Traefik & Kubernetes

The Kubernetes Ingress Controller, The Custom Resource Way.

Configuration Examples

Configuring KubernetesCRD and Deploying/Exposing Services

Resource Definition

  1. # All resources definition must be declared
  2. ---
  3. apiVersion: apiextensions.k8s.io/v1
  4. kind: CustomResourceDefinition
  5. metadata:
  6.   annotations:
  7.     controller-gen.kubebuilder.io/version: v0.14.0
  8.   name: ingressroutes.traefik.io
  9. spec:
  10.   group: traefik.io
  11.   names:
  12.     kind: IngressRoute
  13.     listKind: IngressRouteList
  14.     plural: ingressroutes
  15.     singular: ingressroute
  16.   scope: Namespaced
  17.   versions:
  18.   - name: v1alpha1
  19.     schema:
  20.       openAPIV3Schema:
  21.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  22.         properties:
  23.           apiVersion:
  24.             description: |-
  25.               APIVersion defines the versioned schema of this representation of an object.
  26.               Servers should convert recognized schemas to the latest internal value, and
  27.               may reject unrecognized values.
  28.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  29.             type: string
  30.           kind:
  31.             description: |-
  32.               Kind is a string value representing the REST resource this object represents.
  33.               Servers may infer this from the endpoint the client submits requests to.
  34.               Cannot be updated.
  35.               In CamelCase.
  36.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  37.             type: string
  38.           metadata:
  39.             type: object
  40.           spec:
  41.             description: IngressRouteSpec defines the desired state of IngressRoute.
  42.             properties:
  43.               entryPoints:
  44.                 description: |-
  45.                   EntryPoints defines the list of entry point names to bind to.
  46.                   Entry points have to be configured in the static configuration.
  47.                   More info: https://doc.traefik.io/traefik/v3.0/routing/entrypoints/
  48.                   Default: all.
  49.                 items:
  50.                   type: string
  51.                 type: array
  52.               routes:
  53.                 description: Routes defines the list of routes.
  54.                 items:
  55.                   description: Route holds the HTTP route configuration.
  56.                   properties:
  57.                     kind:
  58.                       description: |-
  59.                         Kind defines the kind of the route.
  60.                         Rule is the only supported kind.
  61.                       enum:
  62.                       - Rule
  63.                       type: string
  64.                     match:
  65.                       description: |-
  66.                         Match defines the router's rule.
  67.                         More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#rule
  68.                       type: string
  69.                     middlewares:
  70.                       description: |-
  71.                         Middlewares defines the list of references to Middleware resources.
  72.                         More info: https://doc.traefik.io/traefik/v3.0/routing/providers/kubernetes-crd/#kind-middleware
  73.                       items:
  74.                         description: MiddlewareRef is a reference to a Middleware
  75.                           resource.
  76.                         properties:
  77.                           name:
  78.                             description: Name defines the name of the referenced Middleware
  79.                               resource.
  80.                             type: string
  81.                           namespace:
  82.                             description: Namespace defines the namespace of the referenced
  83.                               Middleware resource.
  84.                             type: string
  85.                         required:
  86.                         - name
  87.                         type: object
  88.                       type: array
  89.                     priority:
  90.                       description: |-
  91.                         Priority defines the router's priority.
  92.                         More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#priority
  93.                       type: integer
  94.                     services:
  95.                       description: |-
  96.                         Services defines the list of Service.
  97.                         It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
  98.                       items:
  99.                         description: Service defines an upstream HTTP service to proxy
  100.                           traffic to.
  101.                         properties:
  102.                           kind:
  103.                             description: Kind defines the kind of the Service.
  104.                             enum:
  105.                             - Service
  106.                             - TraefikService
  107.                             type: string
  108.                           name:
  109.                             description: |-
  110.                               Name defines the name of the referenced Kubernetes Service or TraefikService.
  111.                               The differentiation between the two is specified in the Kind field.
  112.                             type: string
  113.                           namespace:
  114.                             description: Namespace defines the namespace of the referenced
  115.                               Kubernetes Service or TraefikService.
  116.                             type: string
  117.                           nativeLB:
  118.                             description: |-
  119.                               NativeLB controls, when creating the load-balancer,
  120.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  121.                               The Kubernetes Service itself does load-balance to the pods.
  122.                               By default, NativeLB is false.
  123.                             type: boolean
  124.                           passHostHeader:
  125.                             description: |-
  126.                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  127.                               By default, passHostHeader is true.
  128.                             type: boolean
  129.                           port:
  130.                             anyOf:
  131.                             - type: integer
  132.                             - type: string
  133.                             description: |-
  134.                               Port defines the port of a Kubernetes Service.
  135.                               This can be a reference to a named port.
  136.                             x-kubernetes-int-or-string: true
  137.                           responseForwarding:
  138.                             description: ResponseForwarding defines how Traefik forwards
  139.                               the response from the upstream Kubernetes Service to
  140.                               the client.
  141.                             properties:
  142.                               flushInterval:
  143.                                 description: |-
  144.                                   FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  145.                                   A negative value means to flush immediately after each write to the client.
  146.                                   This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  147.                                   for such responses, writes are flushed to the client immediately.
  148.                                   Default: 100ms
  149.                                 type: string
  150.                             type: object
  151.                           scheme:
  152.                             description: |-
  153.                               Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  154.                               It defaults to https when Kubernetes Service port is 443, http otherwise.
  155.                             type: string
  156.                           serversTransport:
  157.                             description: |-
  158.                               ServersTransport defines the name of ServersTransport resource to use.
  159.                               It allows to configure the transport between Traefik and your servers.
  160.                               Can only be used on a Kubernetes Service.
  161.                             type: string
  162.                           sticky:
  163.                             description: |-
  164.                               Sticky defines the sticky sessions configuration.
  165.                               More info: https://doc.traefik.io/traefik/v3.0/routing/services/#sticky-sessions
  166.                             properties:
  167.                               cookie:
  168.                                 description: Cookie defines the sticky cookie configuration.
  169.                                 properties:
  170.                                   httpOnly:
  171.                                     description: HTTPOnly defines whether the cookie
  172.                                       can be accessed by client-side APIs, such as
  173.                                       JavaScript.
  174.                                     type: boolean
  175.                                   maxAge:
  176.                                     description: |-
  177.                                       MaxAge indicates the number of seconds until the cookie expires.
  178.                                       When set to a negative number, the cookie expires immediately.
  179.                                       When set to zero, the cookie never expires.
  180.                                     type: integer
  181.                                   name:
  182.                                     description: Name defines the Cookie name.
  183.                                     type: string
  184.                                   sameSite:
  185.                                     description: |-
  186.                                       SameSite defines the same site policy.
  187.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  188.                                     type: string
  189.                                   secure:
  190.                                     description: Secure defines whether the cookie
  191.                                       can only be transmitted over an encrypted connection
  192.                                       (i.e. HTTPS).
  193.                                     type: boolean
  194.                                 type: object
  195.                             type: object
  196.                           strategy:
  197.                             description: |-
  198.                               Strategy defines the load balancing strategy between the servers.
  199.                               RoundRobin is the only supported value at the moment.
  200.                             type: string
  201.                           weight:
  202.                             description: |-
  203.                               Weight defines the weight and should only be specified when Name references a TraefikService object
  204.                               (and to be precise, one that embeds a Weighted Round Robin).
  205.                             type: integer
  206.                         required:
  207.                         - name
  208.                         type: object
  209.                       type: array
  210.                     syntax:
  211.                       description: |-
  212.                         Syntax defines the router's rule syntax.
  213.                         More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#rulesyntax
  214.                       type: string
  215.                   required:
  216.                   - kind
  217.                   - match
  218.                   type: object
  219.                 type: array
  220.               tls:
  221.                 description: |-
  222.                   TLS defines the TLS configuration.
  223.                   More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#tls
  224.                 properties:
  225.                   certResolver:
  226.                     description: |-
  227.                       CertResolver defines the name of the certificate resolver to use.
  228.                       Cert resolvers have to be configured in the static configuration.
  229.                       More info: https://doc.traefik.io/traefik/v3.0/https/acme/#certificate-resolvers
  230.                     type: string
  231.                   domains:
  232.                     description: |-
  233.                       Domains defines the list of domains that will be used to issue certificates.
  234.                       More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#domains
  235.                     items:
  236.                       description: Domain holds a domain name with SANs.
  237.                       properties:
  238.                         main:
  239.                           description: Main defines the main domain name.
  240.                           type: string
  241.                         sans:
  242.                           description: SANs defines the subject alternative domain
  243.                             names.
  244.                           items:
  245.                             type: string
  246.                           type: array
  247.                       type: object
  248.                     type: array
  249.                   options:
  250.                     description: |-
  251.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  252.                       If not defined, the `default` TLSOption is used.
  253.                       More info: https://doc.traefik.io/traefik/v3.0/https/tls/#tls-options
  254.                     properties:
  255.                       name:
  256.                         description: |-
  257.                           Name defines the name of the referenced TLSOption.
  258.                           More info: https://doc.traefik.io/traefik/v3.0/routing/providers/kubernetes-crd/#kind-tlsoption
  259.                         type: string
  260.                       namespace:
  261.                         description: |-
  262.                           Namespace defines the namespace of the referenced TLSOption.
  263.                           More info: https://doc.traefik.io/traefik/v3.0/routing/providers/kubernetes-crd/#kind-tlsoption
  264.                         type: string
  265.                     required:
  266.                     - name
  267.                     type: object
  268.                   secretName:
  269.                     description: SecretName is the name of the referenced Kubernetes
  270.                       Secret to specify the certificate details.
  271.                     type: string
  272.                   store:
  273.                     description: |-
  274.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  275.                       Please note that only `default` TLSStore can be used.
  276.                     properties:
  277.                       name:
  278.                         description: |-
  279.                           Name defines the name of the referenced TLSStore.
  280.                           More info: https://doc.traefik.io/traefik/v3.0/routing/providers/kubernetes-crd/#kind-tlsstore
  281.                         type: string
  282.                       namespace:
  283.                         description: |-
  284.                           Namespace defines the namespace of the referenced TLSStore.
  285.                           More info: https://doc.traefik.io/traefik/v3.0/routing/providers/kubernetes-crd/#kind-tlsstore
  286.                         type: string
  287.                     required:
  288.                     - name
  289.                     type: object
  290.                 type: object
  291.             required:
  292.             - routes
  293.             type: object
  294.         required:
  295.         - metadata
  296.         - spec
  297.         type: object
  298.     served: true
  299.     storage: true
  300. ---
  301. apiVersion: apiextensions.k8s.io/v1
  302. kind: CustomResourceDefinition
  303. metadata:
  304.   annotations:
  305.     controller-gen.kubebuilder.io/version: v0.14.0
  306.   name: ingressroutetcps.traefik.io
  307. spec:
  308.   group: traefik.io
  309.   names:
  310.     kind: IngressRouteTCP
  311.     listKind: IngressRouteTCPList
  312.     plural: ingressroutetcps
  313.     singular: ingressroutetcp
  314.   scope: Namespaced
  315.   versions:
  316.   - name: v1alpha1
  317.     schema:
  318.       openAPIV3Schema:
  319.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  320.         properties:
  321.           apiVersion:
  322.             description: |-
  323.               APIVersion defines the versioned schema of this representation of an object.
  324.               Servers should convert recognized schemas to the latest internal value, and
  325.               may reject unrecognized values.
  326.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  327.             type: string
  328.           kind:
  329.             description: |-
  330.               Kind is a string value representing the REST resource this object represents.
  331.               Servers may infer this from the endpoint the client submits requests to.
  332.               Cannot be updated.
  333.               In CamelCase.
  334.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  335.             type: string
  336.           metadata:
  337.             type: object
  338.           spec:
  339.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  340.             properties:
  341.               entryPoints:
  342.                 description: |-
  343.                   EntryPoints defines the list of entry point names to bind to.
  344.                   Entry points have to be configured in the static configuration.
  345.                   More info: https://doc.traefik.io/traefik/v3.0/routing/entrypoints/
  346.                   Default: all.
  347.                 items:
  348.                   type: string
  349.                 type: array
  350.               routes:
  351.                 description: Routes defines the list of routes.
  352.                 items:
  353.                   description: RouteTCP holds the TCP route configuration.
  354.                   properties:
  355.                     match:
  356.                       description: |-
  357.                         Match defines the router's rule.
  358.                         More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#rule_1
  359.                       type: string
  360.                     middlewares:
  361.                       description: Middlewares defines the list of references to MiddlewareTCP
  362.                         resources.
  363.                       items:
  364.                         description: ObjectReference is a generic reference to a Traefik
  365.                           resource.
  366.                         properties:
  367.                           name:
  368.                             description: Name defines the name of the referenced Traefik
  369.                               resource.
  370.                             type: string
  371.                           namespace:
  372.                             description: Namespace defines the namespace of the referenced
  373.                               Traefik resource.
  374.                             type: string
  375.                         required:
  376.                         - name
  377.                         type: object
  378.                       type: array
  379.                     priority:
  380.                       description: |-
  381.                         Priority defines the router's priority.
  382.                         More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#priority_1
  383.                       type: integer
  384.                     services:
  385.                       description: Services defines the list of TCP services.
  386.                       items:
  387.                         description: ServiceTCP defines an upstream TCP service to
  388.                           proxy traffic to.
  389.                         properties:
  390.                           name:
  391.                             description: Name defines the name of the referenced Kubernetes
  392.                               Service.
  393.                             type: string
  394.                           namespace:
  395.                             description: Namespace defines the namespace of the referenced
  396.                               Kubernetes Service.
  397.                             type: string
  398.                           nativeLB:
  399.                             description: |-
  400.                               NativeLB controls, when creating the load-balancer,
  401.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  402.                               The Kubernetes Service itself does load-balance to the pods.
  403.                               By default, NativeLB is false.
  404.                             type: boolean
  405.                           port:
  406.                             anyOf:
  407.                             - type: integer
  408.                             - type: string
  409.                             description: |-
  410.                               Port defines the port of a Kubernetes Service.
  411.                               This can be a reference to a named port.
  412.                             x-kubernetes-int-or-string: true
  413.                           proxyProtocol:
  414.                             description: |-
  415.                               ProxyProtocol defines the PROXY protocol configuration.
  416.                               More info: https://doc.traefik.io/traefik/v3.0/routing/services/#proxy-protocol
  417.                             properties:
  418.                               version:
  419.                                 description: Version defines the PROXY Protocol version
  420.                                   to use.
  421.                                 type: integer
  422.                             type: object
  423.                           serversTransport:
  424.                             description: |-
  425.                               ServersTransport defines the name of ServersTransportTCP resource to use.
  426.                               It allows to configure the transport between Traefik and your servers.
  427.                               Can only be used on a Kubernetes Service.
  428.                             type: string
  429.                           terminationDelay:
  430.                             description: |-
  431.                               TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates
  432.                               it has closed the writing capability of its connection, to close the reading capability as well,
  433.                               hence fully terminating the connection.
  434.                               It is a duration in milliseconds, defaulting to 100.
  435.                               A negative value means an infinite deadline (i.e. the reading capability is never closed).
