Traefik & Kubernetes

The Kubernetes Ingress Controller, The Custom Resource Way.

Configuration Examples

Configuring KubernetesCRD and Deploying/Exposing Services

Resource Definition

  1. # All resources definition must be declared
  3. ---
  4. apiVersion: apiextensions.k8s.io/v1
  5. kind: CustomResourceDefinition
  6. metadata:
  7.   annotations:
  8.     controller-gen.kubebuilder.io/version: v0.6.2
  9.   creationTimestamp: null
  10.   name: ingressroutes.traefik.containo.us
  11. spec:
  12.   group: traefik.containo.us
  13.   names:
  14.     kind: IngressRoute
  15.     listKind: IngressRouteList
  16.     plural: ingressroutes
  17.     singular: ingressroute
  18.   scope: Namespaced
  19.   versions:
  20.   - name: v1alpha1
  21.     schema:
  22.       openAPIV3Schema:
  23.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  24.         properties:
  25.           apiVersion:
  26.             description: 'APIVersion defines the versioned schema of this representation
  27.               of an object. Servers should convert recognized schemas to the latest
  28.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  29.             type: string
  30.           kind:
  31.             description: 'Kind is a string value representing the REST resource this
  32.               object represents. Servers may infer this from the endpoint the client
  33.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  34.             type: string
  35.           metadata:
  36.             type: object
  37.           spec:
  38.             description: IngressRouteSpec defines the desired state of IngressRoute.
  39.             properties:
  40.               entryPoints:
  41.                 description: 'EntryPoints defines the list of entry point names to
  42.                   bind to. Entry points have to be configured in the static configuration.
  43.                   More info: https://doc.traefik.io/traefik/v2.9/routing/entrypoints/
  44.                   Default: all.'
  45.                 items:
  46.                   type: string
  47.                 type: array
  48.               routes:
  49.                 description: Routes defines the list of routes.
  50.                 items:
  51.                   description: Route holds the HTTP route configuration.
  52.                   properties:
  53.                     kind:
  54.                       description: Kind defines the kind of the route. Rule is the
  55.                         only supported kind.
  56.                       enum:
  57.                       - Rule
  58.                       type: string
  59.                     match:
  60.                       description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#rule'
  61.                       type: string
  62.                     middlewares:
  63.                       description: 'Middlewares defines the list of references to
  64.                         Middleware resources. More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-middleware'
  65.                       items:
  66.                         description: MiddlewareRef is a reference to a Middleware
  67.                           resource.
  68.                         properties:
  69.                           name:
  70.                             description: Name defines the name of the referenced Middleware
  71.                               resource.
  72.                             type: string
  73.                           namespace:
  74.                             description: Namespace defines the namespace of the referenced
  75.                               Middleware resource.
  76.                             type: string
  77.                         required:
  78.                         - name
  79.                         type: object
  80.                       type: array
  81.                     priority:
  82.                       description: 'Priority defines the router''s priority. More
  83.                         info: https://doc.traefik.io/traefik/v2.9/routing/routers/#priority'
  84.                       type: integer
  85.                     services:
  86.                       description: Services defines the list of Service. It can contain
  87.                         any combination of TraefikService and/or reference to a Kubernetes
  88.                         Service.
  89.                       items:
  90.                         description: Service defines an upstream HTTP service to proxy
  91.                           traffic to.
  92.                         properties:
  93.                           kind:
  94.                             description: Kind defines the kind of the Service.
  95.                             enum:
  96.                             - Service
  97.                             - TraefikService
  98.                             type: string
  99.                           name:
  100.                             description: Name defines the name of the referenced Kubernetes
  101.                               Service or TraefikService. The differentiation between
  102.                               the two is specified in the Kind field.
  103.                             type: string
  104.                           namespace:
  105.                             description: Namespace defines the namespace of the referenced
  106.                               Kubernetes Service or TraefikService.
  107.                             type: string
  108.                           passHostHeader:
  109.                             description: PassHostHeader defines whether the client
  110.                               Host header is forwarded to the upstream Kubernetes
  111.                               Service. By default, passHostHeader is true.
  112.                             type: boolean
  113.                           port:
  114.                             anyOf:
  115.                             - type: integer
  116.                             - type: string
  117.                             description: Port defines the port of a Kubernetes Service.
  118.                               This can be a reference to a named port.
  119.                             x-kubernetes-int-or-string: true
  120.                           responseForwarding:
  121.                             description: ResponseForwarding defines how Traefik forwards
  122.                               the response from the upstream Kubernetes Service to
  123.                               the client.
  124.                             properties:
  125.                               flushInterval:
  126.                                 description: 'FlushInterval defines the interval,
  127.                                   in milliseconds, in between flushes to the client
  128.                                   while copying the response body. A negative value
  129.                                   means to flush immediately after each write to the
  130.                                   client. This configuration is ignored when ReverseProxy
  131.                                   recognizes a response as a streaming response; for
  132.                                   such responses, writes are flushed to the client
  133.                                   immediately. Default: 100ms'
  134.                                 type: string
  135.                             type: object
  136.                           scheme:
  137.                             description: Scheme defines the scheme to use for the
  138.                               request to the upstream Kubernetes Service. It defaults
  139.                               to https when Kubernetes Service port is 443, http otherwise.
  140.                             type: string
  141.                           serversTransport:
  142.                             description: ServersTransport defines the name of ServersTransport
  143.                               resource to use. It allows to configure the transport
  144.                               between Traefik and your servers. Can only be used on
  145.                               a Kubernetes Service.
  146.                             type: string
  147.                           sticky:
  148.                             description: 'Sticky defines the sticky sessions configuration.
  149.                               More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
  150.                             properties:
  151.                               cookie:
  152.                                 description: Cookie defines the sticky cookie configuration.
  153.                                 properties:
  154.                                   httpOnly:
  155.                                     description: HTTPOnly defines whether the cookie
  156.                                       can be accessed by client-side APIs, such as
  157.                                       JavaScript.
  158.                                     type: boolean
  159.                                   name:
  160.                                     description: Name defines the Cookie name.
  161.                                     type: string
  162.                                   sameSite:
  163.                                     description: 'SameSite defines the same site policy.
  164.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  165.                                     type: string
  166.                                   secure:
  167.                                     description: Secure defines whether the cookie
  168.                                       can only be transmitted over an encrypted connection
  169.                                       (i.e. HTTPS).
  170.                                     type: boolean
  171.                                 type: object
  172.                             type: object
  173.                           strategy:
  174.                             description: Strategy defines the load balancing strategy
  175.                               between the servers. RoundRobin is the only supported
  176.                               value at the moment.
  177.                             type: string
  178.                           weight:
  179.                             description: Weight defines the weight and should only
  180.                               be specified when Name references a TraefikService object
  181.                               (and to be precise, one that embeds a Weighted Round
  182.                               Robin).
  183.                             type: integer
  184.                         required:
  185.                         - name
  186.                         type: object
  187.                       type: array
  188.                   required:
  189.                   - kind
  190.                   - match
  191.                   type: object
  192.                 type: array
  193.               tls:
  194.                 description: 'TLS defines the TLS configuration. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#tls'
  195.                 properties:
  196.                   certResolver:
  197.                     description: 'CertResolver defines the name of the certificate
  198.                       resolver to use. Cert resolvers have to be configured in the
  199.                       static configuration. More info: https://doc.traefik.io/traefik/v2.9/https/acme/#certificate-resolvers'
  200.                     type: string
  201.                   domains:
  202.                     description: 'Domains defines the list of domains that will be
  203.                       used to issue certificates. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#domains'
  204.                     items:
  205.                       description: Domain holds a domain name with SANs.
  206.                       properties:
  207.                         main:
  208.                           description: Main defines the main domain name.
  209.                           type: string
  210.                         sans:
  211.                           description: SANs defines the subject alternative domain
  212.                             names.
  213.                           items:
  214.                             type: string
  215.                           type: array
  216.                       type: object
  217.                     type: array
  218.                   options:
  219.                     description: 'Options defines the reference to a TLSOption, that
  220.                       specifies the parameters of the TLS connection. If not defined,
  221.                       the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options'
  222.                     properties:
  223.                       name:
  224.                         description: 'Name defines the name of the referenced TLSOption.
  225.                           More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsoption'
  226.                         type: string
  227.                       namespace:
  228.                         description: 'Namespace defines the namespace of the referenced
  229.                           TLSOption. More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsoption'
  230.                         type: string
  231.                     required:
  232.                     - name
  233.                     type: object
  234.                   secretName:
  235.                     description: SecretName is the name of the referenced Kubernetes
  236.                       Secret to specify the certificate details.
  237.                     type: string
  238.                   store:
  239.                     description: Store defines the reference to the TLSStore, that
  240.                       will be used to store certificates. Please note that only `default`
  241.                       TLSStore can be used.
  242.                     properties:
  243.                       name:
  244.                         description: 'Name defines the name of the referenced TLSStore.
  245.                           More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsstore'
  246.                         type: string
  247.                       namespace:
  248.                         description: 'Namespace defines the namespace of the referenced
  249.                           TLSStore. More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-tlsstore'
  250.                         type: string
  251.                     required:
  252.                     - name
  253.                     type: object
  254.                 type: object
  255.             required:
  256.             - routes
  257.             type: object
  258.         required:
  259.         - metadata
  260.         - spec
  261.         type: object
  262.     served: true
  263.     storage: true
  264. status:
  265.   acceptedNames:
  266.     kind: ""
  267.     plural: ""
  268.   conditions: []
  269.   storedVersions: []
  271. ---
  272. apiVersion: apiextensions.k8s.io/v1
  273. kind: CustomResourceDefinition
  274. metadata:
  275.   annotations:
  276.     controller-gen.kubebuilder.io/version: v0.6.2
  277.   creationTimestamp: null
  278.   name: ingressroutetcps.traefik.containo.us
  279. spec:
  280.   group: traefik.containo.us
  281.   names:
  282.     kind: IngressRouteTCP
  283.     listKind: IngressRouteTCPList
  284.     plural: ingressroutetcps
  285.     singular: ingressroutetcp
  286.   scope: Namespaced
  287.   versions:
  288.   - name: v1alpha1
  289.     schema:
  290.       openAPIV3Schema:
  291.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  292.         properties:
  293.           apiVersion:
  294.             description: 'APIVersion defines the versioned schema of this representation
  295.               of an object. Servers should convert recognized schemas to the latest
  296.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  297.             type: string
  298.           kind:
  299.             description: 'Kind is a string value representing the REST resource this
  300.               object represents. Servers may infer this from the endpoint the client
  301.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  302.             type: string
  303.           metadata:
  304.             type: object
  305.           spec:
  306.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  307.             properties:
  308.               entryPoints:
  309.                 description: 'EntryPoints defines the list of entry point names to
  310.                   bind to. Entry points have to be configured in the static configuration.
  311.                   More info: https://doc.traefik.io/traefik/v2.9/routing/entrypoints/
  312.                   Default: all.'
  313.                 items:
  314.                   type: string
  315.                 type: array
  316.               routes:
  317.                 description: Routes defines the list of routes.
  318.                 items:
  319.                   description: RouteTCP holds the TCP route configuration.
  320.                   properties:
  321.                     match:
  322.                       description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#rule_1'
  323.                       type: string
  324.                     middlewares:
  325.                       description: Middlewares defines the list of references to MiddlewareTCP
  326.                         resources.
  327.                       items:
  328.                         description: ObjectReference is a generic reference to a Traefik
  329.                           resource.
  330.                         properties:
  331.                           name:
  332.                             description: Name defines the name of the referenced Traefik
  333.                               resource.
  334.                             type: string
  335.                           namespace:
  336.                             description: Namespace defines the namespace of the referenced
  337.                               Traefik resource.
  338.                             type: string
  339.                         required:
  340.                         - name
  341.                         type: object
  342.                       type: array
  343.                     priority:
  344.                       description: 'Priority defines the router''s priority. More
  345.                         info: https://doc.traefik.io/traefik/v2.9/routing/routers/#priority_1'
  346.                       type: integer
  347.                     services:
  348.                       description: Services defines the list of TCP services.
  349.                       items:
  350.                         description: ServiceTCP defines an upstream TCP service to
  351.                           proxy traffic to.
  352.                         properties:
  353.                           name:
  354.                             description: Name defines the name of the referenced Kubernetes
  355.                               Service.
  356.                             type: string
  357.                           namespace:
  358.                             description: Namespace defines the namespace of the referenced
  359.                               Kubernetes Service.
  360.                             type: string
  361.                           port:
  362.                             anyOf:
  363.                             - type: integer
  364.                             - type: string
  365.                             description: Port defines the port of a Kubernetes Service.
  366.                               This can be a reference to a named port.
  367.                             x-kubernetes-int-or-string: true
  368.                           proxyProtocol:
  369.                             description: 'ProxyProtocol defines the PROXY protocol
  370.                               configuration. More info: https://doc.traefik.io/traefik/v2.9/routing/services/#proxy-protocol'
  371.                             properties:
  372.                               version:
  373.                                 description: Version defines the PROXY Protocol version
  374.                                   to use.
  375.                                 type: integer
  376.                             type: object
  377.                           terminationDelay:
  378.                             description: TerminationDelay defines the deadline that
  379.                               the proxy sets, after one of its connected peers indicates
  380.                               it has closed the writing capability of its connection,
  381.                               to close the reading capability as well, hence fully
  382.                               terminating the connection. It is a duration in milliseconds,
  383.                               defaulting to 100. A negative value means an infinite
  384.                               deadline (i.e. the reading capability is never closed).
