   type: string
  4615.                                 secure:
  4616.                                   description: Secure defines whether the cookie can
  4617.                                     only be transmitted over an encrypted connection
  4618.                                     (i.e. HTTPS).
  4619.                                   type: boolean
  4620.                               type: object
  4621.                           type: object
  4622.                         strategy:
  4623.                           description: Strategy defines the load balancing strategy
  4624.                             between the servers. RoundRobin is the only supported
  4625.                             value at the moment.
  4626.                           type: string
  4627.                         weight:
  4628.                           description: Weight defines the weight and should only be
  4629.                             specified when Name references a TraefikService object
  4630.                             (and to be precise, one that embeds a Weighted Round Robin).
  4631.                           type: integer
  4632.                       required:
  4633.                       - name
  4634.                       type: object
  4635.                     type: array
  4636.                   sticky:
  4637.                     description: 'Sticky defines whether sticky sessions are enabled.
  4638.                       More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#stickiness-and-load-balancing'
  4639.                     properties:
  4640.                       cookie:
  4641.                         description: Cookie defines the sticky cookie configuration.
  4642.                         properties:
  4643.                           httpOnly:
  4644.                             description: HTTPOnly defines whether the cookie can be
  4645.                               accessed by client-side APIs, such as JavaScript.
  4646.                             type: boolean
  4647.                           name:
  4648.                             description: Name defines the Cookie name.
  4649.                             type: string
  4650.                           sameSite:
  4651.                             description: 'SameSite defines the same site policy. More
  4652.                               info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  4653.                             type: string
  4654.                           secure:
  4655.                             description: Secure defines whether the cookie can only
  4656.                               be transmitted over an encrypted connection (i.e. HTTPS).
  4657.                             type: boolean
  4658.                         type: object
  4659.                     type: object
  4660.                 type: object
  4661.             type: object
  4662.         required:
  4663.         - metadata
  4664.         - spec
  4665.         type: object
  4666.     served: true
  4667.     storage: true
  4668. status:
  4669.   acceptedNames:
  4670.     kind: ""
  4671.     plural: ""
  4672.   conditions: []
  4673.   storedVersions: []

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.io
      - traefik.containo.us
    resources:
      - middlewares
      - middlewaretcps
      - ingressroutes
      - traefikservices
      - ingressroutetcps
      - ingressrouteudps
      - tlsoptions
      - tlsstores
      - serverstransports
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default

Traefik

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v2.10
          args:
            - --log.level=DEBUG
            - --api
            - --api.insecure
            - --entrypoints.web.address=:80
            - --entrypoints.tcpep.address=:8000
            - --entrypoints.udpep.address=:9000/udp
            - --providers.kubernetescrd
          ports:
            - name: web
              containerPort: 80
            - name: admin
              containerPort: 8080
            - name: tcpep
              containerPort: 8000
            - name: udpep
              containerPort: 9000

---
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: TCP
      port: 80
      name: web
      targetPort: 80
    - protocol: TCP
      port: 8080
      name: admin
      targetPort: 8080
    - protocol: TCP
      port: 8000
      name: tcpep
      targetPort: 8000

---
apiVersion: v1
kind: Service
metadata:
  name: traefikudp
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: UDP
      port: 9000
      name: udpep
      targetPort: 9000

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: myingressroute
  namespace: default

spec:
  entryPoints:
    - web

  routes:
  - match: Host(`foo`) && PathPrefix(`/bar`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroute.tcp
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressroute.udp
  namespace: default

spec:
  entryPoints:
    - udpep
  routes:
  - services:
      - name: whoamiudp
        port: 8080

Whoami

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  namespace: default
  labels:
    app: traefiklabs
    name: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoami
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: whoami

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamitcp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamitcp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamitcp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamitcp
    spec:
      containers:
        - name: whoamitcp
          image: traefik/whoamitcp
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamitcp
  namespace: default

spec:
  ports:
    - protocol: TCP
      port: 8080
  selector:
    app: traefiklabs
    task: whoamitcp

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamiudp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamiudp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: traefik/whoamiudp:latest
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
  namespace: default

spec:
  ports:
    - port: 8080
  selector:
    app: traefiklabs
    task: whoamiudp

Routing Configuration

Custom Resource Definition (CRD)

  • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
  • Validate that the prerequisites are fulfilled before using the Traefik custom resources.
  • Traefik CRDs are building blocks that you can assemble according to your needs.

