Traefik & Kubernetes

The Kubernetes Ingress Controller, The Custom Resource Way.

Configuration Examples

Configuring KubernetesCRD and Deploying/Exposing Services

Resource Definition

  1. # All resources definition must be declared
  2. ---
  3. apiVersion: apiextensions.k8s.io/v1
  4. kind: CustomResourceDefinition
  5. metadata:
  6.   annotations:
  7.     controller-gen.kubebuilder.io/version: v0.14.0
  8.   name: ingressroutes.traefik.io
  9. spec:
  10.   group: traefik.io
  11.   names:
  12.     kind: IngressRoute
  13.     listKind: IngressRouteList
  14.     plural: ingressroutes
  15.     singular: ingressroute
  16.   scope: Namespaced
  17.   versions:
  18.   - name: v1alpha1
  19.     schema:
  20.       openAPIV3Schema:
  21.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  22.         properties:
  23.           apiVersion:
  24.             description: |-
  25.               APIVersion defines the versioned schema of this representation of an object.
  26.               Servers should convert recognized schemas to the latest internal value, and
  27.               may reject unrecognized values.
  28.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  29.             type: string
  30.           kind:
  31.             description: |-
  32.               Kind is a string value representing the REST resource this object represents.
  33.               Servers may infer this from the endpoint the client submits requests to.
  34.               Cannot be updated.
  35.               In CamelCase.
  36.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  37.             type: string
  38.           metadata:
  39.             type: object
  40.           spec:
  41.             description: IngressRouteSpec defines the desired state of IngressRoute.
  42.             properties:
  43.               entryPoints:
  44.                 description: |-
  45.                   EntryPoints defines the list of entry point names to bind to.
  46.                   Entry points have to be configured in the static configuration.
  47.                   More info: https://doc.traefik.io/traefik/v3.1/routing/entrypoints/
  48.                   Default: all.
  49.                 items:
  50.                   type: string
  51.                 type: array
  52.               routes:
  53.                 description: Routes defines the list of routes.
  54.                 items:
  55.                   description: Route holds the HTTP route configuration.
  56.                   properties:
  57.                     kind:
  58.                       description: |-
  59.                         Kind defines the kind of the route.
  60.                         Rule is the only supported kind.
  61.                       enum:
  62.                       - Rule
  63.                       type: string
  64.                     match:
  65.                       description: |-
  66.                         Match defines the router's rule.
  67.                         More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#rule
  68.                       type: string
  69.                     middlewares:
  70.                       description: |-
  71.                         Middlewares defines the list of references to Middleware resources.
  72.                         More info: https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#kind-middleware
  73.                       items:
  74.                         description: MiddlewareRef is a reference to a Middleware
  75.                           resource.
  76.                         properties:
  77.                           name:
  78.                             description: Name defines the name of the referenced Middleware
  79.                               resource.
  80.                             type: string
  81.                           namespace:
  82.                             description: Namespace defines the namespace of the referenced
  83.                               Middleware resource.
  84.                             type: string
  85.                         required:
  86.                         - name
  87.                         type: object
  88.                       type: array
  89.                     priority:
  90.                       description: |-
  91.                         Priority defines the router's priority.
  92.                         More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#priority
  93.                       type: integer
  94.                     services:
  95.                       description: |-
  96.                         Services defines the list of Service.
  97.                         It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
  98.                       items:
  99.                         description: Service defines an upstream HTTP service to proxy
  100.                           traffic to.
  101.                         properties:
  102.                           healthCheck:
  103.                             description: Healthcheck defines health checks for ExternalName
  104.                               services.
  105.                             properties:
  106.                               followRedirects:
  107.                                 description: |-
  108.                                   FollowRedirects defines whether redirects should be followed during the health check calls.
  109.                                   Default: true
  110.                                 type: boolean
  111.                               headers:
  112.                                 additionalProperties:
  113.                                   type: string
  114.                                 description: Headers defines custom headers to be
  115.                                   sent to the health check endpoint.
  116.                                 type: object
  117.                               hostname:
  118.                                 description: Hostname defines the value of hostname
  119.                                   in the Host header of the health check request.
  120.                                 type: string
  121.                               interval:
  122.                                 anyOf:
  123.                                 - type: integer
  124.                                 - type: string
  125.                                 description: |-
  126.                                   Interval defines the frequency of the health check calls.
  127.                                   Default: 30s
  128.                                 x-kubernetes-int-or-string: true
  129.                               method:
  130.                                 description: Method defines the healthcheck method.
  131.                                 type: string
  132.                               mode:
  133.                                 description: |-
  134.                                   Mode defines the health check mode.
  135.                                   If defined to grpc, will use the gRPC health check protocol to probe the server.
  136.                                   Default: http
  137.                                 type: string
  138.                               path:
  139.                                 description: Path defines the server URL path for
  140.                                   the health check endpoint.
  141.                                 type: string
  142.                               port:
  143.                                 description: Port defines the server URL port for
  144.                                   the health check endpoint.
  145.                                 type: integer
  146.                               scheme:
  147.                                 description: Scheme replaces the server URL scheme
  148.                                   for the health check endpoint.
  149.                                 type: string
  150.                               status:
  151.                                 description: Status defines the expected HTTP status
  152.                                   code of the response to the health check request.
  153.                                 type: integer
  154.                               timeout:
  155.                                 anyOf:
  156.                                 - type: integer
  157.                                 - type: string
  158.                                 description: |-
  159.                                   Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  160.                                   Default: 5s
  161.                                 x-kubernetes-int-or-string: true
  162.                             type: object
  163.                           kind:
  164.                             description: Kind defines the kind of the Service.
  165.                             enum:
  166.                             - Service
  167.                             - TraefikService
  168.                             type: string
  169.                           name:
  170.                             description: |-
  171.                               Name defines the name of the referenced Kubernetes Service or TraefikService.
  172.                               The differentiation between the two is specified in the Kind field.
  173.                             type: string
  174.                           namespace:
  175.                             description: Namespace defines the namespace of the referenced
  176.                               Kubernetes Service or TraefikService.
  177.                             type: string
  178.                           nativeLB:
  179.                             description: |-
  180.                               NativeLB controls, when creating the load-balancer,
  181.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  182.                               The Kubernetes Service itself does load-balance to the pods.
  183.                               By default, NativeLB is false.
  184.                             type: boolean
  185.                           nodePortLB:
  186.                             description: |-
  187.                               NodePortLB controls, when creating the load-balancer,
  188.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  189.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  190.                               By default, NodePortLB is false.
  191.                             type: boolean
  192.                           passHostHeader:
  193.                             description: |-
  194.                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  195.                               By default, passHostHeader is true.
  196.                             type: boolean
  197.                           port:
  198.                             anyOf:
  199.                             - type: integer
  200.                             - type: string
  201.                             description: |-
  202.                               Port defines the port of a Kubernetes Service.
  203.                               This can be a reference to a named port.
  204.                             x-kubernetes-int-or-string: true
  205.                           responseForwarding:
  206.                             description: ResponseForwarding defines how Traefik forwards
  207.                               the response from the upstream Kubernetes Service to
  208.                               the client.
  209.                             properties:
  210.                               flushInterval:
  211.                                 description: |-
  212.                                   FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  213.                                   A negative value means to flush immediately after each write to the client.
  214.                                   This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  215.                                   for such responses, writes are flushed to the client immediately.
  216.                                   Default: 100ms
  217.                                 type: string
  218.                             type: object
  219.                           scheme:
  220.                             description: |-
  221.                               Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  222.                               It defaults to https when Kubernetes Service port is 443, http otherwise.
  223.                             type: string
  224.                           serversTransport:
  225.                             description: |-
  226.                               ServersTransport defines the name of ServersTransport resource to use.
  227.                               It allows to configure the transport between Traefik and your servers.
  228.                               Can only be used on a Kubernetes Service.
  229.                             type: string
  230.                           sticky:
  231.                             description: |-
  232.                               Sticky defines the sticky sessions configuration.
  233.                               More info: https://doc.traefik.io/traefik/v3.1/routing/services/#sticky-sessions
  234.                             properties:
  235.                               cookie:
  236.                                 description: Cookie defines the sticky cookie configuration.
  237.                                 properties:
  238.                                   httpOnly:
  239.                                     description: HTTPOnly defines whether the cookie
  240.                                       can be accessed by client-side APIs, such as
  241.                                       JavaScript.
  242.                                     type: boolean
  243.                                   maxAge:
  244.                                     description: |-
  245.                                       MaxAge indicates the number of seconds until the cookie expires.
  246.                                       When set to a negative number, the cookie expires immediately.
  247.                                       When set to zero, the cookie never expires.
  248.                                     type: integer
  249.                                   name:
  250.                                     description: Name defines the Cookie name.
  251.                                     type: string
  252.                                   sameSite:
  253.                                     description: |-
  254.                                       SameSite defines the same site policy.
  255.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  256.                                     type: string
  257.                                   secure:
  258.                                     description: Secure defines whether the cookie
  259.                                       can only be transmitted over an encrypted connection
  260.                                       (i.e. HTTPS).
  261.                                     type: boolean
  262.                                 type: object
  263.                             type: object
  264.                           strategy:
  265.                             description: |-
  266.                               Strategy defines the load balancing strategy between the servers.
  267.                               RoundRobin is the only supported value at the moment.
  268.                             type: string
  269.                           weight:
  270.                             description: |-
  271.                               Weight defines the weight and should only be specified when Name references a TraefikService object
  272.                               (and to be precise, one that embeds a Weighted Round Robin).