  385.                             type: integer
  386.                           weight:
  387.                             description: Weight defines the weight used when balancing
  388.                               requests between multiple Kubernetes Service.
  389.                             type: integer
  390.                         required:
  391.                         - name
  392.                         - port
  393.                         type: object
  394.                       type: array
  395.                   required:
  396.                   - match
  397.                   type: object
  398.                 type: array
  399.               tls:
  400.                 description: 'TLS defines the TLS configuration on a layer 4 / TCP
  401.                   Route. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#tls_1'
  402.                 properties:
  403.                   certResolver:
  404.                     description: 'CertResolver defines the name of the certificate
  405.                       resolver to use. Cert resolvers have to be configured in the
  406.                       static configuration. More info: https://doc.traefik.io/traefik/v2.9/https/acme/#certificate-resolvers'
  407.                     type: string
  408.                   domains:
  409.                     description: 'Domains defines the list of domains that will be
  410.                       used to issue certificates. More info: https://doc.traefik.io/traefik/v2.9/routing/routers/#domains'
  411.                     items:
  412.                       description: Domain holds a domain name with SANs.
  413.                       properties:
  414.                         main:
  415.                           description: Main defines the main domain name.
  416.                           type: string
  417.                         sans:
  418.                           description: SANs defines the subject alternative domain
  419.                             names.
  420.                           items:
  421.                             type: string
  422.                           type: array
  423.                       type: object
  424.                     type: array
  425.                   options:
  426.                     description: 'Options defines the reference to a TLSOption, that
  427.                       specifies the parameters of the TLS connection. If not defined,
  428.                       the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options'
  429.                     properties:
  430.                       name:
  431.                         description: Name defines the name of the referenced Traefik
  432.                           resource.
  433.                         type: string
  434.                       namespace:
  435.                         description: Namespace defines the namespace of the referenced
  436.                           Traefik resource.
  437.                         type: string
  438.                     required:
  439.                     - name
  440.                     type: object
  441.                   passthrough:
  442.                     description: Passthrough defines whether a TLS router will terminate
  443.                       the TLS connection.
  444.                     type: boolean
  445.                   secretName:
  446.                     description: SecretName is the name of the referenced Kubernetes
  447.                       Secret to specify the certificate details.
  448.                     type: string
  449.                   store:
  450.                     description: Store defines the reference to the TLSStore, that
  451.                       will be used to store certificates. Please note that only `default`
  452.                       TLSStore can be used.
  453.                     properties:
  454.                       name:
  455.                         description: Name defines the name of the referenced Traefik
  456.                           resource.
  457.                         type: string
  458.                       namespace:
  459.                         description: Namespace defines the namespace of the referenced
  460.                           Traefik resource.
  461.                         type: string
  462.                     required:
  463.                     - name
  464.                     type: object
  465.                 type: object
  466.             required:
  467.             - routes
  468.             type: object
  469.         required:
  470.         - metadata
  471.         - spec
  472.         type: object
  473.     served: true
  474.     storage: true
  475. status:
  476.   acceptedNames:
  477.     kind: ""
  478.     plural: ""
  479.   conditions: []
  480.   storedVersions: []
  482. ---
  483. apiVersion: apiextensions.k8s.io/v1
  484. kind: CustomResourceDefinition
  485. metadata:
  486.   annotations:
  487.     controller-gen.kubebuilder.io/version: v0.6.2
  488.   creationTimestamp: null
  489.   name: ingressrouteudps.traefik.containo.us
  490. spec:
  491.   group: traefik.containo.us
  492.   names:
  493.     kind: IngressRouteUDP
  494.     listKind: IngressRouteUDPList
  495.     plural: ingressrouteudps
  496.     singular: ingressrouteudp
  497.   scope: Namespaced
  498.   versions:
  499.   - name: v1alpha1
  500.     schema:
  501.       openAPIV3Schema:
  502.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  503.         properties:
  504.           apiVersion:
  505.             description: 'APIVersion defines the versioned schema of this representation
  506.               of an object. Servers should convert recognized schemas to the latest
  507.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  508.             type: string
  509.           kind:
  510.             description: 'Kind is a string value representing the REST resource this
  511.               object represents. Servers may infer this from the endpoint the client
  512.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  513.             type: string
  514.           metadata:
  515.             type: object
  516.           spec:
  517.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  518.             properties:
  519.               entryPoints:
  520.                 description: 'EntryPoints defines the list of entry point names to
  521.                   bind to. Entry points have to be configured in the static configuration.
  522.                   More info: https://doc.traefik.io/traefik/v2.9/routing/entrypoints/
  523.                   Default: all.'
  524.                 items:
  525.                   type: string
  526.                 type: array
  527.               routes:
  528.                 description: Routes defines the list of routes.
  529.                 items:
  530.                   description: RouteUDP holds the UDP route configuration.
  531.                   properties:
  532.                     services:
  533.                       description: Services defines the list of UDP services.
  534.                       items:
  535.                         description: ServiceUDP defines an upstream UDP service to
  536.                           proxy traffic to.
  537.                         properties:
  538.                           name:
  539.                             description: Name defines the name of the referenced Kubernetes
  540.                               Service.
  541.                             type: string
  542.                           namespace:
  543.                             description: Namespace defines the namespace of the referenced
  544.                               Kubernetes Service.
  545.                             type: string
  546.                           port:
  547.                             anyOf:
  548.                             - type: integer
  549.                             - type: string
  550.                             description: Port defines the port of a Kubernetes Service.
  551.                               This can be a reference to a named port.
  552.                             x-kubernetes-int-or-string: true
  553.                           weight:
  554.                             description: Weight defines the weight used when balancing
  555.                               requests between multiple Kubernetes Service.
  556.                             type: integer
  557.                         required:
  558.                         - name
  559.                         - port
  560.                         type: object
  561.                       type: array
  562.                   type: object
  563.                 type: array
  564.             required:
  565.             - routes
  566.             type: object
  567.         required:
  568.         - metadata
  569.         - spec
  570.         type: object
  571.     served: true
  572.     storage: true
  573. status:
  574.   acceptedNames:
  575.     kind: ""
  576.     plural: ""
  577.   conditions: []
  578.   storedVersions: []
  580. ---
  581. apiVersion: apiextensions.k8s.io/v1
  582. kind: CustomResourceDefinition
  583. metadata:
  584.   annotations:
  585.     controller-gen.kubebuilder.io/version: v0.6.2
  586.   creationTimestamp: null
  587.   name: middlewares.traefik.containo.us
  588. spec:
  589.   group: traefik.containo.us
  590.   names:
  591.     kind: Middleware
  592.     listKind: MiddlewareList
  593.     plural: middlewares
  594.     singular: middleware
  595.   scope: Namespaced
  596.   versions:
  597.   - name: v1alpha1
  598.     schema:
  599.       openAPIV3Schema:
  600.         description: 'Middleware is the CRD implementation of a Traefik Middleware.
  601.           More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/overview/'
  602.         properties:
  603.           apiVersion:
  604.             description: 'APIVersion defines the versioned schema of this representation
  605.               of an object. Servers should convert recognized schemas to the latest
  606.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  607.             type: string
  608.           kind:
  609.             description: 'Kind is a string value representing the REST resource this
  610.               object represents. Servers may infer this from the endpoint the client
  611.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  612.             type: string
  613.           metadata:
  614.             type: object
  615.           spec:
  616.             description: MiddlewareSpec defines the desired state of a Middleware.
  617.             properties:
  618.               addPrefix:
  619.                 description: 'AddPrefix holds the add prefix middleware configuration.
  620.                   This middleware updates the path of a request before forwarding
  621.                   it. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/addprefix/'
  622.                 properties:
  623.                   prefix:
  624.                     description: Prefix is the string to add before the current path
  625.                       in the requested URL. It should include a leading slash (/).
  626.                     type: string
  627.                 type: object
  628.               basicAuth:
  629.                 description: 'BasicAuth holds the basic auth middleware configuration.
  630.                   This middleware restricts access to your services to known users.
  631.                   More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/basicauth/'
  632.                 properties:
  633.                   headerField:
  634.                     description: 'HeaderField defines a header field to store the
  635.                       authenticated user. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/basicauth/#headerfield'
  636.                     type: string
  637.                   realm:
  638.                     description: 'Realm allows the protected resources on a server
  639.                       to be partitioned into a set of protection spaces, each with
  640.                       its own authentication scheme. Default: traefik.'
  641.                     type: string
  642.                   removeHeader:
  643.                     description: 'RemoveHeader sets the removeHeader option to true
  644.                       to remove the authorization header before forwarding the request
  645.                       to your service. Default: false.'
  646.                     type: boolean
  647.                   secret:
  648.                     description: Secret is the name of the referenced Kubernetes Secret
  649.                       containing user credentials.
  650.                     type: string
  651.                 type: object
  652.               buffering:
  653.                 description: 'Buffering holds the buffering middleware configuration.
  654.                   This middleware retries or limits the size of requests that can
  655.                   be forwarded to backends. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/buffering/#maxrequestbodybytes'
  656.                 properties:
  657.                   maxRequestBodyBytes:
  658.                     description: 'MaxRequestBodyBytes defines the maximum allowed
  659.                       body size for the request (in bytes). If the request exceeds
  660.                       the allowed size, it is not forwarded to the service, and the
  661.                       client gets a 413 (Request Entity Too Large) response. Default:
  662.                       0 (no maximum).'
  663.                     format: int64
  664.                     type: integer
  665.                   maxResponseBodyBytes:
  666.                     description: 'MaxResponseBodyBytes defines the maximum allowed
  667.                       response size from the service (in bytes). If the response exceeds
  668.                       the allowed size, it is not forwarded to the client. The client
  669.                       gets a 500 (Internal Server Error) response instead. Default:
  670.                       0 (no maximum).'
  671.                     format: int64
  672.                     type: integer
  673.                   memRequestBodyBytes:
  674.                     description: 'MemRequestBodyBytes defines the threshold (in bytes)
  675.                       from which the request will be buffered on disk instead of in
  676.                       memory. Default: 1048576 (1Mi).'
  677.                     format: int64
  678.                     type: integer
  679.                   memResponseBodyBytes:
  680.                     description: 'MemResponseBodyBytes defines the threshold (in bytes)
  681.                       from which the response will be buffered on disk instead of
  682.                       in memory. Default: 1048576 (1Mi).'
  683.                     format: int64
  684.                     type: integer
  685.                   retryExpression:
  686.                     description: 'RetryExpression defines the retry conditions. It
  687.                       is a logical combination of functions with operators AND (&&)
  688.                       and OR (||). More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/buffering/#retryexpression'
  689.                     type: string
  690.                 type: object
  691.               chain:
  692.                 description: 'Chain holds the configuration of the chain middleware.
  693.                   This middleware enables to define reusable combinations of other
  694.                   pieces of middleware. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/chain/'
  695.                 properties:
  696.                   middlewares:
  697.                     description: Middlewares is the list of MiddlewareRef which composes
  698.                       the chain.
  699.                     items:
  700.                       description: MiddlewareRef is a reference to a Middleware resource.
  701.                       properties:
  702.                         name:
  703.                           description: Name defines the name of the referenced Middleware
  704.                             resource.
  705.                           type: string
  706.                         namespace:
  707.                           description: Namespace defines the namespace of the referenced
  708.                             Middleware resource.
  709.                           type: string
  710.                       required:
  711.                       - name
  712.                       type: object
  713.                     type: array
  714.                 type: object
  715.               circuitBreaker:
  716.                 description: CircuitBreaker holds the circuit breaker configuration.
  717.                 properties:
  718.                   checkPeriod:
  719.                     anyOf:
  720.                     - type: integer
  721.                     - type: string
  722.                     description: CheckPeriod is the interval between successive checks
  723.                       of the circuit breaker condition (when in standby state).
  724.                     x-kubernetes-int-or-string: true
  725.                   expression:
  726.                     description: Expression is the condition that triggers the tripped
  727.                       state.
  728.                     type: string
  729.                   fallbackDuration:
  730.                     anyOf:
  731.                     - type: integer
  732.                     - type: string
  733.                     description: FallbackDuration is the duration for which the circuit
  734.                       breaker will wait before trying to recover (from a tripped state).
  735.                     x-kubernetes-int-or-string: true
  736.                   recoveryDuration:
  737.                     anyOf:
  738.                     - type: integer
  739.                     - type: string
  740.                     description: RecoveryDuration is the duration for which the circuit
  741.                       breaker will try to recover (as soon as it is in recovering
  742.                       state).
  743.                     x-kubernetes-int-or-string: true
  744.                 type: object
  745.               compress:
  746.                 description: 'Compress holds the compress middleware configuration.
  747.                   This middleware compresses responses before sending them to the
  748.                   client, using gzip compression. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/compress/'
  749.                 properties:
  750.                   excludedContentTypes:
  751.                     description: ExcludedContentTypes defines the list of content
  752.                       types to compare the Content-Type header of the incoming requests
  753.                       and responses before compressing.
  754.                     items:
  755.                       type: string
  756.                     type: array
  757.                   minResponseBodyBytes:
  758.                     description: 'MinResponseBodyBytes defines the minimum amount
  759.                       of bytes a response body must have to be compressed. Default:
  760.                       1024.'
  761.                     type: integer
  762.                 type: object
  763.               contentType:
  764.                 description: ContentType holds the content-type middleware configuration.
  765.                   This middleware exists to enable the correct behavior until at least
  766.                   the default one can be changed in a future version.
  767.                 properties:
  768.                   autoDetect:
  769.                     description: AutoDetect specifies whether to let the `Content-Type`
  770.                       header, if it has not been set by the backend, be automatically
  771.                       set to a value derived from the contents of the response. As
  772.                       a proxy, the default behavior should be to leave the header
  773.                       alone, regardless of what the backend did with it. However,
  774.                       the historic default was to always auto-detect and set the header
  775.                       if it was nil, and it is going to be kept that way in order
  776.                       to support users currently relying on it.
  777.                     type: boolean
  778.                 type: object
  779.               digestAuth:
  780.                 description: 'DigestAuth holds the digest auth middleware configuration.
  781.                   This middleware restricts access to your services to known users.
  782.                   More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/digestauth/'
  783.                 properties:
  784.                   headerField:
  785.                     description: 'HeaderField defines a header field to store the
  786.                       authenticated user. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/basicauth/#headerfield'
  787.                     type: string