  436.                               Deprecated: TerminationDelay is not supported APIVersion traefik.io/v1, please use ServersTransport to configure the TerminationDelay instead.
  437.                             type: integer
  438.                           tls:
  439.                             description: TLS determines whether to use TLS when dialing
  440.                               with the backend.
  441.                             type: boolean
  442.                           weight:
  443.                             description: Weight defines the weight used when balancing
  444.                               requests between multiple Kubernetes Service.
  445.                             type: integer
  446.                         required:
  447.                         - name
  448.                         - port
  449.                         type: object
  450.                       type: array
  451.                     syntax:
  452.                       description: |-
  453.                         Syntax defines the router's rule syntax.
  454.                         More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#rulesyntax_1
  455.                       type: string
  456.                   required:
  457.                   - match
  458.                   type: object
  459.                 type: array
  460.               tls:
  461.                 description: |-
  462.                   TLS defines the TLS configuration on a layer 4 / TCP Route.
  463.                   More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#tls_1
  464.                 properties:
  465.                   certResolver:
  466.                     description: |-
  467.                       CertResolver defines the name of the certificate resolver to use.
  468.                       Cert resolvers have to be configured in the static configuration.
  469.                       More info: https://doc.traefik.io/traefik/v3.0/https/acme/#certificate-resolvers
  470.                     type: string
  471.                   domains:
  472.                     description: |-
  473.                       Domains defines the list of domains that will be used to issue certificates.
  474.                       More info: https://doc.traefik.io/traefik/v3.0/routing/routers/#domains
  475.                     items:
  476.                       description: Domain holds a domain name with SANs.
  477.                       properties:
  478.                         main:
  479.                           description: Main defines the main domain name.
  480.                           type: string
  481.                         sans:
  482.                           description: SANs defines the subject alternative domain
  483.                             names.
  484.                           items:
  485.                             type: string
  486.                           type: array
  487.                       type: object
  488.                     type: array
  489.                   options:
  490.                     description: |-
  491.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  492.                       If not defined, the `default` TLSOption is used.
  493.                       More info: https://doc.traefik.io/traefik/v3.0/https/tls/#tls-options
  494.                     properties:
  495.                       name:
  496.                         description: Name defines the name of the referenced Traefik
  497.                           resource.
  498.                         type: string
  499.                       namespace:
  500.                         description: Namespace defines the namespace of the referenced
  501.                           Traefik resource.
  502.                         type: string
  503.                     required:
  504.                     - name
  505.                     type: object
  506.                   passthrough:
  507.                     description: Passthrough defines whether a TLS router will terminate
  508.                       the TLS connection.
  509.                     type: boolean
  510.                   secretName:
  511.                     description: SecretName is the name of the referenced Kubernetes
  512.                       Secret to specify the certificate details.
  513.                     type: string
  514.                   store:
  515.                     description: |-
  516.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  517.                       Please note that only `default` TLSStore can be used.
  518.                     properties:
  519.                       name:
  520.                         description: Name defines the name of the referenced Traefik
  521.                           resource.
  522.                         type: string
  523.                       namespace:
  524.                         description: Namespace defines the namespace of the referenced
  525.                           Traefik resource.
  526.                         type: string
  527.                     required:
  528.                     - name
  529.                     type: object
  530.                 type: object
  531.             required:
  532.             - routes
  533.             type: object
  534.         required:
  535.         - metadata
  536.         - spec
  537.         type: object
  538.     served: true
  539.     storage: true
  540. ---
  541. apiVersion: apiextensions.k8s.io/v1
  542. kind: CustomResourceDefinition
  543. metadata:
  544.   annotations:
  545.     controller-gen.kubebuilder.io/version: v0.14.0
  546.   name: ingressrouteudps.traefik.io
  547. spec:
  548.   group: traefik.io
  549.   names:
  550.     kind: IngressRouteUDP
  551.     listKind: IngressRouteUDPList
  552.     plural: ingressrouteudps
  553.     singular: ingressrouteudp
  554.   scope: Namespaced
  555.   versions:
  556.   - name: v1alpha1
  557.     schema:
  558.       openAPIV3Schema:
  559.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  560.         properties:
  561.           apiVersion:
  562.             description: |-
  563.               APIVersion defines the versioned schema of this representation of an object.
  564.               Servers should convert recognized schemas to the latest internal value, and
  565.               may reject unrecognized values.
  566.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  567.             type: string
  568.           kind:
  569.             description: |-
  570.               Kind is a string value representing the REST resource this object represents.
  571.               Servers may infer this from the endpoint the client submits requests to.
  572.               Cannot be updated.
  573.               In CamelCase.
  574.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  575.             type: string
  576.           metadata:
  577.             type: object
  578.           spec:
  579.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  580.             properties:
  581.               entryPoints:
  582.                 description: |-
  583.                   EntryPoints defines the list of entry point names to bind to.
  584.                   Entry points have to be configured in the static configuration.
  585.                   More info: https://doc.traefik.io/traefik/v3.0/routing/entrypoints/
  586.                   Default: all.
  587.                 items:
  588.                   type: string
  589.                 type: array
  590.               routes:
  591.                 description: Routes defines the list of routes.
  592.                 items:
  593.                   description: RouteUDP holds the UDP route configuration.
  594.                   properties:
  595.                     services:
  596.                       description: Services defines the list of UDP services.
  597.                       items:
  598.                         description: ServiceUDP defines an upstream UDP service to
  599.                           proxy traffic to.
  600.                         properties:
  601.                           name:
  602.                             description: Name defines the name of the referenced Kubernetes
  603.                               Service.
  604.                             type: string
  605.                           namespace:
  606.                             description: Namespace defines the namespace of the referenced
  607.                               Kubernetes Service.
  608.                             type: string
  609.                           nativeLB:
  610.                             description: |-
  611.                               NativeLB controls, when creating the load-balancer,
  612.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  613.                               The Kubernetes Service itself does load-balance to the pods.
  614.                               By default, NativeLB is false.
  615.                             type: boolean
  616.                           port:
  617.                             anyOf:
  618.                             - type: integer
  619.                             - type: string
  620.                             description: |-
  621.                               Port defines the port of a Kubernetes Service.
  622.                               This can be a reference to a named port.
  623.                             x-kubernetes-int-or-string: true
  624.                           weight:
  625.                             description: Weight defines the weight used when balancing
  626.                               requests between multiple Kubernetes Service.
  627.                             type: integer
  628.                         required:
  629.                         - name
  630.                         - port
  631.                         type: object
  632.                       type: array
  633.                   type: object
  634.                 type: array
  635.             required:
  636.             - routes
  637.             type: object
  638.         required:
  639.         - metadata
  640.         - spec
  641.         type: object
  642.     served: true
  643.     storage: true
  644. ---
  645. apiVersion: apiextensions.k8s.io/v1
  646. kind: CustomResourceDefinition
  647. metadata:
  648.   annotations:
  649.     controller-gen.kubebuilder.io/version: v0.14.0
  650.   name: middlewares.traefik.io
  651. spec:
  652.   group: traefik.io
  653.   names:
  654.     kind: Middleware
  655.     listKind: MiddlewareList
  656.     plural: middlewares
  657.     singular: middleware
  658.   scope: Namespaced
  659.   versions:
  660.   - name: v1alpha1
  661.     schema:
  662.       openAPIV3Schema:
  663.         description: |-
  664.           Middleware is the CRD implementation of a Traefik Middleware.
  665.           More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/overview/
  666.         properties:
  667.           apiVersion:
  668.             description: |-
  669.               APIVersion defines the versioned schema of this representation of an object.
  670.               Servers should convert recognized schemas to the latest internal value, and
  671.               may reject unrecognized values.
  672.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  673.             type: string
  674.           kind:
  675.             description: |-
  676.               Kind is a string value representing the REST resource this object represents.
  677.               Servers may infer this from the endpoint the client submits requests to.
  678.               Cannot be updated.
  679.               In CamelCase.
  680.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  681.             type: string
  682.           metadata:
  683.             type: object
  684.           spec:
  685.             description: MiddlewareSpec defines the desired state of a Middleware.
  686.             properties:
  687.               addPrefix:
  688.                 description: |-
  689.                   AddPrefix holds the add prefix middleware configuration.
  690.                   This middleware updates the path of a request before forwarding it.
  691.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/addprefix/
  692.                 properties:
  693.                   prefix:
  694.                     description: |-
  695.                       Prefix is the string to add before the current path in the requested URL.
  696.                       It should include a leading slash (/).
  697.                     type: string
  698.                 type: object
  699.               basicAuth:
  700.                 description: |-
  701.                   BasicAuth holds the basic auth middleware configuration.
  702.                   This middleware restricts access to your services to known users.
  703.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/basicauth/
  704.                 properties:
  705.                   headerField:
  706.                     description: |-
  707.                       HeaderField defines a header field to store the authenticated user.
  708.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/basicauth/#headerfield
  709.                     type: string
  710.                   realm:
  711.                     description: |-
  712.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  713.                       Default: traefik.
  714.                     type: string
  715.                   removeHeader:
  716.                     description: |-
  717.                       RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service.
  718.                       Default: false.
  719.                     type: boolean
  720.                   secret:
  721.                     description: Secret is the name of the referenced Kubernetes Secret
  722.                       containing user credentials.
  723.                     type: string
  724.                 type: object
  725.               buffering:
  726.                 description: |-
  727.                   Buffering holds the buffering middleware configuration.
  728.                   This middleware retries or limits the size of requests that can be forwarded to backends.
  729.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/buffering/#maxrequestbodybytes
  730.                 properties:
  731.                   maxRequestBodyBytes:
  732.                     description: |-
  733.                       MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).
  734.                       If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.
  735.                       Default: 0 (no maximum).
  736.                     format: int64
  737.                     type: integer
  738.                   maxResponseBodyBytes:
  739.                     description: |-
  740.                       MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes).
  741.                       If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead.
  742.                       Default: 0 (no maximum).
  743.                     format: int64
  744.                     type: integer
  745.                   memRequestBodyBytes:
  746.                     description: |-
  747.                       MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory.
  748.                       Default: 1048576 (1Mi).
  749.                     format: int64
  750.                     type: integer
  751.                   memResponseBodyBytes:
  752.                     description: |-
  753.                       MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory.
  754.                       Default: 1048576 (1Mi).
  755.                     format: int64
  756.                     type: integer
  757.                   retryExpression:
  758.                     description: |-
  759.                       RetryExpression defines the retry conditions.
  760.                       It is a logical combination of functions with operators AND (&&) and OR (||).
  761.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/buffering/#retryexpression
  762.                     type: string
  763.                 type: object
  764.               chain:
  765.                 description: |-
  766.                   Chain holds the configuration of the chain middleware.
  767.                   This middleware enables to define reusable combinations of other pieces of middleware.
  768.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/chain/
  769.                 properties:
  770.                   middlewares:
  771.                     description: Middlewares is the list of MiddlewareRef which composes
  772.                       the chain.
  773.                     items:
  774.                       description: MiddlewareRef is a reference to a Middleware resource.
  775.                       properties:
  776.                         name:
  777.                           description: Name defines the name of the referenced Middleware
  778.                             resource.
  779.                           type: string
  780.                         namespace:
  781.                           description: Namespace defines the namespace of the referenced
  782.                             Middleware resource.
  783.                           type: string
  784.                       required:
  785.                       - name
  786.                       type: object
  787.                     type: array
  788.                 type: object
  789.               circuitBreaker:
  790.                 description: CircuitBreaker holds the circuit breaker configuration.
  791.                 properties:
  792.                   checkPeriod:
  793.                     anyOf:
  794.                     - type: integer
  795.                     - type: string
  796.                     description: CheckPeriod is the interval between successive checks
  797.                       of the circuit breaker condition (when in standby state).
  798.                     x-kubernetes-int-or-string: true
  799.                   expression:
  800.                     description: Expression is the condition that triggers the tripped
  801.                       state.
  802.                     type: string
  803.                   fallbackDuration:
  804.                     anyOf:
  805.                     - type: integer
  806.                     - type: string
  807.                     description: FallbackDuration is the duration for which the circuit
  808.                       breaker will wait before trying to recover (from a tripped state).
  809.                     x-kubernetes-int-or-string: true
  810.                   recoveryDuration:
  811.                     anyOf:
  812.                     - type: integer
  813.                     - type: string
  814.                     description: RecoveryDuration is the duration for which the circuit
  815.                       breaker will try to recover (as soon as it is in recovering
  816.                       state).
  817.                     x-kubernetes-int-or-string: true
  818.                   responseCode:
  819.                     description: ResponseCode is the status code that the circuit
  820.                       breaker will return while it is in the open state.
  821.                     type: integer
  822.                 type: object
  823.               compress:
  824.                 description: |-
  825.                   Compress holds the compress middleware configuration.
  826.                   This middleware compresses responses before sending them to the client, using gzip compression.
  827.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/compress/
  828.                 properties:
  829.                   excludedContentTypes:
  830.                     description: |-
  831.                       ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing.
  832.                       `application/grpc` is always excluded.
  833.                     items:
  834.                       type: string
  835.                     type: array
  836.                   includedContentTypes:
  837.                     description: IncludedContentTypes defines the list of content
  838.                       types to compare the Content-Type header of the responses before
  839.                       compressing.
  840.                     items:
  841.                       type: string
  842.                     type: array
  843.                   minResponseBodyBytes:
  844.                     description: |-
  845.                       MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed.
  846.                       Default: 1024.
  847.                     type: integer
  848.                 type: object
  849.               contentType:
  850.                 description: |-
  851.                   ContentType holds the content-type middleware configuration.
  852.                   This middleware exists to enable the correct behavior until at least the default one can be changed in a future version.
  853.                 properties:
  854.                   autoDetect:
  855.                     description: |-
  856.                       AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend,
  857.                       be automatically set to a value derived from the contents of the response.
  858.                       Deprecated: AutoDetect option is deprecated, Content-Type middleware is only meant to be used to enable the content-type detection, please remove any usage of this option.
  859.                     type: boolean
  860.                 type: object
  861.               digestAuth:
  862.                 description: |-
  863.                   DigestAuth holds the digest auth middleware configuration.
  864.                   This middleware restricts access to your services to known users.
  865.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/digestauth/
  866.                 properties:
  867.                   headerField:
  868.                     description: |-
  869.                       HeaderField defines a header field to store the authenticated user.
  870.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/basicauth/#headerfield
  871.                     type: string
  872.                   realm:
  873.                     description: |-
  874.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  875.                       Default: traefik.
  876.                     type: string
  877.                   removeHeader:
  878.                     description: RemoveHeader defines whether to remove the authorization
  879.                       header before forwarding the request to the backend.
  880.                     type: boolean
  881.                   secret:
  882.                     description: Secret is the name of the referenced Kubernetes Secret
  883.                       containing user credentials.
  884.                     type: string
  885.                 type: object
  886.               errors:
  887.                 description: |-
  888.                   ErrorPage holds the custom error middleware configuration.
  889.                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
  890.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/errorpages/
  891.                 properties:
  892.                   query:
  893.                     description: |-
  894.                       Query defines the URL for the error page (hosted by service).
  895.                       The {status} variable can be used in order to insert the status code in the URL.
  896.                     type: string
  897.                   service:
  898.                     description: |-
  899.                       Service defines the reference to a Kubernetes Service that will serve the error page.
  900.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/errorpages/#service
  901.                     properties:
  902.                       kind:
  903.                         description: Kind defines the kind of the Service.
  904.                         enum:
  905.                         - Service
  906.                         - TraefikService
  907.                         type: string
  908.                       name:
  909.                         description: |-
  910.                           Name defines the name of the referenced Kubernetes Service or TraefikService.
  911.                           The differentiation between the two is specified in the Kind field.
  912.                         type: string
  913.                       namespace:
  914.                         description: Namespace defines the namespace of the referenced
  915.                           Kubernetes Service or TraefikService.
  916.                         type: string
  917.                       nativeLB:
  918.                         description: |-
  919.                           NativeLB controls, when creating the load-balancer,
  920.                           whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  921.                           The Kubernetes Service itself does load-balance to the pods.
  922.                           By default, NativeLB is false.
  923.                         type: boolean
  924.                       passHostHeader:
  925.                         description: |-
  926.                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  927.                           By default, passHostHeader is true.
  928.                         type: boolean
  929.                       port:
  930.                         anyOf:
  931.                         - type: integer
  932.                         - type: string
  933.                         description: |-
  934.                           Port defines the port of a Kubernetes Service.
  935.                           This can be a reference to a named port.
  936.                         x-kubernetes-int-or-string: true
  937.                       responseForwarding:
  938.                         description: ResponseForwarding defines how Traefik forwards
  939.                           the response from the upstream Kubernetes Service to the
  940.                           client.
  941.                         properties:
  942.                           flushInterval:
  943.                             description: |-
  944.                               FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  945.                               A negative value means to flush immediately after each write to the client.
  946.                               This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  947.                               for such responses, writes are flushed to the client immediately.
  948.                               Default: 100ms
  949.                             type: string
  950.                         type: object
  951.                       scheme:
  952.                         description: |-
  953.                           Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  954.                           It defaults to https when Kubernetes Service port is 443, http otherwise.
  955.                         type: string
  956.                       serversTransport:
  957.                         description: |-
  958.                           ServersTransport defines the name of ServersTransport resource to use.
  959.                           It allows to configure the transport between Traefik and your servers.
  960.                           Can only be used on a Kubernetes Service.
  961.                         type: string
  962.                       sticky:
  963.                         description: |-
  964.                           Sticky defines the sticky sessions configuration.
  965.                           More info: https://doc.traefik.io/traefik/v3.0/routing/services/#sticky-sessions
  966.                         properties:
  967.                           cookie:
  968.                             description: Cookie defines the sticky cookie configuration.
  969.                             properties:
  970.                               httpOnly:
  971.                                 description: HTTPOnly defines whether the cookie can
  972.                                   be accessed by client-side APIs, such as JavaScript.
  973.                                 type: boolean
  974.                               maxAge:
  975.                                 description: |-
  976.                                   MaxAge indicates the number of seconds until the cookie expires.
  977.                                   When set to a negative number, the cookie expires immediately.
  978.                                   When set to zero, the cookie never expires.
  979.                                 type: integer
  980.                               name:
  981.                                 description: Name defines the Cookie name.
  982.                                 type: string
  983.                               sameSite:
  984.                                 description: |-
  985.                                   SameSite defines the same site policy.
  986.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  987.                                 type: string
  988.                               secure:
  989.                                 description: Secure defines whether the cookie can
  990.                                   only be transmitted over an encrypted connection
  991.                                   (i.e. HTTPS).
  992.                                 type: boolean
  993.                             type: object
  994.                         type: object
  995.                       strategy:
  996.                         description: |-
  997.                           Strategy defines the load balancing strategy between the servers.
  998.                           RoundRobin is the only supported value at the moment.
  999.                         type: string
  1000.                       weight:
  1001.                         description: |-
  1002.                           Weight defines the weight and should only be specified when Name references a TraefikService object
  1003.                           (and to be precise, one that embeds a Weighted Round Robin).
  1004.                         type: integer
  1005.                     required:
  1006.                     - name
  1007.                     type: object
  1008.                   status:
  1009.                     description: |-
  1010.                       Status defines which status or range of statuses should result in an error page.
  1011.                       It can be either a status code as a number (500),
  1012.                       as multiple comma-separated numbers (500,502),
  1013.                       as ranges by separating two codes with a dash (500-599),
  1014.                       or a combination of the two (404,418,500-599).
  1015.                     items:
  1016.                       type: string
  1017.                     type: array
  1018.                 type: object
  1019.               forwardAuth:
  1020.                 description: |-
  1021.                   ForwardAuth holds the forward auth middleware configuration.
  1022.                   This middleware delegates the request authentication to a Service.
  1023.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/forwardauth/
  1024.                 properties:
  1025.                   addAuthCookiesToResponse:
  1026.                     description: AddAuthCookiesToResponse defines the list of cookies
  1027.                       to copy from the authentication server response to the response.
  1028.                     items:
  1029.                       type: string
  1030.                     type: array
  1031.                   address:
  1032.                     description: Address defines the authentication server address.
  1033.                     type: string
  1034.                   authRequestHeaders:
  1035.                     description: |-
  1036.                       AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
  1037.                       If not set or empty then all request headers are passed.
  1038.                     items:
  1039.                       type: string
  1040.                     type: array
  1041.                   authResponseHeaders:
  1042.                     description: AuthResponseHeaders defines the list of headers to
  1043.                       copy from the authentication server response and set on forwarded
  1044.                       request, replacing any existing conflicting headers.
  1045.                     items:
  1046.                       type: string
  1047.                     type: array
  1048.                   authResponseHeadersRegex:
  1049.                     description: |-
  1050.                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
  1051.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/forwardauth/#authresponseheadersregex
  1052.                     type: string
  1053.                   tls:
  1054.                     description: TLS defines the configuration used to secure the
  1055.                       connection to the authentication server.
  1056.                     properties:
  1057.                       caOptional:
  1058.                         description: 'Deprecated: TLS client authentication is a server
  1059.                           side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634).'
  1060.                         type: boolean
  1061.                       caSecret:
  1062.                         description: |-
  1063.                           CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate.
  1064.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  1065.                         type: string
  1066.                       certSecret:
  1067.                         description: |-
  1068.                           CertSecret is the name of the referenced Kubernetes Secret containing the client certificate.
  1069.                           The client certificate is extracted from the keys `tls.crt` and `tls.key`.
  1070.                         type: string
  1071.                       insecureSkipVerify:
  1072.                         description: InsecureSkipVerify defines whether the server
  1073.                           certificates should be validated.
  1074.                         type: boolean
  1075.                     type: object
  1076.                   trustForwardHeader:
  1077.                     description: 'TrustForwardHeader defines whether to trust (ie:
  1078.                       forward) all X-Forwarded-* headers.'
  1079.                     type: boolean
  1080.                 type: object
  1081.               grpcWeb:
  1082.                 description: |-
  1083.                   GrpcWeb holds the gRPC web middleware configuration.
  1084.                   This middleware converts a gRPC web request to an HTTP/2 gRPC request.
  1085.                 properties:
  1086.                   allowOrigins:
  1087.                     description: |-
  1088.                       AllowOrigins is a list of allowable origins.
  1089.                       Can also be a wildcard origin "*".
  1090.                     items:
  1091.                       type: string
  1092.                     type: array
  1093.                 type: object
  1094.               headers:
  1095.                 description: |-
  1096.                   Headers holds the headers middleware configuration.
  1097.                   This middleware manages the requests and responses headers.
  1098.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/headers/#customrequestheaders
  1099.                 properties:
  1100.                   accessControlAllowCredentials:
  1101.                     description: AccessControlAllowCredentials defines whether the
  1102.                       request can include user credentials.
  1103.                     type: boolean
  1104.                   accessControlAllowHeaders:
  1105.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  1106.                       values sent in preflight response.
  1107.                     items:
  1108.                       type: string
  1109.                     type: array
  1110.                   accessControlAllowMethods:
  1111.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  1112.                       values sent in preflight response.
  1113.                     items:
  1114.                       type: string
  1115.                     type: array
  1116.                   accessControlAllowOriginList:
  1117.                     description: AccessControlAllowOriginList is a list of allowable
  1118.                       origins. Can also be a wildcard origin "*".
  1119.                     items:
  1120.                       type: string
  1121.                     type: array
  1122.                   accessControlAllowOriginListRegex:
  1123.                     description: AccessControlAllowOriginListRegex is a list of allowable
  1124.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  1125.                     items:
  1126.                       type: string
  1127.                     type: array
  1128.                   accessControlExposeHeaders:
  1129.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  1130.                       values sent in preflight response.
  1131.                     items:
  1132.                       type: string
  1133.                     type: array
  1134.                   accessControlMaxAge:
  1135.                     description: AccessControlMaxAge defines the time that a preflight
  1136.                       request may be cached.
  1137.                     format: int64
  1138.                     type: integer
  1139.                   addVaryHeader:
  1140.                     description: AddVaryHeader defines whether the Vary header is
  1141.                       automatically added/updated when the AccessControlAllowOriginList
  1142.                       is set.
  1143.                     type: boolean
  1144.                   allowedHosts:
  1145.                     description: AllowedHosts defines the fully qualified list of
  1146.                       allowed domain names.
  1147.                     items:
  1148.                       type: string
  1149.                     type: array
  1150.                   browserXssFilter:
  1151.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  1152.                       header with the value 1; mode=block.
  1153.                     type: boolean
  1154.                   contentSecurityPolicy:
  1155.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  1156.                       header value.
  1157.                     type: string
  1158.                   contentTypeNosniff:
  1159.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  1160.                       header with the nosniff value.
  1161.                     type: boolean
  1162.                   customBrowserXSSValue:
  1163.                     description: |-
  1164.                       CustomBrowserXSSValue defines the X-XSS-Protection header value.
  1165.                       This overrides the BrowserXssFilter option.
  1166.                     type: string
  1167.                   customFrameOptionsValue:
  1168.                     description: |-
  1169.                       CustomFrameOptionsValue defines the X-Frame-Options header value.
  1170.                       This overrides the FrameDeny option.
  1171.                     type: string
  1172.                   customRequestHeaders:
  1173.                     additionalProperties:
  1174.                       type: string
  1175.                     description: CustomRequestHeaders defines the header names and
  1176.                       values to apply to the request.
  1177.                     type: object
  1178.                   customResponseHeaders:
  1179.                     additionalProperties:
  1180.                       type: string
  1181.                     description: CustomResponseHeaders defines the header names and
  1182.                       values to apply to the response.
  1183.                     type: object
  1184.                   featurePolicy:
  1185.                     description: 'Deprecated: FeaturePolicy option is deprecated,
  1186.                       please use PermissionsPolicy instead.'
  1187.                     type: string
  1188.                   forceSTSHeader:
  1189.                     description: ForceSTSHeader defines whether to add the STS header
  1190.                       even when the connection is HTTP.
  1191.                     type: boolean
  1192.                   frameDeny:
  1193.                     description: FrameDeny defines whether to add the X-Frame-Options
  1194.                       header with the DENY value.
  1195.                     type: boolean
  1196.                   hostsProxyHeaders:
  1197.                     description: HostsProxyHeaders defines the header keys that may
  1198.                       hold a proxied hostname value for the request.
  1199.                     items:
  1200.                       type: string
  1201.                     type: array
  1202.                   isDevelopment:
  1203.                     description: |-
  1204.                       IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing.
  1205.                       Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain.
  1206.                       If you would like your development environment to mimic production with complete Host blocking, SSL redirects,
  1207.                       and STS headers, leave this as false.
  1208.                     type: boolean
  1209.                   permissionsPolicy:
  1210.                     description: |-
  1211.                       PermissionsPolicy defines the Permissions-Policy header value.
  1212.                       This allows sites to control browser features.
  1213.                     type: string
  1214.                   publicKey:
  1215.                     description: PublicKey is the public key that implements HPKP
  1216.                       to prevent MITM attacks with forged certificates.
  1217.                     type: string
  1218.                   referrerPolicy:
  1219.                     description: |-
  1220.                       ReferrerPolicy defines the Referrer-Policy header value.
  1221.                       This allows sites to control whether browsers forward the Referer header to other sites.
  1222.                     type: string
  1223.                   sslForceHost:
  1224.                     description: 'Deprecated: SSLForceHost option is deprecated, please
  1225.                       use RedirectRegex instead.'
  1226.                     type: boolean
  1227.                   sslHost:
  1228.                     description: 'Deprecated: SSLHost option is deprecated, please
  1229.                       use RedirectRegex instead.'
  1230.                     type: string
  1231.                   sslProxyHeaders:
  1232.                     additionalProperties:
  1233.                       type: string
  1234.                     description: |-
  1235.                       SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request.
  1236.                       It can be useful when using other proxies (example: "X-Forwarded-Proto": "https").
  1237.                     type: object
  1238.                   sslRedirect:
  1239.                     description: 'Deprecated: SSLRedirect option is deprecated, please
  1240.                       use EntryPoint redirection or RedirectScheme instead.'
  1241.                     type: boolean
  1242.                   sslTemporaryRedirect:
  1243.                     description: 'Deprecated: SSLTemporaryRedirect option is deprecated,
  1244.                       please use EntryPoint redirection or RedirectScheme instead.'
  1245.                     type: boolean
  1246.                   stsIncludeSubdomains:
  1247.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  1248.                       directive is appended to the Strict-Transport-Security header.
  1249.                     type: boolean
  1250.                   stsPreload:
  1251.                     description: STSPreload defines whether the preload flag is appended
  1252.                       to the Strict-Transport-Security header.
  1253.                     type: boolean
  1254.                   stsSeconds:
  1255.                     description: |-
  1256.                       STSSeconds defines the max-age of the Strict-Transport-Security header.
  1257.                       If set to 0, the header is not set.
  1258.                     format: int64
  1259.                     type: integer
  1260.                 type: object
  1261.               inFlightReq:
  1262.                 description: |-
  1263.                   InFlightReq holds the in-flight request middleware configuration.
  1264.                   This middleware limits the number of requests being processed and served concurrently.
  1265.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/inflightreq/
  1266.                 properties:
  1267.                   amount:
  1268.                     description: |-
  1269.                       Amount defines the maximum amount of allowed simultaneous in-flight request.
  1270.                       The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).
  1271.                     format: int64
  1272.                     type: integer
  1273.                   sourceCriterion:
  1274.                     description: |-
  1275.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1276.                       If several strategies are defined at the same time, an error will be raised.
  1277.                       If none are set, the default is to use the requestHost.
  1278.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/inflightreq/#sourcecriterion
  1279.                     properties:
  1280.                       ipStrategy:
  1281.                         description: |-
  1282.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1283.                           More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/ipallowlist/#ipstrategy
  1284.                         properties:
  1285.                           depth:
  1286.                             description: Depth tells Traefik to use the X-Forwarded-For
  1287.                               header and take the IP located at the depth position
  1288.                               (starting from the right).
  1289.                             type: integer
  1290.                           excludedIPs:
  1291.                             description: ExcludedIPs configures Traefik to scan the
  1292.                               X-Forwarded-For header and select the first IP not in
  1293.                               the list.
  1294.                             items:
  1295.                               type: string
  1296.                             type: array
  1297.                         type: object
  1298.                       requestHeaderName:
  1299.                         description: RequestHeaderName defines the name of the header
  1300.                           used to group incoming requests.
  1301.                         type: string
  1302.                       requestHost:
  1303.                         description: RequestHost defines whether to consider the request
  1304.                           Host as the source.
  1305.                         type: boolean
  1306.                     type: object
  1307.                 type: object
  1308.               ipAllowList:
  1309.                 description: |-
  1310.                   IPAllowList holds the IP allowlist middleware configuration.