  273.                             type: integer
  274.                         required:
  275.                         - name
  276.                         type: object
  277.                       type: array
  278.                     syntax:
  279.                       description: |-
  280.                         Syntax defines the router's rule syntax.
  281.                         More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#rulesyntax
  282.                       type: string
  283.                   required:
  284.                   - kind
  285.                   - match
  286.                   type: object
  287.                 type: array
  288.               tls:
  289.                 description: |-
  290.                   TLS defines the TLS configuration.
  291.                   More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#tls
  292.                 properties:
  293.                   certResolver:
  294.                     description: |-
  295.                       CertResolver defines the name of the certificate resolver to use.
  296.                       Cert resolvers have to be configured in the static configuration.
  297.                       More info: https://doc.traefik.io/traefik/v3.1/https/acme/#certificate-resolvers
  298.                     type: string
  299.                   domains:
  300.                     description: |-
  301.                       Domains defines the list of domains that will be used to issue certificates.
  302.                       More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#domains
  303.                     items:
  304.                       description: Domain holds a domain name with SANs.
  305.                       properties:
  306.                         main:
  307.                           description: Main defines the main domain name.
  308.                           type: string
  309.                         sans:
  310.                           description: SANs defines the subject alternative domain
  311.                             names.
  312.                           items:
  313.                             type: string
  314.                           type: array
  315.                       type: object
  316.                     type: array
  317.                   options:
  318.                     description: |-
  319.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  320.                       If not defined, the `default` TLSOption is used.
  321.                       More info: https://doc.traefik.io/traefik/v3.1/https/tls/#tls-options
  322.                     properties:
  323.                       name:
  324.                         description: |-
  325.                           Name defines the name of the referenced TLSOption.
  326.                           More info: https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#kind-tlsoption
  327.                         type: string
  328.                       namespace:
  329.                         description: |-
  330.                           Namespace defines the namespace of the referenced TLSOption.
  331.                           More info: https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#kind-tlsoption
  332.                         type: string
  333.                     required:
  334.                     - name
  335.                     type: object
  336.                   secretName:
  337.                     description: SecretName is the name of the referenced Kubernetes
  338.                       Secret to specify the certificate details.
  339.                     type: string
  340.                   store:
  341.                     description: |-
  342.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  343.                       Please note that only `default` TLSStore can be used.
  344.                     properties:
  345.                       name:
  346.                         description: |-
  347.                           Name defines the name of the referenced TLSStore.
  348.                           More info: https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#kind-tlsstore
  349.                         type: string
  350.                       namespace:
  351.                         description: |-
  352.                           Namespace defines the namespace of the referenced TLSStore.
  353.                           More info: https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#kind-tlsstore
  354.                         type: string
  355.                     required:
  356.                     - name
  357.                     type: object
  358.                 type: object
  359.             required:
  360.             - routes
  361.             type: object
  362.         required:
  363.         - metadata
  364.         - spec
  365.         type: object
  366.     served: true
  367.     storage: true
  368. ---
  369. apiVersion: apiextensions.k8s.io/v1
  370. kind: CustomResourceDefinition
  371. metadata:
  372.   annotations:
  373.     controller-gen.kubebuilder.io/version: v0.14.0
  374.   name: ingressroutetcps.traefik.io
  375. spec:
  376.   group: traefik.io
  377.   names:
  378.     kind: IngressRouteTCP
  379.     listKind: IngressRouteTCPList
  380.     plural: ingressroutetcps
  381.     singular: ingressroutetcp
  382.   scope: Namespaced
  383.   versions:
  384.   - name: v1alpha1
  385.     schema:
  386.       openAPIV3Schema:
  387.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  388.         properties:
  389.           apiVersion:
  390.             description: |-
  391.               APIVersion defines the versioned schema of this representation of an object.
  392.               Servers should convert recognized schemas to the latest internal value, and
  393.               may reject unrecognized values.
  394.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  395.             type: string
  396.           kind:
  397.             description: |-
  398.               Kind is a string value representing the REST resource this object represents.
  399.               Servers may infer this from the endpoint the client submits requests to.
  400.               Cannot be updated.
  401.               In CamelCase.
  402.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  403.             type: string
  404.           metadata:
  405.             type: object
  406.           spec:
  407.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  408.             properties:
  409.               entryPoints:
  410.                 description: |-
  411.                   EntryPoints defines the list of entry point names to bind to.
  412.                   Entry points have to be configured in the static configuration.
  413.                   More info: https://doc.traefik.io/traefik/v3.1/routing/entrypoints/
  414.                   Default: all.
  415.                 items:
  416.                   type: string
  417.                 type: array
  418.               routes:
  419.                 description: Routes defines the list of routes.
  420.                 items:
  421.                   description: RouteTCP holds the TCP route configuration.
  422.                   properties:
  423.                     match:
  424.                       description: |-
  425.                         Match defines the router's rule.
  426.                         More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#rule_1
  427.                       type: string
  428.                     middlewares:
  429.                       description: Middlewares defines the list of references to MiddlewareTCP
  430.                         resources.
  431.                       items:
  432.                         description: ObjectReference is a generic reference to a Traefik
  433.                           resource.
  434.                         properties:
  435.                           name:
  436.                             description: Name defines the name of the referenced Traefik
  437.                               resource.
  438.                             type: string
  439.                           namespace:
  440.                             description: Namespace defines the namespace of the referenced
  441.                               Traefik resource.
  442.                             type: string
  443.                         required:
  444.                         - name
  445.                         type: object
  446.                       type: array
  447.                     priority:
  448.                       description: |-
  449.                         Priority defines the router's priority.
  450.                         More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#priority_1
  451.                       type: integer
  452.                     services:
  453.                       description: Services defines the list of TCP services.
  454.                       items:
  455.                         description: ServiceTCP defines an upstream TCP service to
  456.                           proxy traffic to.
  457.                         properties:
  458.                           name:
  459.                             description: Name defines the name of the referenced Kubernetes
  460.                               Service.
  461.                             type: string
  462.                           namespace:
  463.                             description: Namespace defines the namespace of the referenced
  464.                               Kubernetes Service.
  465.                             type: string
  466.                           nativeLB:
  467.                             description: |-
  468.                               NativeLB controls, when creating the load-balancer,
  469.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  470.                               The Kubernetes Service itself does load-balance to the pods.
  471.                               By default, NativeLB is false.
  472.                             type: boolean
  473.                           nodePortLB:
  474.                             description: |-
  475.                               NodePortLB controls, when creating the load-balancer,
  476.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  477.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  478.                               By default, NodePortLB is false.
  479.                             type: boolean
  480.                           port:
  481.                             anyOf:
  482.                             - type: integer
  483.                             - type: string
  484.                             description: |-
  485.                               Port defines the port of a Kubernetes Service.
  486.                               This can be a reference to a named port.
  487.                             x-kubernetes-int-or-string: true
  488.                           proxyProtocol:
  489.                             description: |-
  490.                               ProxyProtocol defines the PROXY protocol configuration.
  491.                               More info: https://doc.traefik.io/traefik/v3.1/routing/services/#proxy-protocol
  492.                             properties:
  493.                               version:
  494.                                 description: Version defines the PROXY Protocol version
  495.                                   to use.
  496.                                 type: integer
  497.                             type: object
  498.                           serversTransport:
  499.                             description: |-
  500.                               ServersTransport defines the name of ServersTransportTCP resource to use.
  501.                               It allows to configure the transport between Traefik and your servers.
  502.                               Can only be used on a Kubernetes Service.
  503.                             type: string
  504.                           terminationDelay:
  505.                             description: |-
  506.                               TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates
  507.                               it has closed the writing capability of its connection, to close the reading capability as well,
  508.                               hence fully terminating the connection.
  509.                               It is a duration in milliseconds, defaulting to 100.
  510.                               A negative value means an infinite deadline (i.e. the reading capability is never closed).
  511.                               Deprecated: TerminationDelay is not supported APIVersion traefik.io/v1, please use ServersTransport to configure the TerminationDelay instead.
  512.                             type: integer
  513.                           tls:
  514.                             description: TLS determines whether to use TLS when dialing
  515.                               with the backend.
  516.                             type: boolean
  517.                           weight:
  518.                             description: Weight defines the weight used when balancing
  519.                               requests between multiple Kubernetes Service.
  520.                             type: integer
  521.                         required:
  522.                         - name
  523.                         - port
  524.                         type: object
  525.                       type: array
  526.                     syntax:
  527.                       description: |-
  528.                         Syntax defines the router's rule syntax.
  529.                         More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#rulesyntax_1
  530.                       type: string
  531.                   required:
  532.                   - match
  533.                   type: object
  534.                 type: array
  535.               tls:
  536.                 description: |-
  537.                   TLS defines the TLS configuration on a layer 4 / TCP Route.
  538.                   More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#tls_1
  539.                 properties:
  540.                   certResolver:
  541.                     description: |-
  542.                       CertResolver defines the name of the certificate resolver to use.
  543.                       Cert resolvers have to be configured in the static configuration.
  544.                       More info: https://doc.traefik.io/traefik/v3.1/https/acme/#certificate-resolvers
  545.                     type: string
  546.                   domains:
  547.                     description: |-
  548.                       Domains defines the list of domains that will be used to issue certificates.
  549.                       More info: https://doc.traefik.io/traefik/v3.1/routing/routers/#domains
  550.                     items:
  551.                       description: Domain holds a domain name with SANs.
