Traefik & Kubernetes

The Kubernetes Ingress Controller, The Custom Resource Way.

Configuration Examples

Configuring KubernetesCRD and Deploying/Exposing Services

Resource Definition

  1. # All resources definition must be declared
  2. ---
  3. apiVersion: apiextensions.k8s.io/v1
  4. kind: CustomResourceDefinition
  5. metadata:
  6.   annotations:
  7.     controller-gen.kubebuilder.io/version: v0.14.0
  8.   name: ingressroutes.traefik.io
  9. spec:
  10.   group: traefik.io
  11.   names:
  12.     kind: IngressRoute
  13.     listKind: IngressRouteList
  14.     plural: ingressroutes
  15.     singular: ingressroute
  16.   scope: Namespaced
  17.   versions:
  18.   - name: v1alpha1
  19.     schema:
  20.       openAPIV3Schema:
  21.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  22.         properties:
  23.           apiVersion:
  24.             description: |-
  25.               APIVersion defines the versioned schema of this representation of an object.
  26.               Servers should convert recognized schemas to the latest internal value, and
  27.               may reject unrecognized values.
  28.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  29.             type: string
  30.           kind:
  31.             description: |-
  32.               Kind is a string value representing the REST resource this object represents.
  33.               Servers may infer this from the endpoint the client submits requests to.
  34.               Cannot be updated.
  35.               In CamelCase.
  36.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  37.             type: string
  38.           metadata:
  39.             type: object
  40.           spec:
  41.             description: IngressRouteSpec defines the desired state of IngressRoute.
  42.             properties:
  43.               entryPoints:
  44.                 description: |-
  45.                   EntryPoints defines the list of entry point names to bind to.
  46.                   Entry points have to be configured in the static configuration.
  47.                   More info: https://doc.traefik.io/traefik/v2.11/routing/entrypoints/
  48.                   Default: all.
  49.                 items:
  50.                   type: string
  51.                 type: array
  52.               routes:
  53.                 description: Routes defines the list of routes.
  54.                 items:
  55.                   description: Route holds the HTTP route configuration.
  56.                   properties:
  57.                     kind:
  58.                       description: |-
  59.                         Kind defines the kind of the route.
  60.                         Rule is the only supported kind.
  61.                       enum:
  62.                       - Rule
  63.                       type: string
  64.                     match:
  65.                       description: |-
  66.                         Match defines the router's rule.
  67.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#rule
  68.                       type: string
  69.                     middlewares:
  70.                       description: |-
  71.                         Middlewares defines the list of references to Middleware resources.
  72.                         More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-middleware
  73.                       items:
  74.                         description: MiddlewareRef is a reference to a Middleware
  75.                           resource.
  76.                         properties:
  77.                           name:
  78.                             description: Name defines the name of the referenced Middleware
  79.                               resource.
  80.                             type: string
  81.                           namespace:
  82.                             description: Namespace defines the namespace of the referenced
  83.                               Middleware resource.
  84.                             type: string
  85.                         required:
  86.                         - name
  87.                         type: object
  88.                       type: array
  89.                     priority:
  90.                       description: |-
  91.                         Priority defines the router's priority.
  92.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#priority
  93.                       type: integer
  94.                     services:
  95.                       description: |-
  96.                         Services defines the list of Service.
  97.                         It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
  98.                       items:
  99.                         description: Service defines an upstream HTTP service to proxy
  100.                           traffic to.
  101.                         properties:
  102.                           kind:
  103.                             description: Kind defines the kind of the Service.
  104.                             enum:
  105.                             - Service
  106.                             - TraefikService
  107.                             type: string
  108.                           name:
  109.                             description: |-
  110.                               Name defines the name of the referenced Kubernetes Service or TraefikService.
  111.                               The differentiation between the two is specified in the Kind field.
  112.                             type: string
  113.                           namespace:
  114.                             description: Namespace defines the namespace of the referenced
  115.                               Kubernetes Service or TraefikService.
  116.                             type: string
  117.                           nativeLB:
  118.                             description: |-
  119.                               NativeLB controls, when creating the load-balancer,
  120.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  121.                               The Kubernetes Service itself does load-balance to the pods.
  122.                               By default, NativeLB is false.
  123.                             type: boolean
  124.                           passHostHeader:
  125.                             description: |-
  126.                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  127.                               By default, passHostHeader is true.
  128.                             type: boolean
  129.                           port:
  130.                             anyOf:
  131.                             - type: integer
  132.                             - type: string
  133.                             description: |-
  134.                               Port defines the port of a Kubernetes Service.
  135.                               This can be a reference to a named port.
  136.                             x-kubernetes-int-or-string: true
  137.                           responseForwarding:
  138.                             description: ResponseForwarding defines how Traefik forwards
  139.                               the response from the upstream Kubernetes Service to
  140.                               the client.
  141.                             properties:
  142.                               flushInterval:
  143.                                 description: |-
  144.                                   FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  145.                                   A negative value means to flush immediately after each write to the client.
  146.                                   This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  147.                                   for such responses, writes are flushed to the client immediately.
  148.                                   Default: 100ms
  149.                                 type: string
  150.                             type: object
  151.                           scheme:
  152.                             description: |-
  153.                               Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  154.                               It defaults to https when Kubernetes Service port is 443, http otherwise.
  155.                             type: string
  156.                           serversTransport:
  157.                             description: |-
  158.                               ServersTransport defines the name of ServersTransport resource to use.
  159.                               It allows to configure the transport between Traefik and your servers.
  160.                               Can only be used on a Kubernetes Service.
  161.                             type: string
  162.                           sticky:
  163.                             description: |-
  164.                               Sticky defines the sticky sessions configuration.
  165.                               More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  166.                             properties:
  167.                               cookie:
  168.                                 description: Cookie defines the sticky cookie configuration.
  169.                                 properties:
  170.                                   httpOnly:
  171.                                     description: HTTPOnly defines whether the cookie
  172.                                       can be accessed by client-side APIs, such as
  173.                                       JavaScript.
  174.                                     type: boolean
  175.                                   name:
  176.                                     description: Name defines the Cookie name.
  177.                                     type: string
  178.                                   sameSite:
  179.                                     description: |-
  180.                                       SameSite defines the same site policy.
  181.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  182.                                     type: string
  183.                                   secure:
  184.                                     description: Secure defines whether the cookie
  185.                                       can only be transmitted over an encrypted connection
  186.                                       (i.e. HTTPS).
  187.                                     type: boolean
  188.                                 type: object
  189.                             type: object
  190.                           strategy:
  191.                             description: |-
  192.                               Strategy defines the load balancing strategy between the servers.
  193.                               RoundRobin is the only supported value at the moment.
  194.                             type: string
  195.                           weight:
  196.                             description: |-
  197.                               Weight defines the weight and should only be specified when Name references a TraefikService object
  198.                               (and to be precise, one that embeds a Weighted Round Robin).
  199.                             type: integer
  200.                         required:
  201.                         - name
  202.                         type: object
  203.                       type: array
  204.                   required:
  205.                   - kind
  206.                   - match
  207.                   type: object
  208.                 type: array
  209.               tls:
  210.                 description: |-
  211.                   TLS defines the TLS configuration.
  212.                   More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#tls
  213.                 properties:
  214.                   certResolver:
  215.                     description: |-
  216.                       CertResolver defines the name of the certificate resolver to use.
  217.                       Cert resolvers have to be configured in the static configuration.
  218.                       More info: https://doc.traefik.io/traefik/v2.11/https/acme/#certificate-resolvers
  219.                     type: string
  220.                   domains:
  221.                     description: |-
  222.                       Domains defines the list of domains that will be used to issue certificates.
  223.                       More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#domains
  224.                     items:
  225.                       description: Domain holds a domain name with SANs.
  226.                       properties:
  227.                         main:
  228.                           description: Main defines the main domain name.
  229.                           type: string
  230.                         sans:
  231.                           description: SANs defines the subject alternative domain
  232.                             names.
  233.                           items:
  234.                             type: string
  235.                           type: array
  236.                       type: object
  237.                     type: array
  238.                   options:
  239.                     description: |-
  240.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  241.                       If not defined, the `default` TLSOption is used.
  242.                       More info: https://doc.traefik.io/traefik/v2.11/https/tls/#tls-options
  243.                     properties:
  244.                       name:
  245.                         description: |-
  246.                           Name defines the name of the referenced TLSOption.
  247.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsoption
  248.                         type: string
  249.                       namespace:
  250.                         description: |-
  251.                           Namespace defines the namespace of the referenced TLSOption.
  252.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsoption
  253.                         type: string
  254.                     required:
  255.                     - name
  256.                     type: object
  257.                   secretName:
  258.                     description: SecretName is the name of the referenced Kubernetes
  259.                       Secret to specify the certificate details.
  260.                     type: string
  261.                   store:
  262.                     description: |-
  263.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  264.                       Please note that only `default` TLSStore can be used.
  265.                     properties:
  266.                       name:
  267.                         description: |-
  268.                           Name defines the name of the referenced TLSStore.
  269.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsstore
  270.                         type: string
  271.                       namespace:
  272.                         description: |-
  273.                           Namespace defines the namespace of the referenced TLSStore.
  274.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsstore
  275.                         type: string
  276.                     required:
  277.                     - name
  278.                     type: object
  279.                 type: object
  280.             required:
  281.             - routes
  282.             type: object
  283.         required:
  284.         - metadata
  285.         - spec
  286.         type: object
  287.     served: true
  288.     storage: true
  289. ---
  290. apiVersion: apiextensions.k8s.io/v1
  291. kind: CustomResourceDefinition
  292. metadata:
  293.   annotations:
  294.     controller-gen.kubebuilder.io/version: v0.14.0
  295.   name: ingressroutetcps.traefik.io
  296. spec:
  297.   group: traefik.io
  298.   names:
  299.     kind: IngressRouteTCP
  300.     listKind: IngressRouteTCPList
  301.     plural: ingressroutetcps
  302.     singular: ingressroutetcp
  303.   scope: Namespaced
  304.   versions:
  305.   - name: v1alpha1
  306.     schema:
  307.       openAPIV3Schema:
  308.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  309.         properties:
  310.           apiVersion:
  311.             description: |-
  312.               APIVersion defines the versioned schema of this representation of an object.
  313.               Servers should convert recognized schemas to the latest internal value, and
  314.               may reject unrecognized values.
  315.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  316.             type: string
  317.           kind:
  318.             description: |-
  319.               Kind is a string value representing the REST resource this object represents.
  320.               Servers may infer this from the endpoint the client submits requests to.
  321.               Cannot be updated.
  322.               In CamelCase.
  323.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  324.             type: string
  325.           metadata:
  326.             type: object
  327.           spec:
  328.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  329.             properties:
  330.               entryPoints:
  331.                 description: |-
  332.                   EntryPoints defines the list of entry point names to bind to.
  333.                   Entry points have to be configured in the static configuration.
  334.                   More info: https://doc.traefik.io/traefik/v2.11/routing/entrypoints/
  335.                   Default: all.
  336.                 items:
  337.                   type: string
  338.                 type: array
  339.               routes:
  340.                 description: Routes defines the list of routes.
  341.                 items:
  342.                   description: RouteTCP holds the TCP route configuration.
  343.                   properties:
  344.                     match:
  345.                       description: |-
  346.                         Match defines the router's rule.
  347.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#rule_1
  348.                       type: string
  349.                     middlewares:
  350.                       description: Middlewares defines the list of references to MiddlewareTCP
  351.                         resources.
  352.                       items:
  353.                         description: ObjectReference is a generic reference to a Traefik
  354.                           resource.
  355.                         properties:
  356.                           name:
  357.                             description: Name defines the name of the referenced Traefik
  358.                               resource.
  359.                             type: string
  360.                           namespace:
  361.                             description: Namespace defines the namespace of the referenced
  362.                               Traefik resource.
  363.                             type: string
  364.                         required:
  365.                         - name
  366.                         type: object
  367.                       type: array
  368.                     priority:
  369.                       description: |-
  370.                         Priority defines the router's priority.
  371.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#priority_1
  372.                       type: integer
  373.                     services:
  374.                       description: Services defines the list of TCP services.
  375.                       items:
  376.                         description: ServiceTCP defines an upstream TCP service to
  377.                           proxy traffic to.
  378.                         properties:
  379.                           name:
  380.                             description: Name defines the name of the referenced Kubernetes
  381.                               Service.
  382.                             type: string
  383.                           namespace:
  384.                             description: Namespace defines the namespace of the referenced
  385.                               Kubernetes Service.
  386.                             type: string
  387.                           nativeLB:
  388.                             description: |-
  389.                               NativeLB controls, when creating the load-balancer,
  390.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  391.                               The Kubernetes Service itself does load-balance to the pods.
  392.                               By default, NativeLB is false.
  393.                             type: boolean
  394.                           port:
  395.                             anyOf:
  396.                             - type: integer
  397.                             - type: string
  398.                             description: |-
  399.                               Port defines the port of a Kubernetes Service.
  400.                               This can be a reference to a named port.
  401.                             x-kubernetes-int-or-string: true
  402.                           proxyProtocol:
  403.                             description: |-
  404.                               ProxyProtocol defines the PROXY protocol configuration.
  405.                               More info: https://doc.traefik.io/traefik/v2.11/routing/services/#proxy-protocol
  406.                             properties:
  407.                               version:
  408.                                 description: Version defines the PROXY Protocol version
  409.                                   to use.
  410.                                 type: integer
  411.                             type: object
  412.                           terminationDelay:
  413.                             description: |-
  414.                               TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates
  415.                               it has closed the writing capability of its connection, to close the reading capability as well,
  416.                               hence fully terminating the connection.
  417.                               It is a duration in milliseconds, defaulting to 100.
  418.                               A negative value means an infinite deadline (i.e. the reading capability is never closed).
  419.                             type: integer
  420.                           weight:
  421.                             description: Weight defines the weight used when balancing
  422.                               requests between multiple Kubernetes Service.
  423.                             type: integer
  424.                         required:
  425.                         - name
  426.                         - port
  427.                         type: object
  428.                       type: array
  429.                   required:
  430.                   - match
  431.                   type: object
  432.                 type: array
  433.               tls:
  434.                 description: |-
  435.                   TLS defines the TLS configuration on a layer 4 / TCP Route.
  436.                   More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#tls_1
  437.                 properties:
  438.                   certResolver:
  439.                     description: |-
  440.                       CertResolver defines the name of the certificate resolver to use.
  441.                       Cert resolvers have to be configured in the static configuration.
  442.                       More info: https://doc.traefik.io/traefik/v2.11/https/acme/#certificate-resolvers
  443.                     type: string
  444.                   domains:
  445.                     description: |-
  446.                       Domains defines the list of domains that will be used to issue certificates.
  447.                       More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#domains
  448.                     items:
  449.                       description: Domain holds a domain name with SANs.
  450.                       properties:
  451.                         main:
  452.                           description: Main defines the main domain name.
  453.                           type: string
  454.                         sans:
  455.                           description: SANs defines the subject alternative domain
  456.                             names.
  457.                           items:
  458.                             type: string
  459.                           type: array
  460.                       type: object
  461.                     type: array
  462.                   options:
  463.                     description: |-
  464.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  465.                       If not defined, the `default` TLSOption is used.
  466.                       More info: https://doc.traefik.io/traefik/v2.11/https/tls/#tls-options
  467.                     properties:
  468.                       name:
  469.                         description: Name defines the name of the referenced Traefik
  470.                           resource.
  471.                         type: string
  472.                       namespace:
  473.                         description: Namespace defines the namespace of the referenced
  474.                           Traefik resource.
  475.                         type: string
  476.                     required:
  477.                     - name
  478.                     type: object
  479.                   passthrough:
  480.                     description: Passthrough defines whether a TLS router will terminate
  481.                       the TLS connection.
  482.                     type: boolean
  483.                   secretName:
  484.                     description: SecretName is the name of the referenced Kubernetes
  485.                       Secret to specify the certificate details.
  486.                     type: string
  487.                   store:
  488.                     description: |-
  489.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  490.                       Please note that only `default` TLSStore can be used.
  491.                     properties:
  492.                       name:
  493.                         description: Name defines the name of the referenced Traefik
  494.                           resource.
  495.                         type: string
  496.                       namespace:
  497.                         description: Namespace defines the namespace of the referenced
  498.                           Traefik resource.
  499.                         type: string
  500.                     required:
  501.                     - name
  502.                     type: object
  503.                 type: object
  504.             required:
  505.             - routes
  506.             type: object
  507.         required:
  508.         - metadata
  509.         - spec
  510.         type: object
  511.     served: true
  512.     storage: true
  513. ---
  514. apiVersion: apiextensions.k8s.io/v1
  515. kind: CustomResourceDefinition
  516. metadata:
  517.   annotations:
  518.     controller-gen.kubebuilder.io/version: v0.14.0
  519.   name: ingressrouteudps.traefik.io
  520. spec:
  521.   group: traefik.io
  522.   names:
  523.     kind: IngressRouteUDP
  524.     listKind: IngressRouteUDPList
  525.     plural: ingressrouteudps
  526.     singular: ingressrouteudp
  527.   scope: Namespaced
  528.   versions:
  529.   - name: v1alpha1
  530.     schema:
  531.       openAPIV3Schema:
  532.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  533.         properties:
  534.           apiVersion:
  535.             description: |-
  536.               APIVersion defines the versioned schema of this representation of an object.
  537.               Servers should convert recognized schemas to the latest internal value, and
  538.               may reject unrecognized values.
  539.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  540.             type: string
  541.           kind:
  542.             description: |-
  543.               Kind is a string value representing the REST resource this object represents.
  544.               Servers may infer this from the endpoint the client submits requests to.
  545.               Cannot be updated.
  546.               In CamelCase.
  547.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  548.             type: string
  549.           metadata:
  550.             type: object
  551.           spec:
  552.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  553.             properties:
  554.               entryPoints:
  555.                 description: |-
  556.                   EntryPoints defines the list of entry point names to bind to.
  557.                   Entry points have to be configured in the static configuration.
  558.                   More info: https://doc.traefik.io/traefik/v2.11/routing/entrypoints/
  559.                   Default: all.
  560.                 items:
  561.                   type: string
  562.                 type: array
  563.               routes:
  564.                 description: Routes defines the list of routes.
  565.                 items:
  566.                   description: RouteUDP holds the UDP route configuration.
  567.                   properties:
  568.                     services:
  569.                       description: Services defines the list of UDP services.
  570.                       items:
  571.                         description: ServiceUDP defines an upstream UDP service to
  572.                           proxy traffic to.
  573.                         properties:
  574.                           name:
  575.                             description: Name defines the name of the referenced Kubernetes
  576.                               Service.
  577.                             type: string
  578.                           namespace:
  579.                             description: Namespace defines the namespace of the referenced
  580.                               Kubernetes Service.
  581.                             type: string
  582.                           nativeLB:
  583.                             description: |-
  584.                               NativeLB controls, when creating the load-balancer,
  585.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  586.                               The Kubernetes Service itself does load-balance to the pods.
  587.                               By default, NativeLB is false.
  588.                             type: boolean
  589.                           port:
  590.                             anyOf:
  591.                             - type: integer
  592.                             - type: string
  593.                             description: |-
  594.                               Port defines the port of a Kubernetes Service.
  595.                               This can be a reference to a named port.
  596.                             x-kubernetes-int-or-string: true
  597.                           weight:
  598.                             description: Weight defines the weight used when balancing
  599.                               requests between multiple Kubernetes Service.
  600.                             type: integer
  601.                         required:
  602.                         - name
  603.                         - port
  604.                         type: object
  605.                       type: array
  606.                   type: object
  607.                 type: array
  608.             required:
  609.             - routes
  610.             type: object
  611.         required:
  612.         - metadata
  613.         - spec
  614.         type: object
  615.     served: true
  616.     storage: true
  617. ---
  618. apiVersion: apiextensions.k8s.io/v1
  619. kind: CustomResourceDefinition
  620. metadata:
  621.   annotations:
  622.     controller-gen.kubebuilder.io/version: v0.14.0
  623.   name: middlewares.traefik.io
  624. spec:
  625.   group: traefik.io
  626.   names:
  627.     kind: Middleware
  628.     listKind: MiddlewareList
  629.     plural: middlewares
  630.     singular: middleware
  631.   scope: Namespaced
  632.   versions:
  633.   - name: v1alpha1
  634.     schema:
  635.       openAPIV3Schema:
  636.         description: |-
  637.           Middleware is the CRD implementation of a Traefik Middleware.
  638.           More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/overview/
  639.         properties:
  640.           apiVersion:
  641.             description: |-
  642.               APIVersion defines the versioned schema of this representation of an object.
  643.               Servers should convert recognized schemas to the latest internal value, and
  644.               may reject unrecognized values.
  645.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  646.             type: string
  647.           kind:
  648.             description: |-
  649.               Kind is a string value representing the REST resource this object represents.
  650.               Servers may infer this from the endpoint the client submits requests to.
  651.               Cannot be updated.
  652.               In CamelCase.
  653.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  654.             type: string
  655.           metadata:
  656.             type: object
  657.           spec:
  658.             description: MiddlewareSpec defines the desired state of a Middleware.
  659.             properties:
  660.               addPrefix:
  661.                 description: |-
  662.                   AddPrefix holds the add prefix middleware configuration.
  663.                   This middleware updates the path of a request before forwarding it.
  664.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/addprefix/
  665.                 properties:
  666.                   prefix:
  667.                     description: |-
  668.                       Prefix is the string to add before the current path in the requested URL.
  669.                       It should include a leading slash (/).
  670.                     type: string
  671.                 type: object
  672.               basicAuth:
  673.                 description: |-
  674.                   BasicAuth holds the basic auth middleware configuration.
  675.                   This middleware restricts access to your services to known users.
  676.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/basicauth/
  677.                 properties:
  678.                   headerField:
  679.                     description: |-
  680.                       HeaderField defines a header field to store the authenticated user.
  681.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/basicauth/#headerfield
  682.                     type: string
  683.                   realm:
  684.                     description: |-
  685.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  686.                       Default: traefik.
  687.                     type: string
  688.                   removeHeader:
  689.                     description: |-
  690.                       RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service.
  691.                       Default: false.
  692.                     type: boolean
  693.                   secret:
  694.                     description: Secret is the name of the referenced Kubernetes Secret
  695.                       containing user credentials.
  696.                     type: string
  697.                 type: object
  698.               buffering:
  699.                 description: |-
  700.                   Buffering holds the buffering middleware configuration.
  701.                   This middleware retries or limits the size of requests that can be forwarded to backends.
  702.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/buffering/#maxrequestbodybytes
  703.                 properties:
  704.                   maxRequestBodyBytes:
  705.                     description: |-
  706.                       MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).
  707.                       If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.
  708.                       Default: 0 (no maximum).
  709.                     format: int64
  710.                     type: integer
  711.                   maxResponseBodyBytes:
  712.                     description: |-
  713.                       MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes).
  714.                       If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead.
  715.                       Default: 0 (no maximum).
  716.                     format: int64
  717.                     type: integer
  718.                   memRequestBodyBytes:
  719.                     description: |-
  720.                       MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory.
  721.                       Default: 1048576 (1Mi).
  722.                     format: int64
  723.                     type: integer
  724.                   memResponseBodyBytes:
  725.                     description: |-
  726.                       MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory.
  727.                       Default: 1048576 (1Mi).
  728.                     format: int64
  729.                     type: integer
  730.                   retryExpression:
  731.                     description: |-
  732.                       RetryExpression defines the retry conditions.
  733.                       It is a logical combination of functions with operators AND (&&) and OR (||).
  734.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/buffering/#retryexpression
  735.                     type: string
  736.                 type: object
  737.               chain:
  738.                 description: |-
  739.                   Chain holds the configuration of the chain middleware.
  740.                   This middleware enables to define reusable combinations of other pieces of middleware.
  741.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/chain/
  742.                 properties:
  743.                   middlewares:
  744.                     description: Middlewares is the list of MiddlewareRef which composes
  745.                       the chain.
  746.                     items:
  747.                       description: MiddlewareRef is a reference to a Middleware resource.
  748.                       properties:
  749.                         name:
  750.                           description: Name defines the name of the referenced Middleware
  751.                             resource.
  752.                           type: string
  753.                         namespace:
  754.                           description: Namespace defines the namespace of the referenced
  755.                             Middleware resource.
  756.                           type: string
  757.                       required:
  758.                       - name
  759.                       type: object
  760.                     type: array
  761.                 type: object
  762.               circuitBreaker:
  763.                 description: CircuitBreaker holds the circuit breaker configuration.
  764.                 properties:
  765.                   checkPeriod:
  766.                     anyOf:
  767.                     - type: integer
  768.                     - type: string
  769.                     description: CheckPeriod is the interval between successive checks
  770.                       of the circuit breaker condition (when in standby state).
  771.                     x-kubernetes-int-or-string: true
  772.                   expression:
  773.                     description: Expression is the condition that triggers the tripped
  774.                       state.
  775.                     type: string
  776.                   fallbackDuration:
  777.                     anyOf:
  778.                     - type: integer
  779.                     - type: string
  780.                     description: FallbackDuration is the duration for which the circuit
  781.                       breaker will wait before trying to recover (from a tripped state).
  782.                     x-kubernetes-int-or-string: true
  783.                   recoveryDuration:
  784.                     anyOf:
  785.                     - type: integer
  786.                     - type: string
  787.                     description: RecoveryDuration is the duration for which the circuit
  788.                       breaker will try to recover (as soon as it is in recovering
  789.                       state).
  790.                     x-kubernetes-int-or-string: true
  791.                 type: object
  792.               compress:
  793.                 description: |-
  794.                   Compress holds the compress middleware configuration.
  795.                   This middleware compresses responses before sending them to the client, using gzip compression.
  796.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/compress/
  797.                 properties:
  798.                   excludedContentTypes:
  799.                     description: ExcludedContentTypes defines the list of content
  800.                       types to compare the Content-Type header of the incoming requests
  801.                       and responses before compressing.
  802.                     items:
  803.                       type: string
  804.                     type: array
  805.                   minResponseBodyBytes:
  806.                     description: |-
  807.                       MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed.
  808.                       Default: 1024.
  809.                     type: integer
  810.                 type: object
  811.               contentType:
  812.                 description: |-
  813.                   ContentType holds the content-type middleware configuration.
  814.                   This middleware exists to enable the correct behavior until at least the default one can be changed in a future version.
  815.                 properties:
  816.                   autoDetect:
  817.                     description: |-
  818.                       AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend,
  819.                       be automatically set to a value derived from the contents of the response.
  820.                       As a proxy, the default behavior should be to leave the header alone, regardless of what the backend did with it.
  821.                       However, the historic default was to always auto-detect and set the header if it was nil,
  822.                       and it is going to be kept that way in order to support users currently relying on it.
  823.                     type: boolean
  824.                 type: object
  825.               digestAuth:
  826.                 description: |-
  827.                   DigestAuth holds the digest auth middleware configuration.
  828.                   This middleware restricts access to your services to known users.
  829.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/digestauth/
  830.                 properties:
  831.                   headerField:
  832.                     description: |-
  833.                       HeaderField defines a header field to store the authenticated user.
  834.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/basicauth/#headerfield
  835.                     type: string
  836.                   realm:
  837.                     description: |-
  838.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  839.                       Default: traefik.
  840.                     type: string
  841.                   removeHeader:
  842.                     description: RemoveHeader defines whether to remove the authorization
  843.                       header before forwarding the request to the backend.
  844.                     type: boolean
  845.                   secret:
  846.                     description: Secret is the name of the referenced Kubernetes Secret
  847.                       containing user credentials.
  848.                     type: string
  849.                 type: object
  850.               errors:
  851.                 description: |-
  852.                   ErrorPage holds the custom error middleware configuration.
  853.                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
  854.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/errorpages/
  855.                 properties:
  856.                   query:
  857.                     description: |-
  858.                       Query defines the URL for the error page (hosted by service).
  859.                       The {status} variable can be used in order to insert the status code in the URL.
  860.                     type: string
  861.                   service:
  862.                     description: |-
  863.                       Service defines the reference to a Kubernetes Service that will serve the error page.
  864.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/errorpages/#service
  865.                     properties:
  866.                       kind:
  867.                         description: Kind defines the kind of the Service.
  868.                         enum:
  869.                         - Service
  870.                         - TraefikService
  871.                         type: string
  872.                       name:
  873.                         description: |-
  874.                           Name defines the name of the referenced Kubernetes Service or TraefikService.
  875.                           The differentiation between the two is specified in the Kind field.
  876.                         type: string
  877.                       namespace:
  878.                         description: Namespace defines the namespace of the referenced
  879.                           Kubernetes Service or TraefikService.
  880.                         type: string
  881.                       nativeLB:
  882.                         description: |-
  883.                           NativeLB controls, when creating the load-balancer,
  884.                           whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  885.                           The Kubernetes Service itself does load-balance to the pods.
  886.                           By default, NativeLB is false.
  887.                         type: boolean
  888.                       passHostHeader:
  889.                         description: |-
  890.                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  891.                           By default, passHostHeader is true.
  892.                         type: boolean
  893.                       port:
  894.                         anyOf:
  895.                         - type: integer
  896.                         - type: string
  897.                         description: |-
  898.                           Port defines the port of a Kubernetes Service.
  899.                           This can be a reference to a named port.
  900.                         x-kubernetes-int-or-string: true
  901.                       responseForwarding:
  902.                         description: ResponseForwarding defines how Traefik forwards
  903.                           the response from the upstream Kubernetes Service to the
  904.                           client.
  905.                         properties:
  906.                           flushInterval:
  907.                             description: |-
  908.                               FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  909.                               A negative value means to flush immediately after each write to the client.
  910.                               This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  911.                               for such responses, writes are flushed to the client immediately.
  912.                               Default: 100ms
  913.                             type: string
  914.                         type: object
  915.                       scheme:
  916.                         description: |-
  917.                           Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  918.                           It defaults to https when Kubernetes Service port is 443, http otherwise.
  919.                         type: string
  920.                       serversTransport:
  921.                         description: |-
  922.                           ServersTransport defines the name of ServersTransport resource to use.
  923.                           It allows to configure the transport between Traefik and your servers.
  924.                           Can only be used on a Kubernetes Service.
  925.                         type: string
  926.                       sticky:
  927.                         description: |-
  928.                           Sticky defines the sticky sessions configuration.
  929.                           More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  930.                         properties:
  931.                           cookie:
  932.                             description: Cookie defines the sticky cookie configuration.
  933.                             properties:
  934.                               httpOnly:
  935.                                 description: HTTPOnly defines whether the cookie can
  936.                                   be accessed by client-side APIs, such as JavaScript.
  937.                                 type: boolean
  938.                               name:
  939.                                 description: Name defines the Cookie name.
  940.                                 type: string
  941.                               sameSite:
  942.                                 description: |-
  943.                                   SameSite defines the same site policy.
  944.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  945.                                 type: string
  946.                               secure:
  947.                                 description: Secure defines whether the cookie can
  948.                                   only be transmitted over an encrypted connection
  949.                                   (i.e. HTTPS).
  950.                                 type: boolean
  951.                             type: object
  952.                         type: object
  953.                       strategy:
  954.                         description: |-
  955.                           Strategy defines the load balancing strategy between the servers.
  956.                           RoundRobin is the only supported value at the moment.
  957.                         type: string
  958.                       weight:
  959.                         description: |-
  960.                           Weight defines the weight and should only be specified when Name references a TraefikService object
  961.                           (and to be precise, one that embeds a Weighted Round Robin).
  962.                         type: integer
  963.                     required:
  964.                     - name
  965.                     type: object
  966.                   status:
  967.                     description: |-
  968.                       Status defines which status or range of statuses should result in an error page.
  969.                       It can be either a status code as a number (500),
  970.                       as multiple comma-separated numbers (500,502),
  971.                       as ranges by separating two codes with a dash (500-599),
  972.                       or a combination of the two (404,418,500-599).
  973.                     items:
  974.                       type: string
  975.                     type: array
  976.                 type: object
  977.               forwardAuth:
  978.                 description: |-
  979.                   ForwardAuth holds the forward auth middleware configuration.
  980.                   This middleware delegates the request authentication to a Service.
  981.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/forwardauth/
  982.                 properties:
  983.                   address:
  984.                     description: Address defines the authentication server address.
  985.                     type: string
  986.                   authRequestHeaders:
  987.                     description: |-
  988.                       AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
  989.                       If not set or empty then all request headers are passed.
  990.                     items:
  991.                       type: string
  992.                     type: array
  993.                   authResponseHeaders:
  994.                     description: AuthResponseHeaders defines the list of headers to
  995.                       copy from the authentication server response and set on forwarded
  996.                       request, replacing any existing conflicting headers.
  997.                     items:
  998.                       type: string
  999.                     type: array
  1000.                   authResponseHeadersRegex:
  1001.                     description: |-
  1002.                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
  1003.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/forwardauth/#authresponseheadersregex
  1004.                     type: string
  1005.                   tls:
  1006.                     description: TLS defines the configuration used to secure the
  1007.                       connection to the authentication server.
  1008.                     properties:
  1009.                       caOptional:
  1010.                         type: boolean
  1011.                       caSecret:
  1012.                         description: |-
  1013.                           CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate.
  1014.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  1015.                         type: string
  1016.                       certSecret:
  1017.                         description: |-
  1018.                           CertSecret is the name of the referenced Kubernetes Secret containing the client certificate.
  1019.                           The client certificate is extracted from the keys `tls.crt` and `tls.key`.
  1020.                         type: string
  1021.                       insecureSkipVerify:
  1022.                         description: InsecureSkipVerify defines whether the server
  1023.                           certificates should be validated.
  1024.                         type: boolean
  1025.                     type: object
  1026.                   trustForwardHeader:
  1027.                     description: 'TrustForwardHeader defines whether to trust (ie:
  1028.                       forward) all X-Forwarded-* headers.'
  1029.                     type: boolean
  1030.                 type: object
  1031.               headers:
  1032.                 description: |-
  1033.                   Headers holds the headers middleware configuration.
  1034.                   This middleware manages the requests and responses headers.
  1035.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/headers/#customrequestheaders
  1036.                 properties:
  1037.                   accessControlAllowCredentials:
  1038.                     description: AccessControlAllowCredentials defines whether the
  1039.                       request can include user credentials.
  1040.                     type: boolean
  1041.                   accessControlAllowHeaders:
  1042.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  1043.                       values sent in preflight response.
  1044.                     items:
  1045.                       type: string
  1046.                     type: array
  1047.                   accessControlAllowMethods:
  1048.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  1049.                       values sent in preflight response.
  1050.                     items:
  1051.                       type: string
  1052.                     type: array
  1053.                   accessControlAllowOriginList:
  1054.                     description: AccessControlAllowOriginList is a list of allowable
  1055.                       origins. Can also be a wildcard origin "*".
  1056.                     items:
  1057.                       type: string
  1058.                     type: array
  1059.                   accessControlAllowOriginListRegex:
  1060.                     description: AccessControlAllowOriginListRegex is a list of allowable
  1061.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  1062.                     items:
  1063.                       type: string
  1064.                     type: array
  1065.                   accessControlExposeHeaders:
  1066.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  1067.                       values sent in preflight response.
  1068.                     items:
  1069.                       type: string
  1070.                     type: array
  1071.                   accessControlMaxAge:
  1072.                     description: AccessControlMaxAge defines the time that a preflight
  1073.                       request may be cached.
  1074.                     format: int64
  1075.                     type: integer
  1076.                   addVaryHeader:
  1077.                     description: AddVaryHeader defines whether the Vary header is
  1078.                       automatically added/updated when the AccessControlAllowOriginList
  1079.                       is set.
  1080.                     type: boolean
  1081.                   allowedHosts:
  1082.                     description: AllowedHosts defines the fully qualified list of
  1083.                       allowed domain names.
  1084.                     items:
  1085.                       type: string
  1086.                     type: array
  1087.                   browserXssFilter:
  1088.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  1089.                       header with the value 1; mode=block.
  1090.                     type: boolean
  1091.                   contentSecurityPolicy:
  1092.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  1093.                       header value.
  1094.                     type: string
  1095.                   contentTypeNosniff:
  1096.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  1097.                       header with the nosniff value.
  1098.                     type: boolean
  1099.                   customBrowserXSSValue:
  1100.                     description: |-
  1101.                       CustomBrowserXSSValue defines the X-XSS-Protection header value.
  1102.                       This overrides the BrowserXssFilter option.
  1103.                     type: string
  1104.                   customFrameOptionsValue:
  1105.                     description: |-
  1106.                       CustomFrameOptionsValue defines the X-Frame-Options header value.
  1107.                       This overrides the FrameDeny option.
  1108.                     type: string
  1109.                   customRequestHeaders:
  1110.                     additionalProperties:
  1111.                       type: string
  1112.                     description: CustomRequestHeaders defines the header names and
  1113.                       values to apply to the request.
  1114.                     type: object
  1115.                   customResponseHeaders:
  1116.                     additionalProperties:
  1117.                       type: string
  1118.                     description: CustomResponseHeaders defines the header names and
  1119.                       values to apply to the response.
  1120.                     type: object
  1121.                   featurePolicy:
  1122.                     description: 'Deprecated: use PermissionsPolicy instead.'
  1123.                     type: string
  1124.                   forceSTSHeader:
  1125.                     description: ForceSTSHeader defines whether to add the STS header
  1126.                       even when the connection is HTTP.
  1127.                     type: boolean
  1128.                   frameDeny:
  1129.                     description: FrameDeny defines whether to add the X-Frame-Options
  1130.                       header with the DENY value.
  1131.                     type: boolean
  1132.                   hostsProxyHeaders:
  1133.                     description: HostsProxyHeaders defines the header keys that may
  1134.                       hold a proxied hostname value for the request.
  1135.                     items:
  1136.                       type: string
  1137.                     type: array
  1138.                   isDevelopment:
  1139.                     description: |-
  1140.                       IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing.
  1141.                       Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain.
  1142.                       If you would like your development environment to mimic production with complete Host blocking, SSL redirects,
  1143.                       and STS headers, leave this as false.
  1144.                     type: boolean
  1145.                   permissionsPolicy:
  1146.                     description: |-
  1147.                       PermissionsPolicy defines the Permissions-Policy header value.
  1148.                       This allows sites to control browser features.
  1149.                     type: string
  1150.                   publicKey:
  1151.                     description: PublicKey is the public key that implements HPKP
  1152.                       to prevent MITM attacks with forged certificates.
  1153.                     type: string
  1154.                   referrerPolicy:
  1155.                     description: |-
  1156.                       ReferrerPolicy defines the Referrer-Policy header value.
  1157.                       This allows sites to control whether browsers forward the Referer header to other sites.
  1158.                     type: string
  1159.                   sslForceHost:
  1160.                     description: 'Deprecated: use RedirectRegex instead.'
  1161.                     type: boolean
  1162.                   sslHost:
  1163.                     description: 'Deprecated: use RedirectRegex instead.'
  1164.                     type: string
  1165.                   sslProxyHeaders:
  1166.                     additionalProperties:
  1167.                       type: string
  1168.                     description: |-
  1169.                       SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request.
  1170.                       It can be useful when using other proxies (example: "X-Forwarded-Proto": "https").
  1171.                     type: object
  1172.                   sslRedirect:
  1173.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  1174.                       instead.'
  1175.                     type: boolean
  1176.                   sslTemporaryRedirect:
  1177.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  1178.                       instead.'
  1179.                     type: boolean
  1180.                   stsIncludeSubdomains:
  1181.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  1182.                       directive is appended to the Strict-Transport-Security header.
  1183.                     type: boolean
  1184.                   stsPreload:
  1185.                     description: STSPreload defines whether the preload flag is appended
  1186.                       to the Strict-Transport-Security header.
  1187.                     type: boolean
  1188.                   stsSeconds:
  1189.                     description: |-
  1190.                       STSSeconds defines the max-age of the Strict-Transport-Security header.
  1191.                       If set to 0, the header is not set.
  1192.                     format: int64
  1193.                     type: integer
  1194.                 type: object
  1195.               inFlightReq:
  1196.                 description: |-
  1197.                   InFlightReq holds the in-flight request middleware configuration.
  1198.                   This middleware limits the number of requests being processed and served concurrently.
  1199.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/inflightreq/
  1200.                 properties:
  1201.                   amount:
  1202.                     description: |-
  1203.                       Amount defines the maximum amount of allowed simultaneous in-flight request.
  1204.                       The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).
  1205.                     format: int64
  1206.                     type: integer
  1207.                   sourceCriterion:
  1208.                     description: |-
  1209.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1210.                       If several strategies are defined at the same time, an error will be raised.
  1211.                       If none are set, the default is to use the requestHost.
  1212.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/inflightreq/#sourcecriterion
  1213.                     properties:
  1214.                       ipStrategy:
  1215.                         description: |-
  1216.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1217.                           More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  1218.                         properties:
  1219.                           depth:
  1220.                             description: Depth tells Traefik to use the X-Forwarded-For
  1221.                               header and take the IP located at the depth position
  1222.                               (starting from the right).
  1223.                             type: integer
  1224.                           excludedIPs:
  1225.                             description: ExcludedIPs configures Traefik to scan the
  1226.                               X-Forwarded-For header and select the first IP not in
  1227.                               the list.
  1228.                             items:
  1229.                               type: string
  1230.                             type: array
  1231.                         type: object
  1232.                       requestHeaderName:
  1233.                         description: RequestHeaderName defines the name of the header
  1234.                           used to group incoming requests.
  1235.                         type: string
  1236.                       requestHost:
  1237.                         description: RequestHost defines whether to consider the request
  1238.                           Host as the source.
  1239.                         type: boolean
  1240.                     type: object
  1241.                 type: object
  1242.               ipAllowList:
  1243.                 description: |-
  1244.                   IPAllowList holds the IP allowlist middleware configuration.
  1245.                   This middleware accepts / refuses requests based on the client IP.
  1246.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/
  1247.                 properties:
  1248.                   ipStrategy:
  1249.                     description: |-
  1250.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1251.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  1252.                     properties:
  1253.                       depth:
  1254.                         description: Depth tells Traefik to use the X-Forwarded-For
  1255.                           header and take the IP located at the depth position (starting
  1256.                           from the right).
  1257.                         type: integer
  1258.                       excludedIPs:
  1259.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1260.                           header and select the first IP not in the list.
  1261.                         items:
  1262.                           type: string
  1263.                         type: array
  1264.                     type: object
  1265.                   sourceRange:
  1266.                     description: SourceRange defines the set of allowed IPs (or ranges
  1267.                       of allowed IPs by using CIDR notation).
  1268.                     items:
  1269.                       type: string
  1270.                     type: array
  1271.                 type: object
  1272.               ipWhiteList:
  1273.                 description: |-
  1274.                   IPWhiteList holds the IP whitelist middleware configuration.
  1275.                   This middleware accepts / refuses requests based on the client IP.
  1276.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipwhitelist/
  1277.                   Deprecated: please use IPAllowList instead.
  1278.                 properties:
  1279.                   ipStrategy:
  1280.                     description: |-
  1281.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1282.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  1283.                     properties:
  1284.                       depth:
  1285.                         description: Depth tells Traefik to use the X-Forwarded-For
  1286.                           header and take the IP located at the depth position (starting
  1287.                           from the right).
  1288.                         type: integer
  1289.                       excludedIPs:
  1290.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1291.                           header and select the first IP not in the list.
  1292.                         items:
  1293.                           type: string
  1294.                         type: array
  1295.                     type: object
  1296.                   sourceRange:
  1297.                     description: SourceRange defines the set of allowed IPs (or ranges
  1298.                       of allowed IPs by using CIDR notation).
  1299.                     items:
  1300.                       type: string
  1301.                     type: array
  1302.                 type: object
  1303.               passTLSClientCert:
  1304.                 description: |-
  1305.                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
  1306.                   This middleware adds the selected data from the passed client TLS certificate to a header.
  1307.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/passtlsclientcert/
  1308.                 properties:
  1309.                   info:
  1310.                     description: Info selects the specific client certificate details
  1311.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1312.                     properties:
  1313.                       issuer:
  1314.                         description: Issuer defines the client certificate issuer
  1315.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1316.                         properties:
  1317.                           commonName:
  1318.                             description: CommonName defines whether to add the organizationalUnit
  1319.                               information into the issuer.
  1320.                             type: boolean
  1321.                           country:
  1322.                             description: Country defines whether to add the country
  1323.                               information into the issuer.
  1324.                             type: boolean
  1325.                           domainComponent:
  1326.                             description: DomainComponent defines whether to add the
  1327.                               domainComponent information into the issuer.
  1328.                             type: boolean
  1329.                           locality:
  1330.                             description: Locality defines whether to add the locality
  1331.                               information into the issuer.
  1332.                             type: boolean
  1333.                           organization:
  1334.                             description: Organization defines whether to add the organization
  1335.                               information into the issuer.
  1336.                             type: boolean
  1337.                           province:
  1338.                             description: Province defines whether to add the province
  1339.                               information into the issuer.
  1340.                             type: boolean
  1341.                           serialNumber:
  1342.                             description: SerialNumber defines whether to add the serialNumber
  1343.                               information into the issuer.
  1344.                             type: boolean
  1345.                         type: object
  1346.                       notAfter:
  1347.                         description: NotAfter defines whether to add the Not After
  1348.                           information from the Validity part.
  1349.                         type: boolean
  1350.                       notBefore:
  1351.                         description: NotBefore defines whether to add the Not Before
  1352.                           information from the Validity part.
  1353.                         type: boolean
  1354.                       sans:
  1355.                         description: Sans defines whether to add the Subject Alternative
  1356.                           Name information from the Subject Alternative Name part.
  1357.                         type: boolean
  1358.                       serialNumber:
  1359.                         description: SerialNumber defines whether to add the client
  1360.                           serialNumber information.
  1361.                         type: boolean
  1362.                       subject:
  1363.                         description: Subject defines the client certificate subject
  1364.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1365.                         properties:
  1366.                           commonName:
  1367.                             description: CommonName defines whether to add the organizationalUnit
  1368.                               information into the subject.
  1369.                             type: boolean
  1370.                           country:
  1371.                             description: Country defines whether to add the country
  1372.                               information into the subject.
  1373.                             type: boolean
  1374.                           domainComponent:
  1375.                             description: DomainComponent defines whether to add the
  1376.                               domainComponent information into the subject.