You can find an excerpt of the available custom resources in the table below:

KindPurposeConcept Behind
IngressRouteHTTP RoutingHTTP router
MiddlewareTweaks the HTTP requests before they are sent to your serviceHTTP Middlewares
TraefikServiceAbstraction for HTTP loadbalancing/mirroringHTTP service
IngressRouteTCPTCP RoutingTCP router
MiddlewareTCPTweaks the TCP requests before they are sent to your serviceTCP Middlewares
IngressRouteUDPUDP RoutingUDP router
TLSOptionsAllows to configure some parameters of the TLS connectionTLSOptions
TLSStoresAllows to configure the default TLS storeTLSStores
ServersTransportAllows to configure the transport between Traefik and the backendsServersTransport

Kind: IngressRoute

IngressRoute is the CRD implementation of a Traefik HTTP router.

Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

IngressRoute Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: foo
  namespace: bar
spec:
  entryPoints:                      # [1]
    - foo
  routes:                           # [2]
  - kind: Rule
    match: Host(`test.example.com`) # [3]
    priority: 10                    # [4]
    middlewares:                    # [5]
    - name: middleware1             # [6]
      namespace: default            # [7]
    services:                       # [8]
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80                      # [9]
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      serversTransport: transport   # [10]
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
          sameSite: none
      strategy: RoundRobin
      weight: 10
      nativeLB: true                # [11]
  tls:                              # [12]
    secretName: supersecret         # [13]
    options:                        # [14]
      name: opt                     # [15]
      namespace: default            # [16]
    certResolver: foo               # [17]
    domains:                        # [18]
    - main: example.net             # [19]
      sans:                         # [20]
      - a.example.net
      - b.example.net
RefAttributePurpose
[1]entryPointsList of entry points names
[2]routesList of routes
[3]routes[n].matchDefines the rule corresponding to an underlying router.
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]routes[n].middlewaresList of reference to Middleware
[6]middlewares[n].nameDefines the Middleware name
[7]middlewares[n].namespaceDefines the Middleware namespace
[8]routes[n].servicesList of any combination of TraefikService and reference to a Kubernetes service (See below for ExternalName Service setup)
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].serversTransportDefines the reference to a ServersTransport. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[11]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[12]tlsDefines TLS certificate configuration
[13]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[14]tls.optionsDefines the reference to a TLSOption
[15]options.nameDefines the TLSOption name
[16]options.namespaceDefines the TLSOption namespace
[17]tls.certResolverDefines the reference to a CertResolver
[18]tls.domainsList of domains
[19]domains[n].mainDefines the main domain name
[20]domains[n].sansList of SANs (alternative domains)

Declaring an IngressRoute

IngressRoute

# All resources definition must be declared
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test-name
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - kind: Rule
    match: Host(`test.example.com`)
    middlewares:
    - name: middleware1
      namespace: default
    priority: 10
    services:
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
      strategy: RoundRobin
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret

Middlewares

# All resources definition must be declared
# Prefixing with /foo
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: middleware1
  namespace: default
spec:
  addPrefix:
    prefix: /foo

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Configuring Backend Protocol

There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

  • Setting the scheme explicitly (http/https/h2c)
  • Configuring the name of the kubernetes service port to start with https (https)
  • Setting the kubernetes service port to use port 443 (https)

If you do not configure the above, Traefik will assume an http connection.