  552.                       properties:
  553.                         main:
  554.                           description: Main defines the main domain name.
  555.                           type: string
  556.                         sans:
  557.                           description: SANs defines the subject alternative domain
  558.                             names.
  559.                           items:
  560.                             type: string
  561.                           type: array
  562.                       type: object
  563.                     type: array
  564.                   options:
  565.                     description: |-
  566.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  567.                       If not defined, the `default` TLSOption is used.
  568.                       More info: https://doc.traefik.io/traefik/v3.1/https/tls/#tls-options
  569.                     properties:
  570.                       name:
  571.                         description: Name defines the name of the referenced Traefik
  572.                           resource.
  573.                         type: string
  574.                       namespace:
  575.                         description: Namespace defines the namespace of the referenced
  576.                           Traefik resource.
  577.                         type: string
  578.                     required:
  579.                     - name
  580.                     type: object
  581.                   passthrough:
  582.                     description: Passthrough defines whether a TLS router will terminate
  583.                       the TLS connection.
  584.                     type: boolean
  585.                   secretName:
  586.                     description: SecretName is the name of the referenced Kubernetes
  587.                       Secret to specify the certificate details.
  588.                     type: string
  589.                   store:
  590.                     description: |-
  591.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  592.                       Please note that only `default` TLSStore can be used.
  593.                     properties:
  594.                       name:
  595.                         description: Name defines the name of the referenced Traefik
  596.                           resource.
  597.                         type: string
  598.                       namespace:
  599.                         description: Namespace defines the namespace of the referenced
  600.                           Traefik resource.
  601.                         type: string
  602.                     required:
  603.                     - name
  604.                     type: object
  605.                 type: object
  606.             required:
  607.             - routes
  608.             type: object
  609.         required:
  610.         - metadata
  611.         - spec
  612.         type: object
  613.     served: true
  614.     storage: true
  615. ---
  616. apiVersion: apiextensions.k8s.io/v1
  617. kind: CustomResourceDefinition
  618. metadata:
  619.   annotations:
  620.     controller-gen.kubebuilder.io/version: v0.14.0
  621.   name: ingressrouteudps.traefik.io
  622. spec:
  623.   group: traefik.io
  624.   names:
  625.     kind: IngressRouteUDP
  626.     listKind: IngressRouteUDPList
  627.     plural: ingressrouteudps
  628.     singular: ingressrouteudp
  629.   scope: Namespaced
  630.   versions:
  631.   - name: v1alpha1
  632.     schema:
  633.       openAPIV3Schema:
  634.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  635.         properties:
  636.           apiVersion:
  637.             description: |-
  638.               APIVersion defines the versioned schema of this representation of an object.
  639.               Servers should convert recognized schemas to the latest internal value, and
  640.               may reject unrecognized values.
  641.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  642.             type: string
  643.           kind:
  644.             description: |-
  645.               Kind is a string value representing the REST resource this object represents.
  646.               Servers may infer this from the endpoint the client submits requests to.
  647.               Cannot be updated.
  648.               In CamelCase.
  649.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  650.             type: string
  651.           metadata:
  652.             type: object
  653.           spec:
  654.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  655.             properties:
  656.               entryPoints:
  657.                 description: |-
  658.                   EntryPoints defines the list of entry point names to bind to.
  659.                   Entry points have to be configured in the static configuration.
  660.                   More info: https://doc.traefik.io/traefik/v3.1/routing/entrypoints/
  661.                   Default: all.
  662.                 items:
  663.                   type: string
  664.                 type: array
  665.               routes:
  666.                 description: Routes defines the list of routes.
  667.                 items:
  668.                   description: RouteUDP holds the UDP route configuration.
  669.                   properties:
  670.                     services:
  671.                       description: Services defines the list of UDP services.
  672.                       items:
  673.                         description: ServiceUDP defines an upstream UDP service to
  674.                           proxy traffic to.
  675.                         properties:
  676.                           name:
  677.                             description: Name defines the name of the referenced Kubernetes
  678.                               Service.
  679.                             type: string
  680.                           namespace:
  681.                             description: Namespace defines the namespace of the referenced
  682.                               Kubernetes Service.
  683.                             type: string
  684.                           nativeLB:
  685.                             description: |-
  686.                               NativeLB controls, when creating the load-balancer,
  687.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  688.                               The Kubernetes Service itself does load-balance to the pods.
  689.                               By default, NativeLB is false.
  690.                             type: boolean
  691.                           nodePortLB:
  692.                             description: |-
  693.                               NodePortLB controls, when creating the load-balancer,
  694.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  695.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  696.                               By default, NodePortLB is false.
  697.                             type: boolean
  698.                           port:
  699.                             anyOf:
  700.                             - type: integer
  701.                             - type: string
  702.                             description: |-
  703.                               Port defines the port of a Kubernetes Service.
  704.                               This can be a reference to a named port.
  705.                             x-kubernetes-int-or-string: true
  706.                           weight:
  707.                             description: Weight defines the weight used when balancing
  708.                               requests between multiple Kubernetes Service.
  709.                             type: integer
  710.                         required:
  711.                         - name
  712.                         - port
  713.                         type: object
  714.                       type: array
  715.                   type: object
  716.                 type: array
  717.             required:
  718.             - routes
  719.             type: object
  720.         required:
  721.         - metadata
  722.         - spec
  723.         type: object
  724.     served: true
  725.     storage: true
  726. ---
  727. apiVersion: apiextensions.k8s.io/v1
  728. kind: CustomResourceDefinition
  729. metadata:
  730.   annotations:
  731.     controller-gen.kubebuilder.io/version: v0.14.0
  732.   name: middlewares.traefik.io
  733. spec:
  734.   group: traefik.io
  735.   names:
  736.     kind: Middleware
  737.     listKind: MiddlewareList
  738.     plural: middlewares
  739.     singular: middleware
  740.   scope: Namespaced
  741.   versions:
  742.   - name: v1alpha1
  743.     schema:
  744.       openAPIV3Schema:
  745.         description: |-
  746.           Middleware is the CRD implementation of a Traefik Middleware.
  747.           More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/overview/
  748.         properties:
  749.           apiVersion:
  750.             description: |-
  751.               APIVersion defines the versioned schema of this representation of an object.
  752.               Servers should convert recognized schemas to the latest internal value, and
  753.               may reject unrecognized values.
  754.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  755.             type: string
  756.           kind:
  757.             description: |-
  758.               Kind is a string value representing the REST resource this object represents.
  759.               Servers may infer this from the endpoint the client submits requests to.
  760.               Cannot be updated.
  761.               In CamelCase.
  762.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  763.             type: string
  764.           metadata:
  765.             type: object
  766.           spec:
  767.             description: MiddlewareSpec defines the desired state of a Middleware.
  768.             properties:
  769.               addPrefix:
  770.                 description: |-
  771.                   AddPrefix holds the add prefix middleware configuration.
  772.                   This middleware updates the path of a request before forwarding it.
  773.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/addprefix/
  774.                 properties:
  775.                   prefix:
  776.                     description: |-
  777.                       Prefix is the string to add before the current path in the requested URL.
  778.                       It should include a leading slash (/).
  779.                     type: string
  780.                 type: object
  781.               basicAuth:
  782.                 description: |-
  783.                   BasicAuth holds the basic auth middleware configuration.
  784.                   This middleware restricts access to your services to known users.
  785.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/basicauth/
  786.                 properties:
  787.                   headerField:
  788.                     description: |-
  789.                       HeaderField defines a header field to store the authenticated user.
  790.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/basicauth/#headerfield
  791.                     type: string
  792.                   realm:
  793.                     description: |-
  794.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  795.                       Default: traefik.
  796.                     type: string
  797.                   removeHeader:
  798.                     description: |-
  799.                       RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service.
  800.                       Default: false.
  801.                     type: boolean
  802.                   secret:
  803.                     description: Secret is the name of the referenced Kubernetes Secret
  804.                       containing user credentials.
  805.                     type: string
  806.                 type: object
  807.               buffering:
  808.                 description: |-
  809.                   Buffering holds the buffering middleware configuration.
  810.                   This middleware retries or limits the size of requests that can be forwarded to backends.
  811.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/buffering/#maxrequestbodybytes
  812.                 properties:
  813.                   maxRequestBodyBytes:
  814.                     description: |-
  815.                       MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).
  816.                       If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.
  817.                       Default: 0 (no maximum).
  818.                     format: int64
  819.                     type: integer
  820.                   maxResponseBodyBytes:
  821.                     description: |-
  822.                       MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes).
  823.                       If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead.
  824.                       Default: 0 (no maximum).
  825.                     format: int64
  826.                     type: integer
  827.                   memRequestBodyBytes:
  828.                     description: |-
  829.                       MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory.
  830.                       Default: 1048576 (1Mi).
  831.                     format: int64
  832.                     type: integer
  833.                   memResponseBodyBytes:
  834.                     description: |-
  835.                       MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory.
  836.                       Default: 1048576 (1Mi).
  837.                     format: int64
  838.                     type: integer
  839.                   retryExpression:
  840.                     description: |-
  841.                       RetryExpression defines the retry conditions.
  842.                       It is a logical combination of functions with operators AND (&&) and OR (||).
  843.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/buffering/#retryexpression
  844.                     type: string
  845.                 type: object
  846.               chain:
  847.                 description: |-
  848.                   Chain holds the configuration of the chain middleware.
  849.                   This middleware enables to define reusable combinations of other pieces of middleware.
  850.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/chain/
  851.                 properties:
  852.                   middlewares:
  853.                     description: Middlewares is the list of MiddlewareRef which composes
  854.                       the chain.