  1377.                             type: boolean
  1378.                           locality:
  1379.                             description: Locality defines whether to add the locality
  1380.                               information into the subject.
  1381.                             type: boolean
  1382.                           organization:
  1383.                             description: Organization defines whether to add the organization
  1384.                               information into the subject.
  1385.                             type: boolean
  1386.                           organizationalUnit:
  1387.                             description: OrganizationalUnit defines whether to add
  1388.                               the organizationalUnit information into the subject.
  1389.                             type: boolean
  1390.                           province:
  1391.                             description: Province defines whether to add the province
  1392.                               information into the subject.
  1393.                             type: boolean
  1394.                           serialNumber:
  1395.                             description: SerialNumber defines whether to add the serialNumber
  1396.                               information into the subject.
  1397.                             type: boolean
  1398.                         type: object
  1399.                     type: object
  1400.                   pem:
  1401.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  1402.                       the certificate.
  1403.                     type: boolean
  1404.                 type: object
  1405.               plugin:
  1406.                 additionalProperties:
  1407.                   x-kubernetes-preserve-unknown-fields: true
  1408.                 description: |-
  1409.                   Plugin defines the middleware plugin configuration.
  1410.                   More info: https://doc.traefik.io/traefik/plugins/
  1411.                 type: object
  1412.               rateLimit:
  1413.                 description: |-
  1414.                   RateLimit holds the rate limit configuration.
  1415.                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
  1416.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ratelimit/
  1417.                 properties:
  1418.                   average:
  1419.                     description: |-
  1420.                       Average is the maximum rate, by default in requests/s, allowed for the given source.
  1421.                       It defaults to 0, which means no rate limiting.
  1422.                       The rate is actually defined by dividing Average by Period. So for a rate below 1req/s,
  1423.                       one needs to define a Period larger than a second.
  1424.                     format: int64
  1425.                     type: integer
  1426.                   burst:
  1427.                     description: |-
  1428.                       Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time.
  1429.                       It defaults to 1.
  1430.                     format: int64
  1431.                     type: integer
  1432.                   period:
  1433.                     anyOf:
  1434.                     - type: integer
  1435.                     - type: string
  1436.                     description: |-
  1437.                       Period, in combination with Average, defines the actual maximum rate, such as:
  1438.                       r = Average / Period. It defaults to a second.
  1439.                     x-kubernetes-int-or-string: true
  1440.                   sourceCriterion:
  1441.                     description: |-
  1442.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1443.                       If several strategies are defined at the same time, an error will be raised.
  1444.                       If none are set, the default is to use the request's remote address field (as an ipStrategy).
  1445.                     properties:
  1446.                       ipStrategy:
  1447.                         description: |-
  1448.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1449.                           More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  1450.                         properties:
  1451.                           depth:
  1452.                             description: Depth tells Traefik to use the X-Forwarded-For
  1453.                               header and take the IP located at the depth position
  1454.                               (starting from the right).
  1455.                             type: integer
  1456.                           excludedIPs:
  1457.                             description: ExcludedIPs configures Traefik to scan the
  1458.                               X-Forwarded-For header and select the first IP not in
  1459.                               the list.
  1460.                             items:
  1461.                               type: string
  1462.                             type: array
  1463.                         type: object
  1464.                       requestHeaderName:
  1465.                         description: RequestHeaderName defines the name of the header
  1466.                           used to group incoming requests.
  1467.                         type: string
  1468.                       requestHost:
  1469.                         description: RequestHost defines whether to consider the request
  1470.                           Host as the source.
  1471.                         type: boolean
  1472.                     type: object
  1473.                 type: object
  1474.               redirectRegex:
  1475.                 description: |-
  1476.                   RedirectRegex holds the redirect regex middleware configuration.
  1477.                   This middleware redirects a request using regex matching and replacement.
  1478.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/redirectregex/#regex
  1479.                 properties:
  1480.                   permanent:
  1481.                     description: Permanent defines whether the redirection is permanent
  1482.                       (301).
  1483.                     type: boolean
  1484.                   regex:
  1485.                     description: Regex defines the regex used to match and capture
  1486.                       elements from the request URL.
  1487.                     type: string
  1488.                   replacement:
  1489.                     description: Replacement defines how to modify the URL to have
  1490.                       the new target URL.
  1491.                     type: string
  1492.                 type: object
  1493.               redirectScheme:
  1494.                 description: |-
  1495.                   RedirectScheme holds the redirect scheme middleware configuration.
  1496.                   This middleware redirects requests from a scheme/port to another.
  1497.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/redirectscheme/
  1498.                 properties:
  1499.                   permanent:
  1500.                     description: Permanent defines whether the redirection is permanent
  1501.                       (301).
  1502.                     type: boolean
  1503.                   port:
  1504.                     description: Port defines the port of the new URL.
  1505.                     type: string
  1506.                   scheme:
  1507.                     description: Scheme defines the scheme of the new URL.
  1508.                     type: string
  1509.                 type: object
  1510.               replacePath:
  1511.                 description: |-
  1512.                   ReplacePath holds the replace path middleware configuration.
  1513.                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
  1514.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/replacepath/
  1515.                 properties:
  1516.                   path:
  1517.                     description: Path defines the path to use as replacement in the
  1518.                       request URL.
  1519.                     type: string
  1520.                 type: object
  1521.               replacePathRegex:
  1522.                 description: |-
  1523.                   ReplacePathRegex holds the replace path regex middleware configuration.
  1524.                   This middleware replaces the path of a URL using regex matching and replacement.
  1525.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/replacepathregex/
  1526.                 properties:
  1527.                   regex:
  1528.                     description: Regex defines the regular expression used to match
  1529.                       and capture the path from the request URL.
  1530.                     type: string
  1531.                   replacement:
  1532.                     description: Replacement defines the replacement path format,
  1533.                       which can include captured variables.
  1534.                     type: string
  1535.                 type: object
  1536.               retry:
  1537.                 description: |-
  1538.                   Retry holds the retry middleware configuration.
  1539.                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
  1540.                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
  1541.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/retry/
  1542.                 properties:
  1543.                   attempts:
  1544.                     description: Attempts defines how many times the request should
  1545.                       be retried.
  1546.                     type: integer
  1547.                   initialInterval:
  1548.                     anyOf:
  1549.                     - type: integer
  1550.                     - type: string
  1551.                     description: |-
  1552.                       InitialInterval defines the first wait time in the exponential backoff series.
  1553.                       The maximum interval is calculated as twice the initialInterval.
  1554.                       If unspecified, requests will be retried immediately.
  1555.                       The value of initialInterval should be provided in seconds or as a valid duration format,
  1556.                       see https://pkg.go.dev/time#ParseDuration.
  1557.                     x-kubernetes-int-or-string: true
  1558.                 type: object
  1559.               stripPrefix:
  1560.                 description: |-
  1561.                   StripPrefix holds the strip prefix middleware configuration.
  1562.                   This middleware removes the specified prefixes from the URL path.
  1563.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/stripprefix/
  1564.                 properties:
  1565.                   forceSlash:
  1566.                     description: |-
  1567.                       ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.
  1568.                       Default: true.
  1569.                     type: boolean
  1570.                   prefixes:
  1571.                     description: Prefixes defines the prefixes to strip from the request
  1572.                       URL.
  1573.                     items:
  1574.                       type: string
  1575.                     type: array
  1576.                 type: object
  1577.               stripPrefixRegex:
  1578.                 description: |-
  1579.                   StripPrefixRegex holds the strip prefix regex middleware configuration.
  1580.                   This middleware removes the matching prefixes from the URL path.
  1581.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/stripprefixregex/
  1582.                 properties:
  1583.                   regex:
  1584.                     description: Regex defines the regular expression to match the
  1585.                       path prefix from the request URL.
  1586.                     items:
  1587.                       type: string
  1588.                     type: array
  1589.                 type: object
  1590.             type: object
  1591.         required:
  1592.         - metadata
  1593.         - spec
  1594.         type: object
  1595.     served: true
  1596.     storage: true
  1597. ---
  1598. apiVersion: apiextensions.k8s.io/v1
  1599. kind: CustomResourceDefinition
  1600. metadata:
  1601.   annotations:
  1602.     controller-gen.kubebuilder.io/version: v0.14.0
  1603.   name: middlewaretcps.traefik.io
  1604. spec:
  1605.   group: traefik.io
  1606.   names:
  1607.     kind: MiddlewareTCP
  1608.     listKind: MiddlewareTCPList
  1609.     plural: middlewaretcps
  1610.     singular: middlewaretcp
  1611.   scope: Namespaced
  1612.   versions:
  1613.   - name: v1alpha1
  1614.     schema:
  1615.       openAPIV3Schema:
  1616.         description: |-
  1617.           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  1618.           More info: https://doc.traefik.io/traefik/v2.11/middlewares/overview/
  1619.         properties:
  1620.           apiVersion:
  1621.             description: |-
  1622.               APIVersion defines the versioned schema of this representation of an object.
  1623.               Servers should convert recognized schemas to the latest internal value, and
  1624.               may reject unrecognized values.
  1625.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1626.             type: string
  1627.           kind:
  1628.             description: |-
  1629.               Kind is a string value representing the REST resource this object represents.
  1630.               Servers may infer this from the endpoint the client submits requests to.
  1631.               Cannot be updated.
  1632.               In CamelCase.
  1633.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1634.             type: string
  1635.           metadata:
  1636.             type: object
  1637.           spec:
  1638.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  1639.             properties:
  1640.               inFlightConn:
  1641.                 description: InFlightConn defines the InFlightConn middleware configuration.
  1642.                 properties:
  1643.                   amount:
  1644.                     description: |-
  1645.                       Amount defines the maximum amount of allowed simultaneous connections.
  1646.                       The middleware closes the connection if there are already amount connections opened.
  1647.                     format: int64
  1648.                     type: integer
  1649.                 type: object
  1650.               ipAllowList:
  1651.                 description: |-
  1652.                   IPAllowList defines the IPAllowList middleware configuration.
  1653.                   This middleware accepts/refuses connections based on the client IP.
  1654.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/tcp/ipallowlist/
  1655.                 properties:
  1656.                   sourceRange:
  1657.                     description: SourceRange defines the allowed IPs (or ranges of
  1658.                       allowed IPs by using CIDR notation).
  1659.                     items:
  1660.                       type: string
  1661.                     type: array
  1662.                 type: object
  1663.               ipWhiteList:
  1664.                 description: |-
  1665.                   IPWhiteList defines the IPWhiteList middleware configuration.
  1666.                   This middleware accepts/refuses connections based on the client IP.
  1667.                   Deprecated: please use IPAllowList instead.
  1668.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/tcp/ipwhitelist/
  1669.                 properties:
  1670.                   sourceRange:
  1671.                     description: SourceRange defines the allowed IPs (or ranges of
  1672.                       allowed IPs by using CIDR notation).
  1673.                     items:
  1674.                       type: string
  1675.                     type: array
  1676.                 type: object
  1677.             type: object
  1678.         required:
  1679.         - metadata
  1680.         - spec
  1681.         type: object
  1682.     served: true
  1683.     storage: true
  1684. ---
  1685. apiVersion: apiextensions.k8s.io/v1
  1686. kind: CustomResourceDefinition
  1687. metadata:
  1688.   annotations:
  1689.     controller-gen.kubebuilder.io/version: v0.14.0
  1690.   name: serverstransports.traefik.io
  1691. spec:
  1692.   group: traefik.io
  1693.   names:
  1694.     kind: ServersTransport
  1695.     listKind: ServersTransportList
  1696.     plural: serverstransports
  1697.     singular: serverstransport
  1698.   scope: Namespaced
  1699.   versions:
  1700.   - name: v1alpha1
  1701.     schema:
  1702.       openAPIV3Schema:
  1703.         description: |-
  1704.           ServersTransport is the CRD implementation of a ServersTransport.
  1705.           If no serversTransport is specified, the default@internal will be used.
  1706.           The default@internal serversTransport is created from the static configuration.
  1707.           More info: https://doc.traefik.io/traefik/v2.11/routing/services/#serverstransport_1
  1708.         properties:
  1709.           apiVersion:
  1710.             description: |-
  1711.               APIVersion defines the versioned schema of this representation of an object.
  1712.               Servers should convert recognized schemas to the latest internal value, and
  1713.               may reject unrecognized values.
  1714.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1715.             type: string
  1716.           kind:
  1717.             description: |-
  1718.               Kind is a string value representing the REST resource this object represents.
  1719.               Servers may infer this from the endpoint the client submits requests to.
  1720.               Cannot be updated.
  1721.               In CamelCase.
  1722.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1723.             type: string
  1724.           metadata:
  1725.             type: object
  1726.           spec:
  1727.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  1728.             properties:
  1729.               certificatesSecrets:
  1730.                 description: CertificatesSecrets defines a list of secret storing
  1731.                   client certificates for mTLS.
  1732.                 items:
  1733.                   type: string
  1734.                 type: array
  1735.               disableHTTP2:
  1736.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  1737.                   servers.
  1738.                 type: boolean
  1739.               forwardingTimeouts:
  1740.                 description: ForwardingTimeouts defines the timeouts for requests
  1741.                   forwarded to the backend servers.
  1742.                 properties:
  1743.                   dialTimeout:
  1744.                     anyOf:
  1745.                     - type: integer
  1746.                     - type: string
  1747.                     description: DialTimeout is the amount of time to wait until a
  1748.                       connection to a backend server can be established.
  1749.                     x-kubernetes-int-or-string: true
  1750.                   idleConnTimeout:
  1751.                     anyOf:
  1752.                     - type: integer
  1753.                     - type: string
  1754.                     description: IdleConnTimeout is the maximum period for which an
  1755.                       idle HTTP keep-alive connection will remain open before closing
  1756.                       itself.
  1757.                     x-kubernetes-int-or-string: true
  1758.                   pingTimeout:
  1759.                     anyOf:
  1760.                     - type: integer
  1761.                     - type: string
  1762.                     description: PingTimeout is the timeout after which the HTTP/2
  1763.                       connection will be closed if a response to ping is not received.
  1764.                     x-kubernetes-int-or-string: true
  1765.                   readIdleTimeout:
  1766.                     anyOf:
  1767.                     - type: integer
  1768.                     - type: string
  1769.                     description: ReadIdleTimeout is the timeout after which a health
  1770.                       check using ping frame will be carried out if no frame is received
  1771.                       on the HTTP/2 connection.
  1772.                     x-kubernetes-int-or-string: true
  1773.                   responseHeaderTimeout:
  1774.                     anyOf:
  1775.                     - type: integer
  1776.                     - type: string
  1777.                     description: ResponseHeaderTimeout is the amount of time to wait
  1778.                       for a server's response headers after fully writing the request
  1779.                       (including its body, if any).
  1780.                     x-kubernetes-int-or-string: true
  1781.                 type: object
  1782.               insecureSkipVerify:
  1783.                 description: InsecureSkipVerify disables SSL certificate verification.
  1784.                 type: boolean
  1785.               maxIdleConnsPerHost:
  1786.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  1787.                   to keep per-host.
  1788.                 type: integer
  1789.               peerCertURI:
  1790.                 description: PeerCertURI defines the peer cert URI used to match against
  1791.                   SAN URI during the peer certificate verification.
  1792.                 type: string
  1793.               rootCAsSecrets:
  1794.                 description: RootCAsSecrets defines a list of CA secret used to validate
  1795.                   self-signed certificate.
  1796.                 items:
  1797.                   type: string
  1798.                 type: array
  1799.               serverName:
  1800.                 description: ServerName defines the server name used to contact the
  1801.                   server.
  1802.                 type: string
  1803.             type: object
  1804.         required:
  1805.         - metadata
  1806.         - spec
  1807.         type: object
  1808.     served: true
  1809.     storage: true
  1810. ---
  1811. apiVersion: apiextensions.k8s.io/v1
  1812. kind: CustomResourceDefinition
  1813. metadata:
  1814.   annotations:
  1815.     controller-gen.kubebuilder.io/version: v0.14.0
  1816.   name: tlsoptions.traefik.io
  1817. spec:
  1818.   group: traefik.io
  1819.   names:
  1820.     kind: TLSOption
  1821.     listKind: TLSOptionList
  1822.     plural: tlsoptions
  1823.     singular: tlsoption
  1824.   scope: Namespaced
  1825.   versions:
  1826.   - name: v1alpha1
  1827.     schema:
  1828.       openAPIV3Schema:
  1829.         description: |-
  1830.           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
  1831.           More info: https://doc.traefik.io/traefik/v2.11/https/tls/#tls-options
  1832.         properties:
  1833.           apiVersion:
  1834.             description: |-
  1835.               APIVersion defines the versioned schema of this representation of an object.
  1836.               Servers should convert recognized schemas to the latest internal value, and
  1837.               may reject unrecognized values.
  1838.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1839.             type: string
  1840.           kind:
  1841.             description: |-
  1842.               Kind is a string value representing the REST resource this object represents.
  1843.               Servers may infer this from the endpoint the client submits requests to.
  1844.               Cannot be updated.
  1845.               In CamelCase.
  1846.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1847.             type: string
  1848.           metadata:
  1849.             type: object
  1850.           spec:
  1851.             description: TLSOptionSpec defines the desired state of a TLSOption.
  1852.             properties:
  1853.               alpnProtocols:
  1854.                 description: |-
  1855.                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
  1856.                   More info: https://doc.traefik.io/traefik/v2.11/https/tls/#alpn-protocols
  1857.                 items:
  1858.                   type: string
  1859.                 type: array
  1860.               cipherSuites:
  1861.                 description: |-
  1862.                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
  1863.                   More info: https://doc.traefik.io/traefik/v2.11/https/tls/#cipher-suites
  1864.                 items:
  1865.                   type: string
  1866.                 type: array
  1867.               clientAuth:
  1868.                 description: ClientAuth defines the server's policy for TLS Client
  1869.                   Authentication.
  1870.                 properties:
  1871.                   clientAuthType:
  1872.                     description: ClientAuthType defines the client authentication
  1873.                       type to apply.
  1874.                     enum:
  1875.                     - NoClientCert
  1876.                     - RequestClientCert
  1877.                     - RequireAnyClientCert
  1878.                     - VerifyClientCertIfGiven
  1879.                     - RequireAndVerifyClientCert
  1880.                     type: string
  1881.                   secretNames:
  1882.                     description: SecretNames defines the names of the referenced Kubernetes
  1883.                       Secret storing certificate details.
  1884.                     items:
  1885.                       type: string
  1886.                     type: array
  1887.                 type: object
  1888.               curvePreferences:
  1889.                 description: |-
  1890.                   CurvePreferences defines the preferred elliptic curves in a specific order.
  1891.                   More info: https://doc.traefik.io/traefik/v2.11/https/tls/#curve-preferences
  1892.                 items:
  1893.                   type: string
  1894.                 type: array
  1895.               maxVersion:
  1896.                 description: |-
  1897.                   MaxVersion defines the maximum TLS version that Traefik will accept.
  1898.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  1899.                   Default: None.
  1900.                 type: string
  1901.               minVersion:
  1902.                 description: |-
  1903.                   MinVersion defines the minimum TLS version that Traefik will accept.
  1904.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  1905.                   Default: VersionTLS10.
  1906.                 type: string
  1907.               preferServerCipherSuites:
  1908.                 description: |-
  1909.                   PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
  1910.                   It is enabled automatically when minVersion or maxVersion is set.
  1911.                   Deprecated: https://github.com/golang/go/issues/45430
  1912.                 type: boolean
  1913.               sniStrict:
  1914.                 description: SniStrict defines whether Traefik allows connections
  1915.                   from clients connections that do not specify a server_name extension.
  1916.                 type: boolean
  1917.             type: object
  1918.         required:
  1919.         - metadata
  1920.         - spec
  1921.         type: object
  1922.     served: true
  1923.     storage: true
  1924. ---
  1925. apiVersion: apiextensions.k8s.io/v1
  1926. kind: CustomResourceDefinition
  1927. metadata:
  1928.   annotations:
  1929.     controller-gen.kubebuilder.io/version: v0.14.0
  1930.   name: tlsstores.traefik.io
  1931. spec:
  1932.   group: traefik.io
  1933.   names:
  1934.     kind: TLSStore
  1935.     listKind: TLSStoreList
  1936.     plural: tlsstores
  1937.     singular: tlsstore
  1938.   scope: Namespaced
  1939.   versions:
  1940.   - name: v1alpha1
  1941.     schema:
  1942.       openAPIV3Schema:
  1943.         description: |-
  1944.           TLSStore is the CRD implementation of a Traefik TLS Store.
  1945.           For the time being, only the TLSStore named default is supported.
  1946.           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
  1947.           More info: https://doc.traefik.io/traefik/v2.11/https/tls/#certificates-stores
  1948.         properties:
  1949.           apiVersion:
  1950.             description: |-
  1951.               APIVersion defines the versioned schema of this representation of an object.
  1952.               Servers should convert recognized schemas to the latest internal value, and
  1953.               may reject unrecognized values.
  1954.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1955.             type: string
  1956.           kind:
  1957.             description: |-
  1958.               Kind is a string value representing the REST resource this object represents.
  1959.               Servers may infer this from the endpoint the client submits requests to.
  1960.               Cannot be updated.
  1961.               In CamelCase.
  1962.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1963.             type: string
  1964.           metadata:
  1965.             type: object
  1966.           spec:
  1967.             description: TLSStoreSpec defines the desired state of a TLSStore.
  1968.             properties:
  1969.               certificates:
  1970.                 description: Certificates is a list of secret names, each secret holding
  1971.                   a key/certificate pair to add to the store.
  1972.                 items:
  1973.                   description: Certificate holds a secret name for the TLSStore resource.
  1974.                   properties:
  1975.                     secretName:
  1976.                       description: SecretName is the name of the referenced Kubernetes
  1977.                         Secret to specify the certificate details.
  1978.                       type: string
  1979.                   required:
  1980.                   - secretName
  1981.                   type: object
  1982.                 type: array
  1983.               defaultCertificate:
  1984.                 description: DefaultCertificate defines the default certificate configuration.
  1985.                 properties:
  1986.                   secretName:
  1987.                     description: SecretName is the name of the referenced Kubernetes
  1988.                       Secret to specify the certificate details.
  1989.                     type: string
  1990.                 required:
  1991.                 - secretName
  1992.                 type: object
  1993.               defaultGeneratedCert:
  1994.                 description: DefaultGeneratedCert defines the default generated certificate
  1995.                   configuration.
  1996.                 properties:
  1997.                   domain:
  1998.                     description: Domain is the domain definition for the DefaultCertificate.
  1999.                     properties:
  2000.                       main:
  2001.                         description: Main defines the main domain name.
  2002.                         type: string
  2003.                       sans:
  2004.                         description: SANs defines the subject alternative domain names.
  2005.                         items:
  2006.                           type: string
  2007.                         type: array
  2008.                     type: object
  2009.                   resolver:
  2010.                     description: Resolver is the name of the resolver that will be
  2011.                       used to issue the DefaultCertificate.
  2012.                     type: string
  2013.                 type: object
  2014.             type: object
  2015.         required:
  2016.         - metadata
  2017.         - spec
  2018.         type: object
  2019.     served: true
  2020.     storage: true
  2021. ---
  2022. apiVersion: apiextensions.k8s.io/v1
  2023. kind: CustomResourceDefinition
  2024. metadata:
  2025.   annotations:
  2026.     controller-gen.kubebuilder.io/version: v0.14.0
  2027.   name: traefikservices.traefik.io
  2028. spec:
  2029.   group: traefik.io
  2030.   names:
  2031.     kind: TraefikService
  2032.     listKind: TraefikServiceList
  2033.     plural: traefikservices
  2034.     singular: traefikservice
  2035.   scope: Namespaced
  2036.   versions:
  2037.   - name: v1alpha1
  2038.     schema:
  2039.       openAPIV3Schema:
  2040.         description: |-
  2041.           TraefikService is the CRD implementation of a Traefik Service.
  2042.           TraefikService object allows to:
  2043.           - Apply weight to Services on load-balancing
  2044.           - Mirror traffic on services
  2045.           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-traefikservice
  2046.         properties:
  2047.           apiVersion:
  2048.             description: |-
  2049.               APIVersion defines the versioned schema of this representation of an object.
  2050.               Servers should convert recognized schemas to the latest internal value, and
  2051.               may reject unrecognized values.
  2052.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2053.             type: string
  2054.           kind:
  2055.             description: |-
  2056.               Kind is a string value representing the REST resource this object represents.
  2057.               Servers may infer this from the endpoint the client submits requests to.
  2058.               Cannot be updated.
  2059.               In CamelCase.
  2060.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2061.             type: string
  2062.           metadata:
  2063.             type: object
  2064.           spec:
  2065.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  2066.             properties:
  2067.               mirroring:
  2068.                 description: Mirroring defines the Mirroring service configuration.
  2069.                 properties:
  2070.                   kind:
  2071.                     description: Kind defines the kind of the Service.
  2072.                     enum:
  2073.                     - Service
  2074.                     - TraefikService
  2075.                     type: string
  2076.                   maxBodySize:
  2077.                     description: |-
  2078.                       MaxBodySize defines the maximum size allowed for the body of the request.
  2079.                       If the body is larger, the request is not mirrored.
  2080.                       Default value is -1, which means unlimited size.
  2081.                     format: int64
  2082.                     type: integer
  2083.                   mirrors:
  2084.                     description: Mirrors defines the list of mirrors where Traefik
  2085.                       will duplicate the traffic.
  2086.                     items:
  2087.                       description: MirrorService holds the mirror configuration.
  2088.                       properties:
  2089.                         kind:
  2090.                           description: Kind defines the kind of the Service.
  2091.                           enum:
  2092.                           - Service
  2093.                           - TraefikService
  2094.                           type: string
  2095.                         name:
  2096.                           description: |-
  2097.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2098.                             The differentiation between the two is specified in the Kind field.
  2099.                           type: string
  2100.                         namespace:
  2101.                           description: Namespace defines the namespace of the referenced
  2102.                             Kubernetes Service or TraefikService.
  2103.                           type: string
  2104.                         nativeLB:
  2105.                           description: |-
  2106.                             NativeLB controls, when creating the load-balancer,
  2107.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2108.                             The Kubernetes Service itself does load-balance to the pods.
  2109.                             By default, NativeLB is false.
  2110.                           type: boolean
  2111.                         passHostHeader:
  2112.                           description: |-
  2113.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2114.                             By default, passHostHeader is true.
  2115.                           type: boolean
  2116.                         percent:
  2117.                           description: |-
  2118.                             Percent defines the part of the traffic to mirror.
  2119.                             Supported values: 0 to 100.
  2120.                           type: integer
  2121.                         port:
  2122.                           anyOf:
  2123.                           - type: integer
  2124.                           - type: string
  2125.                           description: |-