  788.                   realm:
  789.                     description: 'Realm allows the protected resources on a server
  790.                       to be partitioned into a set of protection spaces, each with
  791.                       its own authentication scheme. Default: traefik.'
  792.                     type: string
  793.                   removeHeader:
  794.                     description: RemoveHeader defines whether to remove the authorization
  795.                       header before forwarding the request to the backend.
  796.                     type: boolean
  797.                   secret:
  798.                     description: Secret is the name of the referenced Kubernetes Secret
  799.                       containing user credentials.
  800.                     type: string
  801.                 type: object
  802.               errors:
  803.                 description: 'ErrorPage holds the custom error middleware configuration.
  804.                   This middleware returns a custom page in lieu of the default, according
  805.                   to configured ranges of HTTP Status codes. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/errorpages/'
  806.                 properties:
  807.                   query:
  808.                     description: Query defines the URL for the error page (hosted
  809.                       by service). The {status} variable can be used in order to insert
  810.                       the status code in the URL.
  811.                     type: string
  812.                   service:
  813.                     description: 'Service defines the reference to a Kubernetes Service
  814.                       that will serve the error page. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/errorpages/#service'
  815.                     properties:
  816.                       kind:
  817.                         description: Kind defines the kind of the Service.
  818.                         enum:
  819.                         - Service
  820.                         - TraefikService
  821.                         type: string
  822.                       name:
  823.                         description: Name defines the name of the referenced Kubernetes
  824.                           Service or TraefikService. The differentiation between the
  825.                           two is specified in the Kind field.
  826.                         type: string
  827.                       namespace:
  828.                         description: Namespace defines the namespace of the referenced
  829.                           Kubernetes Service or TraefikService.
  830.                         type: string
  831.                       passHostHeader:
  832.                         description: PassHostHeader defines whether the client Host
  833.                           header is forwarded to the upstream Kubernetes Service.
  834.                           By default, passHostHeader is true.
  835.                         type: boolean
  836.                       port:
  837.                         anyOf:
  838.                         - type: integer
  839.                         - type: string
  840.                         description: Port defines the port of a Kubernetes Service.
  841.                           This can be a reference to a named port.
  842.                         x-kubernetes-int-or-string: true
  843.                       responseForwarding:
  844.                         description: ResponseForwarding defines how Traefik forwards
  845.                           the response from the upstream Kubernetes Service to the
  846.                           client.
  847.                         properties:
  848.                           flushInterval:
  849.                             description: 'FlushInterval defines the interval, in milliseconds,
  850.                               in between flushes to the client while copying the response
  851.                               body. A negative value means to flush immediately after
  852.                               each write to the client. This configuration is ignored
  853.                               when ReverseProxy recognizes a response as a streaming
  854.                               response; for such responses, writes are flushed to
  855.                               the client immediately. Default: 100ms'
  856.                             type: string
  857.                         type: object
  858.                       scheme:
  859.                         description: Scheme defines the scheme to use for the request
  860.                           to the upstream Kubernetes Service. It defaults to https
  861.                           when Kubernetes Service port is 443, http otherwise.
  862.                         type: string
  863.                       serversTransport:
  864.                         description: ServersTransport defines the name of ServersTransport
  865.                           resource to use. It allows to configure the transport between
  866.                           Traefik and your servers. Can only be used on a Kubernetes
  867.                           Service.
  868.                         type: string
  869.                       sticky:
  870.                         description: 'Sticky defines the sticky sessions configuration.
  871.                           More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
  872.                         properties:
  873.                           cookie:
  874.                             description: Cookie defines the sticky cookie configuration.
  875.                             properties:
  876.                               httpOnly:
  877.                                 description: HTTPOnly defines whether the cookie can
  878.                                   be accessed by client-side APIs, such as JavaScript.
  879.                                 type: boolean
  880.                               name:
  881.                                 description: Name defines the Cookie name.
  882.                                 type: string
  883.                               sameSite:
  884.                                 description: 'SameSite defines the same site policy.
  885.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  886.                                 type: string
  887.                               secure:
  888.                                 description: Secure defines whether the cookie can
  889.                                   only be transmitted over an encrypted connection
  890.                                   (i.e. HTTPS).
  891.                                 type: boolean
  892.                             type: object
  893.                         type: object
  894.                       strategy:
  895.                         description: Strategy defines the load balancing strategy
  896.                           between the servers. RoundRobin is the only supported value
  897.                           at the moment.
  898.                         type: string
  899.                       weight:
  900.                         description: Weight defines the weight and should only be
  901.                           specified when Name references a TraefikService object (and
  902.                           to be precise, one that embeds a Weighted Round Robin).
  903.                         type: integer
  904.                     required:
  905.                     - name
  906.                     type: object
  907.                   status:
  908.                     description: Status defines which status or range of statuses
  909.                       should result in an error page. It can be either a status code
  910.                       as a number (500), as multiple comma-separated numbers (500,502),
  911.                       as ranges by separating two codes with a dash (500-599), or
  912.                       a combination of the two (404,418,500-599).
  913.                     items:
  914.                       type: string
  915.                     type: array
  916.                 type: object
  917.               forwardAuth:
  918.                 description: 'ForwardAuth holds the forward auth middleware configuration.
  919.                   This middleware delegates the request authentication to a Service.
  920.                   More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/forwardauth/'
  921.                 properties:
  922.                   address:
  923.                     description: Address defines the authentication server address.
  924.                     type: string
  925.                   authRequestHeaders:
  926.                     description: AuthRequestHeaders defines the list of the headers
  927.                       to copy from the request to the authentication server. If not
  928.                       set or empty then all request headers are passed.
  929.                     items:
  930.                       type: string
  931.                     type: array
  932.                   authResponseHeaders:
  933.                     description: AuthResponseHeaders defines the list of headers to
  934.                       copy from the authentication server response and set on forwarded
  935.                       request, replacing any existing conflicting headers.
  936.                     items:
  937.                       type: string
  938.                     type: array
  939.                   authResponseHeadersRegex:
  940.                     description: 'AuthResponseHeadersRegex defines the regex to match
  941.                       headers to copy from the authentication server response and
  942.                       set on forwarded request, after stripping all headers that match
  943.                       the regex. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/forwardauth/#authresponseheadersregex'
  944.                     type: string
  945.                   tls:
  946.                     description: TLS defines the configuration used to secure the
  947.                       connection to the authentication server.
  948.                     properties:
  949.                       caOptional:
  950.                         type: boolean
  951.                       caSecret:
  952.                         description: CASecret is the name of the referenced Kubernetes
  953.                           Secret containing the CA to validate the server certificate.
  954.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  955.                         type: string
  956.                       certSecret:
  957.                         description: CertSecret is the name of the referenced Kubernetes
  958.                           Secret containing the client certificate. The client certificate
  959.                           is extracted from the keys `tls.crt` and `tls.key`.
  960.                         type: string
  961.                       insecureSkipVerify:
  962.                         description: InsecureSkipVerify defines whether the server
  963.                           certificates should be validated.
  964.                         type: boolean
  965.                     type: object
  966.                   trustForwardHeader:
  967.                     description: 'TrustForwardHeader defines whether to trust (ie:
  968.                       forward) all X-Forwarded-* headers.'
  969.                     type: boolean
  970.                 type: object
  971.               headers:
  972.                 description: 'Headers holds the headers middleware configuration.
  973.                   This middleware manages the requests and responses headers. More
  974.                   info: https://doc.traefik.io/traefik/v2.9/middlewares/http/headers/#customrequestheaders'
  975.                 properties:
  976.                   accessControlAllowCredentials:
  977.                     description: AccessControlAllowCredentials defines whether the
  978.                       request can include user credentials.
  979.                     type: boolean
  980.                   accessControlAllowHeaders:
  981.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  982.                       values sent in preflight response.
  983.                     items:
  984.                       type: string
  985.                     type: array
  986.                   accessControlAllowMethods:
  987.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  988.                       values sent in preflight response.
  989.                     items:
  990.                       type: string
  991.                     type: array
  992.                   accessControlAllowOriginList:
  993.                     description: AccessControlAllowOriginList is a list of allowable
  994.                       origins. Can also be a wildcard origin "*".
  995.                     items:
  996.                       type: string
  997.                     type: array
  998.                   accessControlAllowOriginListRegex:
  999.                     description: AccessControlAllowOriginListRegex is a list of allowable
  1000.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  1001.                     items:
  1002.                       type: string
  1003.                     type: array
  1004.                   accessControlExposeHeaders:
  1005.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  1006.                       values sent in preflight response.
  1007.                     items:
  1008.                       type: string
  1009.                     type: array
  1010.                   accessControlMaxAge:
  1011.                     description: AccessControlMaxAge defines the time that a preflight
  1012.                       request may be cached.
  1013.                     format: int64
  1014.                     type: integer
  1015.                   addVaryHeader:
  1016.                     description: AddVaryHeader defines whether the Vary header is
  1017.                       automatically added/updated when the AccessControlAllowOriginList
  1018.                       is set.
  1019.                     type: boolean
  1020.                   allowedHosts:
  1021.                     description: AllowedHosts defines the fully qualified list of
  1022.                       allowed domain names.
  1023.                     items:
  1024.                       type: string
  1025.                     type: array
  1026.                   browserXssFilter:
  1027.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  1028.                       header with the value 1; mode=block.
  1029.                     type: boolean
  1030.                   contentSecurityPolicy:
  1031.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  1032.                       header value.
  1033.                     type: string
  1034.                   contentTypeNosniff:
  1035.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  1036.                       header with the nosniff value.
  1037.                     type: boolean
  1038.                   customBrowserXSSValue:
  1039.                     description: CustomBrowserXSSValue defines the X-XSS-Protection
  1040.                       header value. This overrides the BrowserXssFilter option.
  1041.                     type: string
  1042.                   customFrameOptionsValue:
  1043.                     description: CustomFrameOptionsValue defines the X-Frame-Options
  1044.                       header value. This overrides the FrameDeny option.
  1045.                     type: string
  1046.                   customRequestHeaders:
  1047.                     additionalProperties:
  1048.                       type: string
  1049.                     description: CustomRequestHeaders defines the header names and
  1050.                       values to apply to the request.
  1051.                     type: object
  1052.                   customResponseHeaders:
  1053.                     additionalProperties:
  1054.                       type: string
  1055.                     description: CustomResponseHeaders defines the header names and
  1056.                       values to apply to the response.
  1057.                     type: object
  1058.                   featurePolicy:
  1059.                     description: 'Deprecated: use PermissionsPolicy instead.'
  1060.                     type: string
  1061.                   forceSTSHeader:
  1062.                     description: ForceSTSHeader defines whether to add the STS header
  1063.                       even when the connection is HTTP.
  1064.                     type: boolean
  1065.                   frameDeny:
  1066.                     description: FrameDeny defines whether to add the X-Frame-Options
  1067.                       header with the DENY value.
  1068.                     type: boolean
  1069.                   hostsProxyHeaders:
  1070.                     description: HostsProxyHeaders defines the header keys that may
  1071.                       hold a proxied hostname value for the request.
  1072.                     items:
  1073.                       type: string
  1074.                     type: array
  1075.                   isDevelopment:
  1076.                     description: IsDevelopment defines whether to mitigate the unwanted
  1077.                       effects of the AllowedHosts, SSL, and STS options when developing.
  1078.                       Usually testing takes place using HTTP, not HTTPS, and on localhost,
  1079.                       not your production domain. If you would like your development
  1080.                       environment to mimic production with complete Host blocking,
  1081.                       SSL redirects, and STS headers, leave this as false.
  1082.                     type: boolean
  1083.                   permissionsPolicy:
  1084.                     description: PermissionsPolicy defines the Permissions-Policy
  1085.                       header value. This allows sites to control browser features.
  1086.                     type: string
  1087.                   publicKey:
  1088.                     description: PublicKey is the public key that implements HPKP
  1089.                       to prevent MITM attacks with forged certificates.
  1090.                     type: string
  1091.                   referrerPolicy:
  1092.                     description: ReferrerPolicy defines the Referrer-Policy header
  1093.                       value. This allows sites to control whether browsers forward
  1094.                       the Referer header to other sites.
  1095.                     type: string
  1096.                   sslForceHost:
  1097.                     description: 'Deprecated: use RedirectRegex instead.'
  1098.                     type: boolean
  1099.                   sslHost:
  1100.                     description: 'Deprecated: use RedirectRegex instead.'
  1101.                     type: string
  1102.                   sslProxyHeaders:
  1103.                     additionalProperties:
  1104.                       type: string
  1105.                     description: 'SSLProxyHeaders defines the header keys with associated
  1106.                       values that would indicate a valid HTTPS request. It can be
  1107.                       useful when using other proxies (example: "X-Forwarded-Proto":
  1108.                       "https").'
  1109.                     type: object
  1110.                   sslRedirect:
  1111.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  1112.                       instead.'
  1113.                     type: boolean
  1114.                   sslTemporaryRedirect:
  1115.                     description: 'Deprecated: use EntryPoint redirection or RedirectScheme
  1116.                       instead.'
  1117.                     type: boolean
  1118.                   stsIncludeSubdomains:
  1119.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  1120.                       directive is appended to the Strict-Transport-Security header.
  1121.                     type: boolean
  1122.                   stsPreload:
  1123.                     description: STSPreload defines whether the preload flag is appended
  1124.                       to the Strict-Transport-Security header.
  1125.                     type: boolean
  1126.                   stsSeconds:
  1127.                     description: STSSeconds defines the max-age of the Strict-Transport-Security
  1128.                       header. If set to 0, the header is not set.
  1129.                     format: int64
  1130.                     type: integer
  1131.                 type: object
  1132.               inFlightReq:
  1133.                 description: 'InFlightReq holds the in-flight request middleware configuration.
  1134.                   This middleware limits the number of requests being processed and
  1135.                   served concurrently. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/inflightreq/'
  1136.                 properties:
  1137.                   amount:
  1138.                     description: Amount defines the maximum amount of allowed simultaneous
  1139.                       in-flight request. The middleware responds with HTTP 429 Too
  1140.                       Many Requests if there are already amount requests in progress
  1141.                       (based on the same sourceCriterion strategy).
  1142.                     format: int64
  1143.                     type: integer
  1144.                   sourceCriterion:
  1145.                     description: 'SourceCriterion defines what criterion is used to
  1146.                       group requests as originating from a common source. If several
  1147.                       strategies are defined at the same time, an error will be raised.
  1148.                       If none are set, the default is to use the requestHost. More
  1149.                       info: https://doc.traefik.io/traefik/v2.9/middlewares/http/inflightreq/#sourcecriterion'
  1150.                     properties:
  1151.                       ipStrategy:
  1152.                         description: 'IPStrategy holds the IP strategy configuration
  1153.                           used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/#ipstrategy'
  1154.                         properties:
  1155.                           depth:
  1156.                             description: Depth tells Traefik to use the X-Forwarded-For
  1157.                               header and take the IP located at the depth position
  1158.                               (starting from the right).
  1159.                             type: integer
  1160.                           excludedIPs:
  1161.                             description: ExcludedIPs configures Traefik to scan the
  1162.                               X-Forwarded-For header and select the first IP not in
  1163.                               the list.
  1164.                             items:
  1165.                               type: string
  1166.                             type: array
  1167.                         type: object
  1168.                       requestHeaderName:
  1169.                         description: RequestHeaderName defines the name of the header
  1170.                           used to group incoming requests.
  1171.                         type: string
  1172.                       requestHost:
  1173.                         description: RequestHost defines whether to consider the request
  1174.                           Host as the source.
  1175.                         type: boolean
  1176.                     type: object
  1177.                 type: object
  1178.               ipWhiteList:
  1179.                 description: 'IPWhiteList holds the IP whitelist middleware configuration.
  1180.                   This middleware accepts / refuses requests based on the client IP.
  1181.                   More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/'
  1182.                 properties:
  1183.                   ipStrategy:
  1184.                     description: 'IPStrategy holds the IP strategy configuration used
  1185.                       by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/#ipstrategy'
  1186.                     properties:
  1187.                       depth:
  1188.                         description: Depth tells Traefik to use the X-Forwarded-For
  1189.                           header and take the IP located at the depth position (starting
  1190.                           from the right).
  1191.                         type: integer
  1192.                       excludedIPs:
  1193.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1194.                           header and select the first IP not in the list.
  1195.                         items:
  1196.                           type: string
  1197.                         type: array
  1198.                     type: object
  1199.                   sourceRange:
  1200.                     description: SourceRange defines the set of allowed IPs (or ranges
  1201.                       of allowed IPs by using CIDR notation).
  1202.                     items:
  1203.                       type: string
  1204.                     type: array
  1205.                 type: object
  1206.               passTLSClientCert:
  1207.                 description: 'PassTLSClientCert holds the pass TLS client cert middleware
  1208.                   configuration. This middleware adds the selected data from the passed
  1209.                   client TLS certificate to a header. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/passtlsclientcert/'
  1210.                 properties:
  1211.                   info:
  1212.                     description: Info selects the specific client certificate details
  1213.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1214.                     properties:
  1215.                       issuer:
  1216.                         description: Issuer defines the client certificate issuer
  1217.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1218.                         properties:
  1219.                           commonName:
  1220.                             description: CommonName defines whether to add the organizationalUnit
  1221.                               information into the issuer.
  1222.                             type: boolean
  1223.                           country:
  1224.                             description: Country defines whether to add the country
  1225.                               information into the issuer.
  1226.                             type: boolean
  1227.                           domainComponent:
  1228.                             description: DomainComponent defines whether to add the
  1229.                               domainComponent information into the issuer.
  1230.                             type: boolean
  1231.                           locality:
  1232.                             description: Locality defines whether to add the locality
  1233.                               information into the issuer.
  1234.                             type: boolean
  1235.                           organization:
  1236.                             description: Organization defines whether to add the organization
  1237.                               information into the issuer.
  1238.                             type: boolean
  1239.                           province:
  1240.                             description: Province defines whether to add the province
  1241.                               information into the issuer.
  1242.                             type: boolean
  1243.                           serialNumber:
  1244.                             description: SerialNumber defines whether to add the serialNumber
  1245.                               information into the issuer.
  1246.                             type: boolean
  1247.                         type: object
  1248.                       notAfter:
  1249.                         description: NotAfter defines whether to add the Not After
  1250.                           information from the Validity part.
  1251.                         type: boolean
  1252.                       notBefore:
  1253.                         description: NotBefore defines whether to add the Not Before
  1254.                           information from the Validity part.
  1255.                         type: boolean
  1256.                       sans:
  1257.                         description: Sans defines whether to add the Subject Alternative
  1258.                           Name information from the Subject Alternative Name part.
  1259.                         type: boolean
  1260.                       serialNumber:
  1261.                         description: SerialNumber defines whether to add the client
  1262.                           serialNumber information.
  1263.                         type: boolean
  1264.                       subject:
  1265.                         description: Subject defines the client certificate subject
  1266.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1267.                         properties:
  1268.                           commonName:
  1269.                             description: CommonName defines whether to add the organizationalUnit
  1270.                               information into the subject.
  1271.                             type: boolean
  1272.                           country:
  1273.                             description: Country defines whether to add the country
  1274.                               information into the subject.
  1275.                             type: boolean
  1276.                           domainComponent:
  1277.                             description: DomainComponent defines whether to add the
  1278.                               domainComponent information into the subject.
  1279.                             type: boolean
  1280.                           locality:
  1281.                             description: Locality defines whether to add the locality
  1282.                               information into the subject.
  1283.                             type: boolean
  1284.                           organization:
  1285.                             description: Organization defines whether to add the organization
  1286.                               information into the subject.
  1287.                             type: boolean
  1288.                           organizationalUnit:
  1289.                             description: OrganizationalUnit defines whether to add
  1290.                               the organizationalUnit information into the subject.
  1291.                             type: boolean
  1292.                           province:
  1293.                             description: Province defines whether to add the province
  1294.                               information into the subject.
  1295.                             type: boolean
  1296.                           serialNumber:
  1297.                             description: SerialNumber defines whether to add the serialNumber
  1298.                               information into the subject.
  1299.                             type: boolean
  1300.                         type: object
  1301.                     type: object
  1302.                   pem:
  1303.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  1304.                       the certificate.
  1305.                     type: boolean
  1306.                 type: object
  1307.               plugin:
  1308.                 additionalProperties:
  1309.                   x-kubernetes-preserve-unknown-fields: true
  1310.                 description: 'Plugin defines the middleware plugin configuration.
  1311.                   More info: https://doc.traefik.io/traefik/plugins/'
  1312.                 type: object
  1313.               rateLimit:
  1314.                 description: 'RateLimit holds the rate limit configuration. This middleware
  1315.                   ensures that services will receive a fair amount of requests, and
  1316.                   allows one to define what fair is. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ratelimit/'
  1317.                 properties:
  1318.                   average:
  1319.                     description: Average is the maximum rate, by default in requests/s,
  1320.                       allowed for the given source. It defaults to 0, which means
  1321.                       no rate limiting. The rate is actually defined by dividing Average
  1322.                       by Period. So for a rate below 1req/s, one needs to define a
  1323.                       Period larger than a second.
  1324.                     format: int64
  1325.                     type: integer
  1326.                   burst:
  1327.                     description: Burst is the maximum number of requests allowed to
  1328.                       arrive in the same arbitrarily small period of time. It defaults
  1329.                       to 1.
  1330.                     format: int64
  1331.                     type: integer
  1332.                   period:
  1333.                     anyOf:
  1334.                     - type: integer
  1335.                     - type: string
  1336.                     description: 'Period, in combination with Average, defines the
  1337.                       actual maximum rate, such as: r = Average / Period. It defaults
  1338.                       to a second.'
  1339.                     x-kubernetes-int-or-string: true
  1340.                   sourceCriterion:
  1341.                     description: SourceCriterion defines what criterion is used to
  1342.                       group requests as originating from a common source. If several
  1343.                       strategies are defined at the same time, an error will be raised.
  1344.                       If none are set, the default is to use the request's remote
  1345.                       address field (as an ipStrategy).
  1346.                     properties:
  1347.                       ipStrategy:
  1348.                         description: 'IPStrategy holds the IP strategy configuration
  1349.                           used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/ipwhitelist/#ipstrategy'
  1350.                         properties:
  1351.                           depth:
  1352.                             description: Depth tells Traefik to use the X-Forwarded-For
  1353.                               header and take the IP located at the depth position
  1354.                               (starting from the right).
  1355.                             type: integer
  1356.                           excludedIPs:
  1357.                             description: ExcludedIPs configures Traefik to scan the
  1358.                               X-Forwarded-For header and select the first IP not in
  1359.                               the list.
  1360.                             items:
  1361.                               type: string
  1362.                             type: array
  1363.                         type: object
  1364.                       requestHeaderName:
  1365.                         description: RequestHeaderName defines the name of the header
  1366.                           used to group incoming requests.
  1367.                         type: string
  1368.                       requestHost:
  1369.                         description: RequestHost defines whether to consider the request
  1370.                           Host as the source.
  1371.                         type: boolean
  1372.                     type: object
  1373.                 type: object
  1374.               redirectRegex:
  1375.                 description: 'RedirectRegex holds the redirect regex middleware configuration.
  1376.                   This middleware redirects a request using regex matching and replacement.
  1377.                   More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/redirectregex/#regex'
  1378.                 properties:
  1379.                   permanent:
  1380.                     description: Permanent defines whether the redirection is permanent
  1381.                       (301).
  1382.                     type: boolean
  1383.                   regex:
  1384.                     description: Regex defines the regex used to match and capture
  1385.                       elements from the request URL.
  1386.                     type: string
  1387.                   replacement:
  1388.                     description: Replacement defines how to modify the URL to have
  1389.                       the new target URL.
  1390.                     type: string
  1391.                 type: object
  1392.               redirectScheme:
  1393.                 description: 'RedirectScheme holds the redirect scheme middleware
  1394.                   configuration. This middleware redirects requests from a scheme/port
  1395.                   to another. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/redirectscheme/'
  1396.                 properties:
  1397.                   permanent:
  1398.                     description: Permanent defines whether the redirection is permanent
  1399.                       (301).
  1400.                     type: boolean
  1401.                   port:
  1402.                     description: Port defines the port of the new URL.
  1403.                     type: string
  1404.                   scheme:
  1405.                     description: Scheme defines the scheme of the new URL.
  1406.                     type: string
  1407.                 type: object
  1408.               replacePath:
  1409.                 description: 'ReplacePath holds the replace path middleware configuration.
  1410.                   This middleware replaces the path of the request URL and store the
  1411.                   original path in an X-Replaced-Path header. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/replacepath/'
  1412.                 properties:
  1413.                   path:
  1414.                     description: Path defines the path to use as replacement in the
  1415.                       request URL.
  1416.                     type: string
  1417.                 type: object
  1418.               replacePathRegex:
  1419.                 description: 'ReplacePathRegex holds the replace path regex middleware
  1420.                   configuration. This middleware replaces the path of a URL using
  1421.                   regex matching and replacement. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/replacepathregex/'
  1422.                 properties:
  1423.                   regex:
  1424.                     description: Regex defines the regular expression used to match
  1425.                       and capture the path from the request URL.
  1426.                     type: string
  1427.                   replacement:
  1428.                     description: Replacement defines the replacement path format,
  1429.                       which can include captured variables.
  1430.                     type: string
  1431.                 type: object
  1432.               retry:
  1433.                 description: 'Retry holds the retry middleware configuration. This
  1434.                   middleware reissues requests a given number of times to a backend
  1435.                   server if that server does not reply. As soon as the server answers,
  1436.                   the middleware stops retrying, regardless of the response status.
  1437.                   More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/retry/'
  1438.                 properties:
  1439.                   attempts:
  1440.                     description: Attempts defines how many times the request should
  1441.                       be retried.
  1442.                     type: integer
  1443.                   initialInterval:
  1444.                     anyOf:
  1445.                     - type: integer
  1446.                     - type: string
  1447.                     description: InitialInterval defines the first wait time in the
  1448.                       exponential backoff series. The maximum interval is calculated
  1449.                       as twice the initialInterval. If unspecified, requests will
  1450.                       be retried immediately. The value of initialInterval should
  1451.                       be provided in seconds or as a valid duration format, see https://pkg.go.dev/time#ParseDuration.
  1452.                     x-kubernetes-int-or-string: true
  1453.                 type: object
  1454.               stripPrefix:
  1455.                 description: 'StripPrefix holds the strip prefix middleware configuration.
  1456.                   This middleware removes the specified prefixes from the URL path.
  1457.                   More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/stripprefix/'
  1458.                 properties:
  1459.                   forceSlash:
  1460.                     description: 'ForceSlash ensures that the resulting stripped path
  1461.                       is not the empty string, by replacing it with / when necessary.
  1462.                       Default: true.'
  1463.                     type: boolean
  1464.                   prefixes:
  1465.                     description: Prefixes defines the prefixes to strip from the request
  1466.                       URL.
  1467.                     items:
  1468.                       type: string
  1469.                     type: array
  1470.                 type: object
  1471.               stripPrefixRegex:
  1472.                 description: 'StripPrefixRegex holds the strip prefix regex middleware
  1473.                   configuration. This middleware removes the matching prefixes from
  1474.                   the URL path. More info: https://doc.traefik.io/traefik/v2.9/middlewares/http/stripprefixregex/'
  1475.                 properties:
  1476.                   regex:
  1477.                     description: Regex defines the regular expression to match the