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRoute service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRoute

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Load Balancing

More information in the dedicated server load balancing section.

Declaring and using Kubernetes Service Load Balancing

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: svc1
      namespace: default
    - name: svc2
      namespace: default

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the service NativeLB option to true. Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set. By default, NativeLB is false.

Example

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: Middleware

Middleware is the CRD implementation of a Traefik middleware.

Register the Middleware kind in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

Declaring and Referencing a Middleware

Middleware

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: foo

spec:
  stripPrefix:
    prefixes:
      - /stripit

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: stripprefix
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available middlewares in the dedicated middlewares section.

Kind: TraefikService

TraefikService is the CRD implementation of a “Traefik Service”.

Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the IngressRoute objects, or recursively in others TraefikService objects.

Disambiguate Traefik and Kubernetes Services

As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

The field kind allows the following values:

TraefikService object allows to use any (valid) combinations of:

Weighted Round Robin

More information in the dedicated Weighted Round Robin service load balancing section.

Declaring and Using Weighted Round Robin

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: svc1
        port: 80
        weight: 1
      - name: wrr2
        kind: TraefikService
        weight: 1
      - name: mirror1
        kind: TraefikService
        weight: 1

---
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr2
  namespace: default

spec:
  weighted:
    services:
      - name: svc2
        port: 80
        weight: 1
      - name: svc3
        port: 80
        weight: 1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2
---
apiVersion: v1
kind: Service
metadata:
  name: svc3
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app3

Mirroring

More information in the dedicated mirroring service section.

Declaring and Using Mirroring

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: mirror1
      namespace: default
      kind: TraefikService

Mirroring k8s Service

# Mirroring from a k8s Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: svc1
    port: 80
    mirrors:
      - name: svc2
        port: 80
        percent: 20
      - name: svc3
        kind: TraefikService
        percent: 20

Mirroring Traefik Service

# Mirroring from a Traefik Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: wrr1
    kind: TraefikService
     mirrors:
       - name: svc2
         port: 80
         percent: 20
       - name: svc3
         kind: TraefikService
         percent: 20

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax ([[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection)) should be used to refer to the TraefikService, just as in the middleware case.

Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

Stickiness and load-balancing

As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

Stickiness on two load-balancing levels

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: whoami1
        kind: Service
        port: 80
        weight: 1
        sticky:
          cookie:
            name: lvl2
      - name: whoami2
        kind: Service
        weight: 1
        port: 80
        sticky:
          cookie:
            name: lvl2
    sticky:
      cookie:
        name: lvl1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: whoami1

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami1

---
apiVersion: v1
kind: Service
metadata:
  name: whoami2

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami2

Deployment (to illustrate replicas)

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami1
  labels:
    app: whoami1

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami1
  template:
    metadata:
      labels:
        app: whoami1
    spec:
      containers:
        - name: whoami1
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami2
  labels:
    app: whoami2

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami2
  template:
    metadata:
      labels:
        app: whoami2
    spec:
      containers:
        - name: whoami2
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

Kind: IngressRouteTCP

IngressRouteTCP is the CRD implementation of a Traefik TCP router.

Register the IngressRouteTCP kind in the Kubernetes cluster before creating IngressRouteTCP objects.