  1311.                   This middleware limits allowed requests based on the client IP.
  1312.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/ipallowlist/
  1313.                 properties:
  1314.                   ipStrategy:
  1315.                     description: |-
  1316.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1317.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/ipallowlist/#ipstrategy
  1318.                     properties:
  1319.                       depth:
  1320.                         description: Depth tells Traefik to use the X-Forwarded-For
  1321.                           header and take the IP located at the depth position (starting
  1322.                           from the right).
  1323.                         type: integer
  1324.                       excludedIPs:
  1325.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1326.                           header and select the first IP not in the list.
  1327.                         items:
  1328.                           type: string
  1329.                         type: array
  1330.                     type: object
  1331.                   rejectStatusCode:
  1332.                     description: |-
  1333.                       RejectStatusCode defines the HTTP status code used for refused requests.
  1334.                       If not set, the default is 403 (Forbidden).
  1335.                     type: integer
  1336.                   sourceRange:
  1337.                     description: SourceRange defines the set of allowed IPs (or ranges
  1338.                       of allowed IPs by using CIDR notation).
  1339.                     items:
  1340.                       type: string
  1341.                     type: array
  1342.                 type: object
  1343.               ipWhiteList:
  1344.                 description: 'Deprecated: please use IPAllowList instead.'
  1345.                 properties:
  1346.                   ipStrategy:
  1347.                     description: |-
  1348.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1349.                       More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/ipallowlist/#ipstrategy
  1350.                     properties:
  1351.                       depth:
  1352.                         description: Depth tells Traefik to use the X-Forwarded-For
  1353.                           header and take the IP located at the depth position (starting
  1354.                           from the right).
  1355.                         type: integer
  1356.                       excludedIPs:
  1357.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1358.                           header and select the first IP not in the list.
  1359.                         items:
  1360.                           type: string
  1361.                         type: array
  1362.                     type: object
  1363.                   sourceRange:
  1364.                     description: SourceRange defines the set of allowed IPs (or ranges
  1365.                       of allowed IPs by using CIDR notation). Required.
  1366.                     items:
  1367.                       type: string
  1368.                     type: array
  1369.                 type: object
  1370.               passTLSClientCert:
  1371.                 description: |-
  1372.                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
  1373.                   This middleware adds the selected data from the passed client TLS certificate to a header.
  1374.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/passtlsclientcert/
  1375.                 properties:
  1376.                   info:
  1377.                     description: Info selects the specific client certificate details
  1378.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1379.                     properties:
  1380.                       issuer:
  1381.                         description: Issuer defines the client certificate issuer
  1382.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1383.                         properties:
  1384.                           commonName:
  1385.                             description: CommonName defines whether to add the organizationalUnit
  1386.                               information into the issuer.
  1387.                             type: boolean
  1388.                           country:
  1389.                             description: Country defines whether to add the country
  1390.                               information into the issuer.
  1391.                             type: boolean
  1392.                           domainComponent:
  1393.                             description: DomainComponent defines whether to add the
  1394.                               domainComponent information into the issuer.
  1395.                             type: boolean
  1396.                           locality:
  1397.                             description: Locality defines whether to add the locality
  1398.                               information into the issuer.
  1399.                             type: boolean
  1400.                           organization:
  1401.                             description: Organization defines whether to add the organization
  1402.                               information into the issuer.
  1403.                             type: boolean
  1404.                           province:
  1405.                             description: Province defines whether to add the province
  1406.                               information into the issuer.
  1407.                             type: boolean
  1408.                           serialNumber:
  1409.                             description: SerialNumber defines whether to add the serialNumber
  1410.                               information into the issuer.
  1411.                             type: boolean
  1412.                         type: object
  1413.                       notAfter:
  1414.                         description: NotAfter defines whether to add the Not After
  1415.                           information from the Validity part.
  1416.                         type: boolean
  1417.                       notBefore:
  1418.                         description: NotBefore defines whether to add the Not Before
  1419.                           information from the Validity part.
  1420.                         type: boolean
  1421.                       sans:
  1422.                         description: Sans defines whether to add the Subject Alternative
  1423.                           Name information from the Subject Alternative Name part.
  1424.                         type: boolean
  1425.                       serialNumber:
  1426.                         description: SerialNumber defines whether to add the client
  1427.                           serialNumber information.
  1428.                         type: boolean
  1429.                       subject:
  1430.                         description: Subject defines the client certificate subject
  1431.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1432.                         properties:
  1433.                           commonName:
  1434.                             description: CommonName defines whether to add the organizationalUnit
  1435.                               information into the subject.
  1436.                             type: boolean
  1437.                           country:
  1438.                             description: Country defines whether to add the country
  1439.                               information into the subject.
  1440.                             type: boolean
  1441.                           domainComponent:
  1442.                             description: DomainComponent defines whether to add the
  1443.                               domainComponent information into the subject.
  1444.                             type: boolean
  1445.                           locality:
  1446.                             description: Locality defines whether to add the locality
  1447.                               information into the subject.
  1448.                             type: boolean
  1449.                           organization:
  1450.                             description: Organization defines whether to add the organization
  1451.                               information into the subject.
  1452.                             type: boolean
  1453.                           organizationalUnit:
  1454.                             description: OrganizationalUnit defines whether to add
  1455.                               the organizationalUnit information into the subject.
  1456.                             type: boolean
  1457.                           province:
  1458.                             description: Province defines whether to add the province
  1459.                               information into the subject.
  1460.                             type: boolean
  1461.                           serialNumber:
  1462.                             description: SerialNumber defines whether to add the serialNumber
  1463.                               information into the subject.
  1464.                             type: boolean
  1465.                         type: object
  1466.                     type: object
  1467.                   pem:
  1468.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  1469.                       the certificate.
  1470.                     type: boolean
  1471.                 type: object
  1472.               plugin:
  1473.                 additionalProperties:
  1474.                   x-kubernetes-preserve-unknown-fields: true
  1475.                 description: |-
  1476.                   Plugin defines the middleware plugin configuration.
  1477.                   More info: https://doc.traefik.io/traefik/plugins/
  1478.                 type: object
  1479.               rateLimit:
  1480.                 description: |-
  1481.                   RateLimit holds the rate limit configuration.
  1482.                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
  1483.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/ratelimit/
  1484.                 properties:
  1485.                   average:
  1486.                     description: |-
  1487.                       Average is the maximum rate, by default in requests/s, allowed for the given source.
  1488.                       It defaults to 0, which means no rate limiting.
  1489.                       The rate is actually defined by dividing Average by Period. So for a rate below 1req/s,
  1490.                       one needs to define a Period larger than a second.
  1491.                     format: int64
  1492.                     type: integer
  1493.                   burst:
  1494.                     description: |-
  1495.                       Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time.
  1496.                       It defaults to 1.
  1497.                     format: int64
  1498.                     type: integer
  1499.                   period:
  1500.                     anyOf:
  1501.                     - type: integer
  1502.                     - type: string
  1503.                     description: |-
  1504.                       Period, in combination with Average, defines the actual maximum rate, such as:
  1505.                       r = Average / Period. It defaults to a second.
  1506.                     x-kubernetes-int-or-string: true
  1507.                   sourceCriterion:
  1508.                     description: |-
  1509.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1510.                       If several strategies are defined at the same time, an error will be raised.
  1511.                       If none are set, the default is to use the request's remote address field (as an ipStrategy).
  1512.                     properties:
  1513.                       ipStrategy:
  1514.                         description: |-
  1515.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1516.                           More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/ipallowlist/#ipstrategy
  1517.                         properties:
  1518.                           depth:
  1519.                             description: Depth tells Traefik to use the X-Forwarded-For
  1520.                               header and take the IP located at the depth position
  1521.                               (starting from the right).
  1522.                             type: integer
  1523.                           excludedIPs:
  1524.                             description: ExcludedIPs configures Traefik to scan the
  1525.                               X-Forwarded-For header and select the first IP not in
  1526.                               the list.
  1527.                             items:
  1528.                               type: string
  1529.                             type: array
  1530.                         type: object
  1531.                       requestHeaderName:
  1532.                         description: RequestHeaderName defines the name of the header
  1533.                           used to group incoming requests.
  1534.                         type: string
  1535.                       requestHost:
  1536.                         description: RequestHost defines whether to consider the request
  1537.                           Host as the source.
  1538.                         type: boolean
  1539.                     type: object
  1540.                 type: object
  1541.               redirectRegex:
  1542.                 description: |-
  1543.                   RedirectRegex holds the redirect regex middleware configuration.
  1544.                   This middleware redirects a request using regex matching and replacement.
  1545.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/redirectregex/#regex
  1546.                 properties:
  1547.                   permanent:
  1548.                     description: Permanent defines whether the redirection is permanent
  1549.                       (301).
  1550.                     type: boolean
  1551.                   regex:
  1552.                     description: Regex defines the regex used to match and capture
  1553.                       elements from the request URL.
  1554.                     type: string
  1555.                   replacement:
  1556.                     description: Replacement defines how to modify the URL to have
  1557.                       the new target URL.
  1558.                     type: string
  1559.                 type: object
  1560.               redirectScheme:
  1561.                 description: |-
  1562.                   RedirectScheme holds the redirect scheme middleware configuration.
  1563.                   This middleware redirects requests from a scheme/port to another.
  1564.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/redirectscheme/
  1565.                 properties:
  1566.                   permanent:
  1567.                     description: Permanent defines whether the redirection is permanent
  1568.                       (301).
  1569.                     type: boolean
  1570.                   port:
  1571.                     description: Port defines the port of the new URL.
  1572.                     type: string
  1573.                   scheme:
  1574.                     description: Scheme defines the scheme of the new URL.
  1575.                     type: string
  1576.                 type: object
  1577.               replacePath:
  1578.                 description: |-
  1579.                   ReplacePath holds the replace path middleware configuration.
  1580.                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
  1581.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/replacepath/
  1582.                 properties:
  1583.                   path:
  1584.                     description: Path defines the path to use as replacement in the
  1585.                       request URL.
  1586.                     type: string
  1587.                 type: object
  1588.               replacePathRegex:
  1589.                 description: |-
  1590.                   ReplacePathRegex holds the replace path regex middleware configuration.
  1591.                   This middleware replaces the path of a URL using regex matching and replacement.
  1592.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/replacepathregex/
  1593.                 properties:
  1594.                   regex:
  1595.                     description: Regex defines the regular expression used to match
  1596.                       and capture the path from the request URL.
  1597.                     type: string
  1598.                   replacement:
  1599.                     description: Replacement defines the replacement path format,
  1600.                       which can include captured variables.
  1601.                     type: string
  1602.                 type: object
  1603.               retry:
  1604.                 description: |-
  1605.                   Retry holds the retry middleware configuration.
  1606.                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
  1607.                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
  1608.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/retry/
  1609.                 properties:
  1610.                   attempts:
  1611.                     description: Attempts defines how many times the request should
  1612.                       be retried.
  1613.                     type: integer
  1614.                   initialInterval:
  1615.                     anyOf:
  1616.                     - type: integer
  1617.                     - type: string
  1618.                     description: |-
  1619.                       InitialInterval defines the first wait time in the exponential backoff series.
  1620.                       The maximum interval is calculated as twice the initialInterval.
  1621.                       If unspecified, requests will be retried immediately.
  1622.                       The value of initialInterval should be provided in seconds or as a valid duration format,
  1623.                       see https://pkg.go.dev/time#ParseDuration.
  1624.                     x-kubernetes-int-or-string: true
  1625.                 type: object
  1626.               stripPrefix:
  1627.                 description: |-
  1628.                   StripPrefix holds the strip prefix middleware configuration.
  1629.                   This middleware removes the specified prefixes from the URL path.
  1630.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/stripprefix/
  1631.                 properties:
  1632.                   forceSlash:
  1633.                     description: |-
  1634.                       Deprecated: ForceSlash option is deprecated, please remove any usage of this option.
  1635.                       ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.
  1636.                       Default: true.
  1637.                     type: boolean
  1638.                   prefixes:
  1639.                     description: Prefixes defines the prefixes to strip from the request
  1640.                       URL.
  1641.                     items:
  1642.                       type: string
  1643.                     type: array
  1644.                 type: object
  1645.               stripPrefixRegex:
  1646.                 description: |-
  1647.                   StripPrefixRegex holds the strip prefix regex middleware configuration.
  1648.                   This middleware removes the matching prefixes from the URL path.
  1649.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/stripprefixregex/
  1650.                 properties:
  1651.                   regex:
  1652.                     description: Regex defines the regular expression to match the
  1653.                       path prefix from the request URL.
  1654.                     items:
  1655.                       type: string
  1656.                     type: array
  1657.                 type: object
  1658.             type: object
  1659.         required:
  1660.         - metadata
  1661.         - spec
  1662.         type: object
  1663.     served: true
  1664.     storage: true
  1665. ---
  1666. apiVersion: apiextensions.k8s.io/v1
  1667. kind: CustomResourceDefinition
  1668. metadata:
  1669.   annotations:
  1670.     controller-gen.kubebuilder.io/version: v0.14.0
  1671.   name: middlewaretcps.traefik.io
  1672. spec:
  1673.   group: traefik.io
  1674.   names:
  1675.     kind: MiddlewareTCP
  1676.     listKind: MiddlewareTCPList
  1677.     plural: middlewaretcps
  1678.     singular: middlewaretcp
  1679.   scope: Namespaced
  1680.   versions:
  1681.   - name: v1alpha1
  1682.     schema:
  1683.       openAPIV3Schema:
  1684.         description: |-
  1685.           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  1686.           More info: https://doc.traefik.io/traefik/v3.0/middlewares/overview/
  1687.         properties:
  1688.           apiVersion:
  1689.             description: |-
  1690.               APIVersion defines the versioned schema of this representation of an object.
  1691.               Servers should convert recognized schemas to the latest internal value, and
  1692.               may reject unrecognized values.
  1693.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1694.             type: string
  1695.           kind:
  1696.             description: |-
  1697.               Kind is a string value representing the REST resource this object represents.
  1698.               Servers may infer this from the endpoint the client submits requests to.
  1699.               Cannot be updated.
  1700.               In CamelCase.
  1701.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1702.             type: string
  1703.           metadata:
  1704.             type: object
  1705.           spec:
  1706.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  1707.             properties:
  1708.               inFlightConn:
  1709.                 description: InFlightConn defines the InFlightConn middleware configuration.
  1710.                 properties:
  1711.                   amount:
  1712.                     description: |-
  1713.                       Amount defines the maximum amount of allowed simultaneous connections.
  1714.                       The middleware closes the connection if there are already amount connections opened.
  1715.                     format: int64
  1716.                     type: integer
  1717.                 type: object
  1718.               ipAllowList:
  1719.                 description: |-
  1720.                   IPAllowList defines the IPAllowList middleware configuration.
  1721.                   This middleware accepts/refuses connections based on the client IP.
  1722.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/tcp/ipallowlist/
  1723.                 properties:
  1724.                   sourceRange:
  1725.                     description: SourceRange defines the allowed IPs (or ranges of
  1726.                       allowed IPs by using CIDR notation).
  1727.                     items:
  1728.                       type: string
  1729.                     type: array
  1730.                 type: object
  1731.               ipWhiteList:
  1732.                 description: |-
  1733.                   IPWhiteList defines the IPWhiteList middleware configuration.
  1734.                   This middleware accepts/refuses connections based on the client IP.
  1735.                   Deprecated: please use IPAllowList instead.
  1736.                   More info: https://doc.traefik.io/traefik/v3.0/middlewares/tcp/ipwhitelist/
  1737.                 properties:
  1738.                   sourceRange:
  1739.                     description: SourceRange defines the allowed IPs (or ranges of
  1740.                       allowed IPs by using CIDR notation).