  855.                     items:
  856.                       description: MiddlewareRef is a reference to a Middleware resource.
  857.                       properties:
  858.                         name:
  859.                           description: Name defines the name of the referenced Middleware
  860.                             resource.
  861.                           type: string
  862.                         namespace:
  863.                           description: Namespace defines the namespace of the referenced
  864.                             Middleware resource.
  865.                           type: string
  866.                       required:
  867.                       - name
  868.                       type: object
  869.                     type: array
  870.                 type: object
  871.               circuitBreaker:
  872.                 description: CircuitBreaker holds the circuit breaker configuration.
  873.                 properties:
  874.                   checkPeriod:
  875.                     anyOf:
  876.                     - type: integer
  877.                     - type: string
  878.                     description: CheckPeriod is the interval between successive checks
  879.                       of the circuit breaker condition (when in standby state).
  880.                     x-kubernetes-int-or-string: true
  881.                   expression:
  882.                     description: Expression is the condition that triggers the tripped
  883.                       state.
  884.                     type: string
  885.                   fallbackDuration:
  886.                     anyOf:
  887.                     - type: integer
  888.                     - type: string
  889.                     description: FallbackDuration is the duration for which the circuit
  890.                       breaker will wait before trying to recover (from a tripped state).
  891.                     x-kubernetes-int-or-string: true
  892.                   recoveryDuration:
  893.                     anyOf:
  894.                     - type: integer
  895.                     - type: string
  896.                     description: RecoveryDuration is the duration for which the circuit
  897.                       breaker will try to recover (as soon as it is in recovering
  898.                       state).
  899.                     x-kubernetes-int-or-string: true
  900.                   responseCode:
  901.                     description: ResponseCode is the status code that the circuit
  902.                       breaker will return while it is in the open state.
  903.                     type: integer
  904.                 type: object
  905.               compress:
  906.                 description: |-
  907.                   Compress holds the compress middleware configuration.
  908.                   This middleware compresses responses before sending them to the client, using gzip compression.
  909.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/compress/
  910.                 properties:
  911.                   defaultEncoding:
  912.                     description: DefaultEncoding specifies the default encoding if
  913.                       the `Accept-Encoding` header is not in the request or contains
  914.                       a wildcard (`*`).
  915.                     type: string
  916.                   excludedContentTypes:
  917.                     description: |-
  918.                       ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing.
  919.                       `application/grpc` is always excluded.
  920.                     items:
  921.                       type: string
  922.                     type: array
  923.                   includedContentTypes:
  924.                     description: IncludedContentTypes defines the list of content
  925.                       types to compare the Content-Type header of the responses before
  926.                       compressing.
  927.                     items:
  928.                       type: string
  929.                     type: array
  930.                   minResponseBodyBytes:
  931.                     description: |-
  932.                       MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed.
  933.                       Default: 1024.
  934.                     type: integer
  935.                 type: object
  936.               contentType:
  937.                 description: |-
  938.                   ContentType holds the content-type middleware configuration.
  939.                   This middleware exists to enable the correct behavior until at least the default one can be changed in a future version.
  940.                 properties:
  941.                   autoDetect:
  942.                     description: |-
  943.                       AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend,
  944.                       be automatically set to a value derived from the contents of the response.
  945.                       Deprecated: AutoDetect option is deprecated, Content-Type middleware is only meant to be used to enable the content-type detection, please remove any usage of this option.
  946.                     type: boolean
  947.                 type: object
  948.               digestAuth:
  949.                 description: |-
  950.                   DigestAuth holds the digest auth middleware configuration.
  951.                   This middleware restricts access to your services to known users.
  952.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/digestauth/
  953.                 properties:
  954.                   headerField:
  955.                     description: |-
  956.                       HeaderField defines a header field to store the authenticated user.
  957.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/basicauth/#headerfield
  958.                     type: string
  959.                   realm:
  960.                     description: |-
  961.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  962.                       Default: traefik.
  963.                     type: string
  964.                   removeHeader:
  965.                     description: RemoveHeader defines whether to remove the authorization
  966.                       header before forwarding the request to the backend.
  967.                     type: boolean
  968.                   secret:
  969.                     description: Secret is the name of the referenced Kubernetes Secret
  970.                       containing user credentials.
  971.                     type: string
  972.                 type: object
  973.               errors:
  974.                 description: |-
  975.                   ErrorPage holds the custom error middleware configuration.
  976.                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
  977.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/errorpages/
  978.                 properties:
  979.                   query:
  980.                     description: |-
  981.                       Query defines the URL for the error page (hosted by service).
  982.                       The {status} variable can be used in order to insert the status code in the URL.
  983.                     type: string
  984.                   service:
  985.                     description: |-
  986.                       Service defines the reference to a Kubernetes Service that will serve the error page.
  987.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/errorpages/#service
  988.                     properties:
  989.                       healthCheck:
  990.                         description: Healthcheck defines health checks for ExternalName
  991.                           services.
  992.                         properties:
  993.                           followRedirects:
  994.                             description: |-
  995.                               FollowRedirects defines whether redirects should be followed during the health check calls.
  996.                               Default: true
  997.                             type: boolean
  998.                           headers:
  999.                             additionalProperties:
  1000.                               type: string
  1001.                             description: Headers defines custom headers to be sent
  1002.                               to the health check endpoint.
  1003.                             type: object
  1004.                           hostname:
  1005.                             description: Hostname defines the value of hostname in
  1006.                               the Host header of the health check request.
  1007.                             type: string
  1008.                           interval:
  1009.                             anyOf:
  1010.                             - type: integer
  1011.                             - type: string
  1012.                             description: |-
  1013.                               Interval defines the frequency of the health check calls.
  1014.                               Default: 30s
  1015.                             x-kubernetes-int-or-string: true
  1016.                           method:
  1017.                             description: Method defines the healthcheck method.
  1018.                             type: string
  1019.                           mode:
  1020.                             description: |-
  1021.                               Mode defines the health check mode.
  1022.                               If defined to grpc, will use the gRPC health check protocol to probe the server.
  1023.                               Default: http
  1024.                             type: string
  1025.                           path:
  1026.                             description: Path defines the server URL path for the
  1027.                               health check endpoint.
  1028.                             type: string
  1029.                           port:
  1030.                             description: Port defines the server URL port for the
  1031.                               health check endpoint.
  1032.                             type: integer
  1033.                           scheme:
  1034.                             description: Scheme replaces the server URL scheme for
  1035.                               the health check endpoint.
  1036.                             type: string
  1037.                           status:
  1038.                             description: Status defines the expected HTTP status code
  1039.                               of the response to the health check request.
  1040.                             type: integer
  1041.                           timeout:
  1042.                             anyOf:
  1043.                             - type: integer
  1044.                             - type: string
  1045.                             description: |-
  1046.                               Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  1047.                               Default: 5s
  1048.                             x-kubernetes-int-or-string: true
  1049.                         type: object
  1050.                       kind:
  1051.                         description: Kind defines the kind of the Service.
  1052.                         enum:
  1053.                         - Service
  1054.                         - TraefikService
  1055.                         type: string
  1056.                       name:
  1057.                         description: |-
  1058.                           Name defines the name of the referenced Kubernetes Service or TraefikService.
  1059.                           The differentiation between the two is specified in the Kind field.
  1060.                         type: string
  1061.                       namespace:
  1062.                         description: Namespace defines the namespace of the referenced
  1063.                           Kubernetes Service or TraefikService.
  1064.                         type: string
  1065.                       nativeLB:
  1066.                         description: |-
  1067.                           NativeLB controls, when creating the load-balancer,
  1068.                           whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  1069.                           The Kubernetes Service itself does load-balance to the pods.
  1070.                           By default, NativeLB is false.
  1071.                         type: boolean
  1072.                       nodePortLB:
  1073.                         description: |-
  1074.                           NodePortLB controls, when creating the load-balancer,
  1075.                           whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  1076.                           It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  1077.                           By default, NodePortLB is false.
  1078.                         type: boolean
  1079.                       passHostHeader:
  1080.                         description: |-
  1081.                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  1082.                           By default, passHostHeader is true.
  1083.                         type: boolean
  1084.                       port:
  1085.                         anyOf:
  1086.                         - type: integer
  1087.                         - type: string
  1088.                         description: |-
  1089.                           Port defines the port of a Kubernetes Service.
  1090.                           This can be a reference to a named port.
  1091.                         x-kubernetes-int-or-string: true
  1092.                       responseForwarding:
  1093.                         description: ResponseForwarding defines how Traefik forwards
  1094.                           the response from the upstream Kubernetes Service to the
  1095.                           client.
  1096.                         properties:
  1097.                           flushInterval:
  1098.                             description: |-
  1099.                               FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  1100.                               A negative value means to flush immediately after each write to the client.
  1101.                               This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  1102.                               for such responses, writes are flushed to the client immediately.
  1103.                               Default: 100ms
  1104.                             type: string
  1105.                         type: object
  1106.                       scheme:
  1107.                         description: |-
  1108.                           Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  1109.                           It defaults to https when Kubernetes Service port is 443, http otherwise.