  1478.                       path prefix from the request URL.
  1479.                     items:
  1480.                       type: string
  1481.                     type: array
  1482.                 type: object
  1483.             type: object
  1484.         required:
  1485.         - metadata
  1486.         - spec
  1487.         type: object
  1488.     served: true
  1489.     storage: true
  1490. status:
  1491.   acceptedNames:
  1492.     kind: ""
  1493.     plural: ""
  1494.   conditions: []
  1495.   storedVersions: []
  1497. ---
  1498. apiVersion: apiextensions.k8s.io/v1
  1499. kind: CustomResourceDefinition
  1500. metadata:
  1501.   annotations:
  1502.     controller-gen.kubebuilder.io/version: v0.6.2
  1503.   creationTimestamp: null
  1504.   name: middlewaretcps.traefik.containo.us
  1505. spec:
  1506.   group: traefik.containo.us
  1507.   names:
  1508.     kind: MiddlewareTCP
  1509.     listKind: MiddlewareTCPList
  1510.     plural: middlewaretcps
  1511.     singular: middlewaretcp
  1512.   scope: Namespaced
  1513.   versions:
  1514.   - name: v1alpha1
  1515.     schema:
  1516.       openAPIV3Schema:
  1517.         description: 'MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  1518.           More info: https://doc.traefik.io/traefik/v2.9/middlewares/overview/'
  1519.         properties:
  1520.           apiVersion:
  1521.             description: 'APIVersion defines the versioned schema of this representation
  1522.               of an object. Servers should convert recognized schemas to the latest
  1523.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1524.             type: string
  1525.           kind:
  1526.             description: 'Kind is a string value representing the REST resource this
  1527.               object represents. Servers may infer this from the endpoint the client
  1528.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1529.             type: string
  1530.           metadata:
  1531.             type: object
  1532.           spec:
  1533.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  1534.             properties:
  1535.               inFlightConn:
  1536.                 description: InFlightConn defines the InFlightConn middleware configuration.
  1537.                 properties:
  1538.                   amount:
  1539.                     description: Amount defines the maximum amount of allowed simultaneous
  1540.                       connections. The middleware closes the connection if there are
  1541.                       already amount connections opened.
  1542.                     format: int64
  1543.                     type: integer
  1544.                 type: object
  1545.               ipWhiteList:
  1546.                 description: IPWhiteList defines the IPWhiteList middleware configuration.
  1547.                 properties:
  1548.                   sourceRange:
  1549.                     description: SourceRange defines the allowed IPs (or ranges of
  1550.                       allowed IPs by using CIDR notation).
  1551.                     items:
  1552.                       type: string
  1553.                     type: array
  1554.                 type: object
  1555.             type: object
  1556.         required:
  1557.         - metadata
  1558.         - spec
  1559.         type: object
  1560.     served: true
  1561.     storage: true
  1562. status:
  1563.   acceptedNames:
  1564.     kind: ""
  1565.     plural: ""
  1566.   conditions: []
  1567.   storedVersions: []
  1569. ---
  1570. apiVersion: apiextensions.k8s.io/v1
  1571. kind: CustomResourceDefinition
  1572. metadata:
  1573.   annotations:
  1574.     controller-gen.kubebuilder.io/version: v0.6.2
  1575.   creationTimestamp: null
  1576.   name: serverstransports.traefik.containo.us
  1577. spec:
  1578.   group: traefik.containo.us
  1579.   names:
  1580.     kind: ServersTransport
  1581.     listKind: ServersTransportList
  1582.     plural: serverstransports
  1583.     singular: serverstransport
  1584.   scope: Namespaced
  1585.   versions:
  1586.   - name: v1alpha1
  1587.     schema:
  1588.       openAPIV3Schema:
  1589.         description: 'ServersTransport is the CRD implementation of a ServersTransport.
  1590.           If no serversTransport is specified, the [email protected] will be used.
  1591.           The [email protected] serversTransport is created from the static configuration.
  1592.           More info: https://doc.traefik.io/traefik/v2.9/routing/services/#serverstransport_1'
  1593.         properties:
  1594.           apiVersion:
  1595.             description: 'APIVersion defines the versioned schema of this representation
  1596.               of an object. Servers should convert recognized schemas to the latest
  1597.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1598.             type: string
  1599.           kind:
  1600.             description: 'Kind is a string value representing the REST resource this
  1601.               object represents. Servers may infer this from the endpoint the client
  1602.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1603.             type: string
  1604.           metadata:
  1605.             type: object
  1606.           spec:
  1607.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  1608.             properties:
  1609.               certificatesSecrets:
  1610.                 description: CertificatesSecrets defines a list of secret storing
  1611.                   client certificates for mTLS.
  1612.                 items:
  1613.                   type: string
  1614.                 type: array
  1615.               disableHTTP2:
  1616.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  1617.                   servers.
  1618.                 type: boolean
  1619.               forwardingTimeouts:
  1620.                 description: ForwardingTimeouts defines the timeouts for requests
  1621.                   forwarded to the backend servers.
  1622.                 properties:
  1623.                   dialTimeout:
  1624.                     anyOf:
  1625.                     - type: integer
  1626.                     - type: string
  1627.                     description: DialTimeout is the amount of time to wait until a
  1628.                       connection to a backend server can be established.
  1629.                     x-kubernetes-int-or-string: true
  1630.                   idleConnTimeout:
  1631.                     anyOf:
  1632.                     - type: integer
  1633.                     - type: string
  1634.                     description: IdleConnTimeout is the maximum period for which an
  1635.                       idle HTTP keep-alive connection will remain open before closing
  1636.                       itself.
  1637.                     x-kubernetes-int-or-string: true
  1638.                   pingTimeout:
  1639.                     anyOf:
  1640.                     - type: integer
  1641.                     - type: string
  1642.                     description: PingTimeout is the timeout after which the HTTP/2
  1643.                       connection will be closed if a response to ping is not received.
  1644.                     x-kubernetes-int-or-string: true
  1645.                   readIdleTimeout:
  1646.                     anyOf:
  1647.                     - type: integer
  1648.                     - type: string
  1649.                     description: ReadIdleTimeout is the timeout after which a health
  1650.                       check using ping frame will be carried out if no frame is received
  1651.                       on the HTTP/2 connection.
  1652.                     x-kubernetes-int-or-string: true
  1653.                   responseHeaderTimeout:
  1654.                     anyOf:
  1655.                     - type: integer
  1656.                     - type: string
  1657.                     description: ResponseHeaderTimeout is the amount of time to wait
  1658.                       for a server's response headers after fully writing the request
  1659.                       (including its body, if any).
  1660.                     x-kubernetes-int-or-string: true
  1661.                 type: object
  1662.               insecureSkipVerify:
  1663.                 description: InsecureSkipVerify disables SSL certificate verification.
  1664.                 type: boolean
  1665.               maxIdleConnsPerHost:
  1666.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  1667.                   to keep per-host.
  1668.                 type: integer
  1669.               peerCertURI:
  1670.                 description: PeerCertURI defines the peer cert URI used to match against
  1671.                   SAN URI during the peer certificate verification.
  1672.                 type: string
  1673.               rootCAsSecrets:
  1674.                 description: RootCAsSecrets defines a list of CA secret used to validate
  1675.                   self-signed certificate.
  1676.                 items:
  1677.                   type: string
  1678.                 type: array
  1679.               serverName:
  1680.                 description: ServerName defines the server name used to contact the
  1681.                   server.
  1682.                 type: string
  1683.             type: object
  1684.         required:
  1685.         - metadata
  1686.         - spec
  1687.         type: object
  1688.     served: true
  1689.     storage: true
  1690. status:
  1691.   acceptedNames:
  1692.     kind: ""
  1693.     plural: ""
  1694.   conditions: []
  1695.   storedVersions: []
  1697. ---
  1698. apiVersion: apiextensions.k8s.io/v1
  1699. kind: CustomResourceDefinition
  1700. metadata:
  1701.   annotations:
  1702.     controller-gen.kubebuilder.io/version: v0.6.2
  1703.   creationTimestamp: null
  1704.   name: tlsoptions.traefik.containo.us
  1705. spec:
  1706.   group: traefik.containo.us
  1707.   names:
  1708.     kind: TLSOption
  1709.     listKind: TLSOptionList
  1710.     plural: tlsoptions
  1711.     singular: tlsoption
  1712.   scope: Namespaced
  1713.   versions:
  1714.   - name: v1alpha1
  1715.     schema:
  1716.       openAPIV3Schema:
  1717.         description: 'TLSOption is the CRD implementation of a Traefik TLS Option,
  1718.           allowing to configure some parameters of the TLS connection. More info:
  1719.           https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options'
  1720.         properties:
  1721.           apiVersion:
  1722.             description: 'APIVersion defines the versioned schema of this representation
  1723.               of an object. Servers should convert recognized schemas to the latest
  1724.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1725.             type: string
  1726.           kind:
  1727.             description: 'Kind is a string value representing the REST resource this
  1728.               object represents. Servers may infer this from the endpoint the client
  1729.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1730.             type: string
  1731.           metadata:
  1732.             type: object
  1733.           spec:
  1734.             description: TLSOptionSpec defines the desired state of a TLSOption.
  1735.             properties:
  1736.               alpnProtocols:
  1737.                 description: 'ALPNProtocols defines the list of supported application
  1738.                   level protocols for the TLS handshake, in order of preference. More
  1739.                   info: https://doc.traefik.io/traefik/v2.9/https/tls/#alpn-protocols'
  1740.                 items:
  1741.                   type: string
  1742.                 type: array
  1743.               cipherSuites:
  1744.                 description: 'CipherSuites defines the list of supported cipher suites
  1745.                   for TLS versions up to TLS 1.2. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#cipher-suites'
  1746.                 items:
  1747.                   type: string
  1748.                 type: array
  1749.               clientAuth:
  1750.                 description: ClientAuth defines the server's policy for TLS Client
  1751.                   Authentication.
  1752.                 properties:
  1753.                   clientAuthType:
  1754.                     description: ClientAuthType defines the client authentication
  1755.                       type to apply.
  1756.                     enum:
  1757.                     - NoClientCert
  1758.                     - RequestClientCert
  1759.                     - RequireAnyClientCert
  1760.                     - VerifyClientCertIfGiven
  1761.                     - RequireAndVerifyClientCert
  1762.                     type: string
  1763.                   secretNames:
  1764.                     description: SecretNames defines the names of the referenced Kubernetes
  1765.                       Secret storing certificate details.
  1766.                     items:
  1767.                       type: string
  1768.                     type: array
  1769.                 type: object
  1770.               curvePreferences:
  1771.                 description: 'CurvePreferences defines the preferred elliptic curves
  1772.                   in a specific order. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#curve-preferences'
  1773.                 items:
  1774.                   type: string
  1775.                 type: array
  1776.               maxVersion:
  1777.                 description: 'MaxVersion defines the maximum TLS version that Traefik
  1778.                   will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
  1779.                   VersionTLS13. Default: None.'
  1780.                 type: string
  1781.               minVersion:
  1782.                 description: 'MinVersion defines the minimum TLS version that Traefik
  1783.                   will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12,
  1784.                   VersionTLS13. Default: VersionTLS10.'
  1785.                 type: string
  1786.               preferServerCipherSuites:
  1787.                 description: 'PreferServerCipherSuites defines whether the server
  1788.                   chooses a cipher suite among his own instead of among the client''s.
  1789.                   It is enabled automatically when minVersion or maxVersion is set.
  1790.                   Deprecated: https://github.com/golang/go/issues/45430'
  1791.                 type: boolean
  1792.               sniStrict:
  1793.                 description: SniStrict defines whether Traefik allows connections
  1794.                   from clients connections that do not specify a server_name extension.
  1795.                 type: boolean
  1796.             type: object
  1797.         required:
  1798.         - metadata
  1799.         - spec
  1800.         type: object
  1801.     served: true
  1802.     storage: true
  1803. status:
  1804.   acceptedNames:
  1805.     kind: ""
  1806.     plural: ""
  1807.   conditions: []
  1808.   storedVersions: []
  1810. ---
  1811. apiVersion: apiextensions.k8s.io/v1
  1812. kind: CustomResourceDefinition
  1813. metadata:
  1814.   annotations:
  1815.     controller-gen.kubebuilder.io/version: v0.6.2
  1816.   creationTimestamp: null
  1817.   name: tlsstores.traefik.containo.us
  1818. spec:
  1819.   group: traefik.containo.us
  1820.   names:
  1821.     kind: TLSStore
  1822.     listKind: TLSStoreList
  1823.     plural: tlsstores
  1824.     singular: tlsstore
  1825.   scope: Namespaced
  1826.   versions:
  1827.   - name: v1alpha1
  1828.     schema:
  1829.       openAPIV3Schema:
  1830.         description: 'TLSStore is the CRD implementation of a Traefik TLS Store. For
  1831.           the time being, only the TLSStore named default is supported. This means
  1832.           that you cannot have two stores that are named default in different Kubernetes
  1833.           namespaces. More info: https://doc.traefik.io/traefik/v2.9/https/tls/#certificates-stores'
  1834.         properties:
  1835.           apiVersion:
  1836.             description: 'APIVersion defines the versioned schema of this representation
  1837.               of an object. Servers should convert recognized schemas to the latest
  1838.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1839.             type: string
  1840.           kind:
  1841.             description: 'Kind is a string value representing the REST resource this
  1842.               object represents. Servers may infer this from the endpoint the client
  1843.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1844.             type: string
  1845.           metadata:
  1846.             type: object
  1847.           spec:
  1848.             description: TLSStoreSpec defines the desired state of a TLSStore.
  1849.             properties:
  1850.               certificates:
  1851.                 description: Certificates is a list of secret names, each secret holding
  1852.                   a key/certificate pair to add to the store.
  1853.                 items:
  1854.                   description: Certificate holds a secret name for the TLSStore resource.
  1855.                   properties:
  1856.                     secretName:
  1857.                       description: SecretName is the name of the referenced Kubernetes
  1858.                         Secret to specify the certificate details.
  1859.                       type: string
  1860.                   required:
  1861.                   - secretName
  1862.                   type: object
  1863.                 type: array
  1864.               defaultCertificate:
  1865.                 description: DefaultCertificate defines the default certificate configuration.
  1866.                 properties:
  1867.                   secretName:
  1868.                     description: SecretName is the name of the referenced Kubernetes
  1869.                       Secret to specify the certificate details.
  1870.                     type: string
  1871.                 required:
  1872.                 - secretName
  1873.                 type: object
  1874.               defaultGeneratedCert:
  1875.                 description: DefaultGeneratedCert defines the default generated certificate
  1876.                   configuration.
  1877.                 properties:
  1878.                   domain:
  1879.                     description: Domain is the domain definition for the DefaultCertificate.
  1880.                     properties:
  1881.                       main:
  1882.                         description: Main defines the main domain name.
  1883.                         type: string
  1884.                       sans:
  1885.                         description: SANs defines the subject alternative domain names.
  1886.                         items:
  1887.                           type: string
  1888.                         type: array
  1889.                     type: object
  1890.                   resolver:
  1891.                     description: Resolver is the name of the resolver that will be
  1892.                       used to issue the DefaultCertificate.
  1893.                     type: string
  1894.                 type: object
  1895.             type: object
  1896.         required:
  1897.         - metadata
  1898.         - spec
  1899.         type: object
  1900.     served: true
  1901.     storage: true
  1902. status:
  1903.   acceptedNames:
  1904.     kind: ""
  1905.     plural: ""
  1906.   conditions: []
  1907.   storedVersions: []
  1909. ---
  1910. apiVersion: apiextensions.k8s.io/v1
  1911. kind: CustomResourceDefinition
  1912. metadata:
  1913.   annotations:
  1914.     controller-gen.kubebuilder.io/version: v0.6.2
  1915.   creationTimestamp: null
  1916.   name: traefikservices.traefik.containo.us
  1917. spec:
  1918.   group: traefik.containo.us
  1919.   names:
  1920.     kind: TraefikService
  1921.     listKind: TraefikServiceList
  1922.     plural: traefikservices
  1923.     singular: traefikservice
  1924.   scope: Namespaced
  1925.   versions:
  1926.   - name: v1alpha1
  1927.     schema:
  1928.       openAPIV3Schema:
  1929.         description: 'TraefikService is the CRD implementation of a Traefik Service.
  1930.           TraefikService object allows to: - Apply weight to Services on load-balancing
  1931.           - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#kind-traefikservice'
  1932.         properties:
  1933.           apiVersion:
  1934.             description: 'APIVersion defines the versioned schema of this representation
  1935.               of an object. Servers should convert recognized schemas to the latest
  1936.               internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  1937.             type: string
  1938.           kind:
  1939.             description: 'Kind is a string value representing the REST resource this
  1940.               object represents. Servers may infer this from the endpoint the client
  1941.               submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  1942.             type: string
  1943.           metadata:
  1944.             type: object
  1945.           spec:
  1946.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  1947.             properties:
  1948.               mirroring:
  1949.                 description: Mirroring defines the Mirroring service configuration.
  1950.                 properties:
  1951.                   kind:
  1952.                     description: Kind defines the kind of the Service.
  1953.                     enum:
  1954.                     - Service
  1955.                     - TraefikService
  1956.                     type: string
  1957.                   maxBodySize:
  1958.                     description: MaxBodySize defines the maximum size allowed for
  1959.                       the body of the request. If the body is larger, the request
  1960.                       is not mirrored. Default value is -1, which means unlimited
  1961.                       size.
  1962.                     format: int64
  1963.                     type: integer
  1964.                   mirrors:
  1965.                     description: Mirrors defines the list of mirrors where Traefik
  1966.                       will duplicate the traffic.
  1967.                     items:
  1968.                       description: MirrorService holds the mirror configuration.
  1969.                       properties:
  1970.                         kind:
  1971.                           description: Kind defines the kind of the Service.
  1972.                           enum:
  1973.                           - Service
  1974.                           - TraefikService
  1975.                           type: string
  1976.                         name:
  1977.                           description: Name defines the name of the referenced Kubernetes
  1978.                             Service or TraefikService. The differentiation between
  1979.                             the two is specified in the Kind field.
  1980.                           type: string
  1981.                         namespace:
  1982.                           description: Namespace defines the namespace of the referenced
  1983.                             Kubernetes Service or TraefikService.
  1984.                           type: string
  1985.                         passHostHeader:
  1986.                           description: PassHostHeader defines whether the client Host
  1987.                             header is forwarded to the upstream Kubernetes Service.
  1988.                             By default, passHostHeader is true.
  1989.                           type: boolean
  1990.                         percent:
  1991.                           description: 'Percent defines the part of the traffic to
  1992.                             mirror. Supported values: 0 to 100.'
  1993.                           type: integer
  1994.                         port:
  1995.                           anyOf:
  1996.                           - type: integer
  1997.                           - type: string
  1998.                           description: Port defines the port of a Kubernetes Service.
  1999.                             This can be a reference to a named port.
  2000.                           x-kubernetes-int-or-string: true
  2001.                         responseForwarding:
  2002.                           description: ResponseForwarding defines how Traefik forwards
  2003.                             the response from the upstream Kubernetes Service to the
  2004.                             client.
  2005.                           properties:
  2006.                             flushInterval:
  2007.                               description: 'FlushInterval defines the interval, in
  2008.                                 milliseconds, in between flushes to the client while
  2009.                                 copying the response body. A negative value means
  2010.                                 to flush immediately after each write to the client.
  2011.                                 This configuration is ignored when ReverseProxy recognizes
  2012.                                 a response as a streaming response; for such responses,
  2013.                                 writes are flushed to the client immediately. Default:
  2014.                                 100ms'
  2015.                               type: string
  2016.                           type: object
  2017.                         scheme:
  2018.                           description: Scheme defines the scheme to use for the request
  2019.                             to the upstream Kubernetes Service. It defaults to https
  2020.                             when Kubernetes Service port is 443, http otherwise.
  2021.                           type: string
  2022.                         serversTransport:
  2023.                           description: ServersTransport defines the name of ServersTransport
  2024.                             resource to use. It allows to configure the transport
  2025.                             between Traefik and your servers. Can only be used on
  2026.                             a Kubernetes Service.
  2027.                           type: string
  2028.                         sticky:
  2029.                           description: 'Sticky defines the sticky sessions configuration.
  2030.                             More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
  2031.                           properties:
  2032.                             cookie:
  2033.                               description: Cookie defines the sticky cookie configuration.
  2034.                               properties:
  2035.                                 httpOnly:
  2036.                                   description: HTTPOnly defines whether the cookie
  2037.                                     can be accessed by client-side APIs, such as JavaScript.
  2038.                                   type: boolean
  2039.                                 name:
  2040.                                   description: Name defines the Cookie name.
  2041.                                   type: string
  2042.                                 sameSite:
  2043.                                   description: 'SameSite defines the same site policy.
  2044.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2045.                                   type: string
  2046.                                 secure:
  2047.                                   description: Secure defines whether the cookie can
  2048.                                     only be transmitted over an encrypted connection
  2049.                                     (i.e. HTTPS).
  2050.                                   type: boolean
  2051.                               type: object
  2052.                           type: object
  2053.                         strategy:
  2054.                           description: Strategy defines the load balancing strategy
  2055.                             between the servers. RoundRobin is the only supported
  2056.                             value at the moment.
  2057.                           type: string
  2058.                         weight:
  2059.                           description: Weight defines the weight and should only be
  2060.                             specified when Name references a TraefikService object
  2061.                             (and to be precise, one that embeds a Weighted Round Robin).
  2062.                           type: integer
  2063.                       required:
  2064.                       - name
  2065.                       type: object
  2066.                     type: array
  2067.                   name:
  2068.                     description: Name defines the name of the referenced Kubernetes
  2069.                       Service or TraefikService. The differentiation between the two
  2070.                       is specified in the Kind field.
  2071.                     type: string
  2072.                   namespace:
  2073.                     description: Namespace defines the namespace of the referenced
  2074.                       Kubernetes Service or TraefikService.
  2075.                     type: string
  2076.                   passHostHeader:
  2077.                     description: PassHostHeader defines whether the client Host header
  2078.                       is forwarded to the upstream Kubernetes Service. By default,
  2079.                       passHostHeader is true.
  2080.                     type: boolean
  2081.                   port:
  2082.                     anyOf:
  2083.                     - type: integer
  2084.                     - type: string
  2085.                     description: Port defines the port of a Kubernetes Service. This
  2086.                       can be a reference to a named port.
  2087.                     x-kubernetes-int-or-string: true
  2088.                   responseForwarding:
  2089.                     description: ResponseForwarding defines how Traefik forwards the
  2090.                       response from the upstream Kubernetes Service to the client.
  2091.                     properties:
  2092.                       flushInterval:
  2093.                         description: 'FlushInterval defines the interval, in milliseconds,
  2094.                           in between flushes to the client while copying the response
  2095.                           body. A negative value means to flush immediately after
  2096.                           each write to the client. This configuration is ignored
  2097.                           when ReverseProxy recognizes a response as a streaming response;
  2098.                           for such responses, writes are flushed to the client immediately.
  2099.                           Default: 100ms'
  2100.                         type: string
  2101.                     type: object
  2102.                   scheme:
  2103.                     description: Scheme defines the scheme to use for the request
  2104.                       to the upstream Kubernetes Service. It defaults to https when
  2105.                       Kubernetes Service port is 443, http otherwise.
  2106.                     type: string
  2107.                   serversTransport:
  2108.                     description: ServersTransport defines the name of ServersTransport
  2109.                       resource to use. It allows to configure the transport between
  2110.                       Traefik and your servers. Can only be used on a Kubernetes Service.
  2111.                     type: string
  2112.                   sticky:
  2113.                     description: 'Sticky defines the sticky sessions configuration.
  2114.                       More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
  2115.                     properties:
  2116.                       cookie:
  2117.                         description: Cookie defines the sticky cookie configuration.
  2118.                         properties:
  2119.                           httpOnly:
  2120.                             description: HTTPOnly defines whether the cookie can be
  2121.                               accessed by client-side APIs, such as JavaScript.
  2122.                             type: boolean
  2123.                           name:
  2124.                             description: Name defines the Cookie name.
  2125.                             type: string
  2126.                           sameSite:
  2127.                             description: 'SameSite defines the same site policy. More
  2128.                               info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2129.                             type: string
  2130.                           secure:
  2131.                             description: Secure defines whether the cookie can only
  2132.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2133.                             type: boolean
  2134.                         type: object
  2135.                     type: object
  2136.                   strategy:
  2137.                     description: Strategy defines the load balancing strategy between
  2138.                       the servers. RoundRobin is the only supported value at the moment.
  2139.                     type: string
  2140.                   weight:
  2141.                     description: Weight defines the weight and should only be specified
  2142.                       when Name references a TraefikService object (and to be precise,
  2143.                       one that embeds a Weighted Round Robin).
  2144.                     type: integer
  2145.                 required:
  2146.                 - name
  2147.                 type: object
  2148.               weighted:
  2149.                 description: Weighted defines the Weighted Round Robin configuration.
  2150.                 properties:
  2151.                   services:
  2152.                     description: Services defines the list of Kubernetes Service and/or
  2153.                       TraefikService to load-balance, with weight.
  2154.                     items:
  2155.                       description: Service defines an upstream HTTP service to proxy
  2156.                         traffic to.
  2157.                       properties:
  2158.                         kind:
  2159.                           description: Kind defines the kind of the Service.
  2160.                           enum:
  2161.                           - Service
  2162.                           - TraefikService
  2163.                           type: string
  2164.                         name:
  2165.                           description: Name defines the name of the referenced Kubernetes
  2166.                             Service or TraefikService. The differentiation between
  2167.                             the two is specified in the Kind field.
  2168.                           type: string
  2169.                         namespace:
  2170.                           description: Namespace defines the namespace of the referenced
  2171.                             Kubernetes Service or TraefikService.
  2172.                           type: string
  2173.                         passHostHeader:
  2174.                           description: PassHostHeader defines whether the client Host
  2175.                             header is forwarded to the upstream Kubernetes Service.
  2176.                             By default, passHostHeader is true.
  2177.                           type: boolean
  2178.                         port:
  2179.                           anyOf:
  2180.                           - type: integer
  2181.                           - type: string
  2182.                           description: Port defines the port of a Kubernetes Service.
  2183.                             This can be a reference to a named port.
  2184.                           x-kubernetes-int-or-string: true
  2185.                         responseForwarding:
  2186.                           description: ResponseForwarding defines how Traefik forwards
  2187.                             the response from the upstream Kubernetes Service to the
  2188.                             client.
  2189.                           properties:
  2190.                             flushInterval:
  2191.                               description: 'FlushInterval defines the interval, in
  2192.                                 milliseconds, in between flushes to the client while
  2193.                                 copying the response body. A negative value means
  2194.                                 to flush immediately after each write to the client.
  2195.                                 This configuration is ignored when ReverseProxy recognizes
  2196.                                 a response as a streaming response; for such responses,
  2197.                                 writes are flushed to the client immediately. Default:
  2198.                                 100ms'
  2199.                               type: string
  2200.                           type: object
  2201.                         scheme:
  2202.                           description: Scheme defines the scheme to use for the request
  2203.                             to the upstream Kubernetes Service. It defaults to https
  2204.                             when Kubernetes Service port is 443, http otherwise.
  2205.                           type: string
  2206.                         serversTransport:
  2207.                           description: ServersTransport defines the name of ServersTransport
  2208.                             resource to use. It allows to configure the transport
  2209.                             between Traefik and your servers. Can only be used on
  2210.                             a Kubernetes Service.
  2211.                           type: string
  2212.                         sticky:
  2213.                           description: 'Sticky defines the sticky sessions configuration.
  2214.                             More info: https://doc.traefik.io/traefik/v2.9/routing/services/#sticky-sessions'
  2215.                           properties:
  2216.                             cookie:
  2217.                               description: Cookie defines the sticky cookie configuration.
  2218.                               properties:
  2219.                                 httpOnly:
  2220.                                   description: HTTPOnly defines whether the cookie
  2221.                                     can be accessed by client-side APIs, such as JavaScript.
  2222.                                   type: boolean
  2223.                                 name:
  2224.                                   description: Name defines the Cookie name.
  2225.                                   type: string
  2226.                                 sameSite:
  2227.                                   description: 'SameSite defines the same site policy.
  2228.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2229.                                   type: string
  2230.                                 secure:
  2231.                                   description: Secure defines whether the cookie can
  2232.                                     only be transmitted over an encrypted connection
  2233.                                     (i.e. HTTPS).
  2234.                                   type: boolean
  2235.                               type: object
  2236.                           type: object
  2237.                         strategy:
  2238.                           description: Strategy defines the load balancing strategy
  2239.                             between the servers. RoundRobin is the only supported
  2240.                             value at the moment.
  2241.                           type: string
  2242.                         weight:
  2243.                           description: Weight defines the weight and should only be
  2244.                             specified when Name references a TraefikService object
  2245.                             (and to be precise, one that embeds a Weighted Round Robin).
  2246.                           type: integer
  2247.                       required:
  2248.                       - name
  2249.                       type: object
  2250.                     type: array
  2251.                   sticky:
  2252.                     description: 'Sticky defines whether sticky sessions are enabled.
  2253.                       More info: https://doc.traefik.io/traefik/v2.9/routing/providers/kubernetes-crd/#stickiness-and-load-balancing'
  2254.                     properties:
  2255.                       cookie:
  2256.                         description: Cookie defines the sticky cookie configuration.
  2257.                         properties:
  2258.                           httpOnly:
  2259.                             description: HTTPOnly defines whether the cookie can be
  2260.                               accessed by client-side APIs, such as JavaScript.
  2261.                             type: boolean
  2262.                           name:
  2263.                             description: Name defines the Cookie name.
  2264.                             type: string
  2265.                           sameSite:
  2266.                             description: 'SameSite defines the same site policy. More
  2267.                               info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite'
  2268.                             type: string
  2269.                           secure:
  2270.                             description: Secure defines whether the cookie can only
  2271.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2272.                             type: boolean
  2273.                         type: object
  2274.                     type: object
  2275.                 type: object
  2276.             type: object
  2277.         required:
  2278.         - metadata
  2279.         - spec
  2280.         type: object
  2281.     served: true
  2282.     storage: true
  2283. status:
  2284.   acceptedNames:
  2285.     kind: ""
  2286.     plural: ""
  2287.   conditions: []
  2288.   storedVersions: []