  1741.                     items:
  1742.                       type: string
  1743.                     type: array
  1744.                 type: object
  1745.             type: object
  1746.         required:
  1747.         - metadata
  1748.         - spec
  1749.         type: object
  1750.     served: true
  1751.     storage: true
  1752. ---
  1753. apiVersion: apiextensions.k8s.io/v1
  1754. kind: CustomResourceDefinition
  1755. metadata:
  1756.   annotations:
  1757.     controller-gen.kubebuilder.io/version: v0.14.0
  1758.   name: serverstransports.traefik.io
  1759. spec:
  1760.   group: traefik.io
  1761.   names:
  1762.     kind: ServersTransport
  1763.     listKind: ServersTransportList
  1764.     plural: serverstransports
  1765.     singular: serverstransport
  1766.   scope: Namespaced
  1767.   versions:
  1768.   - name: v1alpha1
  1769.     schema:
  1770.       openAPIV3Schema:
  1771.         description: |-
  1772.           ServersTransport is the CRD implementation of a ServersTransport.
  1773.           If no serversTransport is specified, the default@internal will be used.
  1774.           The default@internal serversTransport is created from the static configuration.
  1775.           More info: https://doc.traefik.io/traefik/v3.0/routing/services/#serverstransport_1
  1776.         properties:
  1777.           apiVersion:
  1778.             description: |-
  1779.               APIVersion defines the versioned schema of this representation of an object.
  1780.               Servers should convert recognized schemas to the latest internal value, and
  1781.               may reject unrecognized values.
  1782.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1783.             type: string
  1784.           kind:
  1785.             description: |-
  1786.               Kind is a string value representing the REST resource this object represents.
  1787.               Servers may infer this from the endpoint the client submits requests to.
  1788.               Cannot be updated.
  1789.               In CamelCase.
  1790.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1791.             type: string
  1792.           metadata:
  1793.             type: object
  1794.           spec:
  1795.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  1796.             properties:
  1797.               certificatesSecrets:
  1798.                 description: CertificatesSecrets defines a list of secret storing
  1799.                   client certificates for mTLS.
  1800.                 items:
  1801.                   type: string
  1802.                 type: array
  1803.               disableHTTP2:
  1804.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  1805.                   servers.
  1806.                 type: boolean
  1807.               forwardingTimeouts:
  1808.                 description: ForwardingTimeouts defines the timeouts for requests
  1809.                   forwarded to the backend servers.
  1810.                 properties:
  1811.                   dialTimeout:
  1812.                     anyOf:
  1813.                     - type: integer
  1814.                     - type: string
  1815.                     description: DialTimeout is the amount of time to wait until a
  1816.                       connection to a backend server can be established.
  1817.                     x-kubernetes-int-or-string: true
  1818.                   idleConnTimeout:
  1819.                     anyOf:
  1820.                     - type: integer
  1821.                     - type: string
  1822.                     description: IdleConnTimeout is the maximum period for which an
  1823.                       idle HTTP keep-alive connection will remain open before closing
  1824.                       itself.
  1825.                     x-kubernetes-int-or-string: true
  1826.                   pingTimeout:
  1827.                     anyOf:
  1828.                     - type: integer
  1829.                     - type: string
  1830.                     description: PingTimeout is the timeout after which the HTTP/2
  1831.                       connection will be closed if a response to ping is not received.
  1832.                     x-kubernetes-int-or-string: true
  1833.                   readIdleTimeout:
  1834.                     anyOf:
  1835.                     - type: integer
  1836.                     - type: string
  1837.                     description: ReadIdleTimeout is the timeout after which a health
  1838.                       check using ping frame will be carried out if no frame is received
  1839.                       on the HTTP/2 connection.
  1840.                     x-kubernetes-int-or-string: true
  1841.                   responseHeaderTimeout:
  1842.                     anyOf:
  1843.                     - type: integer
  1844.                     - type: string
  1845.                     description: ResponseHeaderTimeout is the amount of time to wait
  1846.                       for a server's response headers after fully writing the request
  1847.                       (including its body, if any).
  1848.                     x-kubernetes-int-or-string: true
  1849.                 type: object
  1850.               insecureSkipVerify:
  1851.                 description: InsecureSkipVerify disables SSL certificate verification.
  1852.                 type: boolean
  1853.               maxIdleConnsPerHost:
  1854.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  1855.                   to keep per-host.
  1856.                 type: integer
  1857.               peerCertURI:
  1858.                 description: PeerCertURI defines the peer cert URI used to match against
  1859.                   SAN URI during the peer certificate verification.
  1860.                 type: string
  1861.               rootCAsSecrets:
  1862.                 description: RootCAsSecrets defines a list of CA secret used to validate
  1863.                   self-signed certificate.
  1864.                 items:
  1865.                   type: string
  1866.                 type: array
  1867.               serverName:
  1868.                 description: ServerName defines the server name used to contact the
  1869.                   server.
  1870.                 type: string
  1871.               spiffe:
  1872.                 description: Spiffe defines the SPIFFE configuration.
  1873.                 properties:
  1874.                   ids:
  1875.                     description: IDs defines the allowed SPIFFE IDs (takes precedence
  1876.                       over the SPIFFE TrustDomain).
  1877.                     items:
  1878.                       type: string
  1879.                     type: array
  1880.                   trustDomain:
  1881.                     description: TrustDomain defines the allowed SPIFFE trust domain.
  1882.                     type: string
  1883.                 type: object
  1884.             type: object
  1885.         required:
  1886.         - metadata
  1887.         - spec
  1888.         type: object
  1889.     served: true
  1890.     storage: true
  1891. ---
  1892. apiVersion: apiextensions.k8s.io/v1
  1893. kind: CustomResourceDefinition
  1894. metadata:
  1895.   annotations:
  1896.     controller-gen.kubebuilder.io/version: v0.14.0
  1897.   name: serverstransporttcps.traefik.io
  1898. spec:
  1899.   group: traefik.io
  1900.   names:
  1901.     kind: ServersTransportTCP
  1902.     listKind: ServersTransportTCPList
  1903.     plural: serverstransporttcps
  1904.     singular: serverstransporttcp
  1905.   scope: Namespaced
  1906.   versions:
  1907.   - name: v1alpha1
  1908.     schema:
  1909.       openAPIV3Schema:
  1910.         description: |-
  1911.           ServersTransportTCP is the CRD implementation of a TCPServersTransport.
  1912.           If no tcpServersTransport is specified, a default one named default@internal will be used.
  1913.           The default@internal tcpServersTransport can be configured in the static configuration.
  1914.           More info: https://doc.traefik.io/traefik/v3.0/routing/services/#serverstransport_3
  1915.         properties:
  1916.           apiVersion:
  1917.             description: |-
  1918.               APIVersion defines the versioned schema of this representation of an object.
  1919.               Servers should convert recognized schemas to the latest internal value, and
  1920.               may reject unrecognized values.
  1921.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1922.             type: string
  1923.           kind:
  1924.             description: |-
  1925.               Kind is a string value representing the REST resource this object represents.
  1926.               Servers may infer this from the endpoint the client submits requests to.
  1927.               Cannot be updated.
  1928.               In CamelCase.
  1929.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1930.             type: string
  1931.           metadata:
  1932.             type: object
  1933.           spec:
  1934.             description: ServersTransportTCPSpec defines the desired state of a ServersTransportTCP.
  1935.             properties:
  1936.               dialKeepAlive:
  1937.                 anyOf:
  1938.                 - type: integer
  1939.                 - type: string
  1940.                 description: DialKeepAlive is the interval between keep-alive probes
  1941.                   for an active network connection. If zero, keep-alive probes are
  1942.                   sent with a default value (currently 15 seconds), if supported by
  1943.                   the protocol and operating system. Network protocols or operating
  1944.                   systems that do not support keep-alives ignore this field. If negative,
  1945.                   keep-alive probes are disabled.
  1946.                 x-kubernetes-int-or-string: true
  1947.               dialTimeout:
  1948.                 anyOf:
  1949.                 - type: integer
  1950.                 - type: string
  1951.                 description: DialTimeout is the amount of time to wait until a connection
  1952.                   to a backend server can be established.
  1953.                 x-kubernetes-int-or-string: true
  1954.               terminationDelay:
  1955.                 anyOf:
  1956.                 - type: integer
  1957.                 - type: string
  1958.                 description: TerminationDelay defines the delay to wait before fully
  1959.                   terminating the connection, after one connected peer has closed
  1960.                   its writing capability.
  1961.                 x-kubernetes-int-or-string: true
  1962.               tls:
  1963.                 description: TLS defines the TLS configuration
  1964.                 properties:
  1965.                   certificatesSecrets:
  1966.                     description: CertificatesSecrets defines a list of secret storing
  1967.                       client certificates for mTLS.
  1968.                     items:
  1969.                       type: string
  1970.                     type: array
  1971.                   insecureSkipVerify:
  1972.                     description: InsecureSkipVerify disables TLS certificate verification.
  1973.                     type: boolean
  1974.                   peerCertURI:
  1975.                     description: |-
  1976.                       MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.
  1977.                       PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.
  1978.                     type: string
  1979.                   rootCAsSecrets:
  1980.                     description: RootCAsSecrets defines a list of CA secret used to
  1981.                       validate self-signed certificates.
  1982.                     items:
  1983.                       type: string
  1984.                     type: array
  1985.                   serverName:
  1986.                     description: ServerName defines the server name used to contact
  1987.                       the server.
  1988.                     type: string
  1989.                   spiffe:
  1990.                     description: Spiffe defines the SPIFFE configuration.
  1991.                     properties:
  1992.                       ids:
  1993.                         description: IDs defines the allowed SPIFFE IDs (takes precedence
  1994.                           over the SPIFFE TrustDomain).
  1995.                         items:
  1996.                           type: string
  1997.                         type: array
  1998.                       trustDomain:
  1999.                         description: TrustDomain defines the allowed SPIFFE trust
  2000.                           domain.
  2001.                         type: string
  2002.                     type: object
  2003.                 type: object
  2004.             type: object
  2005.         required:
  2006.         - metadata
  2007.         - spec
  2008.         type: object
  2009.     served: true
  2010.     storage: true
  2011. ---
  2012. apiVersion: apiextensions.k8s.io/v1
  2013. kind: CustomResourceDefinition
  2014. metadata:
  2015.   annotations:
  2016.     controller-gen.kubebuilder.io/version: v0.14.0
  2017.   name: tlsoptions.traefik.io
  2018. spec:
  2019.   group: traefik.io
  2020.   names:
  2021.     kind: TLSOption
  2022.     listKind: TLSOptionList
  2023.     plural: tlsoptions
  2024.     singular: tlsoption
  2025.   scope: Namespaced
  2026.   versions:
  2027.   - name: v1alpha1
  2028.     schema:
  2029.       openAPIV3Schema:
  2030.         description: |-
  2031.           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
  2032.           More info: https://doc.traefik.io/traefik/v3.0/https/tls/#tls-options
  2033.         properties:
  2034.           apiVersion:
  2035.             description: |-
  2036.               APIVersion defines the versioned schema of this representation of an object.
  2037.               Servers should convert recognized schemas to the latest internal value, and
  2038.               may reject unrecognized values.
  2039.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2040.             type: string
  2041.           kind:
  2042.             description: |-
  2043.               Kind is a string value representing the REST resource this object represents.
  2044.               Servers may infer this from the endpoint the client submits requests to.
  2045.               Cannot be updated.
  2046.               In CamelCase.
  2047.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2048.             type: string
  2049.           metadata:
  2050.             type: object
  2051.           spec:
  2052.             description: TLSOptionSpec defines the desired state of a TLSOption.
  2053.             properties:
  2054.               alpnProtocols:
  2055.                 description: |-
  2056.                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
  2057.                   More info: https://doc.traefik.io/traefik/v3.0/https/tls/#alpn-protocols
  2058.                 items:
  2059.                   type: string
  2060.                 type: array
  2061.               cipherSuites:
  2062.                 description: |-
  2063.                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
  2064.                   More info: https://doc.traefik.io/traefik/v3.0/https/tls/#cipher-suites
  2065.                 items:
  2066.                   type: string
  2067.                 type: array
  2068.               clientAuth:
  2069.                 description: ClientAuth defines the server's policy for TLS Client
  2070.                   Authentication.
  2071.                 properties:
  2072.                   clientAuthType:
  2073.                     description: ClientAuthType defines the client authentication
  2074.                       type to apply.
  2075.                     enum:
  2076.                     - NoClientCert
  2077.                     - RequestClientCert
  2078.                     - RequireAnyClientCert
  2079.                     - VerifyClientCertIfGiven
  2080.                     - RequireAndVerifyClientCert
  2081.                     type: string
  2082.                   secretNames:
  2083.                     description: SecretNames defines the names of the referenced Kubernetes
  2084.                       Secret storing certificate details.
  2085.                     items:
  2086.                       type: string
  2087.                     type: array
  2088.                 type: object
  2089.               curvePreferences:
  2090.                 description: |-
  2091.                   CurvePreferences defines the preferred elliptic curves in a specific order.
  2092.                   More info: https://doc.traefik.io/traefik/v3.0/https/tls/#curve-preferences
  2093.                 items:
  2094.                   type: string
  2095.                 type: array
  2096.               maxVersion:
  2097.                 description: |-
  2098.                   MaxVersion defines the maximum TLS version that Traefik will accept.
  2099.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2100.                   Default: None.
  2101.                 type: string
  2102.               minVersion:
  2103.                 description: |-
  2104.                   MinVersion defines the minimum TLS version that Traefik will accept.
  2105.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2106.                   Default: VersionTLS10.
  2107.                 type: string
  2108.               preferServerCipherSuites:
  2109.                 description: |-
  2110.                   PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
  2111.                   It is enabled automatically when minVersion or maxVersion is set.
  2112.                   Deprecated: https://github.com/golang/go/issues/45430
  2113.                 type: boolean
  2114.               sniStrict:
  2115.                 description: SniStrict defines whether Traefik allows connections
  2116.                   from clients connections that do not specify a server_name extension.
  2117.                 type: boolean
  2118.             type: object
  2119.         required:
  2120.         - metadata
  2121.         - spec
  2122.         type: object
  2123.     served: true
  2124.     storage: true
  2125. ---
  2126. apiVersion: apiextensions.k8s.io/v1
  2127. kind: CustomResourceDefinition
  2128. metadata:
  2129.   annotations:
  2130.     controller-gen.kubebuilder.io/version: v0.14.0
  2131.   name: tlsstores.traefik.io
  2132. spec:
  2133.   group: traefik.io
  2134.   names:
  2135.     kind: TLSStore
  2136.     listKind: TLSStoreList
  2137.     plural: tlsstores
  2138.     singular: tlsstore
  2139.   scope: Namespaced
  2140.   versions:
  2141.   - name: v1alpha1
  2142.     schema:
  2143.       openAPIV3Schema:
  2144.         description: |-
  2145.           TLSStore is the CRD implementation of a Traefik TLS Store.
  2146.           For the time being, only the TLSStore named default is supported.
  2147.           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
  2148.           More info: https://doc.traefik.io/traefik/v3.0/https/tls/#certificates-stores
  2149.         properties:
  2150.           apiVersion:
  2151.             description: |-
  2152.               APIVersion defines the versioned schema of this representation of an object.
  2153.               Servers should convert recognized schemas to the latest internal value, and
  2154.               may reject unrecognized values.
  2155.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2156.             type: string
  2157.           kind:
  2158.             description: |-
  2159.               Kind is a string value representing the REST resource this object represents.
  2160.               Servers may infer this from the endpoint the client submits requests to.
  2161.               Cannot be updated.
  2162.               In CamelCase.
  2163.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2164.             type: string
  2165.           metadata:
  2166.             type: object
  2167.           spec:
  2168.             description: TLSStoreSpec defines the desired state of a TLSStore.
  2169.             properties:
  2170.               certificates:
  2171.                 description: Certificates is a list of secret names, each secret holding
  2172.                   a key/certificate pair to add to the store.
  2173.                 items:
  2174.                   description: Certificate holds a secret name for the TLSStore resource.
  2175.                   properties:
  2176.                     secretName:
  2177.                       description: SecretName is the name of the referenced Kubernetes
  2178.                         Secret to specify the certificate details.
  2179.                       type: string
  2180.                   required:
  2181.                   - secretName
  2182.                   type: object
  2183.                 type: array
  2184.               defaultCertificate:
  2185.                 description: DefaultCertificate defines the default certificate configuration.
  2186.                 properties:
  2187.                   secretName:
  2188.                     description: SecretName is the name of the referenced Kubernetes
  2189.                       Secret to specify the certificate details.
  2190.                     type: string
  2191.                 required:
  2192.                 - secretName
  2193.                 type: object
  2194.               defaultGeneratedCert:
  2195.                 description: DefaultGeneratedCert defines the default generated certificate
  2196.                   configuration.
  2197.                 properties:
  2198.                   domain:
  2199.                     description: Domain is the domain definition for the DefaultCertificate.
  2200.                     properties:
  2201.                       main:
  2202.                         description: Main defines the main domain name.
  2203.                         type: string
  2204.                       sans:
  2205.                         description: SANs defines the subject alternative domain names.
  2206.                         items:
  2207.                           type: string
  2208.                         type: array
  2209.                     type: object
  2210.                   resolver:
  2211.                     description: Resolver is the name of the resolver that will be
  2212.                       used to issue the DefaultCertificate.
  2213.                     type: string
  2214.                 type: object
  2215.             type: object
  2216.         required:
  2217.         - metadata
  2218.         - spec
  2219.         type: object
  2220.     served: true
  2221.     storage: true
  2222. ---
  2223. apiVersion: apiextensions.k8s.io/v1
  2224. kind: CustomResourceDefinition
  2225. metadata:
  2226.   annotations:
  2227.     controller-gen.kubebuilder.io/version: v0.14.0
  2228.   name: traefikservices.traefik.io
  2229. spec:
  2230.   group: traefik.io
  2231.   names:
  2232.     kind: TraefikService
  2233.     listKind: TraefikServiceList
  2234.     plural: traefikservices
  2235.     singular: traefikservice
  2236.   scope: Namespaced
  2237.   versions:
  2238.   - name: v1alpha1
  2239.     schema:
  2240.       openAPIV3Schema:
  2241.         description: |-
  2242.           TraefikService is the CRD implementation of a Traefik Service.
  2243.           TraefikService object allows to:
  2244.           - Apply weight to Services on load-balancing
  2245.           - Mirror traffic on services
  2246.           More info: https://doc.traefik.io/traefik/v3.0/routing/providers/kubernetes-crd/#kind-traefikservice
  2247.         properties:
  2248.           apiVersion:
  2249.             description: |-
  2250.               APIVersion defines the versioned schema of this representation of an object.