  2126.                             Port defines the port of a Kubernetes Service.
  2127.                             This can be a reference to a named port.
  2128.                           x-kubernetes-int-or-string: true
  2129.                         responseForwarding:
  2130.                           description: ResponseForwarding defines how Traefik forwards
  2131.                             the response from the upstream Kubernetes Service to the
  2132.                             client.
  2133.                           properties:
  2134.                             flushInterval:
  2135.                               description: |-
  2136.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2137.                                 A negative value means to flush immediately after each write to the client.
  2138.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2139.                                 for such responses, writes are flushed to the client immediately.
  2140.                                 Default: 100ms
  2141.                               type: string
  2142.                           type: object
  2143.                         scheme:
  2144.                           description: |-
  2145.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2146.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2147.                           type: string
  2148.                         serversTransport:
  2149.                           description: |-
  2150.                             ServersTransport defines the name of ServersTransport resource to use.
  2151.                             It allows to configure the transport between Traefik and your servers.
  2152.                             Can only be used on a Kubernetes Service.
  2153.                           type: string
  2154.                         sticky:
  2155.                           description: |-
  2156.                             Sticky defines the sticky sessions configuration.
  2157.                             More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  2158.                           properties:
  2159.                             cookie:
  2160.                               description: Cookie defines the sticky cookie configuration.
  2161.                               properties:
  2162.                                 httpOnly:
  2163.                                   description: HTTPOnly defines whether the cookie
  2164.                                     can be accessed by client-side APIs, such as JavaScript.
  2165.                                   type: boolean
  2166.                                 name:
  2167.                                   description: Name defines the Cookie name.
  2168.                                   type: string
  2169.                                 sameSite:
  2170.                                   description: |-
  2171.                                     SameSite defines the same site policy.
  2172.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2173.                                   type: string
  2174.                                 secure:
  2175.                                   description: Secure defines whether the cookie can
  2176.                                     only be transmitted over an encrypted connection
  2177.                                     (i.e. HTTPS).
  2178.                                   type: boolean
  2179.                               type: object
  2180.                           type: object
  2181.                         strategy:
  2182.                           description: |-
  2183.                             Strategy defines the load balancing strategy between the servers.
  2184.                             RoundRobin is the only supported value at the moment.
  2185.                           type: string
  2186.                         weight:
  2187.                           description: |-
  2188.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2189.                             (and to be precise, one that embeds a Weighted Round Robin).
  2190.                           type: integer
  2191.                       required:
  2192.                       - name
  2193.                       type: object
  2194.                     type: array
  2195.                   name:
  2196.                     description: |-
  2197.                       Name defines the name of the referenced Kubernetes Service or TraefikService.
  2198.                       The differentiation between the two is specified in the Kind field.
  2199.                     type: string
  2200.                   namespace:
  2201.                     description: Namespace defines the namespace of the referenced
  2202.                       Kubernetes Service or TraefikService.
  2203.                     type: string
  2204.                   nativeLB:
  2205.                     description: |-
  2206.                       NativeLB controls, when creating the load-balancer,
  2207.                       whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2208.                       The Kubernetes Service itself does load-balance to the pods.
  2209.                       By default, NativeLB is false.
  2210.                     type: boolean
  2211.                   passHostHeader:
  2212.                     description: |-
  2213.                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2214.                       By default, passHostHeader is true.
  2215.                     type: boolean
  2216.                   port:
  2217.                     anyOf:
  2218.                     - type: integer
  2219.                     - type: string
  2220.                     description: |-
  2221.                       Port defines the port of a Kubernetes Service.
  2222.                       This can be a reference to a named port.
  2223.                     x-kubernetes-int-or-string: true
  2224.                   responseForwarding:
  2225.                     description: ResponseForwarding defines how Traefik forwards the
  2226.                       response from the upstream Kubernetes Service to the client.
  2227.                     properties:
  2228.                       flushInterval:
  2229.                         description: |-
  2230.                           FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2231.                           A negative value means to flush immediately after each write to the client.
  2232.                           This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2233.                           for such responses, writes are flushed to the client immediately.
  2234.                           Default: 100ms
  2235.                         type: string
  2236.                     type: object
  2237.                   scheme:
  2238.                     description: |-
  2239.                       Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2240.                       It defaults to https when Kubernetes Service port is 443, http otherwise.
  2241.                     type: string
  2242.                   serversTransport:
  2243.                     description: |-
  2244.                       ServersTransport defines the name of ServersTransport resource to use.
  2245.                       It allows to configure the transport between Traefik and your servers.
  2246.                       Can only be used on a Kubernetes Service.
  2247.                     type: string
  2248.                   sticky:
  2249.                     description: |-
  2250.                       Sticky defines the sticky sessions configuration.
  2251.                       More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  2252.                     properties:
  2253.                       cookie:
  2254.                         description: Cookie defines the sticky cookie configuration.
  2255.                         properties:
  2256.                           httpOnly:
  2257.                             description: HTTPOnly defines whether the cookie can be
  2258.                               accessed by client-side APIs, such as JavaScript.
  2259.                             type: boolean
  2260.                           name:
  2261.                             description: Name defines the Cookie name.
  2262.                             type: string
  2263.                           sameSite:
  2264.                             description: |-
  2265.                               SameSite defines the same site policy.
  2266.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2267.                             type: string
  2268.                           secure:
  2269.                             description: Secure defines whether the cookie can only
  2270.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2271.                             type: boolean
  2272.                         type: object
  2273.                     type: object
  2274.                   strategy:
  2275.                     description: |-
  2276.                       Strategy defines the load balancing strategy between the servers.
  2277.                       RoundRobin is the only supported value at the moment.
  2278.                     type: string
  2279.                   weight:
  2280.                     description: |-
  2281.                       Weight defines the weight and should only be specified when Name references a TraefikService object
  2282.                       (and to be precise, one that embeds a Weighted Round Robin).
  2283.                     type: integer
  2284.                 required:
  2285.                 - name
  2286.                 type: object
  2287.               weighted:
  2288.                 description: Weighted defines the Weighted Round Robin configuration.
  2289.                 properties:
  2290.                   services:
  2291.                     description: Services defines the list of Kubernetes Service and/or
  2292.                       TraefikService to load-balance, with weight.
  2293.                     items:
  2294.                       description: Service defines an upstream HTTP service to proxy
  2295.                         traffic to.
  2296.                       properties:
  2297.                         kind:
  2298.                           description: Kind defines the kind of the Service.
  2299.                           enum:
  2300.                           - Service
  2301.                           - TraefikService
  2302.                           type: string
  2303.                         name:
  2304.                           description: |-
  2305.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2306.                             The differentiation between the two is specified in the Kind field.
  2307.                           type: string
  2308.                         namespace:
  2309.                           description: Namespace defines the namespace of the referenced
  2310.                             Kubernetes Service or TraefikService.
  2311.                           type: string
  2312.                         nativeLB:
  2313.                           description: |-
  2314.                             NativeLB controls, when creating the load-balancer,
  2315.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2316.                             The Kubernetes Service itself does load-balance to the pods.
  2317.                             By default, NativeLB is false.
  2318.                           type: boolean
  2319.                         passHostHeader:
  2320.                           description: |-
  2321.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2322.                             By default, passHostHeader is true.
  2323.                           type: boolean
  2324.                         port:
  2325.                           anyOf:
  2326.                           - type: integer
  2327.                           - type: string
  2328.                           description: |-
  2329.                             Port defines the port of a Kubernetes Service.
  2330.                             This can be a reference to a named port.
  2331.                           x-kubernetes-int-or-string: true
  2332.                         responseForwarding:
  2333.                           description: ResponseForwarding defines how Traefik forwards
  2334.                             the response from the upstream Kubernetes Service to the
  2335.                             client.
  2336.                           properties:
  2337.                             flushInterval:
  2338.                               description: |-
  2339.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2340.                                 A negative value means to flush immediately after each write to the client.
  2341.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2342.                                 for such responses, writes are flushed to the client immediately.
  2343.                                 Default: 100ms
  2344.                               type: string
  2345.                           type: object
  2346.                         scheme:
  2347.                           description: |-
  2348.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2349.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2350.                           type: string
  2351.                         serversTransport:
  2352.                           description: |-
  2353.                             ServersTransport defines the name of ServersTransport resource to use.
  2354.                             It allows to configure the transport between Traefik and your servers.
  2355.                             Can only be used on a Kubernetes Service.
  2356.                           type: string
  2357.                         sticky:
  2358.                           description: |-
  2359.                             Sticky defines the sticky sessions configuration.
  2360.                             More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  2361.                           properties:
  2362.                             cookie:
  2363.                               description: Cookie defines the sticky cookie configuration.
  2364.                               properties:
  2365.                                 httpOnly:
  2366.                                   description: HTTPOnly defines whether the cookie
  2367.                                     can be accessed by client-side APIs, such as JavaScript.
  2368.                                   type: boolean
  2369.                                 name:
  2370.                                   description: Name defines the Cookie name.
  2371.                                   type: string
  2372.                                 sameSite:
  2373.                                   description: |-
  2374.                                     SameSite defines the same site policy.
  2375.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2376.                                   type: string
  2377.                                 secure:
  2378.                                   description: Secure defines whether the cookie can
  2379.                                     only be transmitted over an encrypted connection
  2380.                                     (i.e. HTTPS).
  2381.                                   type: boolean
  2382.                               type: object
  2383.                           type: object
  2384.                         strategy:
  2385.                           description: |-
  2386.                             Strategy defines the load balancing strategy between the servers.
  2387.                             RoundRobin is the only supported value at the moment.
  2388.                           type: string
  2389.                         weight:
  2390.                           description: |-
  2391.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2392.                             (and to be precise, one that embeds a Weighted Round Robin).
  2393.                           type: integer
  2394.                       required:
  2395.                       - name
  2396.                       type: object
  2397.                     type: array
  2398.                   sticky:
  2399.                     description: |-
  2400.                       Sticky defines whether sticky sessions are enabled.
  2401.                       More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#stickiness-and-load-balancing
  2402.                     properties:
  2403.                       cookie:
  2404.                         description: Cookie defines the sticky cookie configuration.
  2405.                         properties:
  2406.                           httpOnly:
  2407.                             description: HTTPOnly defines whether the cookie can be
  2408.                               accessed by client-side APIs, such as JavaScript.
  2409.                             type: boolean
  2410.                           name:
  2411.                             description: Name defines the Cookie name.
  2412.                             type: string
  2413.                           sameSite:
  2414.                             description: |-
  2415.                               SameSite defines the same site policy.
  2416.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2417.                             type: string
  2418.                           secure:
  2419.                             description: Secure defines whether the cookie can only
  2420.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2421.                             type: boolean
  2422.                         type: object
  2423.                     type: object
  2424.                 type: object
  2425.             type: object
  2426.         required:
  2427.         - metadata
  2428.         - spec
  2429.         type: object
  2430.     served: true
  2431.     storage: true
  2432. ---
  2433. apiVersion: apiextensions.k8s.io/v1
  2434. kind: CustomResourceDefinition
  2435. metadata:
  2436.   annotations:
  2437.     controller-gen.kubebuilder.io/version: v0.14.0
  2438.   name: ingressroutes.traefik.containo.us
  2439. spec:
  2440.   group: traefik.containo.us
  2441.   names:
  2442.     kind: IngressRoute
  2443.     listKind: IngressRouteList
  2444.     plural: ingressroutes
  2445.     singular: ingressroute
  2446.   scope: Namespaced
  2447.   versions:
  2448.   - name: v1alpha1
  2449.     schema:
  2450.       openAPIV3Schema:
  2451.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  2452.         properties:
  2453.           apiVersion:
  2454.             description: |-
  2455.               APIVersion defines the versioned schema of this representation of an object.
  2456.               Servers should convert recognized schemas to the latest internal value, and
  2457.               may reject unrecognized values.
  2458.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2459.             type: string
  2460.           kind:
  2461.             description: |-
  2462.               Kind is a string value representing the REST resource this object represents.
  2463.               Servers may infer this from the endpoint the client submits requests to.
  2464.               Cannot be updated.
  2465.               In CamelCase.
  2466.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2467.             type: string
  2468.           metadata:
  2469.             type: object
  2470.           spec:
  2471.             description: IngressRouteSpec defines the desired state of IngressRoute.
  2472.             properties:
  2473.               entryPoints:
  2474.                 description: |-
  2475.                   EntryPoints defines the list of entry point names to bind to.
  2476.                   Entry points have to be configured in the static configuration.
  2477.                   More info: https://doc.traefik.io/traefik/v2.11/routing/entrypoints/
  2478.                   Default: all.
  2479.                 items:
  2480.                   type: string
  2481.                 type: array
  2482.               routes:
  2483.                 description: Routes defines the list of routes.
  2484.                 items:
  2485.                   description: Route holds the HTTP route configuration.
  2486.                   properties:
  2487.                     kind:
  2488.                       description: |-
  2489.                         Kind defines the kind of the route.
  2490.                         Rule is the only supported kind.
  2491.                       enum:
  2492.                       - Rule
  2493.                       type: string
  2494.                     match:
  2495.                       description: |-
  2496.                         Match defines the router's rule.
  2497.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#rule
  2498.                       type: string
  2499.                     middlewares:
  2500.                       description: |-
  2501.                         Middlewares defines the list of references to Middleware resources.
  2502.                         More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-middleware
  2503.                       items:
  2504.                         description: MiddlewareRef is a reference to a Middleware
  2505.                           resource.
  2506.                         properties:
  2507.                           name:
  2508.                             description: Name defines the name of the referenced Middleware
  2509.                               resource.
  2510.                             type: string
  2511.                           namespace:
  2512.                             description: Namespace defines the namespace of the referenced
  2513.                               Middleware resource.
  2514.                             type: string
  2515.                         required:
  2516.                         - name
  2517.                         type: object
  2518.                       type: array
  2519.                     priority:
  2520.                       description: |-
  2521.                         Priority defines the router's priority.
  2522.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#priority
  2523.                       type: integer
  2524.                     services:
  2525.                       description: |-
  2526.                         Services defines the list of Service.
  2527.                         It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
  2528.                       items:
  2529.                         description: Service defines an upstream HTTP service to proxy
  2530.                           traffic to.
  2531.                         properties:
  2532.                           kind:
  2533.                             description: Kind defines the kind of the Service.
  2534.                             enum:
  2535.                             - Service
  2536.                             - TraefikService
  2537.                             type: string
  2538.                           name:
  2539.                             description: |-
  2540.                               Name defines the name of the referenced Kubernetes Service or TraefikService.
  2541.                               The differentiation between the two is specified in the Kind field.
  2542.                             type: string
  2543.                           namespace:
  2544.                             description: Namespace defines the namespace of the referenced
  2545.                               Kubernetes Service or TraefikService.
  2546.                             type: string
  2547.                           nativeLB:
  2548.                             description: |-
  2549.                               NativeLB controls, when creating the load-balancer,
  2550.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2551.                               The Kubernetes Service itself does load-balance to the pods.
  2552.                               By default, NativeLB is false.
  2553.                             type: boolean
  2554.                           passHostHeader:
  2555.                             description: |-
  2556.                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2557.                               By default, passHostHeader is true.
  2558.                             type: boolean
  2559.                           port:
  2560.                             anyOf:
  2561.                             - type: integer
  2562.                             - type: string
  2563.                             description: |-
  2564.                               Port defines the port of a Kubernetes Service.
  2565.                               This can be a reference to a named port.
  2566.                             x-kubernetes-int-or-string: true
  2567.                           responseForwarding:
  2568.                             description: ResponseForwarding defines how Traefik forwards
  2569.                               the response from the upstream Kubernetes Service to
  2570.                               the client.
  2571.                             properties:
  2572.                               flushInterval:
  2573.                                 description: |-
  2574.                                   FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2575.                                   A negative value means to flush immediately after each write to the client.
  2576.                                   This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2577.                                   for such responses, writes are flushed to the client immediately.
  2578.                                   Default: 100ms
  2579.                                 type: string
  2580.                             type: object
  2581.                           scheme:
  2582.                             description: |-
  2583.                               Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2584.                               It defaults to https when Kubernetes Service port is 443, http otherwise.
  2585.                             type: string
  2586.                           serversTransport:
  2587.                             description: |-
  2588.                               ServersTransport defines the name of ServersTransport resource to use.
  2589.                               It allows to configure the transport between Traefik and your servers.
  2590.                               Can only be used on a Kubernetes Service.
  2591.                             type: string
  2592.                           sticky:
  2593.                             description: |-
  2594.                               Sticky defines the sticky sessions configuration.
  2595.                               More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  2596.                             properties:
  2597.                               cookie:
  2598.                                 description: Cookie defines the sticky cookie configuration.
  2599.                                 properties:
  2600.                                   httpOnly:
  2601.                                     description: HTTPOnly defines whether the cookie
  2602.                                       can be accessed by client-side APIs, such as
  2603.                                       JavaScript.
  2604.                                     type: boolean
  2605.                                   name:
  2606.                                     description: Name defines the Cookie name.
  2607.                                     type: string
  2608.                                   sameSite:
  2609.                                     description: |-
  2610.                                       SameSite defines the same site policy.
  2611.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2612.                                     type: string
  2613.                                   secure:
  2614.                                     description: Secure defines whether the cookie
  2615.                                       can only be transmitted over an encrypted connection
  2616.                                       (i.e. HTTPS).
  2617.                                     type: boolean
  2618.                                 type: object
  2619.                             type: object
  2620.                           strategy:
  2621.                             description: |-
  2622.                               Strategy defines the load balancing strategy between the servers.
  2623.                               RoundRobin is the only supported value at the moment.
  2624.                             type: string
  2625.                           weight:
  2626.                             description: |-
  2627.                               Weight defines the weight and should only be specified when Name references a TraefikService object
  2628.                               (and to be precise, one that embeds a Weighted Round Robin).
  2629.                             type: integer
  2630.                         required:
  2631.                         - name
  2632.                         type: object
  2633.                       type: array
  2634.                   required:
  2635.                   - kind
  2636.                   - match
  2637.                   type: object
  2638.                 type: array
  2639.               tls:
  2640.                 description: |-
  2641.                   TLS defines the TLS configuration.
  2642.                   More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#tls
  2643.                 properties:
  2644.                   certResolver:
  2645.                     description: |-
  2646.                       CertResolver defines the name of the certificate resolver to use.
  2647.                       Cert resolvers have to be configured in the static configuration.
  2648.                       More info: https://doc.traefik.io/traefik/v2.11/https/acme/#certificate-resolvers
  2649.                     type: string
  2650.                   domains:
  2651.                     description: |-
  2652.                       Domains defines the list of domains that will be used to issue certificates.
  2653.                       More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#domains
  2654.                     items:
  2655.                       description: Domain holds a domain name with SANs.
  2656.                       properties:
  2657.                         main:
  2658.                           description: Main defines the main domain name.
  2659.                           type: string
  2660.                         sans:
  2661.                           description: SANs defines the subject alternative domain
  2662.                             names.
  2663.                           items:
  2664.                             type: string
  2665.                           type: array
  2666.                       type: object
  2667.                     type: array
  2668.                   options:
  2669.                     description: |-
  2670.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  2671.                       If not defined, the `default` TLSOption is used.
  2672.                       More info: https://doc.traefik.io/traefik/v2.11/https/tls/#tls-options
  2673.                     properties:
  2674.                       name:
  2675.                         description: |-
  2676.                           Name defines the name of the referenced TLSOption.
  2677.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsoption
  2678.                         type: string
  2679.                       namespace:
  2680.                         description: |-
  2681.                           Namespace defines the namespace of the referenced TLSOption.
  2682.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsoption
  2683.                         type: string
  2684.                     required:
  2685.                     - name
  2686.                     type: object
  2687.                   secretName:
  2688.                     description: SecretName is the name of the referenced Kubernetes
  2689.                       Secret to specify the certificate details.
  2690.                     type: string
  2691.                   store:
  2692.                     description: |-
  2693.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  2694.                       Please note that only `default` TLSStore can be used.
  2695.                     properties:
  2696.                       name:
  2697.                         description: |-
  2698.                           Name defines the name of the referenced TLSStore.
  2699.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsstore
  2700.                         type: string
  2701.                       namespace:
  2702.                         description: |-
  2703.                           Namespace defines the namespace of the referenced TLSStore.
  2704.                           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-tlsstore
  2705.                         type: string
  2706.                     required:
  2707.                     - name
  2708.                     type: object
  2709.                 type: object
  2710.             required:
  2711.             - routes
  2712.             type: object
  2713.         required:
  2714.         - metadata
  2715.         - spec
  2716.         type: object
  2717.     served: true
  2718.     storage: true
  2719. ---
  2720. apiVersion: apiextensions.k8s.io/v1
  2721. kind: CustomResourceDefinition
  2722. metadata:
  2723.   annotations:
  2724.     controller-gen.kubebuilder.io/version: v0.14.0
  2725.   name: ingressroutetcps.traefik.containo.us
  2726. spec:
  2727.   group: traefik.containo.us
  2728.   names:
  2729.     kind: IngressRouteTCP
  2730.     listKind: IngressRouteTCPList
  2731.     plural: ingressroutetcps
  2732.     singular: ingressroutetcp
  2733.   scope: Namespaced
  2734.   versions:
  2735.   - name: v1alpha1
  2736.     schema:
  2737.       openAPIV3Schema:
  2738.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  2739.         properties:
  2740.           apiVersion:
  2741.             description: |-
  2742.               APIVersion defines the versioned schema of this representation of an object.
  2743.               Servers should convert recognized schemas to the latest internal value, and
  2744.               may reject unrecognized values.
  2745.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2746.             type: string
  2747.           kind:
  2748.             description: |-
  2749.               Kind is a string value representing the REST resource this object represents.
  2750.               Servers may infer this from the endpoint the client submits requests to.
  2751.               Cannot be updated.
  2752.               In CamelCase.
  2753.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2754.             type: string
  2755.           metadata:
  2756.             type: object
  2757.           spec:
  2758.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  2759.             properties:
  2760.               entryPoints:
  2761.                 description: |-
  2762.                   EntryPoints defines the list of entry point names to bind to.
  2763.                   Entry points have to be configured in the static configuration.
  2764.                   More info: https://doc.traefik.io/traefik/v2.11/routing/entrypoints/
  2765.                   Default: all.
  2766.                 items:
  2767.                   type: string
  2768.                 type: array
  2769.               routes:
  2770.                 description: Routes defines the list of routes.
  2771.                 items:
  2772.                   description: RouteTCP holds the TCP route configuration.
  2773.                   properties:
  2774.                     match:
  2775.                       description: |-
  2776.                         Match defines the router's rule.
  2777.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#rule_1
  2778.                       type: string
  2779.                     middlewares:
  2780.                       description: Middlewares defines the list of references to MiddlewareTCP
  2781.                         resources.
  2782.                       items:
  2783.                         description: ObjectReference is a generic reference to a Traefik
  2784.                           resource.
  2785.                         properties:
  2786.                           name:
  2787.                             description: Name defines the name of the referenced Traefik
  2788.                               resource.
  2789.                             type: string
  2790.                           namespace:
  2791.                             description: Namespace defines the namespace of the referenced
  2792.                               Traefik resource.
  2793.                             type: string
  2794.                         required:
  2795.                         - name
  2796.                         type: object