  1110.                         type: string
  1111.                       serversTransport:
  1112.                         description: |-
  1113.                           ServersTransport defines the name of ServersTransport resource to use.
  1114.                           It allows to configure the transport between Traefik and your servers.
  1115.                           Can only be used on a Kubernetes Service.
  1116.                         type: string
  1117.                       sticky:
  1118.                         description: |-
  1119.                           Sticky defines the sticky sessions configuration.
  1120.                           More info: https://doc.traefik.io/traefik/v3.1/routing/services/#sticky-sessions
  1121.                         properties:
  1122.                           cookie:
  1123.                             description: Cookie defines the sticky cookie configuration.
  1124.                             properties:
  1125.                               httpOnly:
  1126.                                 description: HTTPOnly defines whether the cookie can
  1127.                                   be accessed by client-side APIs, such as JavaScript.
  1128.                                 type: boolean
  1129.                               maxAge:
  1130.                                 description: |-
  1131.                                   MaxAge indicates the number of seconds until the cookie expires.
  1132.                                   When set to a negative number, the cookie expires immediately.
  1133.                                   When set to zero, the cookie never expires.
  1134.                                 type: integer
  1135.                               name:
  1136.                                 description: Name defines the Cookie name.
  1137.                                 type: string
  1138.                               sameSite:
  1139.                                 description: |-
  1140.                                   SameSite defines the same site policy.
  1141.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  1142.                                 type: string
  1143.                               secure:
  1144.                                 description: Secure defines whether the cookie can
  1145.                                   only be transmitted over an encrypted connection
  1146.                                   (i.e. HTTPS).
  1147.                                 type: boolean
  1148.                             type: object
  1149.                         type: object
  1150.                       strategy:
  1151.                         description: |-
  1152.                           Strategy defines the load balancing strategy between the servers.
  1153.                           RoundRobin is the only supported value at the moment.
  1154.                         type: string
  1155.                       weight:
  1156.                         description: |-
  1157.                           Weight defines the weight and should only be specified when Name references a TraefikService object
  1158.                           (and to be precise, one that embeds a Weighted Round Robin).
  1159.                         type: integer
  1160.                     required:
  1161.                     - name
  1162.                     type: object
  1163.                   status:
  1164.                     description: |-
  1165.                       Status defines which status or range of statuses should result in an error page.
  1166.                       It can be either a status code as a number (500),
  1167.                       as multiple comma-separated numbers (500,502),
  1168.                       as ranges by separating two codes with a dash (500-599),
  1169.                       or a combination of the two (404,418,500-599).
  1170.                     items:
  1171.                       type: string
  1172.                     type: array
  1173.                 type: object
  1174.               forwardAuth:
  1175.                 description: |-
  1176.                   ForwardAuth holds the forward auth middleware configuration.
  1177.                   This middleware delegates the request authentication to a Service.
  1178.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/forwardauth/
  1179.                 properties:
  1180.                   addAuthCookiesToResponse:
  1181.                     description: AddAuthCookiesToResponse defines the list of cookies
  1182.                       to copy from the authentication server response to the response.
  1183.                     items:
  1184.                       type: string
  1185.                     type: array
  1186.                   address:
  1187.                     description: Address defines the authentication server address.
  1188.                     type: string
  1189.                   authRequestHeaders:
  1190.                     description: |-
  1191.                       AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
  1192.                       If not set or empty then all request headers are passed.
  1193.                     items:
  1194.                       type: string
  1195.                     type: array
  1196.                   authResponseHeaders:
  1197.                     description: AuthResponseHeaders defines the list of headers to
  1198.                       copy from the authentication server response and set on forwarded
  1199.                       request, replacing any existing conflicting headers.
  1200.                     items:
  1201.                       type: string
  1202.                     type: array
  1203.                   authResponseHeadersRegex:
  1204.                     description: |-
  1205.                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
  1206.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/forwardauth/#authresponseheadersregex
  1207.                     type: string
  1208.                   tls:
  1209.                     description: TLS defines the configuration used to secure the
  1210.                       connection to the authentication server.
  1211.                     properties:
  1212.                       caOptional:
  1213.                         description: 'Deprecated: TLS client authentication is a server
  1214.                           side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634).'
  1215.                         type: boolean
  1216.                       caSecret:
  1217.                         description: |-
  1218.                           CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate.
  1219.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  1220.                         type: string
  1221.                       certSecret:
  1222.                         description: |-
  1223.                           CertSecret is the name of the referenced Kubernetes Secret containing the client certificate.
  1224.                           The client certificate is extracted from the keys `tls.crt` and `tls.key`.
  1225.                         type: string
  1226.                       insecureSkipVerify:
  1227.                         description: InsecureSkipVerify defines whether the server
  1228.                           certificates should be validated.
  1229.                         type: boolean
  1230.                     type: object
  1231.                   trustForwardHeader:
  1232.                     description: 'TrustForwardHeader defines whether to trust (ie:
  1233.                       forward) all X-Forwarded-* headers.'
  1234.                     type: boolean
  1235.                 type: object
  1236.               grpcWeb:
  1237.                 description: |-
  1238.                   GrpcWeb holds the gRPC web middleware configuration.
  1239.                   This middleware converts a gRPC web request to an HTTP/2 gRPC request.
  1240.                 properties:
  1241.                   allowOrigins:
  1242.                     description: |-
  1243.                       AllowOrigins is a list of allowable origins.
  1244.                       Can also be a wildcard origin "*".
  1245.                     items:
  1246.                       type: string
  1247.                     type: array
  1248.                 type: object
  1249.               headers:
  1250.                 description: |-
  1251.                   Headers holds the headers middleware configuration.
  1252.                   This middleware manages the requests and responses headers.
  1253.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/headers/#customrequestheaders
  1254.                 properties:
  1255.                   accessControlAllowCredentials:
  1256.                     description: AccessControlAllowCredentials defines whether the
  1257.                       request can include user credentials.
  1258.                     type: boolean
  1259.                   accessControlAllowHeaders:
  1260.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  1261.                       values sent in preflight response.
  1262.                     items:
  1263.                       type: string
  1264.                     type: array
  1265.                   accessControlAllowMethods:
  1266.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  1267.                       values sent in preflight response.
  1268.                     items:
  1269.                       type: string
  1270.                     type: array
  1271.                   accessControlAllowOriginList:
  1272.                     description: AccessControlAllowOriginList is a list of allowable
  1273.                       origins. Can also be a wildcard origin "*".
  1274.                     items:
  1275.                       type: string
  1276.                     type: array
  1277.                   accessControlAllowOriginListRegex:
  1278.                     description: AccessControlAllowOriginListRegex is a list of allowable
  1279.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  1280.                     items:
  1281.                       type: string
  1282.                     type: array
  1283.                   accessControlExposeHeaders:
  1284.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  1285.                       values sent in preflight response.
  1286.                     items:
  1287.                       type: string
  1288.                     type: array
  1289.                   accessControlMaxAge:
  1290.                     description: AccessControlMaxAge defines the time that a preflight
  1291.                       request may be cached.
  1292.                     format: int64
  1293.                     type: integer
  1294.                   addVaryHeader:
  1295.                     description: AddVaryHeader defines whether the Vary header is
  1296.                       automatically added/updated when the AccessControlAllowOriginList
  1297.                       is set.
  1298.                     type: boolean
  1299.                   allowedHosts:
  1300.                     description: AllowedHosts defines the fully qualified list of
  1301.                       allowed domain names.
  1302.                     items:
  1303.                       type: string
  1304.                     type: array
  1305.                   browserXssFilter:
  1306.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  1307.                       header with the value 1; mode=block.
  1308.                     type: boolean
  1309.                   contentSecurityPolicy:
  1310.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  1311.                       header value.
  1312.                     type: string
  1313.                   contentSecurityPolicyReportOnly:
  1314.                     description: ContentSecurityPolicyReportOnly defines the Content-Security-Policy-Report-Only
  1315.                       header value.
  1316.                     type: string
  1317.                   contentTypeNosniff:
  1318.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  1319.                       header with the nosniff value.
  1320.                     type: boolean
  1321.                   customBrowserXSSValue:
  1322.                     description: |-
  1323.                       CustomBrowserXSSValue defines the X-XSS-Protection header value.
  1324.                       This overrides the BrowserXssFilter option.
  1325.                     type: string
  1326.                   customFrameOptionsValue:
  1327.                     description: |-
  1328.                       CustomFrameOptionsValue defines the X-Frame-Options header value.
  1329.                       This overrides the FrameDeny option.
  1330.                     type: string
  1331.                   customRequestHeaders:
  1332.                     additionalProperties:
  1333.                       type: string
  1334.                     description: CustomRequestHeaders defines the header names and
  1335.                       values to apply to the request.
  1336.                     type: object
  1337.                   customResponseHeaders:
  1338.                     additionalProperties:
  1339.                       type: string
  1340.                     description: CustomResponseHeaders defines the header names and
  1341.                       values to apply to the response.
  1342.                     type: object
  1343.                   featurePolicy:
  1344.                     description: 'Deprecated: FeaturePolicy option is deprecated,
  1345.                       please use PermissionsPolicy instead.'
  1346.                     type: string
  1347.                   forceSTSHeader:
  1348.                     description: ForceSTSHeader defines whether to add the STS header
  1349.                       even when the connection is HTTP.
  1350.                     type: boolean
  1351.                   frameDeny:
  1352.                     description: FrameDeny defines whether to add the X-Frame-Options
  1353.                       header with the DENY value.
  1354.                     type: boolean
  1355.                   hostsProxyHeaders:
  1356.                     description: HostsProxyHeaders defines the header keys that may
  1357.                       hold a proxied hostname value for the request.