RBAC

  1. apiVersion: rbac.authorization.k8s.io/v1
  2. kind: ClusterRole
  3. metadata:
  4.   name: traefik-ingress-controller
  6. rules:
  7.   - apiGroups:
  8.       - ""
  9.     resources:
  10.       - services
  11.       - endpoints
  12.       - secrets
  13.     verbs:
  14.       - get
  15.       - list
  16.       - watch
  17.   - apiGroups:
  18.       - extensions
  19.       - networking.k8s.io
  20.     resources:
  21.       - ingresses
  22.       - ingressclasses
  23.     verbs:
  24.       - get
  25.       - list
  26.       - watch
  27.   - apiGroups:
  28.       - extensions
  29.       - networking.k8s.io
  30.     resources:
  31.       - ingresses/status
  32.     verbs:
  33.       - update
  34.   - apiGroups:
  35.       - traefik.containo.us
  36.     resources:
  37.       - middlewares
  38.       - middlewaretcps
  39.       - ingressroutes
  40.       - traefikservices
  41.       - ingressroutetcps
  42.       - ingressrouteudps
  43.       - tlsoptions
  44.       - tlsstores
  45.       - serverstransports
  46.     verbs:
  47.       - get
  48.       - list
  49.       - watch
  51. ---
  52. apiVersion: rbac.authorization.k8s.io/v1
  53. kind: ClusterRoleBinding
  54. metadata:
  55.   name: traefik-ingress-controller
  57. roleRef:
  58.   apiGroup: rbac.authorization.k8s.io
  59.   kind: ClusterRole
  60.   name: traefik-ingress-controller
  61. subjects:
  62.   - kind: ServiceAccount
  63.     name: traefik-ingress-controller
  64.     namespace: default

Traefik

  1. apiVersion: v1
  2. kind: ServiceAccount
  3. metadata:
  4.   name: traefik-ingress-controller
  6. ---
  7. kind: Deployment
  8. apiVersion: apps/v1
  9. metadata:
  10.   name: traefik
  11.   labels:
  12.     app: traefik
  14. spec:
  15.   replicas: 1
  16.   selector:
  17.     matchLabels:
  18.       app: traefik
  19.   template:
  20.     metadata:
  21.       labels:
  22.         app: traefik
  23.     spec:
  24.       serviceAccountName: traefik-ingress-controller
  25.       containers:
  26.         - name: traefik
  27.           image: traefik:v2.9
  28.           args:
  29.             - --log.level=DEBUG
  30.             - --api
  31.             - --api.insecure
  32.             - --entrypoints.web.address=:80
  33.             - --entrypoints.tcpep.address=:8000
  34.             - --entrypoints.udpep.address=:9000/udp
  35.             - --providers.kubernetescrd
  36.           ports:
  37.             - name: web
  38.               containerPort: 80
  39.             - name: admin
  40.               containerPort: 8080
  41.             - name: tcpep
  42.               containerPort: 8000
  43.             - name: udpep
  44.               containerPort: 9000
  46. ---
  47. apiVersion: v1
  48. kind: Service
  49. metadata:
  50.   name: traefik
  51. spec:
  52.   type: LoadBalancer
  53.   selector:
  54.     app: traefik
  55.   ports:
  56.     - protocol: TCP
  57.       port: 80
  58.       name: web
  59.       targetPort: 80
  60.     - protocol: TCP
  61.       port: 8080
  62.       name: admin
  63.       targetPort: 8080
  64.     - protocol: TCP
  65.       port: 8000
  66.       name: tcpep
  67.       targetPort: 8000
  69. ---
  70. apiVersion: v1
  71. kind: Service
  72. metadata:
  73.   name: traefikudp
  74. spec:
  75.   type: LoadBalancer
  76.   selector:
  77.     app: traefik
  78.   ports:
  79.     - protocol: UDP
  80.       port: 9000
  81.       name: udpep
  82.       targetPort: 9000

IngressRoute

  1. apiVersion: traefik.containo.us/v1alpha1
  2. kind: IngressRoute
  3. metadata:
  4.   name: myingressroute
  5.   namespace: default
  7. spec:
  8.   entryPoints:
  9.     - web
  11.   routes:
  12.   - match: Host(`foo`) && PathPrefix(`/bar`)
  13.     kind: Rule
  14.     services:
  15.     - name: whoami
  16.       port: 80
  18. ---
  19. apiVersion: traefik.containo.us/v1alpha1
  20. kind: IngressRouteTCP
  21. metadata:
  22.   name: ingressroute.tcp
  23.   namespace: default
  25. spec:
  26.   entryPoints:
  27.     - tcpep
  28.   routes:
  29.   - match: HostSNI(`bar`)
  30.     services:
  31.       - name: whoamitcp
  32.         port: 8080
  34. ---
  35. apiVersion: traefik.containo.us/v1alpha1
  36. kind: IngressRouteUDP
  37. metadata:
  38.   name: ingressroute.udp
  39.   namespace: default
  41. spec:
  42.   entryPoints:
  43.     - udpep
  44.   routes:
  45.   - services:
  46.       - name: whoamiudp
  47.         port: 8080

Whoami

  1. kind: Deployment
  2. apiVersion: apps/v1
  3. metadata:
  4.   name: whoami
  5.   namespace: default
  6.   labels:
  7.     app: traefiklabs
  8.     name: whoami
  10. spec:
  11.   replicas: 2
  12.   selector:
  13.     matchLabels:
  14.       app: traefiklabs
  15.       task: whoami
  16.   template:
  17.     metadata:
  18.       labels:
  19.         app: traefiklabs
  20.         task: whoami
  21.     spec:
  22.       containers:
  23.         - name: whoami
  24.           image: traefik/whoami
  25.           ports:
  26.             - containerPort: 80
  28. ---
  29. apiVersion: v1
  30. kind: Service
  31. metadata:
  32.   name: whoami
  33.   namespace: default
  35. spec:
  36.   ports:
  37.     - name: http
  38.       port: 80
  39.   selector:
  40.     app: traefiklabs
  41.     task: whoami
  43. ---
  44. kind: Deployment
  45. apiVersion: apps/v1
  46. metadata:
  47.   name: whoamitcp
  48.   namespace: default
  49.   labels:
  50.     app: traefiklabs
  51.     name: whoamitcp
  53. spec:
  54.   replicas: 2
  55.   selector:
  56.     matchLabels:
  57.       app: traefiklabs
  58.       task: whoamitcp
  59.   template:
  60.     metadata:
  61.       labels:
  62.         app: traefiklabs
  63.         task: whoamitcp
  64.     spec:
  65.       containers:
  66.         - name: whoamitcp
  67.           image: traefik/whoamitcp
  68.           ports:
  69.             - containerPort: 8080
  71. ---
  72. apiVersion: v1
  73. kind: Service
  74. metadata:
  75.   name: whoamitcp
  76.   namespace: default
  78. spec:
  79.   ports:
  80.     - protocol: TCP
  81.       port: 8080
  82.   selector:
  83.     app: traefiklabs
  84.     task: whoamitcp
  86. ---
  87. kind: Deployment
  88. apiVersion: apps/v1
  89. metadata:
  90.   name: whoamiudp
  91.   namespace: default
  92.   labels:
  93.     app: traefiklabs
  94.     name: whoamiudp
  96. spec:
  97.   replicas: 2
  98.   selector:
  99.     matchLabels:
  100.       app: traefiklabs
  101.       task: whoamiudp
  102.   template:
  103.     metadata:
  104.       labels:
  105.         app: traefiklabs
  106.         task: whoamiudp
  107.     spec:
  108.       containers:
  109.         - name: whoamiudp
  110.           image: traefik/whoamiudp:latest
  111.           ports:
  112.             - containerPort: 8080
  114. ---
  115. apiVersion: v1
  116. kind: Service
  117. metadata:
  118.   name: whoamiudp
  119.   namespace: default
  121. spec:
  122.   ports:
  123.     - port: 8080
  124.   selector:
  125.     app: traefiklabs
  126.     task: whoamiudp

Routing Configuration

Custom Resource Definition (CRD)

  • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
  • Validate that the prerequisites are fulfilled before using the Traefik custom resources.
  • Traefik CRDs are building blocks that you can assemble according to your needs.

You can find an excerpt of the available custom resources in the table below:

KindPurposeConcept Behind
IngressRouteHTTP RoutingHTTP router
MiddlewareTweaks the HTTP requests before they are sent to your serviceHTTP Middlewares
TraefikServiceAbstraction for HTTP loadbalancing/mirroringHTTP service
IngressRouteTCPTCP RoutingTCP router
MiddlewareTCPTweaks the TCP requests before they are sent to your serviceTCP Middlewares
IngressRouteUDPUDP RoutingUDP router
TLSOptionsAllows to configure some parameters of the TLS connectionTLSOptions
TLSStoresAllows to configure the default TLS storeTLSStores
ServersTransportAllows to configure the transport between Traefik and the backendsServersTransport

Kind: IngressRoute

IngressRoute is the CRD implementation of a Traefik HTTP router.

Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

IngressRoute Attributes

  1. apiVersion: traefik.containo.us/v1alpha1
  2. kind: IngressRoute
  3. metadata:
  4.   name: foo
  5.   namespace: bar
  6. spec:
  7.   entryPoints:                      # [1]
  8.     - foo
  9.   routes:                           # [2]
  10.   - kind: Rule
  11.     match: Host(`test.example.com`) # [3]
  12.     priority: 10                    # [4]
  13.     middlewares:                    # [5]
  14.     - name: middleware1             # [6]
  15.       namespace: default            # [7]
  16.     services:                       # [8]
  17.     - kind: Service
  18.       name: foo
  19.       namespace: default
  20.       passHostHeader: true
  21.       port: 80                      # [9]
  22.       responseForwarding:
  23.         flushInterval: 1ms
  24.       scheme: https
  25.       serversTransport: transport   # [10]
  26.       sticky:
  27.         cookie:
  28.           httpOnly: true
  29.           name: cookie
  30.           secure: true
  31.           sameSite: none
  32.       strategy: RoundRobin
  33.       weight: 10
  34.   tls:                              # [11]
  35.     secretName: supersecret         # [12]
  36.     options:                        # [13]
  37.       name: opt                     # [14]
  38.       namespace: default            # [15]
  39.     certResolver: foo               # [16]
  40.     domains:                        # [17]
  41.     - main: example.net             # [18]
  42.       sans:                         # [19]
  43.       - a.example.net
  44.       - b.example.net
RefAttributePurpose
[1]entryPointsList of entry points names
[2]routesList of routes
[3]routes[n].matchDefines the rule corresponding to an underlying router.
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]routes[n].middlewaresList of reference to Middleware
[6]middlewares[n].nameDefines the Middleware name
[7]middlewares[n].namespaceDefines the Middleware namespace
[8]routes[n].servicesList of any combination of TraefikService and reference to a Kubernetes service (See below for ExternalName Service setup)
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].serversTransportDefines the reference to a ServersTransport. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[11]tlsDefines TLS certificate configuration
[12]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[13]tls.optionsDefines the reference to a TLSOption
[14]options.nameDefines the TLSOption name
[15]options.namespaceDefines the TLSOption namespace
[16]tls.certResolverDefines the reference to a CertResolver
[17]tls.domainsList of domains
[18]domains[n].mainDefines the main domain name
[19]domains[n].sansList of SANs (alternative domains)

Declaring an IngressRoute

IngressRoute

  1. # All resources definition must be declared
  2. apiVersion: traefik.containo.us/v1alpha1
  3. kind: IngressRoute
  4. metadata:
  5.   name: test-name
  6.   namespace: default
  7. spec:
  8.   entryPoints:
  9.     - web
  10.   routes:
  11.   - kind: Rule
  12.     match: Host(`test.example.com`)
  13.     middlewares:
  14.     - name: middleware1
  15.       namespace: default
  16.     priority: 10
  17.     services:
  18.     - kind: Service
  19.       name: foo
  20.       namespace: default
  21.       passHostHeader: true
  22.       port: 80
  23.       responseForwarding:
  24.         flushInterval: 1ms
  25.       scheme: https
  26.       sticky:
  27.         cookie:
  28.           httpOnly: true
  29.           name: cookie
  30.           secure: true
  31.       strategy: RoundRobin
  32.       weight: 10
  33.   tls:
  34.     certResolver: foo
  35.     domains:
  36.     - main: example.net
  37.       sans:
  38.       - a.example.net
  39.       - b.example.net
  40.     options:
  41.       name: opt
  42.       namespace: default
  43.     secretName: supersecret

Middlewares

  1. # All resources definition must be declared
  2. # Prefixing with /foo
  3. apiVersion: traefik.containo.us/v1alpha1
  4. kind: Middleware
  5. metadata:
  6.   name: middleware1
  7.   namespace: default
  8. spec:
  9.   addPrefix:
  10.     prefix: /foo

TLSOption

  1. apiVersion: traefik.containo.us/v1alpha1
  2. kind: TLSOption
  3. metadata:
  4.   name: opt
  5.   namespace: default
  7. spec:
  8.   minVersion: VersionTLS12

Secret

  1. apiVersion: v1
  2. kind: Secret
  3. metadata:
  4.   name: supersecret
  6. data:
  7.   tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  8.   tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Configuring Backend Protocol

There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

  • Setting the scheme explicitly (http/https/h2c)
  • Configuring the name of the kubernetes service port to start with https (https)
  • Setting the kubernetes service port to use port 443 (https)

If you do not configure the above, Traefik will assume an http connection.