  2797.                       type: array
  2798.                     priority:
  2799.                       description: |-
  2800.                         Priority defines the router's priority.
  2801.                         More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#priority_1
  2802.                       type: integer
  2803.                     services:
  2804.                       description: Services defines the list of TCP services.
  2805.                       items:
  2806.                         description: ServiceTCP defines an upstream TCP service to
  2807.                           proxy traffic to.
  2808.                         properties:
  2809.                           name:
  2810.                             description: Name defines the name of the referenced Kubernetes
  2811.                               Service.
  2812.                             type: string
  2813.                           namespace:
  2814.                             description: Namespace defines the namespace of the referenced
  2815.                               Kubernetes Service.
  2816.                             type: string
  2817.                           nativeLB:
  2818.                             description: |-
  2819.                               NativeLB controls, when creating the load-balancer,
  2820.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2821.                               The Kubernetes Service itself does load-balance to the pods.
  2822.                               By default, NativeLB is false.
  2823.                             type: boolean
  2824.                           port:
  2825.                             anyOf:
  2826.                             - type: integer
  2827.                             - type: string
  2828.                             description: |-
  2829.                               Port defines the port of a Kubernetes Service.
  2830.                               This can be a reference to a named port.
  2831.                             x-kubernetes-int-or-string: true
  2832.                           proxyProtocol:
  2833.                             description: |-
  2834.                               ProxyProtocol defines the PROXY protocol configuration.
  2835.                               More info: https://doc.traefik.io/traefik/v2.11/routing/services/#proxy-protocol
  2836.                             properties:
  2837.                               version:
  2838.                                 description: Version defines the PROXY Protocol version
  2839.                                   to use.
  2840.                                 type: integer
  2841.                             type: object
  2842.                           terminationDelay:
  2843.                             description: |-
  2844.                               TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates
  2845.                               it has closed the writing capability of its connection, to close the reading capability as well,
  2846.                               hence fully terminating the connection.
  2847.                               It is a duration in milliseconds, defaulting to 100.
  2848.                               A negative value means an infinite deadline (i.e. the reading capability is never closed).
  2849.                             type: integer
  2850.                           weight:
  2851.                             description: Weight defines the weight used when balancing
  2852.                               requests between multiple Kubernetes Service.
  2853.                             type: integer
  2854.                         required:
  2855.                         - name
  2856.                         - port
  2857.                         type: object
  2858.                       type: array
  2859.                   required:
  2860.                   - match
  2861.                   type: object
  2862.                 type: array
  2863.               tls:
  2864.                 description: |-
  2865.                   TLS defines the TLS configuration on a layer 4 / TCP Route.
  2866.                   More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#tls_1
  2867.                 properties:
  2868.                   certResolver:
  2869.                     description: |-
  2870.                       CertResolver defines the name of the certificate resolver to use.
  2871.                       Cert resolvers have to be configured in the static configuration.
  2872.                       More info: https://doc.traefik.io/traefik/v2.11/https/acme/#certificate-resolvers
  2873.                     type: string
  2874.                   domains:
  2875.                     description: |-
  2876.                       Domains defines the list of domains that will be used to issue certificates.
  2877.                       More info: https://doc.traefik.io/traefik/v2.11/routing/routers/#domains
  2878.                     items:
  2879.                       description: Domain holds a domain name with SANs.
  2880.                       properties:
  2881.                         main:
  2882.                           description: Main defines the main domain name.
  2883.                           type: string
  2884.                         sans:
  2885.                           description: SANs defines the subject alternative domain
  2886.                             names.
  2887.                           items:
  2888.                             type: string
  2889.                           type: array
  2890.                       type: object
  2891.                     type: array
  2892.                   options:
  2893.                     description: |-
  2894.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  2895.                       If not defined, the `default` TLSOption is used.
  2896.                       More info: https://doc.traefik.io/traefik/v2.11/https/tls/#tls-options
  2897.                     properties:
  2898.                       name:
  2899.                         description: Name defines the name of the referenced Traefik
  2900.                           resource.
  2901.                         type: string
  2902.                       namespace:
  2903.                         description: Namespace defines the namespace of the referenced
  2904.                           Traefik resource.
  2905.                         type: string
  2906.                     required:
  2907.                     - name
  2908.                     type: object
  2909.                   passthrough:
  2910.                     description: Passthrough defines whether a TLS router will terminate
  2911.                       the TLS connection.
  2912.                     type: boolean
  2913.                   secretName:
  2914.                     description: SecretName is the name of the referenced Kubernetes
  2915.                       Secret to specify the certificate details.
  2916.                     type: string
  2917.                   store:
  2918.                     description: |-
  2919.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  2920.                       Please note that only `default` TLSStore can be used.
  2921.                     properties:
  2922.                       name:
  2923.                         description: Name defines the name of the referenced Traefik
  2924.                           resource.
  2925.                         type: string
  2926.                       namespace:
  2927.                         description: Namespace defines the namespace of the referenced
  2928.                           Traefik resource.
  2929.                         type: string
  2930.                     required:
  2931.                     - name
  2932.                     type: object
  2933.                 type: object
  2934.             required:
  2935.             - routes
  2936.             type: object
  2937.         required:
  2938.         - metadata
  2939.         - spec
  2940.         type: object
  2941.     served: true
  2942.     storage: true
  2943. ---
  2944. apiVersion: apiextensions.k8s.io/v1
  2945. kind: CustomResourceDefinition
  2946. metadata:
  2947.   annotations:
  2948.     controller-gen.kubebuilder.io/version: v0.14.0
  2949.   name: ingressrouteudps.traefik.containo.us
  2950. spec:
  2951.   group: traefik.containo.us
  2952.   names:
  2953.     kind: IngressRouteUDP
  2954.     listKind: IngressRouteUDPList
  2955.     plural: ingressrouteudps
  2956.     singular: ingressrouteudp
  2957.   scope: Namespaced
  2958.   versions:
  2959.   - name: v1alpha1
  2960.     schema:
  2961.       openAPIV3Schema:
  2962.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  2963.         properties:
  2964.           apiVersion:
  2965.             description: |-
  2966.               APIVersion defines the versioned schema of this representation of an object.
  2967.               Servers should convert recognized schemas to the latest internal value, and
  2968.               may reject unrecognized values.
  2969.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2970.             type: string
  2971.           kind:
  2972.             description: |-
  2973.               Kind is a string value representing the REST resource this object represents.
  2974.               Servers may infer this from the endpoint the client submits requests to.
  2975.               Cannot be updated.
  2976.               In CamelCase.
  2977.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2978.             type: string
  2979.           metadata:
  2980.             type: object
  2981.           spec:
  2982.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  2983.             properties:
  2984.               entryPoints:
  2985.                 description: |-
  2986.                   EntryPoints defines the list of entry point names to bind to.
  2987.                   Entry points have to be configured in the static configuration.
  2988.                   More info: https://doc.traefik.io/traefik/v2.11/routing/entrypoints/
  2989.                   Default: all.
  2990.                 items:
  2991.                   type: string
  2992.                 type: array
  2993.               routes:
  2994.                 description: Routes defines the list of routes.
  2995.                 items:
  2996.                   description: RouteUDP holds the UDP route configuration.
  2997.                   properties:
  2998.                     services:
  2999.                       description: Services defines the list of UDP services.
  3000.                       items:
  3001.                         description: ServiceUDP defines an upstream UDP service to
  3002.                           proxy traffic to.
  3003.                         properties:
  3004.                           name:
  3005.                             description: Name defines the name of the referenced Kubernetes
  3006.                               Service.
  3007.                             type: string
  3008.                           namespace:
  3009.                             description: Namespace defines the namespace of the referenced
  3010.                               Kubernetes Service.
  3011.                             type: string
  3012.                           nativeLB:
  3013.                             description: |-
  3014.                               NativeLB controls, when creating the load-balancer,
  3015.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  3016.                               The Kubernetes Service itself does load-balance to the pods.
  3017.                               By default, NativeLB is false.
  3018.                             type: boolean
  3019.                           port:
  3020.                             anyOf:
  3021.                             - type: integer
  3022.                             - type: string
  3023.                             description: |-
  3024.                               Port defines the port of a Kubernetes Service.
  3025.                               This can be a reference to a named port.
  3026.                             x-kubernetes-int-or-string: true
  3027.                           weight:
  3028.                             description: Weight defines the weight used when balancing
  3029.                               requests between multiple Kubernetes Service.
  3030.                             type: integer
  3031.                         required:
  3032.                         - name
  3033.                         - port
  3034.                         type: object
  3035.                       type: array
  3036.                   type: object
  3037.                 type: array
  3038.             required:
  3039.             - routes
  3040.             type: object
  3041.         required:
  3042.         - metadata
  3043.         - spec
  3044.         type: object
  3045.     served: true
  3046.     storage: true
  3047. ---
  3048. apiVersion: apiextensions.k8s.io/v1
  3049. kind: CustomResourceDefinition
  3050. metadata:
  3051.   annotations:
  3052.     controller-gen.kubebuilder.io/version: v0.14.0
  3053.   name: middlewares.traefik.containo.us
  3054. spec:
  3055.   group: traefik.containo.us
  3056.   names:
  3057.     kind: Middleware
  3058.     listKind: MiddlewareList
  3059.     plural: middlewares
  3060.     singular: middleware
  3061.   scope: Namespaced
  3062.   versions:
  3063.   - name: v1alpha1
  3064.     schema:
  3065.       openAPIV3Schema:
  3066.         description: |-
  3067.           Middleware is the CRD implementation of a Traefik Middleware.
  3068.           More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/overview/
  3069.         properties:
  3070.           apiVersion:
  3071.             description: |-
  3072.               APIVersion defines the versioned schema of this representation of an object.
  3073.               Servers should convert recognized schemas to the latest internal value, and
  3074.               may reject unrecognized values.
  3075.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  3076.             type: string
  3077.           kind:
  3078.             description: |-
  3079.               Kind is a string value representing the REST resource this object represents.
  3080.               Servers may infer this from the endpoint the client submits requests to.
  3081.               Cannot be updated.
  3082.               In CamelCase.
  3083.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  3084.             type: string
  3085.           metadata:
  3086.             type: object
  3087.           spec:
  3088.             description: MiddlewareSpec defines the desired state of a Middleware.
  3089.             properties:
  3090.               addPrefix:
  3091.                 description: |-
  3092.                   AddPrefix holds the add prefix middleware configuration.
  3093.                   This middleware updates the path of a request before forwarding it.
  3094.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/addprefix/
  3095.                 properties:
  3096.                   prefix:
  3097.                     description: |-
  3098.                       Prefix is the string to add before the current path in the requested URL.
  3099.                       It should include a leading slash (/).
  3100.                     type: string
  3101.                 type: object
  3102.               basicAuth:
  3103.                 description: |-
  3104.                   BasicAuth holds the basic auth middleware configuration.
  3105.                   This middleware restricts access to your services to known users.
  3106.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/basicauth/
  3107.                 properties:
  3108.                   headerField:
  3109.                     description: |-
  3110.                       HeaderField defines a header field to store the authenticated user.
  3111.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/basicauth/#headerfield
  3112.                     type: string
  3113.                   realm:
  3114.                     description: |-
  3115.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  3116.                       Default: traefik.
  3117.                     type: string
  3118.                   removeHeader:
  3119.                     description: |-
  3120.                       RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service.
  3121.                       Default: false.
  3122.                     type: boolean
  3123.                   secret:
  3124.                     description: Secret is the name of the referenced Kubernetes Secret
  3125.                       containing user credentials.
  3126.                     type: string
  3127.                 type: object
  3128.               buffering:
  3129.                 description: |-
  3130.                   Buffering holds the buffering middleware configuration.
  3131.                   This middleware retries or limits the size of requests that can be forwarded to backends.
  3132.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/buffering/#maxrequestbodybytes
  3133.                 properties:
  3134.                   maxRequestBodyBytes:
  3135.                     description: |-
  3136.                       MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).
  3137.                       If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.
  3138.                       Default: 0 (no maximum).
  3139.                     format: int64
  3140.                     type: integer
  3141.                   maxResponseBodyBytes:
  3142.                     description: |-
  3143.                       MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes).
  3144.                       If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead.
  3145.                       Default: 0 (no maximum).
  3146.                     format: int64
  3147.                     type: integer
  3148.                   memRequestBodyBytes:
  3149.                     description: |-
  3150.                       MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory.
  3151.                       Default: 1048576 (1Mi).
  3152.                     format: int64
  3153.                     type: integer
  3154.                   memResponseBodyBytes:
  3155.                     description: |-
  3156.                       MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory.
  3157.                       Default: 1048576 (1Mi).
  3158.                     format: int64
  3159.                     type: integer
  3160.                   retryExpression:
  3161.                     description: |-
  3162.                       RetryExpression defines the retry conditions.
  3163.                       It is a logical combination of functions with operators AND (&&) and OR (||).
  3164.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/buffering/#retryexpression
  3165.                     type: string
  3166.                 type: object
  3167.               chain:
  3168.                 description: |-
  3169.                   Chain holds the configuration of the chain middleware.
  3170.                   This middleware enables to define reusable combinations of other pieces of middleware.
  3171.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/chain/
  3172.                 properties:
  3173.                   middlewares:
  3174.                     description: Middlewares is the list of MiddlewareRef which composes
  3175.                       the chain.
  3176.                     items:
  3177.                       description: MiddlewareRef is a reference to a Middleware resource.
  3178.                       properties:
  3179.                         name:
  3180.                           description: Name defines the name of the referenced Middleware
  3181.                             resource.
  3182.                           type: string
  3183.                         namespace:
  3184.                           description: Namespace defines the namespace of the referenced
  3185.                             Middleware resource.
  3186.                           type: string
  3187.                       required:
  3188.                       - name
  3189.                       type: object
  3190.                     type: array
  3191.                 type: object
  3192.               circuitBreaker:
  3193.                 description: CircuitBreaker holds the circuit breaker configuration.
  3194.                 properties:
  3195.                   checkPeriod:
  3196.                     anyOf:
  3197.                     - type: integer
  3198.                     - type: string
  3199.                     description: CheckPeriod is the interval between successive checks
  3200.                       of the circuit breaker condition (when in standby state).
  3201.                     x-kubernetes-int-or-string: true
  3202.                   expression:
  3203.                     description: Expression is the condition that triggers the tripped
  3204.                       state.
  3205.                     type: string
  3206.                   fallbackDuration:
  3207.                     anyOf:
  3208.                     - type: integer
  3209.                     - type: string
  3210.                     description: FallbackDuration is the duration for which the circuit
  3211.                       breaker will wait before trying to recover (from a tripped state).
  3212.                     x-kubernetes-int-or-string: true
  3213.                   recoveryDuration:
  3214.                     anyOf:
  3215.                     - type: integer
  3216.                     - type: string
  3217.                     description: RecoveryDuration is the duration for which the circuit
  3218.                       breaker will try to recover (as soon as it is in recovering
  3219.                       state).
  3220.                     x-kubernetes-int-or-string: true
  3221.                 type: object
  3222.               compress:
  3223.                 description: |-
  3224.                   Compress holds the compress middleware configuration.
  3225.                   This middleware compresses responses before sending them to the client, using gzip compression.
  3226.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/compress/
  3227.                 properties:
  3228.                   excludedContentTypes:
  3229.                     description: ExcludedContentTypes defines the list of content
  3230.                       types to compare the Content-Type header of the incoming requests
  3231.                       and responses before compressing.
  3232.                     items:
  3233.                       type: string
  3234.                     type: array
  3235.                   minResponseBodyBytes:
  3236.                     description: |-
  3237.                       MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed.
  3238.                       Default: 1024.
  3239.                     type: integer
  3240.                 type: object
  3241.               contentType:
  3242.                 description: |-
  3243.                   ContentType holds the content-type middleware configuration.
  3244.                   This middleware exists to enable the correct behavior until at least the default one can be changed in a future version.
  3245.                 properties:
  3246.                   autoDetect:
  3247.                     description: |-
  3248.                       AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend,
  3249.                       be automatically set to a value derived from the contents of the response.
  3250.                       As a proxy, the default behavior should be to leave the header alone, regardless of what the backend did with it.
  3251.                       However, the historic default was to always auto-detect and set the header if it was nil,
  3252.                       and it is going to be kept that way in order to support users currently relying on it.
  3253.                     type: boolean
  3254.                 type: object
  3255.               digestAuth:
  3256.                 description: |-
  3257.                   DigestAuth holds the digest auth middleware configuration.
  3258.                   This middleware restricts access to your services to known users.
  3259.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/digestauth/
  3260.                 properties:
  3261.                   headerField:
  3262.                     description: |-
  3263.                       HeaderField defines a header field to store the authenticated user.
  3264.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/basicauth/#headerfield
  3265.                     type: string
  3266.                   realm:
  3267.                     description: |-
  3268.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  3269.                       Default: traefik.
  3270.                     type: string
  3271.                   removeHeader:
  3272.                     description: RemoveHeader defines whether to remove the authorization
  3273.                       header before forwarding the request to the backend.
  3274.                     type: boolean
  3275.                   secret:
  3276.                     description: Secret is the name of the referenced Kubernetes Secret
  3277.                       containing user credentials.
  3278.                     type: string
  3279.                 type: object
  3280.               errors:
  3281.                 description: |-
  3282.                   ErrorPage holds the custom error middleware configuration.
  3283.                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
  3284.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/errorpages/
  3285.                 properties:
  3286.                   query:
  3287.                     description: |-
  3288.                       Query defines the URL for the error page (hosted by service).
  3289.                       The {status} variable can be used in order to insert the status code in the URL.
  3290.                     type: string
  3291.                   service:
  3292.                     description: |-
  3293.                       Service defines the reference to a Kubernetes Service that will serve the error page.
  3294.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/errorpages/#service
  3295.                     properties:
  3296.                       kind:
  3297.                         description: Kind defines the kind of the Service.
  3298.                         enum:
  3299.                         - Service
  3300.                         - TraefikService
  3301.                         type: string
  3302.                       name:
  3303.                         description: |-
  3304.                           Name defines the name of the referenced Kubernetes Service or TraefikService.
  3305.                           The differentiation between the two is specified in the Kind field.
  3306.                         type: string
  3307.                       namespace:
  3308.                         description: Namespace defines the namespace of the referenced
  3309.                           Kubernetes Service or TraefikService.
  3310.                         type: string
  3311.                       nativeLB:
  3312.                         description: |-
  3313.                           NativeLB controls, when creating the load-balancer,
  3314.                           whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  3315.                           The Kubernetes Service itself does load-balance to the pods.
  3316.                           By default, NativeLB is false.
  3317.                         type: boolean
  3318.                       passHostHeader:
  3319.                         description: |-
  3320.                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  3321.                           By default, passHostHeader is true.
  3322.                         type: boolean
  3323.                       port:
  3324.                         anyOf:
  3325.                         - type: integer
  3326.                         - type: string
  3327.                         description: |-
  3328.                           Port defines the port of a Kubernetes Service.
  3329.                           This can be a reference to a named port.
  3330.                         x-kubernetes-int-or-string: true
  3331.                       responseForwarding:
  3332.                         description: ResponseForwarding defines how Traefik forwards
  3333.                           the response from the upstream Kubernetes Service to the
  3334.                           client.
  3335.                         properties:
  3336.                           flushInterval:
  3337.                             description: |-
  3338.                               FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  3339.                               A negative value means to flush immediately after each write to the client.
  3340.                               This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  3341.                               for such responses, writes are flushed to the client immediately.
  3342.                               Default: 100ms
  3343.                             type: string
  3344.                         type: object
  3345.                       scheme:
  3346.                         description: |-
  3347.                           Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  3348.                           It defaults to https when Kubernetes Service port is 443, http otherwise.
  3349.                         type: string
  3350.                       serversTransport:
  3351.                         description: |-
  3352.                           ServersTransport defines the name of ServersTransport resource to use.
  3353.                           It allows to configure the transport between Traefik and your servers.
  3354.                           Can only be used on a Kubernetes Service.
  3355.                         type: string
  3356.                       sticky:
  3357.                         description: |-
  3358.                           Sticky defines the sticky sessions configuration.
  3359.                           More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  3360.                         properties:
  3361.                           cookie:
  3362.                             description: Cookie defines the sticky cookie configuration.
  3363.                             properties:
  3364.                               httpOnly:
  3365.                                 description: HTTPOnly defines whether the cookie can
  3366.                                   be accessed by client-side APIs, such as JavaScript.
  3367.                                 type: boolean
  3368.                               name:
  3369.                                 description: Name defines the Cookie name.
  3370.                                 type: string
  3371.                               sameSite:
  3372.                                 description: |-
  3373.                                   SameSite defines the same site policy.
  3374.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  3375.                                 type: string
  3376.                               secure:
  3377.                                 description: Secure defines whether the cookie can
  3378.                                   only be transmitted over an encrypted connection
  3379.                                   (i.e. HTTPS).
  3380.                                 type: boolean
  3381.                             type: object
  3382.                         type: object
  3383.                       strategy:
  3384.                         description: |-
  3385.                           Strategy defines the load balancing strategy between the servers.
  3386.                           RoundRobin is the only supported value at the moment.
  3387.                         type: string
  3388.                       weight:
  3389.                         description: |-
  3390.                           Weight defines the weight and should only be specified when Name references a TraefikService object
  3391.                           (and to be precise, one that embeds a Weighted Round Robin).
  3392.                         type: integer
  3393.                     required:
  3394.                     - name
  3395.                     type: object
  3396.                   status:
  3397.                     description: |-
  3398.                       Status defines which status or range of statuses should result in an error page.
  3399.                       It can be either a status code as a number (500),
  3400.                       as multiple comma-separated numbers (500,502),
  3401.                       as ranges by separating two codes with a dash (500-599),
  3402.                       or a combination of the two (404,418,500-599).
  3403.                     items:
  3404.                       type: string
  3405.                     type: array
  3406.                 type: object
  3407.               forwardAuth:
  3408.                 description: |-
  3409.                   ForwardAuth holds the forward auth middleware configuration.
  3410.                   This middleware delegates the request authentication to a Service.
  3411.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/forwardauth/
  3412.                 properties:
  3413.                   address:
  3414.                     description: Address defines the authentication server address.
  3415.                     type: string
  3416.                   authRequestHeaders:
  3417.                     description: |-
  3418.                       AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
  3419.                       If not set or empty then all request headers are passed.
  3420.                     items:
  3421.                       type: string
  3422.                     type: array
  3423.                   authResponseHeaders:
  3424.                     description: AuthResponseHeaders defines the list of headers to
  3425.                       copy from the authentication server response and set on forwarded
  3426.                       request, replacing any existing conflicting headers.
  3427.                     items:
  3428.                       type: string
  3429.                     type: array
  3430.                   authResponseHeadersRegex:
  3431.                     description: |-
  3432.                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
  3433.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/forwardauth/#authresponseheadersregex
  3434.                     type: string
  3435.                   tls:
  3436.                     description: TLS defines the configuration used to secure the
  3437.                       connection to the authentication server.
  3438.                     properties:
  3439.                       caOptional:
  3440.                         type: boolean
  3441.                       caSecret:
  3442.                         description: |-
  3443.                           CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate.
  3444.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  3445.                         type: string
  3446.                       certSecret:
  3447.                         description: |-
  3448.                           CertSecret is the name of the referenced Kubernetes Secret containing the client certificate.
  3449.                           The client certificate is extracted from the keys `tls.crt` and `tls.key`.
  3450.                         type: string
  3451.                       insecureSkipVerify:
  3452.                         description: InsecureSkipVerify defines whether the server
  3453.                           certificates should be validated.
  3454.                         type: boolean
  3455.                     type: object
  3456.                   trustForwardHeader:
  3457.                     description: 'TrustForwardHeader defines whether to trust (ie:
  3458.                       forward) all X-Forwarded-* headers.'
  3459.                     type: boolean
  3460.                 type: object
  3461.               headers:
  3462.                 description: |-
  3463.                   Headers holds the headers middleware configuration.
  3464.                   This middleware manages the requests and responses headers.
  3465.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/headers/#customrequestheaders
  3466.                 properties:
  3467.                   accessControlAllowCredentials:
  3468.                     description: AccessControlAllowCredentials defines whether the
  3469.                       request can include user credentials.
  3470.                     type: boolean
  3471.                   accessControlAllowHeaders:
  3472.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  3473.                       values sent in preflight response.
  3474.                     items:
  3475.                       type: string
  3476.                     type: array
  3477.                   accessControlAllowMethods:
  3478.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  3479.                       values sent in preflight response.
  3480.                     items:
  3481.                       type: string
  3482.                     type: array
  3483.                   accessControlAllowOriginList:
  3484.                     description: AccessControlAllowOriginList is a list of allowable
  3485.                       origins. Can also be a wildcard origin "*".
  3486.                     items:
  3487.                       type: string
  3488.                     type: array
  3489.                   accessControlAllowOriginListRegex:
  3490.                     description: AccessControlAllowOriginListRegex is a list of allowable
  3491.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  3492.                     items:
  3493.                       type: string
  3494.                     type: array
  3495.                   accessControlExposeHeaders:
  3496.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  3497.                       values sent in preflight response.
  3498.                     items:
  3499.                       type: string
  3500.                     type: array
  3501.                   accessControlMaxAge:
  3502.                     description: AccessControlMaxAge defines the time that a preflight
  3503.                       request may be cached.
  3504.                     format: int64
  3505.                     type: integer
  3506.                   addVaryHeader:
  3507.                     description: AddVaryHeader defines whether the Vary header is
  3508.                       automatically added/updated when the AccessControlAllowOriginList
  3509.                       is set.
  3510.                     type: boolean
  3511.                   allowedHosts:
  3512.                     description: AllowedHosts defines the fully qualified list of
  3513.                       allowed domain names.
  3514.                     items:
  3515.                       type: string
  3516.                     type: array
  3517.                   browserXssFilter:
  3518.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  3519.                       header with the value 1; mode=block.
  3520.                     type: boolean
  3521.                   contentSecurityPolicy:
  3522.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  3523.                       header value.
  3524.                     type: string
  3525.                   contentTypeNosniff:
  3526.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  3527.                       header with the nosniff value.
  3528.                     type: boolean
  3529.                   customBrowserXSSValue:
  3530.                     description: |-
  3531.                       CustomBrowserXSSValue defines the X-XSS-Protection header value.
  3532.                       This overrides the BrowserXssFilter option.
  3533.                     type: string
  3534.                   customFrameOptionsValue:
  3535.                     description: |-
  3536.                       CustomFrameOptionsValue defines the X-Frame-Options header value.
  3537.                       This overrides the FrameDeny option.
  3538.                     type: string
  3539.                   customRequestHeaders:
  3540.                     additionalProperties:
  3541.                       type: string
  3542.                     description: CustomRequestHeaders defines the header names and
  3543.                       values to apply to the request.
  3544.                     type: object
  3545.                   customResponseHeaders:
  3546.                     additionalProperties:
  3547.                       type: string
  3548.                     description: CustomResponseHeaders defines the header names and
  3549.                       values to apply to the response.
  3550.                     type: object
  3551.                   featurePolicy:
  3552.                     description: 'Deprecated: use PermissionsPolicy instead.'
  3553.                     type: string
  3554.                   forceSTSHeader:
  3555.                     description: ForceSTSHeader defines whether to add the STS header
  3556.                       even when the connection is HTTP.
  3557.                     type: boolean
  3558.                   frameDeny:
  3559.                     description: FrameDeny defines whether to add the X-Frame-Options
  3560.                       header with the DENY value.
  3561.                     type: boolean
  3562.                   hostsProxyHeaders:
  3563.                     description: HostsProxyHeaders defines the header keys that may
  3564.                       hold a proxied hostname value for the request.
  3565.                     items:
  3566.                       type: string
  3567.                     type: array
  3568.                   isDevelopment:
  3569.                     description: |-
  3570.                       IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing.
  3571.                       Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain.
  3572.                       If you would like your development environment to mimic production with complete Host blocking, SSL redirects,
  3573.                       and STS headers, leave this as false.
  3574.                     type: boolean
  3575.                   permissionsPolicy:
  3576.                     description: |-
  3577.                       PermissionsPolicy defines the Permissions-Policy header value.
  3578.                       This allows sites to control browser features.
  3579.                     type: string
  3580.                   publicKey:
  3581.                     description: PublicKey is the public key that implements HPKP
  3582.                       to prevent MITM attacks with forged certificates.
  3583.                     type: string
  3584.                   referrerPolicy:
  3585.                     description: |-
  3586.                       ReferrerPolicy defines the Referrer-Policy header value.
  3587.                       This allows sites to control whether browsers forward the Referer header to other sites.
  3588.                     type: string
  3589.                   sslForceHost:
  3590.                     description: 'Deprecated: use RedirectRegex instead.'
  3591.                     type: boolean
  3592.                   sslHost:
  3593.                     description: 'Deprecated: use RedirectRegex instead.'
  3594.                     type: string
  3595.                   sslProxyHeaders:
  3596.                     additionalProperties:
  3597.                       type: string
  3598.                     description: |-
  3599.                       SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request.
  3600.                       It can be useful when using other proxies (example: "X-Forwarded-Proto": "https").
  3601.                     type: object
  3602.                   sslRedirect:
  3603.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  3604.                       instead.'
  3605.                     type: boolean
  3606.                   sslTemporaryRedirect:
  3607.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  3608.                       instead.'
  3609.                     type: boolean
  3610.                   stsIncludeSubdomains:
  3611.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  3612.                       directive is appended to the Strict-Transport-Security header.
  3613.                     type: boolean
  3614.                   stsPreload:
  3615.                     description: STSPreload defines whether the preload flag is appended
  3616.                       to the Strict-Transport-Security header.
  3617.                     type: boolean
  3618.                   stsSeconds:
  3619.                     description: |-
  3620.                       STSSeconds defines the max-age of the Strict-Transport-Security header.
  3621.                       If set to 0, the header is not set.
  3622.                     format: int64
  3623.                     type: integer
  3624.                 type: object
  3625.               inFlightReq:
  3626.                 description: |-
  3627.                   InFlightReq holds the in-flight request middleware configuration.
  3628.                   This middleware limits the number of requests being processed and served concurrently.
  3629.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/inflightreq/
  3630.                 properties:
  3631.                   amount:
  3632.                     description: |-
  3633.                       Amount defines the maximum amount of allowed simultaneous in-flight request.
  3634.                       The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).
  3635.                     format: int64
  3636.                     type: integer
  3637.                   sourceCriterion:
  3638.                     description: |-
  3639.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  3640.                       If several strategies are defined at the same time, an error will be raised.
  3641.                       If none are set, the default is to use the requestHost.
  3642.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/inflightreq/#sourcecriterion
  3643.                     properties:
  3644.                       ipStrategy:
  3645.                         description: |-
  3646.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  3647.                           More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  3648.                         properties:
  3649.                           depth:
  3650.                             description: Depth tells Traefik to use the X-Forwarded-For
  3651.                               header and take the IP located at the depth position
  3652.                               (starting from the right).
  3653.                             type: integer
  3654.                           excludedIPs:
  3655.                             description: ExcludedIPs configures Traefik to scan the
  3656.                               X-Forwarded-For header and select the first IP not in
  3657.                               the list.
  3658.                             items:
  3659.                               type: string
  3660.                             type: array
  3661.                         type: object
  3662.                       requestHeaderName:
  3663.                         description: RequestHeaderName defines the name of the header
  3664.                           used to group incoming requests.
  3665.                         type: string
  3666.                       requestHost:
  3667.                         description: RequestHost defines whether to consider the request
  3668.                           Host as the source.
  3669.                         type: boolean
  3670.                     type: object
  3671.                 type: object
  3672.               ipAllowList:
  3673.                 description: |-
  3674.                   IPAllowList holds the IP allowlist middleware configuration.
  3675.                   This middleware accepts / refuses requests based on the client IP.
  3676.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/
  3677.                 properties:
  3678.                   ipStrategy:
  3679.                     description: |-
  3680.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  3681.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  3682.                     properties:
  3683.                       depth:
  3684.                         description: Depth tells Traefik to use the X-Forwarded-For
  3685.                           header and take the IP located at the depth position (starting
  3686.                           from the right).
  3687.                         type: integer
  3688.                       excludedIPs:
  3689.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  3690.                           header and select the first IP not in the list.
  3691.                         items:
  3692.                           type: string
  3693.                         type: array
  3694.                     type: object
  3695.                   sourceRange:
  3696.                     description: SourceRange defines the set of allowed IPs (or ranges
  3697.                       of allowed IPs by using CIDR notation).
  3698.                     items:
  3699.                       type: string
  3700.                     type: array
  3701.                 type: object
  3702.               ipWhiteList:
  3703.                 description: |-
  3704.                   IPWhiteList holds the IP whitelist middleware configuration.
  3705.                   This middleware accepts / refuses requests based on the client IP.
  3706.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipwhitelist/
  3707.                   Deprecated: please use IPAllowList instead.
  3708.                 properties:
  3709.                   ipStrategy:
  3710.                     description: |-
  3711.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  3712.                       More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  3713.                     properties:
  3714.                       depth:
  3715.                         description: Depth tells Traefik to use the X-Forwarded-For
  3716.                           header and take the IP located at the depth position (starting
  3717.                           from the right).
  3718.                         type: integer
  3719.                       excludedIPs:
  3720.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  3721.                           header and select the first IP not in the list.
  3722.                         items:
  3723.                           type: string
  3724.                         type: array
  3725.                     type: object
  3726.                   sourceRange:
  3727.                     description: SourceRange defines the set of allowed IPs (or ranges
  3728.                       of allowed IPs by using CIDR notation).
  3729.                     items:
  3730.                       type: string
  3731.                     type: array
  3732.                 type: object
  3733.               passTLSClientCert:
  3734.                 description: |-
  3735.                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
  3736.                   This middleware adds the selected data from the passed client TLS certificate to a header.
  3737.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/passtlsclientcert/
  3738.                 properties:
  3739.                   info:
  3740.                     description: Info selects the specific client certificate details
  3741.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  3742.                     properties:
  3743.                       issuer:
  3744.                         description: Issuer defines the client certificate issuer
  3745.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  3746.                         properties:
  3747.                           commonName:
  3748.                             description: CommonName defines whether to add the organizationalUnit
  3749.                               information into the issuer.
  3750.                             type: boolean
  3751.                           country:
  3752.                             description: Country defines whether to add the country
  3753.                               information into the issuer.
  3754.                             type: boolean
  3755.                           domainComponent:
  3756.                             description: DomainComponent defines whether to add the
  3757.                               domainComponent information into the issuer.
  3758.                             type: boolean
  3759.                           locality:
  3760.                             description: Locality defines whether to add the locality
  3761.                               information into the issuer.
  3762.                             type: boolean
  3763.                           organization:
  3764.                             description: Organization defines whether to add the organization
  3765.                               information into the issuer.
  3766.                             type: boolean
  3767.                           province:
  3768.                             description: Province defines whether to add the province
  3769.                               information into the issuer.
  3770.                             type: boolean
  3771.                           serialNumber:
  3772.                             description: SerialNumber defines whether to add the serialNumber
  3773.                               information into the issuer.
  3774.                             type: boolean
  3775.                         type: object
  3776.                       notAfter:
  3777.                         description: NotAfter defines whether to add the Not After
  3778.                           information from the Validity part.
  3779.                         type: boolean
  3780.                       notBefore:
  3781.                         description: NotBefore defines whether to add the Not Before
  3782.                           information from the Validity part.
  3783.                         type: boolean
  3784.                       sans:
  3785.                         description: Sans defines whether to add the Subject Alternative
  3786.                           Name information from the Subject Alternative Name part.
  3787.                         type: boolean
  3788.                       serialNumber:
  3789.                         description: SerialNumber defines whether to add the client
  3790.                           serialNumber information.
  3791.                         type: boolean
  3792.                       subject:
  3793.                         description: Subject defines the client certificate subject
  3794.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  3795.                         properties:
  3796.                           commonName:
  3797.                             description: CommonName defines whether to add the organizationalUnit
  3798.                               information into the subject.
  3799.                             type: boolean
  3800.                           country:
  3801.                             description: Country defines whether to add the country
  3802.                               information into the subject.
  3803.                             type: boolean
  3804.                           domainComponent:
  3805.                             description: DomainComponent defines whether to add the
  3806.                               domainComponent information into the subject.
  3807.                             type: boolean
  3808.                           locality:
  3809.                             description: Locality defines whether to add the locality
  3810.                               information into the subject.
  3811.                             type: boolean
  3812.                           organization:
  3813.                             description: Organization defines whether to add the organization
  3814.                               information into the subject.
  3815.                             type: boolean
  3816.                           organizationalUnit:
  3817.                             description: OrganizationalUnit defines whether to add
  3818.                               the organizationalUnit information into the subject.
  3819.                             type: boolean
  3820.                           province:
  3821.                             description: Province defines whether to add the province
  3822.                               information into the subject.
  3823.                             type: boolean
  3824.                           serialNumber:
  3825.                             description: SerialNumber defines whether to add the serialNumber
  3826.                               information into the subject.
  3827.                             type: boolean
  3828.                         type: object
  3829.                     type: object
  3830.                   pem:
  3831.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  3832.                       the certificate.
  3833.                     type: boolean
  3834.                 type: object
  3835.               plugin:
  3836.                 additionalProperties:
  3837.                   x-kubernetes-preserve-unknown-fields: true
  3838.                 description: |-
  3839.                   Plugin defines the middleware plugin configuration.
  3840.                   More info: https://doc.traefik.io/traefik/plugins/
  3841.                 type: object
  3842.               rateLimit:
  3843.                 description: |-
  3844.                   RateLimit holds the rate limit configuration.
  3845.                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
  3846.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ratelimit/
  3847.                 properties:
  3848.                   average:
  3849.                     description: |-
  3850.                       Average is the maximum rate, by default in requests/s, allowed for the given source.
  3851.                       It defaults to 0, which means no rate limiting.
  3852.                       The rate is actually defined by dividing Average by Period. So for a rate below 1req/s,
  3853.                       one needs to define a Period larger than a second.
  3854.                     format: int64
  3855.                     type: integer
  3856.                   burst:
  3857.                     description: |-
  3858.                       Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time.
  3859.                       It defaults to 1.
  3860.                     format: int64
  3861.                     type: integer
  3862.                   period:
  3863.                     anyOf:
  3864.                     - type: integer
  3865.                     - type: string
  3866.                     description: |-
  3867.                       Period, in combination with Average, defines the actual maximum rate, such as:
  3868.                       r = Average / Period. It defaults to a second.
  3869.                     x-kubernetes-int-or-string: true
  3870.                   sourceCriterion:
  3871.                     description: |-
  3872.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  3873.                       If several strategies are defined at the same time, an error will be raised.
  3874.                       If none are set, the default is to use the request's remote address field (as an ipStrategy).
  3875.                     properties:
  3876.                       ipStrategy:
  3877.                         description: |-
  3878.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  3879.                           More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/ipallowlist/#ipstrategy
  3880.                         properties:
  3881.                           depth:
  3882.                             description: Depth tells Traefik to use the X-Forwarded-For
  3883.                               header and take the IP located at the depth position
  3884.                               (starting from the right).
  3885.                             type: integer
  3886.                           excludedIPs:
  3887.                             description: ExcludedIPs configures Traefik to scan the
  3888.                               X-Forwarded-For header and select the first IP not in
  3889.                               the list.
  3890.                             items:
  3891.                               type: string
  3892.                             type: array
  3893.                         type: object
  3894.                       requestHeaderName:
  3895.                         description: RequestHeaderName defines the name of the header
  3896.                           used to group incoming requests.
  3897.                         type: string
  3898.                       requestHost:
  3899.                         description: RequestHost defines whether to consider the request
  3900.                           Host as the source.
  3901.                         type: boolean
  3902.                     type: object
  3903.                 type: object
  3904.               redirectRegex:
  3905.                 description: |-
  3906.                   RedirectRegex holds the redirect regex middleware configuration.
  3907.                   This middleware redirects a request using regex matching and replacement.
  3908.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/redirectregex/#regex
  3909.                 properties:
  3910.                   permanent:
  3911.                     description: Permanent defines whether the redirection is permanent
  3912.                       (301).
  3913.                     type: boolean
  3914.                   regex:
  3915.                     description: Regex defines the regex used to match and capture
  3916.                       elements from the request URL.
  3917.                     type: string
  3918.                   replacement:
  3919.                     description: Replacement defines how to modify the URL to have
  3920.                       the new target URL.
  3921.                     type: string
  3922.                 type: object
  3923.               redirectScheme:
  3924.                 description: |-
  3925.                   RedirectScheme holds the redirect scheme middleware configuration.
  3926.                   This middleware redirects requests from a scheme/port to another.
  3927.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/redirectscheme/
  3928.                 properties:
  3929.                   permanent:
  3930.                     description: Permanent defines whether the redirection is permanent
  3931.                       (301).
  3932.                     type: boolean
  3933.                   port:
  3934.                     description: Port defines the port of the new URL.
  3935.                     type: string
  3936.                   scheme:
  3937.                     description: Scheme defines the scheme of the new URL.
  3938.                     type: string
  3939.                 type: object
  3940.               replacePath:
  3941.                 description: |-
  3942.                   ReplacePath holds the replace path middleware configuration.
  3943.                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
  3944.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/replacepath/
  3945.                 properties:
  3946.                   path:
  3947.                     description: Path defines the path to use as replacement in the
  3948.                       request URL.
  3949.                     type: string
  3950.                 type: object
  3951.               replacePathRegex:
  3952.                 description: |-
  3953.                   ReplacePathRegex holds the replace path regex middleware configuration.
  3954.                   This middleware replaces the path of a URL using regex matching and replacement.
  3955.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/replacepathregex/
  3956.                 properties:
  3957.                   regex:
  3958.                     description: Regex defines the regular expression used to match
  3959.                       and capture the path from the request URL.
  3960.                     type: string
  3961.                   replacement:
  3962.                     description: Replacement defines the replacement path format,
  3963.                       which can include captured variables.
  3964.                     type: string
  3965.                 type: object
  3966.               retry:
  3967.                 description: |-
  3968.                   Retry holds the retry middleware configuration.
  3969.                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
  3970.                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
  3971.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/retry/
  3972.                 properties:
  3973.                   attempts:
  3974.                     description: Attempts defines how many times the request should
  3975.                       be retried.
  3976.                     type: integer
  3977.                   initialInterval:
  3978.                     anyOf:
  3979.                     - type: integer
  3980.                     - type: string
  3981.                     description: |-
  3982.                       InitialInterval defines the first wait time in the exponential backoff series.
  3983.                       The maximum interval is calculated as twice the initialInterval.
  3984.                       If unspecified, requests will be retried immediately.
  3985.                       The value of initialInterval should be provided in seconds or as a valid duration format,
  3986.                       see https://pkg.go.dev/time#ParseDuration.
  3987.                     x-kubernetes-int-or-string: true
  3988.                 type: object
  3989.               stripPrefix:
  3990.                 description: |-
  3991.                   StripPrefix holds the strip prefix middleware configuration.
  3992.                   This middleware removes the specified prefixes from the URL path.
  3993.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/stripprefix/
  3994.                 properties:
  3995.                   forceSlash:
  3996.                     description: |-
  3997.                       ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.
  3998.                       Default: true.
  3999.                     type: boolean
  4000.                   prefixes:
  4001.                     description: Prefixes defines the prefixes to strip from the request
  4002.                       URL.
  4003.                     items:
  4004.                       type: string
  4005.                     type: array
  4006.                 type: object
  4007.               stripPrefixRegex:
  4008.                 description: |-
  4009.                   StripPrefixRegex holds the strip prefix regex middleware configuration.
  4010.                   This middleware removes the matching prefixes from the URL path.
  4011.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/http/stripprefixregex/
  4012.                 properties:
  4013.                   regex:
  4014.                     description: Regex defines the regular expression to match the
  4015.                       path prefix from the request URL.
  4016.                     items:
  4017.                       type: string
  4018.                     type: array
  4019.                 type: object
  4020.             type: object
  4021.         required:
  4022.         - metadata
  4023.         - spec
  4024.         type: object
  4025.     served: true
  4026.     storage: true
  4027. ---
  4028. apiVersion: apiextensions.k8s.io/v1
  4029. kind: CustomResourceDefinition
  4030. metadata:
  4031.   annotations:
  4032.     controller-gen.kubebuilder.io/version: v0.14.0
  4033.   name: middlewaretcps.traefik.containo.us
  4034. spec:
  4035.   group: traefik.containo.us
  4036.   names:
  4037.     kind: MiddlewareTCP
  4038.     listKind: MiddlewareTCPList
  4039.     plural: middlewaretcps
  4040.     singular: middlewaretcp
  4041.   scope: Namespaced
  4042.   versions:
  4043.   - name: v1alpha1
  4044.     schema:
  4045.       openAPIV3Schema:
  4046.         description: |-
  4047.           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  4048.           More info: https://doc.traefik.io/traefik/v2.11/middlewares/overview/
  4049.         properties:
  4050.           apiVersion:
  4051.             description: |-
  4052.               APIVersion defines the versioned schema of this representation of an object.
  4053.               Servers should convert recognized schemas to the latest internal value, and
  4054.               may reject unrecognized values.
  4055.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  4056.             type: string
  4057.           kind:
  4058.             description: |-
  4059.               Kind is a string value representing the REST resource this object represents.
  4060.               Servers may infer this from the endpoint the client submits requests to.
  4061.               Cannot be updated.
  4062.               In CamelCase.
  4063.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  4064.             type: string
  4065.           metadata:
  4066.             type: object
  4067.           spec:
  4068.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  4069.             properties:
  4070.               inFlightConn:
  4071.                 description: InFlightConn defines the InFlightConn middleware configuration.
  4072.                 properties:
  4073.                   amount:
  4074.                     description: |-
  4075.                       Amount defines the maximum amount of allowed simultaneous connections.
  4076.                       The middleware closes the connection if there are already amount connections opened.
  4077.                     format: int64
  4078.                     type: integer
  4079.                 type: object
  4080.               ipAllowList:
  4081.                 description: |-
  4082.                   IPAllowList defines the IPAllowList middleware configuration.
  4083.                   This middleware accepts/refuses connections based on the client IP.
  4084.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/tcp/ipallowlist/
  4085.                 properties:
  4086.                   sourceRange:
  4087.                     description: SourceRange defines the allowed IPs (or ranges of
  4088.                       allowed IPs by using CIDR notation).
  4089.                     items:
  4090.                       type: string
  4091.                     type: array
  4092.                 type: object
  4093.               ipWhiteList:
  4094.                 description: |-
  4095.                   IPWhiteList defines the IPWhiteList middleware configuration.
  4096.                   This middleware accepts/refuses connections based on the client IP.
  4097.                   Deprecated: please use IPAllowList instead.
  4098.                   More info: https://doc.traefik.io/traefik/v2.11/middlewares/tcp/ipwhitelist/
  4099.                 properties:
  4100.                   sourceRange:
  4101.                     description: SourceRange defines the allowed IPs (or ranges of
  4102.                       allowed IPs by using CIDR notation).
  4103.                     items:
  4104.                       type: string
  4105.                     type: array
  4106.                 type: object
  4107.             type: object
  4108.         required:
  4109.         - metadata
  4110.         - spec
  4111.         type: object
  4112.     served: true
  4113.     storage: true
  4114. ---
  4115. apiVersion: apiextensions.k8s.io/v1
  4116. kind: CustomResourceDefinition
  4117. metadata:
  4118.   annotations:
  4119.     controller-gen.kubebuilder.io/version: v0.14.0
  4120.   name: serverstransports.traefik.containo.us
  4121. spec:
  4122.   group: traefik.containo.us
  4123.   names:
  4124.     kind: ServersTransport
  4125.     listKind: ServersTransportList
  4126.     plural: serverstransports
  4127.     singular: serverstransport
  4128.   scope: Namespaced
  4129.   versions:
  4130.   - name: v1alpha1
  4131.     schema:
  4132.       openAPIV3Schema:
  4133.         description: |-
  4134.           ServersTransport is the CRD implementation of a ServersTransport.
  4135.           If no serversTransport is specified, the default@internal will be used.
  4136.           The default@internal serversTransport is created from the static configuration.
  4137.           More info: https://doc.traefik.io/traefik/v2.11/routing/services/#serverstransport_1
  4138.         properties:
  4139.           apiVersion:
  4140.             description: |-
  4141.               APIVersion defines the versioned schema of this representation of an object.
  4142.               Servers should convert recognized schemas to the latest internal value, and
  4143.               may reject unrecognized values.
  4144.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  4145.             type: string
  4146.           kind:
  4147.             description: |-
  4148.               Kind is a string value representing the REST resource this object represents.
  4149.               Servers may infer this from the endpoint the client submits requests to.
  4150.               Cannot be updated.
  4151.               In CamelCase.
  4152.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  4153.             type: string
  4154.           metadata:
  4155.             type: object
  4156.           spec:
  4157.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  4158.             properties:
  4159.               certificatesSecrets:
  4160.                 description: CertificatesSecrets defines a list of secret storing
  4161.                   client certificates for mTLS.
  4162.                 items:
  4163.                   type: string
  4164.                 type: array
  4165.               disableHTTP2:
  4166.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  4167.                   servers.
  4168.                 type: boolean
  4169.               forwardingTimeouts:
  4170.                 description: ForwardingTimeouts defines the timeouts for requests
  4171.                   forwarded to the backend servers.
  4172.                 properties:
  4173.                   dialTimeout:
  4174.                     anyOf:
  4175.                     - type: integer
  4176.                     - type: string
  4177.                     description: DialTimeout is the amount of time to wait until a
  4178.                       connection to a backend server can be established.
  4179.                     x-kubernetes-int-or-string: true
  4180.                   idleConnTimeout:
  4181.                     anyOf:
  4182.                     - type: integer
  4183.                     - type: string
  4184.                     description: IdleConnTimeout is the maximum period for which an
  4185.                       idle HTTP keep-alive connection will remain open before closing
  4186.                       itself.
  4187.                     x-kubernetes-int-or-string: true
  4188.                   pingTimeout:
  4189.                     anyOf:
  4190.                     - type: integer
  4191.                     - type: string
  4192.                     description: PingTimeout is the timeout after which the HTTP/2
  4193.                       connection will be closed if a response to ping is not received.
  4194.                     x-kubernetes-int-or-string: true
  4195.                   readIdleTimeout:
  4196.                     anyOf:
  4197.                     - type: integer
  4198.                     - type: string
  4199.                     description: ReadIdleTimeout is the timeout after which a health
  4200.                       check using ping frame will be carried out if no frame is received
  4201.                       on the HTTP/2 connection.
  4202.                     x-kubernetes-int-or-string: true
  4203.                   responseHeaderTimeout:
  4204.                     anyOf:
  4205.                     - type: integer
  4206.                     - type: string
  4207.                     description: ResponseHeaderTimeout is the amount of time to wait
  4208.                       for a server's response headers after fully writing the request
  4209.                       (including its body, if any).
  4210.                     x-kubernetes-int-or-string: true
  4211.                 type: object
  4212.               insecureSkipVerify:
  4213.                 description: InsecureSkipVerify disables SSL certificate verification.
  4214.                 type: boolean
  4215.               maxIdleConnsPerHost:
  4216.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  4217.                   to keep per-host.
  4218.                 type: integer
  4219.               peerCertURI:
  4220.                 description: PeerCertURI defines the peer cert URI used to match against
  4221.                   SAN URI during the peer certificate verification.
  4222.                 type: string
  4223.               rootCAsSecrets:
  4224.                 description: RootCAsSecrets defines a list of CA secret used to validate
  4225.                   self-signed certificate.
  4226.                 items:
  4227.                   type: string
  4228.                 type: array
  4229.               serverName:
  4230.                 description: ServerName defines the server name used to contact the
  4231.                   server.
  4232.                 type: string
  4233.             type: object
  4234.         required:
  4235.         - metadata
  4236.         - spec
  4237.         type: object
  4238.     served: true
  4239.     storage: true
  4240. ---
  4241. apiVersion: apiextensions.k8s.io/v1
  4242. kind: CustomResourceDefinition
  4243. metadata:
  4244.   annotations:
  4245.     controller-gen.kubebuilder.io/version: v0.14.0
  4246.   name: tlsoptions.traefik.containo.us
  4247. spec:
  4248.   group: traefik.containo.us
  4249.   names:
  4250.     kind: TLSOption
  4251.     listKind: TLSOptionList
  4252.     plural: tlsoptions
  4253.     singular: tlsoption
  4254.   scope: Namespaced
  4255.   versions:
  4256.   - name: v1alpha1
  4257.     schema:
  4258.       openAPIV3Schema:
  4259.         description: |-
  4260.           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
  4261.           More info: https://doc.traefik.io/traefik/v2.11/https/tls/#tls-options
  4262.         properties:
  4263.           apiVersion:
  4264.             description: |-
  4265.               APIVersion defines the versioned schema of this representation of an object.
  4266.               Servers should convert recognized schemas to the latest internal value, and
  4267.               may reject unrecognized values.
  4268.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  4269.             type: string
  4270.           kind:
  4271.             description: |-
  4272.               Kind is a string value representing the REST resource this object represents.
  4273.               Servers may infer this from the endpoint the client submits requests to.
  4274.               Cannot be updated.
  4275.               In CamelCase.
  4276.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  4277.             type: string
  4278.           metadata:
  4279.             type: object
  4280.           spec:
  4281.             description: TLSOptionSpec defines the desired state of a TLSOption.
  4282.             properties:
  4283.               alpnProtocols:
  4284.                 description: |-
  4285.                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
  4286.                   More info: https://doc.traefik.io/traefik/v2.11/https/tls/#alpn-protocols
  4287.                 items:
  4288.                   type: string
  4289.                 type: array
  4290.               cipherSuites:
  4291.                 description: |-
  4292.                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
  4293.                   More info: https://doc.traefik.io/traefik/v2.11/https/tls/#cipher-suites
  4294.                 items:
  4295.                   type: string
  4296.                 type: array
  4297.               clientAuth:
  4298.                 description: ClientAuth defines the server's policy for TLS Client
  4299.                   Authentication.
  4300.                 properties:
  4301.                   clientAuthType:
  4302.                     description: ClientAuthType defines the client authentication
  4303.                       type to apply.
  4304.                     enum:
  4305.                     - NoClientCert
  4306.                     - RequestClientCert
  4307.                     - RequireAnyClientCert
  4308.                     - VerifyClientCertIfGiven
  4309.                     - RequireAndVerifyClientCert
  4310.                     type: string
  4311.                   secretNames:
  4312.                     description: SecretNames defines the names of the referenced Kubernetes
  4313.                       Secret storing certificate details.
  4314.                     items:
  4315.                       type: string
  4316.                     type: array
  4317.                 type: object
  4318.               curvePreferences:
  4319.                 description: |-
  4320.                   CurvePreferences defines the preferred elliptic curves in a specific order.
  4321.                   More info: https://doc.traefik.io/traefik/v2.11/https/tls/#curve-preferences
  4322.                 items:
  4323.                   type: string
  4324.                 type: array
  4325.               maxVersion:
  4326.                 description: |-
  4327.                   MaxVersion defines the maximum TLS version that Traefik will accept.
  4328.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  4329.                   Default: None.
  4330.                 type: string
  4331.               minVersion:
  4332.                 description: |-
  4333.                   MinVersion defines the minimum TLS version that Traefik will accept.
  4334.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  4335.                   Default: VersionTLS10.
  4336.                 type: string
  4337.               preferServerCipherSuites:
  4338.                 description: |-
  4339.                   PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
  4340.                   It is enabled automatically when minVersion or maxVersion is set.
  4341.                   Deprecated: https://github.com/golang/go/issues/45430
  4342.                 type: boolean
  4343.               sniStrict:
  4344.                 description: SniStrict defines whether Traefik allows connections
  4345.                   from clients connections that do not specify a server_name extension.
  4346.                 type: boolean
  4347.             type: object
  4348.         required:
  4349.         - metadata
  4350.         - spec
  4351.         type: object
  4352.     served: true
  4353.     storage: true
  4354. ---
  4355. apiVersion: apiextensions.k8s.io/v1
  4356. kind: CustomResourceDefinition
  4357. metadata:
  4358.   annotations:
  4359.     controller-gen.kubebuilder.io/version: v0.14.0
  4360.   name: tlsstores.traefik.containo.us
  4361. spec:
  4362.   group: traefik.containo.us
  4363.   names:
  4364.     kind: TLSStore
  4365.     listKind: TLSStoreList
  4366.     plural: tlsstores
  4367.     singular: tlsstore
  4368.   scope: Namespaced
  4369.   versions:
  4370.   - name: v1alpha1
  4371.     schema:
  4372.       openAPIV3Schema:
  4373.         description: |-
  4374.           TLSStore is the CRD implementation of a Traefik TLS Store.
  4375.           For the time being, only the TLSStore named default is supported.
  4376.           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
  4377.           More info: https://doc.traefik.io/traefik/v2.11/https/tls/#certificates-stores
  4378.         properties:
  4379.           apiVersion:
  4380.             description: |-
  4381.               APIVersion defines the versioned schema of this representation of an object.
  4382.               Servers should convert recognized schemas to the latest internal value, and
  4383.               may reject unrecognized values.
  4384.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  4385.             type: string
  4386.           kind:
  4387.             description: |-
  4388.               Kind is a string value representing the REST resource this object represents.
  4389.               Servers may infer this from the endpoint the client submits requests to.
  4390.               Cannot be updated.
  4391.               In CamelCase.
  4392.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  4393.             type: string
  4394.           metadata:
  4395.             type: object
  4396.           spec:
  4397.             description: TLSStoreSpec defines the desired state of a TLSStore.
  4398.             properties:
  4399.               certificates:
  4400.                 description: Certificates is a list of secret names, each secret holding
  4401.                   a key/certificate pair to add to the store.
  4402.                 items:
  4403.                   description: Certificate holds a secret name for the TLSStore resource.
  4404.                   properties:
  4405.                     secretName:
  4406.                       description: SecretName is the name of the referenced Kubernetes
  4407.                         Secret to specify the certificate details.
  4408.                       type: string
  4409.                   required:
  4410.                   - secretName
  4411.                   type: object
  4412.                 type: array
  4413.               defaultCertificate:
  4414.                 description: DefaultCertificate defines the default certificate configuration.
  4415.                 properties:
  4416.                   secretName:
  4417.                     description: SecretName is the name of the referenced Kubernetes
  4418.                       Secret to specify the certificate details.
  4419.                     type: string
  4420.                 required:
  4421.                 - secretName
  4422.                 type: object
  4423.               defaultGeneratedCert:
  4424.                 description: DefaultGeneratedCert defines the default generated certificate
  4425.                   configuration.
  4426.                 properties:
  4427.                   domain:
  4428.                     description: Domain is the domain definition for the DefaultCertificate.
  4429.                     properties:
  4430.                       main:
  4431.                         description: Main defines the main domain name.
  4432.                         type: string
  4433.                       sans:
  4434.                         description: SANs defines the subject alternative domain names.
  4435.                         items:
  4436.                           type: string
  4437.                         type: array
  4438.                     type: object
  4439.                   resolver:
  4440.                     description: Resolver is the name of the resolver that will be
  4441.                       used to issue the DefaultCertificate.
  4442.                     type: string
  4443.                 type: object
  4444.             type: object
  4445.         required:
  4446.         - metadata
  4447.         - spec
  4448.         type: object
  4449.     served: true
  4450.     storage: true
  4451. ---
  4452. apiVersion: apiextensions.k8s.io/v1
  4453. kind: CustomResourceDefinition
  4454. metadata:
  4455.   annotations:
  4456.     controller-gen.kubebuilder.io/version: v0.14.0
  4457.   name: traefikservices.traefik.containo.us
  4458. spec:
  4459.   group: traefik.containo.us
  4460.   names:
  4461.     kind: TraefikService
  4462.     listKind: TraefikServiceList
  4463.     plural: traefikservices
  4464.     singular: traefikservice
  4465.   scope: Namespaced
  4466.   versions:
  4467.   - name: v1alpha1
  4468.     schema:
  4469.       openAPIV3Schema:
  4470.         description: |-
  4471.           TraefikService is the CRD implementation of a Traefik Service.
  4472.           TraefikService object allows to:
  4473.           - Apply weight to Services on load-balancing
  4474.           - Mirror traffic on services
  4475.           More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#kind-traefikservice
  4476.         properties:
  4477.           apiVersion:
  4478.             description: |-
  4479.               APIVersion defines the versioned schema of this representation of an object.
  4480.               Servers should convert recognized schemas to the latest internal value, and
  4481.               may reject unrecognized values.
  4482.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  4483.             type: string
  4484.           kind:
  4485.             description: |-
  4486.               Kind is a string value representing the REST resource this object represents.
  4487.               Servers may infer this from the endpoint the client submits requests to.
  4488.               Cannot be updated.
  4489.               In CamelCase.
  4490.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  4491.             type: string
  4492.           metadata:
  4493.             type: object
  4494.           spec:
  4495.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  4496.             properties:
  4497.               mirroring:
  4498.                 description: Mirroring defines the Mirroring service configuration.
  4499.                 properties:
  4500.                   kind:
  4501.                     description: Kind defines the kind of the Service.
  4502.                     enum:
  4503.                     - Service
  4504.                     - TraefikService
  4505.                     type: string
  4506.                   maxBodySize:
  4507.                     description: |-
  4508.                       MaxBodySize defines the maximum size allowed for the body of the request.
  4509.                       If the body is larger, the request is not mirrored.
  4510.                       Default value is -1, which means unlimited size.
  4511.                     format: int64
  4512.                     type: integer
  4513.                   mirrors:
  4514.                     description: Mirrors defines the list of mirrors where Traefik
  4515.                       will duplicate the traffic.
  4516.                     items:
  4517.                       description: MirrorService holds the mirror configuration.
  4518.                       properties:
  4519.                         kind:
  4520.                           description: Kind defines the kind of the Service.
  4521.                           enum:
  4522.                           - Service
  4523.                           - TraefikService
  4524.                           type: string
  4525.                         name:
  4526.                           description: |-
  4527.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  4528.                             The differentiation between the two is specified in the Kind field.
  4529.                           type: string
  4530.                         namespace:
  4531.                           description: Namespace defines the namespace of the referenced
  4532.                             Kubernetes Service or TraefikService.
  4533.                           type: string
  4534.                         nativeLB:
  4535.                           description: |-
  4536.                             NativeLB controls, when creating the load-balancer,
  4537.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  4538.                             The Kubernetes Service itself does load-balance to the pods.
  4539.                             By default, NativeLB is false.
  4540.                           type: boolean
  4541.                         passHostHeader:
  4542.                           description: |-
  4543.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  4544.                             By default, passHostHeader is true.
  4545.                           type: boolean
  4546.                         percent:
  4547.                           description: |-
  4548.                             Percent defines the part of the traffic to mirror.
  4549.                             Supported values: 0 to 100.
  4550.                           type: integer
  4551.                         port:
  4552.                           anyOf:
  4553.                           - type: integer
  4554.                           - type: string
  4555.                           description: |-
  4556.                             Port defines the port of a Kubernetes Service.
  4557.                             This can be a reference to a named port.
  4558.                           x-kubernetes-int-or-string: true
  4559.                         responseForwarding:
  4560.                           description: ResponseForwarding defines how Traefik forwards
  4561.                             the response from the upstream Kubernetes Service to the
  4562.                             client.
  4563.                           properties:
  4564.                             flushInterval:
  4565.                               description: |-
  4566.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  4567.                                 A negative value means to flush immediately after each write to the client.
  4568.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  4569.                                 for such responses, writes are flushed to the client immediately.
  4570.                                 Default: 100ms
  4571.                               type: string
  4572.                           type: object
  4573.                         scheme:
  4574.                           description: |-
  4575.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  4576.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  4577.                           type: string
  4578.                         serversTransport:
  4579.                           description: |-
  4580.                             ServersTransport defines the name of ServersTransport resource to use.
  4581.                             It allows to configure the transport between Traefik and your servers.
  4582.                             Can only be used on a Kubernetes Service.
  4583.                           type: string
  4584.                         sticky:
  4585.                           description: |-
  4586.                             Sticky defines the sticky sessions configuration.
  4587.                             More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  4588.                           properties:
  4589.                             cookie:
  4590.                               description: Cookie defines the sticky cookie configuration.
  4591.                               properties:
  4592.                                 httpOnly:
  4593.                                   description: HTTPOnly defines whether the cookie
  4594.                                     can be accessed by client-side APIs, such as JavaScript.
  4595.                                   type: boolean
  4596.                                 name:
  4597.                                   description: Name defines the Cookie name.
  4598.                                   type: string
  4599.                                 sameSite:
  4600.                                   description: |-
  4601.                                     SameSite defines the same site policy.
  4602.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  4603.                                   type: string
  4604.                                 secure:
  4605.                                   description: Secure defines whether the cookie can
  4606.                                     only be transmitted over an encrypted connection
  4607.                                     (i.e. HTTPS).
  4608.                                   type: boolean
  4609.                               type: object
  4610.                           type: object
  4611.                         strategy:
  4612.                           description: |-
  4613.                             Strategy defines the load balancing strategy between the servers.
  4614.                             RoundRobin is the only supported value at the moment.
  4615.                           type: string
  4616.                         weight:
  4617.                           description: |-
  4618.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  4619.                             (and to be precise, one that embeds a Weighted Round Robin).
  4620.                           type: integer
  4621.                       required:
  4622.                       - name
  4623.                       type: object
  4624.                     type: array
  4625.                   name:
  4626.                     description: |-
  4627.                       Name defines the name of the referenced Kubernetes Service or TraefikService.
  4628.                       The differentiation between the two is specified in the Kind field.
  4629.                     type: string
  4630.                   namespace:
  4631.                     description: Namespace defines the namespace of the referenced
  4632.                       Kubernetes Service or TraefikService.
  4633.                     type: string
  4634.                   nativeLB:
  4635.                     description: |-
  4636.                       NativeLB controls, when creating the load-balancer,
  4637.                       whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  4638.                       The Kubernetes Service itself does load-balance to the pods.
  4639.                       By default, NativeLB is false.
  4640.                     type: boolean
  4641.                   passHostHeader:
  4642.                     description: |-
  4643.                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  4644.                       By default, passHostHeader is true.
  4645.                     type: boolean
  4646.                   port:
  4647.                     anyOf:
  4648.                     - type: integer
  4649.                     - type: string
  4650.                     description: |-
  4651.                       Port defines the port of a Kubernetes Service.
  4652.                       This can be a reference to a named port.
  4653.                     x-kubernetes-int-or-string: true
  4654.                   responseForwarding:
  4655.                     description: ResponseForwarding defines how Traefik forwards the
  4656.                       response from the upstream Kubernetes Service to the client.
  4657.                     properties:
  4658.                       flushInterval:
  4659.                         description: |-
  4660.                           FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  4661.                           A negative value means to flush immediately after each write to the client.
  4662.                           This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  4663.                           for such responses, writes are flushed to the client immediately.
  4664.                           Default: 100ms
  4665.                         type: string
  4666.                     type: object
  4667.                   scheme:
  4668.                     description: |-
  4669.                       Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  4670.                       It defaults to https when Kubernetes Service port is 443, http otherwise.
  4671.                     type: string
  4672.                   serversTransport:
  4673.                     description: |-
  4674.                       ServersTransport defines the name of ServersTransport resource to use.
  4675.                       It allows to configure the transport between Traefik and your servers.
  4676.                       Can only be used on a Kubernetes Service.
  4677.                     type: string
  4678.                   sticky:
  4679.                     description: |-
  4680.                       Sticky defines the sticky sessions configuration.
  4681.                       More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  4682.                     properties:
  4683.                       cookie:
  4684.                         description: Cookie defines the sticky cookie configuration.
  4685.                         properties:
  4686.                           httpOnly:
  4687.                             description: HTTPOnly defines whether the cookie can be
  4688.                               accessed by client-side APIs, such as JavaScript.
  4689.                             type: boolean
  4690.                           name:
  4691.                             description: Name defines the Cookie name.
  4692.                             type: string
  4693.                           sameSite:
  4694.                             description: |-
  4695.                               SameSite defines the same site policy.
  4696.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  4697.                             type: string
  4698.                           secure:
  4699.                             description: Secure defines whether the cookie can only
  4700.                               be transmitted over an encrypted connection (i.e. HTTPS).
  4701.                             type: boolean
  4702.                         type: object
  4703.                     type: object
  4704.                   strategy:
  4705.                     description: |-
  4706.                       Strategy defines the load balancing strategy between the servers.
  4707.                       RoundRobin is the only supported value at the moment.
  4708.                     type: string
  4709.                   weight:
  4710.                     description: |-
  4711.                       Weight defines the weight and should only be specified when Name references a TraefikService object
  4712.                       (and to be precise, one that embeds a Weighted Round Robin).
  4713.                     type: integer
  4714.                 required:
  4715.                 - name
  4716.                 type: object
  4717.               weighted:
  4718.                 description: Weighted defines the Weighted Round Robin configuration.
  4719.                 properties:
  4720.                   services:
  4721.                     description: Services defines the list of Kubernetes Service and/or
  4722.                       TraefikService to load-balance, with weight.
  4723.                     items:
  4724.                       description: Service defines an upstream HTTP service to proxy
  4725.                         traffic to.
  4726.                       properties:
  4727.                         kind:
  4728.                           description: Kind defines the kind of the Service.
  4729.                           enum:
  4730.                           - Service
  4731.                           - TraefikService
  4732.                           type: string
  4733.                         name:
  4734.                           description: |-
  4735.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  4736.                             The differentiation between the two is specified in the Kind field.
  4737.                           type: string
  4738.                         namespace:
  4739.                           description: Namespace defines the namespace of the referenced
  4740.                             Kubernetes Service or TraefikService.
  4741.                           type: string
  4742.                         nativeLB:
  4743.                           description: |-
  4744.                             NativeLB controls, when creating the load-balancer,
  4745.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  4746.                             The Kubernetes Service itself does load-balance to the pods.
  4747.                             By default, NativeLB is false.
  4748.                           type: boolean
  4749.                         passHostHeader:
  4750.                           description: |-
  4751.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  4752.                             By default, passHostHeader is true.
  4753.                           type: boolean
  4754.                         port:
  4755.                           anyOf:
  4756.                           - type: integer
  4757.                           - type: string
  4758.                           description: |-
  4759.                             Port defines the port of a Kubernetes Service.
  4760.                             This can be a reference to a named port.
  4761.                           x-kubernetes-int-or-string: true
  4762.                         responseForwarding:
  4763.                           description: ResponseForwarding defines how Traefik forwards
  4764.                             the response from the upstream Kubernetes Service to the
  4765.                             client.
  4766.                           properties:
  4767.                             flushInterval:
  4768.                               description: |-
  4769.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  4770.                                 A negative value means to flush immediately after each write to the client.
  4771.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  4772.                                 for such responses, writes are flushed to the client immediately.
  4773.                                 Default: 100ms
  4774.                               type: string
  4775.                           type: object
  4776.                         scheme:
  4777.                           description: |-
  4778.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  4779.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  4780.                           type: string
  4781.                         serversTransport:
  4782.                           description: |-
  4783.                             ServersTransport defines the name of ServersTransport resource to use.
  4784.                             It allows to configure the transport between Traefik and your servers.
  4785.                             Can only be used on a Kubernetes Service.
  4786.                           type: string
  4787.                         sticky:
  4788.                           description: |-
  4789.                             Sticky defines the sticky sessions configuration.
  4790.                             More info: https://doc.traefik.io/traefik/v2.11/routing/services/#sticky-sessions
  4791.                           properties:
  4792.                             cookie:
  4793.                               description: Cookie defines the sticky cookie configuration.
  4794.                               properties:
  4795.                                 httpOnly:
  4796.                                   description: HTTPOnly defines whether the cookie
  4797.                                     can be accessed by client-side APIs, such as JavaScript.
  4798.                                   type: boolean
  4799.                                 name:
  4800.                                   description: Name defines the Cookie name.
  4801.                                   type: string
  4802.                                 sameSite:
  4803.                                   description: |-
  4804.                                     SameSite defines the same site policy.
  4805.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  4806.                                   type: string
  4807.                                 secure:
  4808.                                   description: Secure defines whether the cookie can
  4809.                                     only be transmitted over an encrypted connection
  4810.                                     (i.e. HTTPS).
  4811.                                   type: boolean
  4812.                               type: object
  4813.                           type: object
  4814.                         strategy:
  4815.                           description: |-
  4816.                             Strategy defines the load balancing strategy between the servers.
  4817.                             RoundRobin is the only supported value at the moment.
  4818.                           type: string
  4819.                         weight:
  4820.                           description: |-
  4821.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  4822.                             (and to be precise, one that embeds a Weighted Round Robin).
  4823.                           type: integer
  4824.                       required:
  4825.                       - name
  4826.                       type: object
  4827.                     type: array
  4828.                   sticky:
  4829.                     description: |-
  4830.                       Sticky defines whether sticky sessions are enabled.
  4831.                       More info: https://doc.traefik.io/traefik/v2.11/routing/providers/kubernetes-crd/#stickiness-and-load-balancing
  4832.                     properties:
  4833.                       cookie:
  4834.                         description: Cookie defines the sticky cookie configuration.
  4835.                         properties:
  4836.                           httpOnly:
  4837.                             description: HTTPOnly defines whether the cookie can be
  4838.                               accessed by client-side APIs, such as JavaScript.
  4839.                             type: boolean
  4840.                           name:
  4841.                             description: Name defines the Cookie name.
  4842.                             type: string
  4843.                           sameSite:
  4844.                             description: |-
  4845.                               SameSite defines the same site policy.
  4846.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  4847.                             type: string
  4848.                           secure:
  4849.                             description: Secure defines whether the cookie can only
  4850.                               be transmitted over an encrypted connection (i.e. HTTPS).
  4851.                             type: boolean
  4852.                         type: object
  4853.                     type: object
  4854.                 type: object
  4855.             type: object
  4856.         required:
  4857.         - metadata
  4858.         - spec
  4859.         type: object
  4860.     served: true
  4861.     storage: true