  2251.               Servers should convert recognized schemas to the latest internal value, and
  2252.               may reject unrecognized values.
  2253.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2254.             type: string
  2255.           kind:
  2256.             description: |-
  2257.               Kind is a string value representing the REST resource this object represents.
  2258.               Servers may infer this from the endpoint the client submits requests to.
  2259.               Cannot be updated.
  2260.               In CamelCase.
  2261.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2262.             type: string
  2263.           metadata:
  2264.             type: object
  2265.           spec:
  2266.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  2267.             properties:
  2268.               mirroring:
  2269.                 description: Mirroring defines the Mirroring service configuration.
  2270.                 properties:
  2271.                   kind:
  2272.                     description: Kind defines the kind of the Service.
  2273.                     enum:
  2274.                     - Service
  2275.                     - TraefikService
  2276.                     type: string
  2277.                   maxBodySize:
  2278.                     description: |-
  2279.                       MaxBodySize defines the maximum size allowed for the body of the request.
  2280.                       If the body is larger, the request is not mirrored.
  2281.                       Default value is -1, which means unlimited size.
  2282.                     format: int64
  2283.                     type: integer
  2284.                   mirrors:
  2285.                     description: Mirrors defines the list of mirrors where Traefik
  2286.                       will duplicate the traffic.
  2287.                     items:
  2288.                       description: MirrorService holds the mirror configuration.
  2289.                       properties:
  2290.                         kind:
  2291.                           description: Kind defines the kind of the Service.
  2292.                           enum:
  2293.                           - Service
  2294.                           - TraefikService
  2295.                           type: string
  2296.                         name:
  2297.                           description: |-
  2298.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2299.                             The differentiation between the two is specified in the Kind field.
  2300.                           type: string
  2301.                         namespace:
  2302.                           description: Namespace defines the namespace of the referenced
  2303.                             Kubernetes Service or TraefikService.
  2304.                           type: string
  2305.                         nativeLB:
  2306.                           description: |-
  2307.                             NativeLB controls, when creating the load-balancer,
  2308.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2309.                             The Kubernetes Service itself does load-balance to the pods.
  2310.                             By default, NativeLB is false.
  2311.                           type: boolean
  2312.                         passHostHeader:
  2313.                           description: |-
  2314.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2315.                             By default, passHostHeader is true.
  2316.                           type: boolean
  2317.                         percent:
  2318.                           description: |-
  2319.                             Percent defines the part of the traffic to mirror.
  2320.                             Supported values: 0 to 100.
  2321.                           type: integer
  2322.                         port:
  2323.                           anyOf:
  2324.                           - type: integer
  2325.                           - type: string
  2326.                           description: |-
  2327.                             Port defines the port of a Kubernetes Service.
  2328.                             This can be a reference to a named port.
  2329.                           x-kubernetes-int-or-string: true
  2330.                         responseForwarding:
  2331.                           description: ResponseForwarding defines how Traefik forwards
  2332.                             the response from the upstream Kubernetes Service to the
  2333.                             client.
  2334.                           properties:
  2335.                             flushInterval:
  2336.                               description: |-
  2337.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2338.                                 A negative value means to flush immediately after each write to the client.
  2339.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2340.                                 for such responses, writes are flushed to the client immediately.
  2341.                                 Default: 100ms
  2342.                               type: string
  2343.                           type: object
  2344.                         scheme:
  2345.                           description: |-
  2346.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2347.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2348.                           type: string
  2349.                         serversTransport:
  2350.                           description: |-
  2351.                             ServersTransport defines the name of ServersTransport resource to use.
  2352.                             It allows to configure the transport between Traefik and your servers.
  2353.                             Can only be used on a Kubernetes Service.
  2354.                           type: string
  2355.                         sticky:
  2356.                           description: |-
  2357.                             Sticky defines the sticky sessions configuration.
  2358.                             More info: https://doc.traefik.io/traefik/v3.0/routing/services/#sticky-sessions
  2359.                           properties:
  2360.                             cookie:
  2361.                               description: Cookie defines the sticky cookie configuration.
  2362.                               properties:
  2363.                                 httpOnly:
  2364.                                   description: HTTPOnly defines whether the cookie
  2365.                                     can be accessed by client-side APIs, such as JavaScript.
  2366.                                   type: boolean
  2367.                                 maxAge:
  2368.                                   description: |-
  2369.                                     MaxAge indicates the number of seconds until the cookie expires.
  2370.                                     When set to a negative number, the cookie expires immediately.
  2371.                                     When set to zero, the cookie never expires.
  2372.                                   type: integer
  2373.                                 name:
  2374.                                   description: Name defines the Cookie name.
  2375.                                   type: string
  2376.                                 sameSite:
  2377.                                   description: |-
  2378.                                     SameSite defines the same site policy.
  2379.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2380.                                   type: string
  2381.                                 secure:
  2382.                                   description: Secure defines whether the cookie can
  2383.                                     only be transmitted over an encrypted connection
  2384.                                     (i.e. HTTPS).
  2385.                                   type: boolean
  2386.                               type: object
  2387.                           type: object
  2388.                         strategy:
  2389.                           description: |-
  2390.                             Strategy defines the load balancing strategy between the servers.
  2391.                             RoundRobin is the only supported value at the moment.
  2392.                           type: string
  2393.                         weight:
  2394.                           description: |-
  2395.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2396.                             (and to be precise, one that embeds a Weighted Round Robin).
  2397.                           type: integer
  2398.                       required:
  2399.                       - name
  2400.                       type: object
  2401.                     type: array
  2402.                   name:
  2403.                     description: |-
  2404.                       Name defines the name of the referenced Kubernetes Service or TraefikService.
  2405.                       The differentiation between the two is specified in the Kind field.
  2406.                     type: string
  2407.                   namespace:
  2408.                     description: Namespace defines the namespace of the referenced
  2409.                       Kubernetes Service or TraefikService.
  2410.                     type: string
  2411.                   nativeLB:
  2412.                     description: |-
  2413.                       NativeLB controls, when creating the load-balancer,
  2414.                       whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2415.                       The Kubernetes Service itself does load-balance to the pods.
  2416.                       By default, NativeLB is false.
  2417.                     type: boolean
  2418.                   passHostHeader:
  2419.                     description: |-
  2420.                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2421.                       By default, passHostHeader is true.
  2422.                     type: boolean
  2423.                   port:
  2424.                     anyOf:
  2425.                     - type: integer
  2426.                     - type: string
  2427.                     description: |-
  2428.                       Port defines the port of a Kubernetes Service.
  2429.                       This can be a reference to a named port.
  2430.                     x-kubernetes-int-or-string: true
  2431.                   responseForwarding:
  2432.                     description: ResponseForwarding defines how Traefik forwards the
  2433.                       response from the upstream Kubernetes Service to the client.
  2434.                     properties:
  2435.                       flushInterval:
  2436.                         description: |-
  2437.                           FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2438.                           A negative value means to flush immediately after each write to the client.
  2439.                           This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2440.                           for such responses, writes are flushed to the client immediately.
  2441.                           Default: 100ms
  2442.                         type: string
  2443.                     type: object
  2444.                   scheme:
  2445.                     description: |-
  2446.                       Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2447.                       It defaults to https when Kubernetes Service port is 443, http otherwise.
  2448.                     type: string
  2449.                   serversTransport:
  2450.                     description: |-
  2451.                       ServersTransport defines the name of ServersTransport resource to use.
  2452.                       It allows to configure the transport between Traefik and your servers.
  2453.                       Can only be used on a Kubernetes Service.
  2454.                     type: string
  2455.                   sticky:
  2456.                     description: |-
  2457.                       Sticky defines the sticky sessions configuration.
  2458.                       More info: https://doc.traefik.io/traefik/v3.0/routing/services/#sticky-sessions
  2459.                     properties:
  2460.                       cookie:
  2461.                         description: Cookie defines the sticky cookie configuration.
  2462.                         properties:
  2463.                           httpOnly:
  2464.                             description: HTTPOnly defines whether the cookie can be
  2465.                               accessed by client-side APIs, such as JavaScript.
  2466.                             type: boolean
  2467.                           maxAge:
  2468.                             description: |-
  2469.                               MaxAge indicates the number of seconds until the cookie expires.
  2470.                               When set to a negative number, the cookie expires immediately.
  2471.                               When set to zero, the cookie never expires.
  2472.                             type: integer
  2473.                           name:
  2474.                             description: Name defines the Cookie name.
  2475.                             type: string
  2476.                           sameSite:
  2477.                             description: |-
  2478.                               SameSite defines the same site policy.
  2479.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2480.                             type: string
  2481.                           secure:
  2482.                             description: Secure defines whether the cookie can only
  2483.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2484.                             type: boolean
  2485.                         type: object
  2486.                     type: object
  2487.                   strategy:
  2488.                     description: |-
  2489.                       Strategy defines the load balancing strategy between the servers.
  2490.                       RoundRobin is the only supported value at the moment.
  2491.                     type: string
  2492.                   weight:
  2493.                     description: |-
  2494.                       Weight defines the weight and should only be specified when Name references a TraefikService object
  2495.                       (and to be precise, one that embeds a Weighted Round Robin).
  2496.                     type: integer
  2497.                 required:
  2498.                 - name
  2499.                 type: object
  2500.               weighted:
  2501.                 description: Weighted defines the Weighted Round Robin configuration.
  2502.                 properties:
  2503.                   services:
  2504.                     description: Services defines the list of Kubernetes Service and/or
  2505.                       TraefikService to load-balance, with weight.
  2506.                     items:
  2507.                       description: Service defines an upstream HTTP service to proxy
  2508.                         traffic to.
  2509.                       properties:
  2510.                         kind:
  2511.                           description: Kind defines the kind of the Service.
  2512.                           enum:
  2513.                           - Service
  2514.                           - TraefikService
  2515.                           type: string
  2516.                         name:
  2517.                           description: |-
  2518.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2519.                             The differentiation between the two is specified in the Kind field.
  2520.                           type: string
  2521.                         namespace:
  2522.                           description: Namespace defines the namespace of the referenced
  2523.                             Kubernetes Service or TraefikService.
  2524.                           type: string
  2525.                         nativeLB:
  2526.                           description: |-
  2527.                             NativeLB controls, when creating the load-balancer,
  2528.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2529.                             The Kubernetes Service itself does load-balance to the pods.
  2530.                             By default, NativeLB is false.
  2531.                           type: boolean
  2532.                         passHostHeader:
  2533.                           description: |-
  2534.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2535.                             By default, passHostHeader is true.
  2536.                           type: boolean
  2537.                         port:
  2538.                           anyOf:
  2539.                           - type: integer
  2540.                           - type: string
  2541.                           description: |-
  2542.                             Port defines the port of a Kubernetes Service.
  2543.                             This can be a reference to a named port.
  2544.                           x-kubernetes-int-or-string: true
  2545.                         responseForwarding:
  2546.                           description: ResponseForwarding defines how Traefik forwards
  2547.                             the response from the upstream Kubernetes Service to the
  2548.                             client.
  2549.                           properties:
  2550.                             flushInterval:
  2551.                               description: |-
  2552.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2553.                                 A negative value means to flush immediately after each write to the client.
  2554.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2555.                                 for such responses, writes are flushed to the client immediately.
  2556.                                 Default: 100ms
  2557.                               type: string
  2558.                           type: object
  2559.                         scheme:
  2560.                           description: |-
  2561.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2562.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2563.                           type: string
  2564.                         serversTransport:
  2565.                           description: |-
  2566.                             ServersTransport defines the name of ServersTransport resource to use.
  2567.                             It allows to configure the transport between Traefik and your servers.
  2568.                             Can only be used on a Kubernetes Service.
  2569.                           type: string
  2570.                         sticky:
  2571.                           description: |-
  2572.                             Sticky defines the sticky sessions configuration.
  2573.                             More info: https://doc.traefik.io/traefik/v3.0/routing/services/#sticky-sessions
  2574.                           properties:
  2575.                             cookie:
  2576.                               description: Cookie defines the sticky cookie configuration.
  2577.                               properties:
  2578.                                 httpOnly:
  2579.                                   description: HTTPOnly defines whether the cookie
  2580.                                     can be accessed by client-side APIs, such as JavaScript.
  2581.                                   type: boolean
  2582.                                 maxAge:
  2583.                                   description: |-
  2584.                                     MaxAge indicates the number of seconds until the cookie expires.
  2585.                                     When set to a negative number, the cookie expires immediately.
  2586.                                     When set to zero, the cookie never expires.
  2587.                                   type: integer
  2588.                                 name:
  2589.                                   description: Name defines the Cookie name.
  2590.                                   type: string
  2591.                                 sameSite:
  2592.                                   description: |-
  2593.                                     SameSite defines the same site policy.
  2594.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2595.                                   type: string
  2596.                                 secure:
  2597.                                   description: Secure defines whether the cookie can
  2598.                                     only be transmitted over an encrypted connection
  2599.                                     (i.e. HTTPS).
  2600.                                   type: boolean
  2601.                               type: object
  2602.                           type: object
  2603.                         strategy:
  2604.                           description: |-
  2605.                             Strategy defines the load balancing strategy between the servers.
  2606.                             RoundRobin is the only supported value at the moment.
  2607.                           type: string
  2608.                         weight:
  2609.                           description: |-
  2610.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2611.                             (and to be precise, one that embeds a Weighted Round Robin).
  2612.                           type: integer
  2613.                       required:
  2614.                       - name
  2615.                       type: object
  2616.                     type: array
  2617.                   sticky:
  2618.                     description: |-
  2619.                       Sticky defines whether sticky sessions are enabled.
  2620.                       More info: https://doc.traefik.io/traefik/v3.0/routing/providers/kubernetes-crd/#stickiness-and-load-balancing
  2621.                     properties:
  2622.                       cookie:
  2623.                         description: Cookie defines the sticky cookie configuration.
  2624.                         properties:
  2625.                           httpOnly:
  2626.                             description: HTTPOnly defines whether the cookie can be
  2627.                               accessed by client-side APIs, such as JavaScript.
  2628.                             type: boolean
  2629.                           maxAge:
  2630.                             description: |-
  2631.                               MaxAge indicates the number of seconds until the cookie expires.
  2632.                               When set to a negative number, the cookie expires immediately.
  2633.                               When set to zero, the cookie never expires.
  2634.                             type: integer
  2635.                           name:
  2636.                             description: Name defines the Cookie name.
  2637.                             type: string
  2638.                           sameSite:
  2639.                             description: |-
  2640.                               SameSite defines the same site policy.
  2641.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2642.                             type: string
  2643.                           secure:
  2644.                             description: Secure defines whether the cookie can only
  2645.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2646.                             type: boolean
  2647.                         type: object
  2648.                     type: object
  2649.                 type: object
  2650.             type: object
  2651.         required:
  2652.         - metadata
  2653.         - spec
  2654.         type: object
  2655.     served: true
  2656.     storage: true