IngressRouteTCP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:                  # [1]
    - footcp
  routes:                       # [2]
  - match: HostSNI(`*`)         # [3]
    priority: 10                # [4]
    middlewares:
    - name: middleware1         # [5]
      namespace: default        # [6]
    services:                   # [7]
    - name: foo                 # [8]
      port: 8080                # [9]
      weight: 10                # [10]
      terminationDelay: 400     # [11]
      proxyProtocol:            # [12]
        version: 1              # [13]
      nativeLB: true            # [14]
  tls:                          # [15]
    secretName: supersecret     # [16]
    options:                    # [17]
      name: opt                 # [18]
      namespace: default        # [19]
    certResolver: foo           # [20]
    domains:                    # [21]
    - main: example.net         # [22]
      sans:                     # [23]
      - a.example.net
      - b.example.net
    passthrough: false          # [24]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].matchDefines the rule of the underlying router
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]middlewares[n].nameDefines the MiddlewareTCP name
[6]middlewares[n].namespaceDefines the MiddlewareTCP namespace
[7]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[8]services[n].nameDefines the name of a Kubernetes service
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].weightDefines the weight to apply to the server load balancing
[11]services[n].terminationDelaycorresponds to the deadline that the proxy sets, after one of its connected peers indicates it has closed the writing capability of its connection, to close the reading capability as well, hence fully terminating the connection. It is a duration in milliseconds, defaulting to 100. A negative value means an infinite deadline (i.e. the reading capability is never closed).
[12]services[n].proxyProtocolDefines the PROXY protocol configuration
[13]services[n].proxyProtocol.versionDefines the PROXY protocol version
[14]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[15]tlsDefines TLS certificate configuration
[16]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[17]tls.optionsDefines the reference to a TLSOption
[18]options.nameDefines the TLSOption name
[19]options.namespaceDefines the TLSOption namespace
[20]tls.certResolverDefines the reference to a CertResolver
[21]tls.domainsList of domains
[22]domains[n].mainDefines the main domain name
[23]domains[n].sansList of SANs (alternative domains)
[24]tls.passthroughIf true, delegates the TLS termination to the backend

Declaring an IngressRouteTCP

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:
    - footcp
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    priority: 10
    services:
    - name: foo
      port: 8080
      terminationDelay: 400
      weight: 10
    - name: bar
      port: 8081
      terminationDelay: 500
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret
    passthrough: false

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteTCP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

Only on IngressRouteTCP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

On both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the TCP service NativeLB option to true. By default, NativeLB is false.

Examples

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: MiddlewareTCP

MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.

Register the MiddlewareTCP kind in the Kubernetes cluster before creating MiddlewareTCP objects or referencing TCP middlewares in the IngressRouteTCP objects.

Declaring and Referencing a MiddlewareTCP

Middleware

apiVersion: traefik.io/v1alpha1
kind: MiddlewareTCP
metadata:
  name: ipwhitelist
spec:
  ipWhiteList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/whitelist`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: ipwhitelist
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the TCP middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a MiddlewareTCP from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available TCP middlewares in the dedicated middlewares section.

Kind: IngressRouteUDP

IngressRouteUDP is the CRD implementation of a Traefik UDP router.

Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

IngressRouteUDP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:                  # [1]
    - fooudp
  routes:                       # [2]
  - services:                   # [3]
    - name: foo                 # [4]
      port: 8080                # [5]
      weight: 10                # [6]
      nativeLB: true            # [7]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[4]services[n].nameDefines the name of a Kubernetes service
[5]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[6]services[n].weightDefines the weight to apply to the server load balancing
[7]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.

Declaring an IngressRouteUDP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteUDP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteUDP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRouteUDP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the UDP service NativeLB option to true. By default, NativeLB is false.

Example

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: TLSOption

TLSOption is the CRD implementation of a Traefik “TLS Option”.

Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the IngressRoute / IngressRouteTCP objects.

TLSOption Attributes

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption                             # [1]
  namespace: default