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRoute service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRoute

  1. ---
  2. apiVersion: traefik.containo.us/v1alpha1
  3. kind: IngressRoute
  4. metadata:
  5.   name: test.route
  6.   namespace: default
  8. spec:
  9.   entryPoints:
  10.     - foo
  12.   routes:
  13.   - match: Host(`example.net`)
  14.     kind: Rule
  15.     services:
  16.     - name: external-svc
  17.       port: 80
  19. ---
  20. apiVersion: v1
  21. kind: Service
  22. metadata:
  23.   name: external-svc
  24.   namespace: default
  25. spec:
  26.   externalName: external.domain
  27.   type: ExternalName

ExternalName Service

  1. ---
  2. apiVersion: traefik.containo.us/v1alpha1
  3. kind: IngressRoute
  4. metadata:
  5.   name: test.route
  6.   namespace: default
  8. spec:
  9.   entryPoints:
  10.     - foo
  12.   routes:
  13.   - match: Host(`example.net`)
  14.     kind: Rule
  15.     services:
  16.     - name: external-svc
  18. ---
  19. apiVersion: v1
  20. kind: Service
  21. metadata:
  22.   name: external-svc
  23.   namespace: default
  24. spec:
  25.   externalName: external.domain
  26.   type: ExternalName
  27.   ports:
  28.     - port: 80

Both sides

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Load Balancing

More information in the dedicated server load balancing section.

Declaring and using Kubernetes Service Load Balancing

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: svc1
      namespace: default
    - name: svc2
      namespace: default

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

Kind: Middleware

Middleware is the CRD implementation of a Traefik middleware.

Register the Middleware kind in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

Declaring and Referencing a Middleware

Middleware

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: foo

spec:
  stripPrefix:
    prefixes:
      - /stripit

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: stripprefix
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available middlewares in the dedicated middlewares section.

Kind: TraefikService

TraefikService is the CRD implementation of a “Traefik Service”.

Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the IngressRoute objects, or recursively in others TraefikService objects.

Disambiguate Traefik and Kubernetes Services

As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

The field kind allows the following values:

TraefikService object allows to use any (valid) combinations of:

Weighted Round Robin

More information in the dedicated Weighted Round Robin service load balancing section.

Declaring and Using Weighted Round Robin

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: svc1
        port: 80
        weight: 1
      - name: wrr2
        kind: TraefikService
        weight: 1
      - name: mirror1
        kind: TraefikService
        weight: 1

---
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
  name: wrr2
  namespace: default

spec:
  weighted:
    services:
      - name: svc2
        port: 80
        weight: 1
      - name: svc3
        port: 80
        weight: 1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2
---
apiVersion: v1
kind: Service
metadata:
  name: svc3
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app3

Mirroring

More information in the dedicated mirroring service section.

Declaring and Using Mirroring

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: mirror1
      namespace: default
      kind: TraefikService

Mirroring k8s Service

# Mirroring from a k8s Service
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: svc1
    port: 80
    mirrors:
      - name: svc2
        port: 80
        percent: 20
      - name: svc3
        kind: TraefikService
        percent: 20

Mirroring Traefik Service

# Mirroring from a Traefik Service
apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: wrr1
    kind: TraefikService
     mirrors:
       - name: svc2
         port: 80
         percent: 20
       - name: svc3
         kind: TraefikService
         percent: 20

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax ([[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection)) should be used to refer to the TraefikService, just as in the middleware case.

Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

Stickiness and load-balancing

As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

Stickiness on two load-balancing levels

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.containo.us/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: whoami1
        kind: Service
        port: 80
        weight: 1
        sticky:
          cookie:
            name: lvl2
      - name: whoami2
        kind: Service
        weight: 1
        port: 80
        sticky:
          cookie:
            name: lvl2
    sticky:
      cookie:
        name: lvl1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: whoami1

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami1

---
apiVersion: v1
kind: Service
metadata:
  name: whoami2

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami2

Deployment (to illustrate replicas)

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami1
  labels:
    app: whoami1

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami1
  template:
    metadata:
      labels:
        app: whoami1
    spec:
      containers:
        - name: whoami1
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami2
  labels:
    app: whoami2

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami2
  template:
    metadata:
      labels:
        app: whoami2
    spec:
      containers:
        - name: whoami2
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

Kind: IngressRouteTCP

IngressRouteTCP is the CRD implementation of a Traefik TCP router.

Register the IngressRouteTCP kind in the Kubernetes cluster before creating IngressRouteTCP objects.

IngressRouteTCP Attributes

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:                  # [1]
    - footcp
  routes:                       # [2]
  - match: HostSNI(`*`)         # [3]
    priority: 10                # [4]
    middlewares:
    - name: middleware1         # [5]
      namespace: default        # [6]
    services:                   # [7]
    - name: foo                 # [8]
      port: 8080                # [9]
      weight: 10                # [10]
      terminationDelay: 400     # [11]
      proxyProtocol:            # [12]
        version: 1              # [13]
  tls:                          # [14]
    secretName: supersecret     # [15]
    options:                    # [16]
      name: opt                 # [17]
      namespace: default        # [18]
    certResolver: foo           # [19]
    domains:                    # [20]
    - main: example.net         # [21]
      sans:                     # [22]
      - a.example.net
      - b.example.net
    passthrough: false          # [23]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].matchDefines the rule of the underlying router
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]middlewares[n].nameDefines the MiddlewareTCP name
[6]middlewares[n].namespaceDefines the MiddlewareTCP namespace
[7]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[8]services[n].nameDefines the name of a Kubernetes service
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].weightDefines the weight to apply to the server load balancing
[11]services[n].terminationDelaycorresponds to the deadline that the proxy sets, after one of its connected peers indicates it has closed the writing capability of its connection, to close the reading capability as well, hence fully terminating the connection. It is a duration in milliseconds, defaulting to 100. A negative value means an infinite deadline (i.e. the reading capability is never closed).
[12]proxyProtocolDefines the PROXY protocol configuration
[13]versionDefines the PROXY protocol version
[14]tlsDefines TLS certificate configuration
[15]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[16]tls.optionsDefines the reference to a TLSOption
[17]options.nameDefines the TLSOption name
[18]options.namespaceDefines the TLSOption namespace
[19]tls.certResolverDefines the reference to a CertResolver
[20]tls.domainsList of domains
[21]domains[n].mainDefines the main domain name
[22]domains[n].sansList of SANs (alternative domains)
[23]tls.passthroughIf true, delegates the TLS termination to the backend

Declaring an IngressRouteTCP

IngressRouteTCP

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:
    - footcp
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    priority: 10
    services:
    - name: foo
      port: 8080
      terminationDelay: 400
      weight: 10
    - name: bar
      port: 8081
      terminationDelay: 500
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret
    passthrough: false

TLSOption

apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteTCP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

Only on IngressRouteTCP

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

On both sides

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kind: MiddlewareTCP

MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.

Register the MiddlewareTCP kind in the Kubernetes cluster before creating MiddlewareTCP objects or referencing TCP middlewares in the IngressRouteTCP objects.

Declaring and Referencing a MiddlewareTCP

Middleware

apiVersion: traefik.containo.us/v1alpha1
kind: MiddlewareTCP
metadata:
  name: ipwhitelist
spec:
  ipWhiteList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/whitelist`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: ipwhitelist
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the TCP middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a MiddlewareTCP from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available TCP middlewares in the dedicated middlewares section.

Kind: IngressRouteUDP

IngressRouteUDP is the CRD implementation of a Traefik UDP router.

Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

IngressRouteUDP Attributes

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:                  # [1]
    - fooudp
  routes:                       # [2]
  - services:                   # [3]
    - name: foo                 # [4]
      port: 8080                # [5]
      weight: 10                # [6]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[4]services[n].nameDefines the name of a Kubernetes service
[6]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[7]services[n].weightDefines the weight to apply to the server load balancing

Declaring an IngressRouteUDP

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteUDP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteUDP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRouteUDP

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kind: TLSOption

TLSOption is the CRD implementation of a Traefik “TLS Option”.

Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the IngressRoute / IngressRouteTCP objects.

TLSOption Attributes

TLSOption

apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption                             # [1]
  namespace: default

spec:
  minVersion: VersionTLS12                      # [2]
  maxVersion: VersionTLS13                      # [3]
  curvePreferences:                             # [4]
    - CurveP521
    - CurveP384
  cipherSuites:                                 # [5]
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:                                   # [6]
    secretNames:                                # [7]
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven     # [8]
  sniStrict: true                               # [9]
  alpnProtocols:                                # [10]
    - foobar
RefAttributePurpose
[1]nameDefines the name of the TLSOption resource. One can use default as name to redefine the default TLSOption.
[2]minVersionDefines the minimum TLS version that is acceptable.
[3]maxVersionDefines the maximum TLS version that is acceptable.
[4]cipherSuiteslist of supported cipher suites for TLS versions up to TLS 1.2.
[5]curvePreferencesList of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
[6]clientAuthdetermines the server’s policy for TLS Client Authentication.
[7]clientAuth.secretNameslist of names of the referenced Kubernetes Secrets (in TLSOption namespace). The secret must contain a certificate under either a tls.ca or a ca.crt key.
[8]clientAuth.clientAuthTypedefines the client authentication type to apply. The available values are: NoClientCert, RequestClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
[9]sniStrictif true, Traefik won’t allow connections from clients connections that do not specify a server_name extension.
[10]alpnProtocolsList of supported application level protocols for the TLS handshake, in order of preference.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a TLSOption

TLSOption

apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption
  namespace: default

spec:
  minVersion: VersionTLS12
  sniStrict: true
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:
    secretNames:
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    options: 
      name: mytlsoption
      namespace: default

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: secret-ca1
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-ca2
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

Additionally, when the definition of the TLS option is from another provider, the cross-provider syntax ([[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection)) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

Kind: TLSStore

TLSStore is the CRD implementation of a Traefik “TLS Store”.

Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects or referencing TLS stores in the IngressRoute / IngressRouteTCP objects.

Default TLS Store

Traefik currently only uses the TLS Store named “default”. This means that you cannot have two stores that are named default in different Kubernetes namespaces. For the time being, please only configure one TLSStore named default.

TLSStore Attributes

TLSStore

apiVersion: traefik.containo.us/v1alpha1
kind: TLSStore
metadata:
  name: default
  namespace: default
spec:
  certificates:                            # [1]
    - secretName: foo                      
    - secretName: bar
  defaultCertificate:                      # [2]
    secretName: secret
RefAttributePurpose
[1]certificatesList of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store.
[2]defaultCertificateName of a Kubernetes Secret that holds the default key/certificate pair for the store.

Declaring and referencing a TLSStore

TLSStore

apiVersion: traefik.containo.us/v1alpha1
kind: TLSStore
metadata:
  name: default
  namespace: default

spec:
  defaultCertificate:
    secretName:  supersecret

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    store: 
      name: default

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Kind: ServersTransport

ServersTransport is the CRD implementation of a ServersTransport.

Default serversTransport

If no serversTransport is specified, the [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection) will be used. The [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection) serversTransport is created from the static configuration.

ServersTransport Attributes

ServersTransport

apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: foobar               # [1]
  insecureSkipVerify: true         # [2]
  rootCAsSecrets:                  # [3]
    - foobar
    - foobar
  certificatesSecrets:             # [4]
    - foobar
    - foobar
  maxIdleConnsPerHost: 1           # [5]
  forwardingTimeouts:              # [6]
    dialTimeout: 42s               # [7]
    responseHeaderTimeout: 42s     # [8]
    idleConnTimeout: 42s           # [9]
  peerCertURI: foobar              # [10]
  disableHTTP2: true               # [11]
RefAttributePurpose
[1]serverNameServerName used to contact the server.
[2]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[3]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[4]certificatesSecretsCertificates to present to the server for mTLS.
[5]maxIdleConnsPerHostControls the maximum idle (keep-alive) connections to keep per-host. If zero, defaultMaxIdleConnsPerHost is used.
[6]forwardingTimeoutsTimeouts for requests forwarded to the servers.
[7]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[8]responseHeaderTimeoutThe amount of time to wait for a server’s response headers after fully writing the request (including its body, if any). If zero, no timeout exists.
[9]idleConnTimeoutThe maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists.
[10]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[11]disableHTTP2Disables HTTP/2 for connections with servers.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransport

ServersTransport

apiVersion: traefik.containo.us/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

ServersTransport reference

By default, the referenced ServersTransport CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransport CRD from another namespace, the value must be of form [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection), and the cross-namespace option must be enabled.

If the ServersTransport CRD is defined in another provider the cross-provider format [[email protected]](https://doc.traefik.io/cdn-cgi/l/email-protection) should be used.

Further

Also see the full example with Let’s Encrypt.

Using Traefik for Business Applications?

If you are using Traefik for commercial applications, consider the Enterprise Edition. You can use it as your:

Traefik Enterprise enables centralized access management, distributed Let’s Encrypt, and other advanced capabilities. Learn more in this 15-minute technical walkthrough.