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.io
      - traefik.containo.us
    resources:
      - middlewares
      - middlewaretcps
      - ingressroutes
      - traefikservices
      - ingressroutetcps
      - ingressrouteudps
      - tlsoptions
      - tlsstores
      - serverstransports
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default

Traefik

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v2.11
          args:
            - --log.level=DEBUG
            - --api
            - --api.insecure
            - --entrypoints.web.address=:80
            - --entrypoints.tcpep.address=:8000
            - --entrypoints.udpep.address=:9000/udp
            - --providers.kubernetescrd
          ports:
            - name: web
              containerPort: 80
            - name: admin
              containerPort: 8080
            - name: tcpep
              containerPort: 8000
            - name: udpep
              containerPort: 9000

---
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: TCP
      port: 80
      name: web
      targetPort: 80
    - protocol: TCP
      port: 8080
      name: admin
      targetPort: 8080
    - protocol: TCP
      port: 8000
      name: tcpep
      targetPort: 8000

---
apiVersion: v1
kind: Service
metadata:
  name: traefikudp
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: UDP
      port: 9000
      name: udpep
      targetPort: 9000

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: myingressroute
  namespace: default

spec:
  entryPoints:
    - web

  routes:
  - match: Host(`foo`) && PathPrefix(`/bar`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroute.tcp
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressroute.udp
  namespace: default

spec:
  entryPoints:
    - udpep
  routes:
  - services:
      - name: whoamiudp
        port: 8080

Whoami

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  namespace: default
  labels:
    app: traefiklabs
    name: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoami
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: whoami

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamitcp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamitcp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamitcp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamitcp
    spec:
      containers:
        - name: whoamitcp
          image: traefik/whoamitcp
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamitcp
  namespace: default

spec:
  ports:
    - protocol: TCP
      port: 8080
  selector:
    app: traefiklabs
    task: whoamitcp

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamiudp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamiudp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: traefik/whoamiudp:latest
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
  namespace: default

spec:
  ports:
    - port: 8080
  selector:
    app: traefiklabs
    task: whoamiudp

Routing Configuration

Custom Resource Definition (CRD)

  • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
  • Validate that the prerequisites are fulfilled before using the Traefik custom resources.
  • Traefik CRDs are building blocks that you can assemble according to your needs.

You can find an excerpt of the available custom resources in the table below:

KindPurposeConcept Behind
IngressRouteHTTP RoutingHTTP router
MiddlewareTweaks the HTTP requests before they are sent to your serviceHTTP Middlewares
TraefikServiceAbstraction for HTTP loadbalancing/mirroringHTTP service
IngressRouteTCPTCP RoutingTCP router
MiddlewareTCPTweaks the TCP requests before they are sent to your serviceTCP Middlewares
IngressRouteUDPUDP RoutingUDP router
TLSOptionsAllows to configure some parameters of the TLS connectionTLSOptions
TLSStoresAllows to configure the default TLS storeTLSStores
ServersTransportAllows to configure the transport between Traefik and the backendsServersTransport

Kind: IngressRoute

IngressRoute is the CRD implementation of a Traefik HTTP router.

Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

IngressRoute Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: foo
  namespace: bar
spec:
  entryPoints:                      # [1]
    - foo
  routes:                           # [2]
  - kind: Rule
    match: Host(`test.example.com`) # [3]
    priority: 10                    # [4]
    middlewares:                    # [5]
    - name: middleware1             # [6]
      namespace: default            # [7]
    services:                       # [8]
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80                      # [9]
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      serversTransport: transport   # [10]
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
          sameSite: none
      strategy: RoundRobin
      weight: 10
      nativeLB: true                # [11]
  tls:                              # [12]
    secretName: supersecret         # [13]
    options:                        # [14]
      name: opt                     # [15]
      namespace: default            # [16]
    certResolver: foo               # [17]
    domains:                        # [18]
    - main: example.net             # [19]
      sans:                         # [20]
      - a.example.net
      - b.example.net
RefAttributePurpose
[1]entryPointsList of entry points names
[2]routesList of routes
[3]routes[n].matchDefines the rule corresponding to an underlying router.
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]routes[n].middlewaresList of reference to Middleware
[6]middlewares[n].nameDefines the Middleware name
[7]middlewares[n].namespaceDefines the Middleware namespace
[8]routes[n].servicesList of any combination of TraefikService and reference to a Kubernetes service (See below for ExternalName Service setup)
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].serversTransportDefines the reference to a ServersTransport. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[11]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[12]tlsDefines TLS certificate configuration
[13]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[14]tls.optionsDefines the reference to a TLSOption
[15]options.nameDefines the TLSOption name
[16]options.namespaceDefines the TLSOption namespace
[17]tls.certResolverDefines the reference to a CertResolver
[18]tls.domainsList of domains
[19]domains[n].mainDefines the main domain name
[20]domains[n].sansList of SANs (alternative domains)

Declaring an IngressRoute

IngressRoute

# All resources definition must be declared
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test-name
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - kind: Rule
    match: Host(`test.example.com`)
    middlewares:
    - name: middleware1
      namespace: default
    priority: 10
    services:
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
      strategy: RoundRobin
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret

Middlewares

# All resources definition must be declared
# Prefixing with /foo
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: middleware1
  namespace: default
spec:
  addPrefix:
    prefix: /foo

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Configuring Backend Protocol

There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

  • Setting the scheme explicitly (http/https/h2c)
  • Configuring the name of the kubernetes service port to start with https (https)
  • Setting the kubernetes service port to use port 443 (https)

If you do not configure the above, Traefik will assume an http connection.

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRoute service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRoute

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Load Balancing

More information in the dedicated server load balancing section.

Declaring and using Kubernetes Service Load Balancing

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: svc1
      namespace: default
    - name: svc2
      namespace: default

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the service NativeLB option to true. Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set. By default, NativeLB is false.

Example

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: Middleware

Middleware is the CRD implementation of a Traefik middleware.

Register the Middleware kind in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

Declaring and Referencing a Middleware

Middleware

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: foo

spec:
  stripPrefix:
    prefixes:
      - /stripit

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: stripprefix
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available middlewares in the dedicated middlewares section.

Kind: TraefikService

TraefikService is the CRD implementation of a “Traefik Service”.

Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the IngressRoute objects, or recursively in others TraefikService objects.

Disambiguate Traefik and Kubernetes Services

As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

The field kind allows the following values:

TraefikService object allows to use any (valid) combinations of:

Weighted Round Robin

More information in the dedicated Weighted Round Robin service load balancing section.

Declaring and Using Weighted Round Robin

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: svc1
        port: 80
        weight: 1
      - name: wrr2
        kind: TraefikService
        weight: 1
      - name: mirror1
        kind: TraefikService
        weight: 1

---
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr2
  namespace: default

spec:
  weighted:
    services:
      - name: svc2
        port: 80
        weight: 1
      - name: svc3
        port: 80
        weight: 1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2
---
apiVersion: v1
kind: Service
metadata:
  name: svc3
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app3

Mirroring

More information in the dedicated mirroring service section.

Declaring and Using Mirroring

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: mirror1
      namespace: default
      kind: TraefikService

Mirroring k8s Service

# Mirroring from a k8s Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: svc1
    port: 80
    mirrors:
      - name: svc2
        port: 80
        percent: 20
      - name: svc3
        kind: TraefikService
        percent: 20

Mirroring Traefik Service

# Mirroring from a Traefik Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: wrr1
    kind: TraefikService
     mirrors:
       - name: svc2
         port: 80
         percent: 20
       - name: svc3
         kind: TraefikService
         percent: 20

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax (service@provider) should be used to refer to the TraefikService, just as in the middleware case.

Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

Stickiness and load-balancing

As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

Stickiness on two load-balancing levels

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: whoami1
        kind: Service
        port: 80
        weight: 1
        sticky:
          cookie:
            name: lvl2
      - name: whoami2
        kind: Service
        weight: 1
        port: 80
        sticky:
          cookie:
            name: lvl2
    sticky:
      cookie:
        name: lvl1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: whoami1

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami1

---
apiVersion: v1
kind: Service
metadata:
  name: whoami2

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami2

Deployment (to illustrate replicas)

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami1
  labels:
    app: whoami1

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami1
  template:
    metadata:
      labels:
        app: whoami1
    spec:
      containers:
        - name: whoami1
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami2
  labels:
    app: whoami2

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami2
  template:
    metadata:
      labels:
        app: whoami2
    spec:
      containers:
        - name: whoami2
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

Kind: IngressRouteTCP

IngressRouteTCP is the CRD implementation of a Traefik TCP router.

Register the IngressRouteTCP kind in the Kubernetes cluster before creating IngressRouteTCP objects.

IngressRouteTCP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:                  # [1]
    - footcp
  routes:                       # [2]
  - match: HostSNI(`*`)         # [3]
    priority: 10                # [4]
    middlewares:
    - name: middleware1         # [5]
      namespace: default        # [6]
    services:                   # [7]
    - name: foo                 # [8]
      port: 8080                # [9]
      weight: 10                # [10]
      terminationDelay: 400     # [11]
      proxyProtocol:            # [12]
        version: 1              # [13]
      nativeLB: true            # [14]
  tls:                          # [15]
    secretName: supersecret     # [16]
    options:                    # [17]
      name: opt                 # [18]
      namespace: default        # [19]
    certResolver: foo           # [20]
    domains:                    # [21]
    - main: example.net         # [22]
      sans:                     # [23]
      - a.example.net
      - b.example.net
    passthrough: false          # [24]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].matchDefines the rule of the underlying router
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]middlewares[n].nameDefines the MiddlewareTCP name
[6]middlewares[n].namespaceDefines the MiddlewareTCP namespace
[7]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[8]services[n].nameDefines the name of a Kubernetes service
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].weightDefines the weight to apply to the server load balancing
[11]services[n].terminationDelaycorresponds to the deadline that the proxy sets, after one of its connected peers indicates it has closed the writing capability of its connection, to close the reading capability as well, hence fully terminating the connection. It is a duration in milliseconds, defaulting to 100. A negative value means an infinite deadline (i.e. the reading capability is never closed).
[12]services[n].proxyProtocolDefines the PROXY protocol configuration
[13]services[n].proxyProtocol.versionDefines the PROXY protocol version
[14]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[15]tlsDefines TLS certificate configuration
[16]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[17]tls.optionsDefines the reference to a TLSOption
[18]options.nameDefines the TLSOption name
[19]options.namespaceDefines the TLSOption namespace
[20]tls.certResolverDefines the reference to a CertResolver
[21]tls.domainsList of domains
[22]domains[n].mainDefines the main domain name
[23]domains[n].sansList of SANs (alternative domains)
[24]tls.passthroughIf true, delegates the TLS termination to the backend

Declaring an IngressRouteTCP

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:
    - footcp
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    priority: 10
    services:
    - name: foo
      port: 8080
      terminationDelay: 400
      weight: 10
    - name: bar
      port: 8081
      terminationDelay: 500
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret
    passthrough: false

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteTCP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

Only on IngressRouteTCP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

On both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the TCP service NativeLB option to true. By default, NativeLB is false.

Examples

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: MiddlewareTCP

MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.

Register the MiddlewareTCP kind in the Kubernetes cluster before creating MiddlewareTCP objects or referencing TCP middlewares in the IngressRouteTCP objects.

Declaring and Referencing a MiddlewareTCP

Middleware

apiVersion: traefik.io/v1alpha1
kind: MiddlewareTCP
metadata:
  name: ipwhitelist
spec:
  ipWhiteList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/whitelist`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: ipwhitelist
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the TCP middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a MiddlewareTCP from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available TCP middlewares in the dedicated middlewares section.

Kind: IngressRouteUDP

IngressRouteUDP is the CRD implementation of a Traefik UDP router.

Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

IngressRouteUDP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:                  # [1]
    - fooudp
  routes:                       # [2]
  - services:                   # [3]
    - name: foo                 # [4]
      port: 8080                # [5]
      weight: 10                # [6]
      nativeLB: true            # [7]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[4]services[n].nameDefines the name of a Kubernetes service
[5]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[6]services[n].weightDefines the weight to apply to the server load balancing
[7]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.

Declaring an IngressRouteUDP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteUDP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteUDP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRouteUDP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the UDP service NativeLB option to true. By default, NativeLB is false.

Example

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: TLSOption

TLSOption is the CRD implementation of a Traefik “TLS Option”.

Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the IngressRoute / IngressRouteTCP objects.

TLSOption Attributes

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption                             # [1]
  namespace: default

spec:
  minVersion: VersionTLS12                      # [2]
  maxVersion: VersionTLS13                      # [3]
  curvePreferences:                             # [4]
    - CurveP521
    - CurveP384
  cipherSuites:                                 # [5]
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:                                   # [6]
    secretNames:                                # [7]
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven     # [8]
  sniStrict: true                               # [9]
  alpnProtocols:                                # [10]
    - foobar
RefAttributePurpose
[1]nameDefines the name of the TLSOption resource. One can use default as name to redefine the default TLSOption.
[2]minVersionDefines the minimum TLS version that is acceptable.
[3]maxVersionDefines the maximum TLS version that is acceptable.
[4]cipherSuiteslist of supported cipher suites for TLS versions up to TLS 1.2.
[5]curvePreferencesList of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
[6]clientAuthdetermines the server’s policy for TLS Client Authentication.
[7]clientAuth.secretNameslist of names of the referenced Kubernetes Secrets (in TLSOption namespace). The secret must contain a certificate under either a tls.ca or a ca.crt key.
[8]clientAuth.clientAuthTypedefines the client authentication type to apply. The available values are: NoClientCert, RequestClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
[9]sniStrictif true, Traefik won’t allow connections from clients connections that do not specify a server_name extension.
[10]alpnProtocolsList of supported application level protocols for the TLS handshake, in order of preference.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a TLSOption

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption
  namespace: default

spec:
  minVersion: VersionTLS12
  sniStrict: true
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:
    secretNames:
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    options: 
      name: mytlsoption
      namespace: default

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: secret-ca1
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-ca2
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

Additionally, when the definition of the TLS option is from another provider, the cross-provider syntax (middlewarename@provider) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

Kind: TLSStore

TLSStore is the CRD implementation of a Traefik “TLS Store”.

Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects.

Default TLS Store

Traefik currently only uses the TLS Store named “default”. This default TLSStore should be in a namespace discoverable by Traefik. Since it is used by default on IngressRoute and IngressRouteTCP objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default TLSStore.

TLSStore Attributes

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  certificates:                            # [1]
    - secretName: foo                      
    - secretName: bar
  defaultCertificate:                      # [2]
    secretName: secret
RefAttributePurpose
[1]certificatesList of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store.
[2]defaultCertificateName of a Kubernetes Secret that holds the default key/certificate pair for the store.

Declaring and referencing a TLSStore

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  defaultCertificate:
    secretName:  supersecret

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls: {}

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Kind: ServersTransport

ServersTransport is the CRD implementation of a ServersTransport.

Default serversTransport

If no serversTransport is specified, the default@internal will be used. The default@internal serversTransport is created from the static configuration.

ServersTransport Attributes

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: foobar               # [1]
  insecureSkipVerify: true         # [2]
  rootCAsSecrets:                  # [3]
    - foobar
    - foobar
  certificatesSecrets:             # [4]
    - foobar
    - foobar
  maxIdleConnsPerHost: 1           # [5]
  forwardingTimeouts:              # [6]
    dialTimeout: 42s               # [7]
    responseHeaderTimeout: 42s     # [8]
    idleConnTimeout: 42s           # [9]
  peerCertURI: foobar              # [10]
  disableHTTP2: true               # [11]
RefAttributePurpose
[1]serverNameServerName used to contact the server.
[2]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[3]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[4]certificatesSecretsCertificates to present to the server for mTLS.
[5]maxIdleConnsPerHostControls the maximum idle (keep-alive) connections to keep per-host. If zero, defaultMaxIdleConnsPerHost is used.
[6]forwardingTimeoutsTimeouts for requests forwarded to the servers.
[7]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[8]responseHeaderTimeoutThe amount of time to wait for a server’s response headers after fully writing the request (including its body, if any). If zero, no timeout exists.
[9]idleConnTimeoutThe maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists.
[10]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[11]disableHTTP2Disables HTTP/2 for connections with servers.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransport

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

ServersTransport reference

By default, the referenced ServersTransport CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransport CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the cross-namespace option must be enabled.

If the ServersTransport CRD is defined in another provider the cross-provider format name@provider should be used.

Further

Also see the full example with Let’s Encrypt.

Using Traefik for Business Applications?

If you are using Traefik in your organization, consider our enterprise-grade solutions:

These tools help businesses discover, deploy, secure, and manage microservices and APIs easily, at scale, across any environment.