spec:
  minVersion: VersionTLS12                      # [2]
  maxVersion: VersionTLS13                      # [3]
  curvePreferences:                             # [4]
    - CurveP521
    - CurveP384
  cipherSuites:                                 # [5]
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:                                   # [6]
    secretNames:                                # [7]
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven     # [8]
  sniStrict: true                               # [9]
  alpnProtocols:                                # [10]
    - foobar
RefAttributePurpose
[1]nameDefines the name of the TLSOption resource. One can use default as name to redefine the default TLSOption.
[2]minVersionDefines the minimum TLS version that is acceptable.
[3]maxVersionDefines the maximum TLS version that is acceptable.
[4]cipherSuiteslist of supported cipher suites for TLS versions up to TLS 1.2.
[5]curvePreferencesList of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
[6]clientAuthdetermines the server’s policy for TLS Client Authentication.
[7]clientAuth.secretNameslist of names of the referenced Kubernetes Secrets (in TLSOption namespace). The secret must contain a certificate under either a tls.ca or a ca.crt key.
[8]clientAuth.clientAuthTypedefines the client authentication type to apply. The available values are: NoClientCert, RequestClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
[9]sniStrictif true, Traefik won’t allow connections from clients connections that do not specify a server_name extension.
[10]alpnProtocolsList of supported application level protocols for the TLS handshake, in order of preference.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a TLSOption

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption
  namespace: default

spec:
  minVersion: VersionTLS12
  sniStrict: true
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:
    secretNames:
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    options: 
      name: mytlsoption
      namespace: default

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: secret-ca1
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-ca2
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

Additionally, when the definition of the TLS option is from another provider, the cross-provider syntax ([[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection)) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

Kind: TLSStore

TLSStore is the CRD implementation of a Traefik “TLS Store”.

Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects.

Default TLS Store

Traefik currently only uses the TLS Store named “default”. This default TLSStore should be in a namespace discoverable by Traefik. Since it is used by default on IngressRoute and IngressRouteTCP objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default TLSStore.

TLSStore Attributes

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  certificates:                            # [1]
    - secretName: foo                      
    - secretName: bar
  defaultCertificate:                      # [2]
    secretName: secret
RefAttributePurpose
[1]certificatesList of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store.
[2]defaultCertificateName of a Kubernetes Secret that holds the default key/certificate pair for the store.

Declaring and referencing a TLSStore

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  defaultCertificate:
    secretName:  supersecret

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls: {}

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Kind: ServersTransport

ServersTransport is the CRD implementation of a ServersTransport.

Default serversTransport

If no serversTransport is specified, the [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection) will be used. The [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection) serversTransport is created from the static configuration.

ServersTransport Attributes

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: foobar               # [1]
  insecureSkipVerify: true         # [2]
  rootCAsSecrets:                  # [3]
    - foobar
    - foobar
  certificatesSecrets:             # [4]
    - foobar
    - foobar
  maxIdleConnsPerHost: 1           # [5]
  forwardingTimeouts:              # [6]
    dialTimeout: 42s               # [7]
    responseHeaderTimeout: 42s     # [8]
    idleConnTimeout: 42s           # [9]
  peerCertURI: foobar              # [10]
  disableHTTP2: true               # [11]
RefAttributePurpose
[1]serverNameServerName used to contact the server.
[2]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[3]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[4]certificatesSecretsCertificates to present to the server for mTLS.
[5]maxIdleConnsPerHostControls the maximum idle (keep-alive) connections to keep per-host. If zero, defaultMaxIdleConnsPerHost is used.
[6]forwardingTimeoutsTimeouts for requests forwarded to the servers.
[7]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[8]responseHeaderTimeoutThe amount of time to wait for a server’s response headers after fully writing the request (including its body, if any). If zero, no timeout exists.
[9]idleConnTimeoutThe maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists.
[10]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[11]disableHTTP2Disables HTTP/2 for connections with servers.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransport

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

ServersTransport reference

By default, the referenced ServersTransport CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransport CRD from another namespace, the value must be of form [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection), and the cross-namespace option must be enabled.

If the ServersTransport CRD is defined in another provider the cross-provider format [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection) should be used.

Further

Also see the full example with Let’s Encrypt.

Using Traefik for Business Applications?

If you are using Traefik in your organization, consider Traefik Enterprise. You can use it as your:

Traefik Enterprise simplifies the discovery, security, and deployment of APIs and microservices across any environment. See it in action in this short video walkthrough.