  1358.                     items:
  1359.                       type: string
  1360.                     type: array
  1361.                   isDevelopment:
  1362.                     description: |-
  1363.                       IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing.
  1364.                       Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain.
  1365.                       If you would like your development environment to mimic production with complete Host blocking, SSL redirects,
  1366.                       and STS headers, leave this as false.
  1367.                     type: boolean
  1368.                   permissionsPolicy:
  1369.                     description: |-
  1370.                       PermissionsPolicy defines the Permissions-Policy header value.
  1371.                       This allows sites to control browser features.
  1372.                     type: string
  1373.                   publicKey:
  1374.                     description: PublicKey is the public key that implements HPKP
  1375.                       to prevent MITM attacks with forged certificates.
  1376.                     type: string
  1377.                   referrerPolicy:
  1378.                     description: |-
  1379.                       ReferrerPolicy defines the Referrer-Policy header value.
  1380.                       This allows sites to control whether browsers forward the Referer header to other sites.
  1381.                     type: string
  1382.                   sslForceHost:
  1383.                     description: 'Deprecated: SSLForceHost option is deprecated, please
  1384.                       use RedirectRegex instead.'
  1385.                     type: boolean
  1386.                   sslHost:
  1387.                     description: 'Deprecated: SSLHost option is deprecated, please
  1388.                       use RedirectRegex instead.'
  1389.                     type: string
  1390.                   sslProxyHeaders:
  1391.                     additionalProperties:
  1392.                       type: string
  1393.                     description: |-
  1394.                       SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request.
  1395.                       It can be useful when using other proxies (example: "X-Forwarded-Proto": "https").
  1396.                     type: object
  1397.                   sslRedirect:
  1398.                     description: 'Deprecated: SSLRedirect option is deprecated, please
  1399.                       use EntryPoint redirection or RedirectScheme instead.'
  1400.                     type: boolean
  1401.                   sslTemporaryRedirect:
  1402.                     description: 'Deprecated: SSLTemporaryRedirect option is deprecated,
  1403.                       please use EntryPoint redirection or RedirectScheme instead.'
  1404.                     type: boolean
  1405.                   stsIncludeSubdomains:
  1406.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  1407.                       directive is appended to the Strict-Transport-Security header.
  1408.                     type: boolean
  1409.                   stsPreload:
  1410.                     description: STSPreload defines whether the preload flag is appended
  1411.                       to the Strict-Transport-Security header.
  1412.                     type: boolean
  1413.                   stsSeconds:
  1414.                     description: |-
  1415.                       STSSeconds defines the max-age of the Strict-Transport-Security header.
  1416.                       If set to 0, the header is not set.
  1417.                     format: int64
  1418.                     type: integer
  1419.                 type: object
  1420.               inFlightReq:
  1421.                 description: |-
  1422.                   InFlightReq holds the in-flight request middleware configuration.
  1423.                   This middleware limits the number of requests being processed and served concurrently.
  1424.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/inflightreq/
  1425.                 properties:
  1426.                   amount:
  1427.                     description: |-
  1428.                       Amount defines the maximum amount of allowed simultaneous in-flight request.
  1429.                       The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).
  1430.                     format: int64
  1431.                     type: integer
  1432.                   sourceCriterion:
  1433.                     description: |-
  1434.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1435.                       If several strategies are defined at the same time, an error will be raised.
  1436.                       If none are set, the default is to use the requestHost.
  1437.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/inflightreq/#sourcecriterion
  1438.                     properties:
  1439.                       ipStrategy:
  1440.                         description: |-
  1441.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1442.                           More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/ipallowlist/#ipstrategy
  1443.                         properties:
  1444.                           depth:
  1445.                             description: Depth tells Traefik to use the X-Forwarded-For
  1446.                               header and take the IP located at the depth position
  1447.                               (starting from the right).
  1448.                             type: integer
  1449.                           excludedIPs:
  1450.                             description: ExcludedIPs configures Traefik to scan the
  1451.                               X-Forwarded-For header and select the first IP not in
  1452.                               the list.
  1453.                             items:
  1454.                               type: string
  1455.                             type: array
  1456.                         type: object
  1457.                       requestHeaderName:
  1458.                         description: RequestHeaderName defines the name of the header
  1459.                           used to group incoming requests.
  1460.                         type: string
  1461.                       requestHost:
  1462.                         description: RequestHost defines whether to consider the request
  1463.                           Host as the source.
  1464.                         type: boolean
  1465.                     type: object
  1466.                 type: object
  1467.               ipAllowList:
  1468.                 description: |-
  1469.                   IPAllowList holds the IP allowlist middleware configuration.
  1470.                   This middleware limits allowed requests based on the client IP.
  1471.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/ipallowlist/
  1472.                 properties:
  1473.                   ipStrategy:
  1474.                     description: |-
  1475.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1476.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/ipallowlist/#ipstrategy
  1477.                     properties:
  1478.                       depth:
  1479.                         description: Depth tells Traefik to use the X-Forwarded-For
  1480.                           header and take the IP located at the depth position (starting
  1481.                           from the right).
  1482.                         type: integer
  1483.                       excludedIPs:
  1484.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1485.                           header and select the first IP not in the list.
  1486.                         items:
  1487.                           type: string
  1488.                         type: array
  1489.                     type: object
  1490.                   rejectStatusCode:
  1491.                     description: |-
  1492.                       RejectStatusCode defines the HTTP status code used for refused requests.
  1493.                       If not set, the default is 403 (Forbidden).
  1494.                     type: integer
  1495.                   sourceRange:
  1496.                     description: SourceRange defines the set of allowed IPs (or ranges
  1497.                       of allowed IPs by using CIDR notation).
  1498.                     items:
  1499.                       type: string
  1500.                     type: array
  1501.                 type: object
  1502.               ipWhiteList:
  1503.                 description: 'Deprecated: please use IPAllowList instead.'
  1504.                 properties:
  1505.                   ipStrategy:
  1506.                     description: |-
  1507.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1508.                       More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/ipallowlist/#ipstrategy
  1509.                     properties:
  1510.                       depth:
  1511.                         description: Depth tells Traefik to use the X-Forwarded-For
  1512.                           header and take the IP located at the depth position (starting
  1513.                           from the right).
  1514.                         type: integer
  1515.                       excludedIPs:
  1516.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1517.                           header and select the first IP not in the list.
  1518.                         items:
  1519.                           type: string
  1520.                         type: array
  1521.                     type: object
  1522.                   sourceRange:
  1523.                     description: SourceRange defines the set of allowed IPs (or ranges
  1524.                       of allowed IPs by using CIDR notation). Required.
  1525.                     items:
  1526.                       type: string
  1527.                     type: array
  1528.                 type: object
  1529.               passTLSClientCert:
  1530.                 description: |-
  1531.                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
  1532.                   This middleware adds the selected data from the passed client TLS certificate to a header.
  1533.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/passtlsclientcert/
  1534.                 properties:
  1535.                   info:
  1536.                     description: Info selects the specific client certificate details
  1537.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1538.                     properties:
  1539.                       issuer:
  1540.                         description: Issuer defines the client certificate issuer
  1541.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1542.                         properties:
  1543.                           commonName:
  1544.                             description: CommonName defines whether to add the organizationalUnit
  1545.                               information into the issuer.
  1546.                             type: boolean
  1547.                           country:
  1548.                             description: Country defines whether to add the country
  1549.                               information into the issuer.
  1550.                             type: boolean
  1551.                           domainComponent:
  1552.                             description: DomainComponent defines whether to add the
  1553.                               domainComponent information into the issuer.
  1554.                             type: boolean
  1555.                           locality:
  1556.                             description: Locality defines whether to add the locality
  1557.                               information into the issuer.
  1558.                             type: boolean
  1559.                           organization:
  1560.                             description: Organization defines whether to add the organization
  1561.                               information into the issuer.
  1562.                             type: boolean
  1563.                           province:
  1564.                             description: Province defines whether to add the province
  1565.                               information into the issuer.
  1566.                             type: boolean
  1567.                           serialNumber:
  1568.                             description: SerialNumber defines whether to add the serialNumber
  1569.                               information into the issuer.
  1570.                             type: boolean
  1571.                         type: object
  1572.                       notAfter:
  1573.                         description: NotAfter defines whether to add the Not After
  1574.                           information from the Validity part.
  1575.                         type: boolean
  1576.                       notBefore:
  1577.                         description: NotBefore defines whether to add the Not Before
  1578.                           information from the Validity part.
  1579.                         type: boolean
  1580.                       sans:
  1581.                         description: Sans defines whether to add the Subject Alternative
  1582.                           Name information from the Subject Alternative Name part.
  1583.                         type: boolean
  1584.                       serialNumber:
  1585.                         description: SerialNumber defines whether to add the client
  1586.                           serialNumber information.
  1587.                         type: boolean
  1588.                       subject:
  1589.                         description: Subject defines the client certificate subject
  1590.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1591.                         properties:
  1592.                           commonName:
  1593.                             description: CommonName defines whether to add the organizationalUnit
  1594.                               information into the subject.
  1595.                             type: boolean
  1596.                           country:
  1597.                             description: Country defines whether to add the country
  1598.                               information into the subject.
  1599.                             type: boolean
  1600.                           domainComponent:
  1601.                             description: DomainComponent defines whether to add the
  1602.                               domainComponent information into the subject.
  1603.                             type: boolean
  1604.                           locality:
  1605.                             description: Locality defines whether to add the locality
  1606.                               information into the subject.