RBAC

  1. apiVersion: rbac.authorization.k8s.io/v1
  2. kind: ClusterRole
  3. metadata:
  4.   name: traefik-ingress-controller
  6. rules:
  7.   - apiGroups:
  8.       - ""
  9.     resources:
  10.       - services
  11.       - endpoints
  12.       - secrets
  13.     verbs:
  14.       - get
  15.       - list
  16.       - watch
  17.   - apiGroups:
  18.       - extensions
  19.       - networking.k8s.io
  20.     resources:
  21.       - ingresses
  22.       - ingressclasses
  23.     verbs:
  24.       - get
  25.       - list
  26.       - watch
  27.   - apiGroups:
  28.       - extensions
  29.       - networking.k8s.io
  30.     resources:
  31.       - ingresses/status
  32.     verbs:
  33.       - update
  34.   - apiGroups:
  35.       - traefik.io
  36.     resources:
  37.       - middlewares
  38.       - middlewaretcps
  39.       - ingressroutes
  40.       - traefikservices
  41.       - ingressroutetcps
  42.       - ingressrouteudps
  43.       - tlsoptions
  44.       - tlsstores
  45.       - serverstransports
  46.       - serverstransporttcps
  47.     verbs:
  48.       - get
  49.       - list
  50.       - watch
  52. ---
  53. apiVersion: rbac.authorization.k8s.io/v1
  54. kind: ClusterRoleBinding
  55. metadata:
  56.   name: traefik-ingress-controller
  58. roleRef:
  59.   apiGroup: rbac.authorization.k8s.io
  60.   kind: ClusterRole
  61.   name: traefik-ingress-controller
  62. subjects:
  63.   - kind: ServiceAccount
  64.     name: traefik-ingress-controller
  65.     namespace: default

Traefik

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v3.0
          args:
            - --log.level=DEBUG
            - --api
            - --api.insecure
            - --entryPoints.web.address=:80
            - --entryPoints.tcpep.address=:8000
            - --entryPoints.udpep.address=:9000/udp
            - --providers.kubernetescrd
          ports:
            - name: web
              containerPort: 80
            - name: admin
              containerPort: 8080
            - name: tcpep
              containerPort: 8000
            - name: udpep
              containerPort: 9000

---
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: TCP
      port: 80
      name: web
      targetPort: 80
    - protocol: TCP
      port: 8080
      name: admin
      targetPort: 8080
    - protocol: TCP
      port: 8000
      name: tcpep
      targetPort: 8000

---
apiVersion: v1
kind: Service
metadata:
  name: traefikudp
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: UDP
      port: 9000
      name: udpep
      targetPort: 9000

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: myingressroute
  namespace: default

spec:
  entryPoints:
    - web

  routes:
  - match: Host(`foo`) && PathPrefix(`/bar`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroute.tcp
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressroute.udp
  namespace: default

spec:
  entryPoints:
    - udpep
  routes:
  - services:
      - name: whoamiudp
        port: 8080

Whoami

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  namespace: default
  labels:
    app: traefiklabs
    name: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoami
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: whoami

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamitcp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamitcp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamitcp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamitcp
    spec:
      containers:
        - name: whoamitcp
          image: traefik/whoamitcp
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamitcp
  namespace: default

spec:
  ports:
    - protocol: TCP
      port: 8080
  selector:
    app: traefiklabs
    task: whoamitcp

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamiudp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamiudp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: traefik/whoamiudp:latest
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
  namespace: default

spec:
  ports:
    - port: 8080
  selector:
    app: traefiklabs
    task: whoamiudp

Routing Configuration

Custom Resource Definition (CRD)

  • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
  • Validate that the prerequisites are fulfilled before using the Traefik custom resources.
  • Traefik CRDs are building blocks that you can assemble according to your needs.

You can find an excerpt of the available custom resources in the table below:

KindPurposeConcept Behind
IngressRouteHTTP RoutingHTTP router
MiddlewareTweaks the HTTP requests before they are sent to your serviceHTTP Middlewares
TraefikServiceAbstraction for HTTP loadbalancing/mirroringHTTP service
IngressRouteTCPTCP RoutingTCP router
MiddlewareTCPTweaks the TCP requests before they are sent to your serviceTCP Middlewares
IngressRouteUDPUDP RoutingUDP router
TLSOptionsAllows to configure some parameters of the TLS connectionTLSOptions
TLSStoresAllows to configure the default TLS storeTLSStores
ServersTransportAllows to configure the transport between Traefik and the backendsServersTransport
ServersTransportTCPAllows to configure the transport between Traefik and the backendsTCP ServersTransport

Kind: IngressRoute

IngressRoute is the CRD implementation of a Traefik HTTP router.

Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

IngressRoute Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: foo
  namespace: bar
spec:
  entryPoints:                      # [1]
    - foo
  routes:                           # [2]
  - kind: Rule
    match: Host(`test.example.com`) # [3]
    priority: 10                    # [4]
    middlewares:                    # [5]
    - name: middleware1             # [6]
      namespace: default            # [7]
    services:                       # [8]
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80                      # [9]
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      serversTransport: transport   # [10]
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
          sameSite: none
          maxAge: 42  
      strategy: RoundRobin
      weight: 10
      nativeLB: true                # [11]
  tls:                              # [12]
    secretName: supersecret         # [13]
    options:                        # [14]
      name: opt                     # [15]
      namespace: default            # [16]
    certResolver: foo               # [17]
    domains:                        # [18]
    - main: example.net             # [19]
      sans:                         # [20]
      - a.example.net
      - b.example.net
RefAttributePurpose
[1]entryPointsList of entry points names
[2]routesList of routes
[3]routes[n].matchDefines the rule corresponding to an underlying router.
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]routes[n].middlewaresList of reference to Middleware
[6]middlewares[n].nameDefines the Middleware name
[7]middlewares[n].namespaceDefines the Middleware namespace. It can be omitted when the Middleware is in the IngressRoute namespace.
[8]routes[n].servicesList of any combination of TraefikService and reference to a Kubernetes service (See below for ExternalName Service setup)
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].serversTransportDefines the reference to a ServersTransport. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[11]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[12]tlsDefines TLS certificate configuration
[13]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[14]tls.optionsDefines the reference to a TLSOption
[15]options.nameDefines the TLSOption name
[16]options.namespaceDefines the TLSOption namespace
[17]tls.certResolverDefines the reference to a CertResolver
[18]tls.domainsList of domains
[19]domains[n].mainDefines the main domain name
[20]domains[n].sansList of SANs (alternative domains)

Declaring an IngressRoute

IngressRoute

# All resources definition must be declared
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test-name
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - kind: Rule
    match: Host(`test.example.com`)
    middlewares:
    - name: middleware1
      namespace: default
    priority: 10
    services:
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
      strategy: RoundRobin
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret

Middlewares

# All resources definition must be declared
# Prefixing with /foo
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: middleware1
  namespace: default
spec:
  addPrefix:
    prefix: /foo

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Configuring Backend Protocol

There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

  • Setting the scheme explicitly (http/https/h2c)
  • Configuring the name of the kubernetes service port to start with https (https)
  • Setting the kubernetes service port to use port 443 (https)

If you do not configure the above, Traefik will assume an http connection.

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRoute service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRoute

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Load Balancing

More information in the dedicated server load balancing section.

Declaring and using Kubernetes Service Load Balancing

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: svc1
      namespace: default
    - name: svc2
      namespace: default

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the service NativeLB option to true. Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: Middleware

Middleware is the CRD implementation of a Traefik middleware.

Register the Middleware kind in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

Declaring and Referencing a Middleware

Middleware

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: foo

spec:
  stripPrefix:
    prefixes:
      - /stripit

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: stripprefix
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available middlewares in the dedicated middlewares section.

Kind: TraefikService

TraefikService is the CRD implementation of a “Traefik Service”.

Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the IngressRoute objects, or recursively in others TraefikService objects.

Disambiguate Traefik and Kubernetes Services

As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

The field kind allows the following values:

TraefikService object allows to use any (valid) combinations of:

Weighted Round Robin

More information in the dedicated Weighted Round Robin service load balancing section.

Declaring and Using Weighted Round Robin

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: svc1
        port: 80
        weight: 1
      - name: wrr2
        kind: TraefikService
        weight: 1
      - name: mirror1
        kind: TraefikService
        weight: 1

---
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr2
  namespace: default

spec:
  weighted:
    services:
      - name: svc2
        port: 80
        weight: 1
      - name: svc3
        port: 80
        weight: 1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2
---
apiVersion: v1
kind: Service
metadata:
  name: svc3
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app3

Mirroring

More information in the dedicated mirroring service section.

Declaring and Using Mirroring

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: mirror1
      namespace: default
      kind: TraefikService

Mirroring k8s Service

# Mirroring from a k8s Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: svc1                      # svc1 receives 100% of the traffic
    port: 80
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 15% of this traffic
        kind: TraefikService
        percent: 15

Mirroring Traefik Service

# Mirroring from a Traefik Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: wrr1                      # wrr1 receives 100% of the traffic
    kind: TraefikService
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 10% of this traffic
        kind: TraefikService
        percent: 10

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax (service@provider) should be used to refer to the TraefikService, just as in the middleware case.

Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

Stickiness and load-balancing

As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

Stickiness on two load-balancing levels

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: whoami1
        kind: Service
        port: 80
        weight: 1
        sticky:
          cookie:
            name: lvl2
      - name: whoami2
        kind: Service
        weight: 1
        port: 80
        sticky:
          cookie:
            name: lvl2
    sticky:
      cookie:
        name: lvl1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: whoami1

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami1

---
apiVersion: v1
kind: Service
metadata:
  name: whoami2

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami2

Deployment (to illustrate replicas)

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami1
  labels:
    app: whoami1

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami1
  template:
    metadata:
      labels:
        app: whoami1
    spec:
      containers:
        - name: whoami1
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami2
  labels:
    app: whoami2

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami2
  template:
    metadata:
      labels:
        app: whoami2
    spec:
      containers:
        - name: whoami2
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

Kind: IngressRouteTCP

IngressRouteTCP is the CRD implementation of a Traefik TCP router.

Register the IngressRouteTCP kind in the Kubernetes cluster before creating IngressRouteTCP objects.

IngressRouteTCP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:                    # [1]
    - footcp
  routes:                         # [2]
  - match: HostSNI(`*`)           # [3]
    priority: 10                  # [4]
    middlewares:
    - name: middleware1           # [5]
      namespace: default          # [6]
    services:                     # [7]
    - name: foo                   # [8]
      port: 8080                  # [9]
      weight: 10                  # [10]
      proxyProtocol:              # [11]
        version: 1                # [12]
      serversTransport: transport # [13]
      nativeLB: true              # [14]
  tls:                            # [15]
    secretName: supersecret       # [16]
    options:                      # [17]
      name: opt                   # [18]
      namespace: default          # [19]
    certResolver: foo             # [20]
    domains:                      # [21]
    - main: example.net           # [22]
      sans:                       # [23]
      - a.example.net
      - b.example.net
    passthrough: false            # [24]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].matchDefines the rule of the underlying router
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]middlewares[n].nameDefines the MiddlewareTCP name
[6]middlewares[n].namespaceDefines the MiddlewareTCP namespace
[7]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[8]services[n].nameDefines the name of a Kubernetes service
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].weightDefines the weight to apply to the server load balancing
[11]services[n].proxyProtocolDefines the PROXY protocol configuration
[12]services[n].proxyProtocol.versionDefines the PROXY protocol version
[13]services[n].serversTransportDefines the reference to a ServersTransportTCP. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[14]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[15]tlsDefines TLS certificate configuration
[16]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[17]tls.optionsDefines the reference to a TLSOption
[18]tls.options.nameDefines the TLSOption name
[19]tls.options.namespaceDefines the TLSOption namespace
[20]tls.certResolverDefines the reference to a CertResolver
[21]tls.domainsList of domains
[22]tls.domains[n].mainDefines the main domain name
[23]tls.domains[n].sansList of SANs (alternative domains)
[24]tls.passthroughIf true, delegates the TLS termination to the backend

Declaring an IngressRouteTCP

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:
    - footcp
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    priority: 10
    services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret
    passthrough: false

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteTCP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

Only on IngressRouteTCP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

On both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the TCP service NativeLB option to true. By default, NativeLB is false.

Examples

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: MiddlewareTCP

MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.

Register the MiddlewareTCP kind in the Kubernetes cluster before creating MiddlewareTCP objects or referencing TCP middlewares in the IngressRouteTCP objects.

Declaring and Referencing a MiddlewareTCP

Middleware

apiVersion: traefik.io/v1alpha1
kind: MiddlewareTCP
metadata:
  name: ipallowlist
spec:
  ipAllowList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/allowlist`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: ipallowlist
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the TCP middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a MiddlewareTCP from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available TCP middlewares in the dedicated middlewares section.

Kind: IngressRouteUDP

IngressRouteUDP is the CRD implementation of a Traefik UDP router.

Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

IngressRouteUDP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:                  # [1]
    - fooudp
  routes:                       # [2]
  - services:                   # [3]
    - name: foo                 # [4]
      port: 8080                # [5]
      weight: 10                # [6]
      nativeLB: true            # [7]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[4]services[n].nameDefines the name of a Kubernetes service
[5]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[6]services[n].weightDefines the weight to apply to the server load balancing
[7]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.

Declaring an IngressRouteUDP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteUDP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteUDP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRouteUDP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the UDP service NativeLB option to true. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: TLSOption

TLSOption is the CRD implementation of a Traefik “TLS Option”.

Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the IngressRoute / IngressRouteTCP objects.

TLSOption Attributes

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption                             # [1]
  namespace: default

spec:
  minVersion: VersionTLS12                      # [2]
  maxVersion: VersionTLS13                      # [3]
  curvePreferences:                             # [4]
    - CurveP521
    - CurveP384
  cipherSuites:                                 # [5]
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:                                   # [6]
    secretNames:                                # [7]
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven     # [8]
  sniStrict: true                               # [9]
  alpnProtocols:                                # [10]
    - foobar
RefAttributePurpose
[1]nameDefines the name of the TLSOption resource. One can use default as name to redefine the default TLSOption.
[2]minVersionDefines the minimum TLS version that is acceptable.
[3]maxVersionDefines the maximum TLS version that is acceptable.
[4]cipherSuiteslist of supported cipher suites for TLS versions up to TLS 1.2.
[5]curvePreferencesList of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
[6]clientAuthdetermines the server’s policy for TLS Client Authentication.
[7]clientAuth.secretNameslist of names of the referenced Kubernetes Secrets (in TLSOption namespace). The secret must contain a certificate under either a tls.ca or a ca.crt key.
[8]clientAuth.clientAuthTypedefines the client authentication type to apply. The available values are: NoClientCert, RequestClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
[9]sniStrictif true, Traefik won’t allow connections from clients connections that do not specify a server_name extension.
[10]alpnProtocolsList of supported application level protocols for the TLS handshake, in order of preference.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a TLSOption

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption
  namespace: default

spec:
  minVersion: VersionTLS12
  sniStrict: true
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:
    secretNames:
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    options: 
      name: mytlsoption
      namespace: default

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: secret-ca1
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-ca2
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

Additionally, when the definition of the TLS option is from another provider, the cross-provider syntax (middlewarename@provider) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

Kind: TLSStore

TLSStore is the CRD implementation of a Traefik “TLS Store”.

Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects.

Default TLS Store

Traefik currently only uses the TLS Store named “default”. This default TLSStore should be in a namespace discoverable by Traefik. Since it is used by default on IngressRoute and IngressRouteTCP objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default TLSStore.

TLSStore Attributes

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  certificates:                            # [1]
    - secretName: foo                      
    - secretName: bar
  defaultCertificate:                      # [2]
    secretName: secret
RefAttributePurpose
[1]certificatesList of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store.
[2]defaultCertificateName of a Kubernetes Secret that holds the default key/certificate pair for the store.

Declaring and referencing a TLSStore

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  defaultCertificate:
    secretName:  supersecret

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls: {}

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Kind: ServersTransport

ServersTransport is the CRD implementation of a ServersTransport.

Default serversTransport

If no serversTransport is specified, the default@internal will be used. The default@internal serversTransport is created from the static configuration.

ServersTransport Attributes

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: foobar                        # [1]
  insecureSkipVerify: true                  # [2]
  rootCAsSecrets:                           # [3]
    - foobar
    - foobar
  certificatesSecrets:                      # [4]
    - foobar
    - foobar
  maxIdleConnsPerHost: 1                    # [5]
  forwardingTimeouts:                       # [6]
    dialTimeout: 42s                        # [7]
    responseHeaderTimeout: 42s              # [8]
    idleConnTimeout: 42s                    # [9]
  peerCertURI: foobar                       # [10]
  disableHTTP2: true                        # [11]
  spiffe:                                   # [12] 
    ids:                                    # [13]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [14]
RefAttributePurpose
[1]serverNameServerName used to contact the server.
[2]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[3]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[4]certificatesSecretsCertificates to present to the server for mTLS.
[5]maxIdleConnsPerHostControls the maximum idle (keep-alive) connections to keep per-host. If zero, defaultMaxIdleConnsPerHost is used.
[6]forwardingTimeoutsTimeouts for requests forwarded to the servers.
[7]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[8]responseHeaderTimeoutThe amount of time to wait for a server’s response headers after fully writing the request (including its body, if any). If zero, no timeout exists.
[9]idleConnTimeoutThe maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists.
[10]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[11]disableHTTP2Disables HTTP/2 for connections with servers.
[12]spiffeThe spiffe configuration.
[13]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[14]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransport

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

ServersTransport reference

By default, the referenced ServersTransport CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransport CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransport CRD is defined in another provider the cross-provider format name@provider should be used.

Kind: ServersTransportTCP

ServersTransportTCP is the CRD implementation of a ServersTransportTCP.

Default serversTransportTCP

If no serversTransportTCP is specified, the default@internal will be used. The default@internal serversTransportTCP is created from the static configuration.

ServersTransportTCP Attributes

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  dialTimeout: 42s                          # [1]
  dialKeepAlive: 42s                        # [2]
  terminationDelay: 42s                     # [3]
  tls:                                      # [4]
    serverName: foobar                      # [5]
    insecureSkipVerify: true                # [6]
    peerCertURI: foobar                     # [7]
    rootCAsSecrets:                         # [8]
      - foobar
      - foobar
    certificatesSecrets:                    # [9]
      - foobar
      - foobar
  spiffe:                                   # [10] 
    ids:                                    # [11]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [12]
RefAttributePurpose
[1]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[2]dialKeepAliveThe interval between keep-alive probes for an active network connection. If zero, keep-alive probes are sent with a default value (currently 15 seconds), if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field. If negative, keep-alive probes are disabled.
[3]terminationDelayDefines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability.
[4]tlsThe TLS configuration.
[5]serverNameServerName used to contact the server.
[6]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[7]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[8]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[9]certificatesSecretsCertificates to present to the server for mTLS.
[10]spiffeThe SPIFFE configuration.
[11]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[12]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransportTCP

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  tls:
    serverName: example.org
    insecureSkipVerify: true

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080
        serversTransport: mytransport

ServersTransportTCP reference

By default, the referenced ServersTransportTCP CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransportTCP CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransportTCP CRD is defined in another provider the cross-provider format name@provider should be used.

Further

Also see the full example with Let’s Encrypt.

Using Traefik for Business Applications?

If you are using Traefik in your organization, consider our enterprise-grade solutions:

These tools help businesses discover, deploy, secure, and manage microservices and APIs easily, at scale, across any environment.