  1607.                             type: boolean
  1608.                           organization:
  1609.                             description: Organization defines whether to add the organization
  1610.                               information into the subject.
  1611.                             type: boolean
  1612.                           organizationalUnit:
  1613.                             description: OrganizationalUnit defines whether to add
  1614.                               the organizationalUnit information into the subject.
  1615.                             type: boolean
  1616.                           province:
  1617.                             description: Province defines whether to add the province
  1618.                               information into the subject.
  1619.                             type: boolean
  1620.                           serialNumber:
  1621.                             description: SerialNumber defines whether to add the serialNumber
  1622.                               information into the subject.
  1623.                             type: boolean
  1624.                         type: object
  1625.                     type: object
  1626.                   pem:
  1627.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  1628.                       the certificate.
  1629.                     type: boolean
  1630.                 type: object
  1631.               plugin:
  1632.                 additionalProperties:
  1633.                   x-kubernetes-preserve-unknown-fields: true
  1634.                 description: |-
  1635.                   Plugin defines the middleware plugin configuration.
  1636.                   More info: https://doc.traefik.io/traefik/plugins/
  1637.                 type: object
  1638.               rateLimit:
  1639.                 description: |-
  1640.                   RateLimit holds the rate limit configuration.
  1641.                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
  1642.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/ratelimit/
  1643.                 properties:
  1644.                   average:
  1645.                     description: |-
  1646.                       Average is the maximum rate, by default in requests/s, allowed for the given source.
  1647.                       It defaults to 0, which means no rate limiting.
  1648.                       The rate is actually defined by dividing Average by Period. So for a rate below 1req/s,
  1649.                       one needs to define a Period larger than a second.
  1650.                     format: int64
  1651.                     type: integer
  1652.                   burst:
  1653.                     description: |-
  1654.                       Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time.
  1655.                       It defaults to 1.
  1656.                     format: int64
  1657.                     type: integer
  1658.                   period:
  1659.                     anyOf:
  1660.                     - type: integer
  1661.                     - type: string
  1662.                     description: |-
  1663.                       Period, in combination with Average, defines the actual maximum rate, such as:
  1664.                       r = Average / Period. It defaults to a second.
  1665.                     x-kubernetes-int-or-string: true
  1666.                   sourceCriterion:
  1667.                     description: |-
  1668.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1669.                       If several strategies are defined at the same time, an error will be raised.
  1670.                       If none are set, the default is to use the request's remote address field (as an ipStrategy).
  1671.                     properties:
  1672.                       ipStrategy:
  1673.                         description: |-
  1674.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1675.                           More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/ipallowlist/#ipstrategy
  1676.                         properties:
  1677.                           depth:
  1678.                             description: Depth tells Traefik to use the X-Forwarded-For
  1679.                               header and take the IP located at the depth position
  1680.                               (starting from the right).
  1681.                             type: integer
  1682.                           excludedIPs:
  1683.                             description: ExcludedIPs configures Traefik to scan the
  1684.                               X-Forwarded-For header and select the first IP not in
  1685.                               the list.
  1686.                             items:
  1687.                               type: string
  1688.                             type: array
  1689.                         type: object
  1690.                       requestHeaderName:
  1691.                         description: RequestHeaderName defines the name of the header
  1692.                           used to group incoming requests.
  1693.                         type: string
  1694.                       requestHost:
  1695.                         description: RequestHost defines whether to consider the request
  1696.                           Host as the source.
  1697.                         type: boolean
  1698.                     type: object
  1699.                 type: object
  1700.               redirectRegex:
  1701.                 description: |-
  1702.                   RedirectRegex holds the redirect regex middleware configuration.
  1703.                   This middleware redirects a request using regex matching and replacement.
  1704.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/redirectregex/#regex
  1705.                 properties:
  1706.                   permanent:
  1707.                     description: Permanent defines whether the redirection is permanent
  1708.                       (301).
  1709.                     type: boolean
  1710.                   regex:
  1711.                     description: Regex defines the regex used to match and capture
  1712.                       elements from the request URL.
  1713.                     type: string
  1714.                   replacement:
  1715.                     description: Replacement defines how to modify the URL to have
  1716.                       the new target URL.
  1717.                     type: string
  1718.                 type: object
  1719.               redirectScheme:
  1720.                 description: |-
  1721.                   RedirectScheme holds the redirect scheme middleware configuration.
  1722.                   This middleware redirects requests from a scheme/port to another.
  1723.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/redirectscheme/
  1724.                 properties:
  1725.                   permanent:
  1726.                     description: Permanent defines whether the redirection is permanent
  1727.                       (301).
  1728.                     type: boolean
  1729.                   port:
  1730.                     description: Port defines the port of the new URL.
  1731.                     type: string
  1732.                   scheme:
  1733.                     description: Scheme defines the scheme of the new URL.
  1734.                     type: string
  1735.                 type: object
  1736.               replacePath:
  1737.                 description: |-
  1738.                   ReplacePath holds the replace path middleware configuration.
  1739.                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
  1740.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/replacepath/
  1741.                 properties:
  1742.                   path:
  1743.                     description: Path defines the path to use as replacement in the
  1744.                       request URL.
  1745.                     type: string
  1746.                 type: object
  1747.               replacePathRegex:
  1748.                 description: |-
  1749.                   ReplacePathRegex holds the replace path regex middleware configuration.
  1750.                   This middleware replaces the path of a URL using regex matching and replacement.
  1751.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/replacepathregex/
  1752.                 properties:
  1753.                   regex:
  1754.                     description: Regex defines the regular expression used to match
  1755.                       and capture the path from the request URL.
  1756.                     type: string
  1757.                   replacement:
  1758.                     description: Replacement defines the replacement path format,
  1759.                       which can include captured variables.
  1760.                     type: string
  1761.                 type: object
  1762.               retry:
  1763.                 description: |-
  1764.                   Retry holds the retry middleware configuration.
  1765.                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
  1766.                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
  1767.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/retry/
  1768.                 properties:
  1769.                   attempts:
  1770.                     description: Attempts defines how many times the request should
  1771.                       be retried.
  1772.                     type: integer
  1773.                   initialInterval:
  1774.                     anyOf:
  1775.                     - type: integer
  1776.                     - type: string
  1777.                     description: |-
  1778.                       InitialInterval defines the first wait time in the exponential backoff series.
  1779.                       The maximum interval is calculated as twice the initialInterval.
  1780.                       If unspecified, requests will be retried immediately.
  1781.                       The value of initialInterval should be provided in seconds or as a valid duration format,
  1782.                       see https://pkg.go.dev/time#ParseDuration.
  1783.                     x-kubernetes-int-or-string: true
  1784.                 type: object
  1785.               stripPrefix:
  1786.                 description: |-
  1787.                   StripPrefix holds the strip prefix middleware configuration.
  1788.                   This middleware removes the specified prefixes from the URL path.
  1789.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/stripprefix/
  1790.                 properties:
  1791.                   forceSlash:
  1792.                     description: |-
  1793.                       Deprecated: ForceSlash option is deprecated, please remove any usage of this option.
  1794.                       ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.
  1795.                       Default: true.
  1796.                     type: boolean
  1797.                   prefixes:
  1798.                     description: Prefixes defines the prefixes to strip from the request
  1799.                       URL.
  1800.                     items:
  1801.                       type: string
  1802.                     type: array
  1803.                 type: object
  1804.               stripPrefixRegex:
  1805.                 description: |-
  1806.                   StripPrefixRegex holds the strip prefix regex middleware configuration.
  1807.                   This middleware removes the matching prefixes from the URL path.
  1808.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/http/stripprefixregex/
  1809.                 properties:
  1810.                   regex:
  1811.                     description: Regex defines the regular expression to match the
  1812.                       path prefix from the request URL.
  1813.                     items:
  1814.                       type: string
  1815.                     type: array
  1816.                 type: object
  1817.             type: object
  1818.         required:
  1819.         - metadata
  1820.         - spec
  1821.         type: object
  1822.     served: true
  1823.     storage: true
  1824. ---
  1825. apiVersion: apiextensions.k8s.io/v1
  1826. kind: CustomResourceDefinition
  1827. metadata:
  1828.   annotations:
  1829.     controller-gen.kubebuilder.io/version: v0.14.0
  1830.   name: middlewaretcps.traefik.io
  1831. spec:
  1832.   group: traefik.io
  1833.   names:
  1834.     kind: MiddlewareTCP
  1835.     listKind: MiddlewareTCPList
  1836.     plural: middlewaretcps
  1837.     singular: middlewaretcp
  1838.   scope: Namespaced
  1839.   versions:
  1840.   - name: v1alpha1
  1841.     schema:
  1842.       openAPIV3Schema:
  1843.         description: |-
  1844.           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  1845.           More info: https://doc.traefik.io/traefik/v3.1/middlewares/overview/
  1846.         properties:
  1847.           apiVersion:
  1848.             description: |-
  1849.               APIVersion defines the versioned schema of this representation of an object.
  1850.               Servers should convert recognized schemas to the latest internal value, and
  1851.               may reject unrecognized values.
  1852.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1853.             type: string
  1854.           kind:
  1855.             description: |-
  1856.               Kind is a string value representing the REST resource this object represents.
  1857.               Servers may infer this from the endpoint the client submits requests to.
  1858.               Cannot be updated.
  1859.               In CamelCase.
  1860.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1861.             type: string
  1862.           metadata:
  1863.             type: object
  1864.           spec:
  1865.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  1866.             properties:
  1867.               inFlightConn:
  1868.                 description: InFlightConn defines the InFlightConn middleware configuration.
  1869.                 properties:
  1870.                   amount:
  1871.                     description: |-
  1872.                       Amount defines the maximum amount of allowed simultaneous connections.
  1873.                       The middleware closes the connection if there are already amount connections opened.
  1874.                     format: int64
  1875.                     type: integer
  1876.                 type: object
  1877.               ipAllowList:
  1878.                 description: |-
  1879.                   IPAllowList defines the IPAllowList middleware configuration.
  1880.                   This middleware accepts/refuses connections based on the client IP.
  1881.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/tcp/ipallowlist/
  1882.                 properties:
  1883.                   sourceRange:
  1884.                     description: SourceRange defines the allowed IPs (or ranges of
  1885.                       allowed IPs by using CIDR notation).
  1886.                     items:
  1887.                       type: string
  1888.                     type: array
  1889.                 type: object
  1890.               ipWhiteList:
  1891.                 description: |-
  1892.                   IPWhiteList defines the IPWhiteList middleware configuration.
  1893.                   This middleware accepts/refuses connections based on the client IP.
  1894.                   Deprecated: please use IPAllowList instead.
  1895.                   More info: https://doc.traefik.io/traefik/v3.1/middlewares/tcp/ipwhitelist/
  1896.                 properties:
  1897.                   sourceRange:
  1898.                     description: SourceRange defines the allowed IPs (or ranges of
  1899.                       allowed IPs by using CIDR notation).
  1900.                     items:
  1901.                       type: string
  1902.                     type: array
  1903.                 type: object
  1904.             type: object
  1905.         required:
  1906.         - metadata
  1907.         - spec
  1908.         type: object
  1909.     served: true
  1910.     storage: true
  1911. ---
  1912. apiVersion: apiextensions.k8s.io/v1
  1913. kind: CustomResourceDefinition
  1914. metadata:
  1915.   annotations:
  1916.     controller-gen.kubebuilder.io/version: v0.14.0
  1917.   name: serverstransports.traefik.io
  1918. spec:
  1919.   group: traefik.io
  1920.   names:
  1921.     kind: ServersTransport
  1922.     listKind: ServersTransportList
  1923.     plural: serverstransports
  1924.     singular: serverstransport
  1925.   scope: Namespaced
  1926.   versions:
  1927.   - name: v1alpha1
  1928.     schema:
  1929.       openAPIV3Schema:
  1930.         description: |-
  1931.           ServersTransport is the CRD implementation of a ServersTransport.
  1932.           If no serversTransport is specified, the default@internal will be used.
  1933.           The default@internal serversTransport is created from the static configuration.
  1934.           More info: https://doc.traefik.io/traefik/v3.1/routing/services/#serverstransport_1
  1935.         properties:
  1936.           apiVersion:
  1937.             description: |-
  1938.               APIVersion defines the versioned schema of this representation of an object.
  1939.               Servers should convert recognized schemas to the latest internal value, and
  1940.               may reject unrecognized values.
  1941.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1942.             type: string
  1943.           kind:
  1944.             description: |-
  1945.               Kind is a string value representing the REST resource this object represents.
  1946.               Servers may infer this from the endpoint the client submits requests to.
  1947.               Cannot be updated.
  1948.               In CamelCase.
  1949.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1950.             type: string
  1951.           metadata:
  1952.             type: object
  1953.           spec:
  1954.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  1955.             properties:
  1956.               certificatesSecrets:
  1957.                 description: CertificatesSecrets defines a list of secret storing
  1958.                   client certificates for mTLS.
  1959.                 items:
  1960.                   type: string
  1961.                 type: array
  1962.               disableHTTP2:
  1963.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  1964.                   servers.
  1965.                 type: boolean
  1966.               forwardingTimeouts:
  1967.                 description: ForwardingTimeouts defines the timeouts for requests
  1968.                   forwarded to the backend servers.
  1969.                 properties:
  1970.                   dialTimeout:
  1971.                     anyOf:
  1972.                     - type: integer
  1973.                     - type: string
  1974.                     description: DialTimeout is the amount of time to wait until a
  1975.                       connection to a backend server can be established.
  1976.                     x-kubernetes-int-or-string: true
  1977.                   idleConnTimeout:
  1978.                     anyOf:
  1979.                     - type: integer
  1980.                     - type: string
  1981.                     description: IdleConnTimeout is the maximum period for which an
  1982.                       idle HTTP keep-alive connection will remain open before closing
  1983.                       itself.
  1984.                     x-kubernetes-int-or-string: true
  1985.                   pingTimeout:
  1986.                     anyOf:
  1987.                     - type: integer
  1988.                     - type: string
  1989.                     description: PingTimeout is the timeout after which the HTTP/2
  1990.                       connection will be closed if a response to ping is not received.
  1991.                     x-kubernetes-int-or-string: true
  1992.                   readIdleTimeout:
  1993.                     anyOf:
  1994.                     - type: integer
  1995.                     - type: string
  1996.                     description: ReadIdleTimeout is the timeout after which a health
  1997.                       check using ping frame will be carried out if no frame is received
  1998.                       on the HTTP/2 connection.
  1999.                     x-kubernetes-int-or-string: true
  2000.                   responseHeaderTimeout:
  2001.                     anyOf:
  2002.                     - type: integer
  2003.                     - type: string
  2004.                     description: ResponseHeaderTimeout is the amount of time to wait
  2005.                       for a server's response headers after fully writing the request
  2006.                       (including its body, if any).
  2007.                     x-kubernetes-int-or-string: true
  2008.                 type: object
  2009.               insecureSkipVerify:
  2010.                 description: InsecureSkipVerify disables SSL certificate verification.
  2011.                 type: boolean
  2012.               maxIdleConnsPerHost:
  2013.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  2014.                   to keep per-host.
  2015.                 type: integer
  2016.               peerCertURI:
  2017.                 description: PeerCertURI defines the peer cert URI used to match against
  2018.                   SAN URI during the peer certificate verification.
  2019.                 type: string
  2020.               rootCAsSecrets:
  2021.                 description: RootCAsSecrets defines a list of CA secret used to validate
  2022.                   self-signed certificate.
  2023.                 items:
  2024.                   type: string
  2025.                 type: array
  2026.               serverName:
  2027.                 description: ServerName defines the server name used to contact the
  2028.                   server.
  2029.                 type: string
  2030.               spiffe:
  2031.                 description: Spiffe defines the SPIFFE configuration.
  2032.                 properties:
  2033.                   ids:
  2034.                     description: IDs defines the allowed SPIFFE IDs (takes precedence
  2035.                       over the SPIFFE TrustDomain).
  2036.                     items:
  2037.                       type: string
  2038.                     type: array
  2039.                   trustDomain:
  2040.                     description: TrustDomain defines the allowed SPIFFE trust domain.
  2041.                     type: string
  2042.                 type: object
  2043.             type: object
  2044.         required:
  2045.         - metadata
  2046.         - spec
  2047.         type: object
  2048.     served: true
  2049.     storage: true
  2050. ---
  2051. apiVersion: apiextensions.k8s.io/v1
  2052. kind: CustomResourceDefinition
  2053. metadata:
  2054.   annotations:
  2055.     controller-gen.kubebuilder.io/version: v0.14.0
  2056.   name: serverstransporttcps.traefik.io
  2057. spec:
  2058.   group: traefik.io
  2059.   names:
  2060.     kind: ServersTransportTCP
  2061.     listKind: ServersTransportTCPList
  2062.     plural: serverstransporttcps
  2063.     singular: serverstransporttcp
  2064.   scope: Namespaced
  2065.   versions:
  2066.   - name: v1alpha1
  2067.     schema:
  2068.       openAPIV3Schema:
  2069.         description: |-
  2070.           ServersTransportTCP is the CRD implementation of a TCPServersTransport.
  2071.           If no tcpServersTransport is specified, a default one named default@internal will be used.
  2072.           The default@internal tcpServersTransport can be configured in the static configuration.
  2073.           More info: https://doc.traefik.io/traefik/v3.1/routing/services/#serverstransport_3
  2074.         properties:
  2075.           apiVersion:
  2076.             description: |-
  2077.               APIVersion defines the versioned schema of this representation of an object.
  2078.               Servers should convert recognized schemas to the latest internal value, and
  2079.               may reject unrecognized values.
  2080.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2081.             type: string
  2082.           kind:
  2083.             description: |-
  2084.               Kind is a string value representing the REST resource this object represents.
  2085.               Servers may infer this from the endpoint the client submits requests to.
  2086.               Cannot be updated.
  2087.               In CamelCase.
  2088.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2089.             type: string
  2090.           metadata:
  2091.             type: object
  2092.           spec:
  2093.             description: ServersTransportTCPSpec defines the desired state of a ServersTransportTCP.
  2094.             properties:
  2095.               dialKeepAlive:
  2096.                 anyOf:
  2097.                 - type: integer
  2098.                 - type: string
  2099.                 description: DialKeepAlive is the interval between keep-alive probes
  2100.                   for an active network connection. If zero, keep-alive probes are
  2101.                   sent with a default value (currently 15 seconds), if supported by
  2102.                   the protocol and operating system. Network protocols or operating
  2103.                   systems that do not support keep-alives ignore this field. If negative,
  2104.                   keep-alive probes are disabled.
  2105.                 x-kubernetes-int-or-string: true
  2106.               dialTimeout:
  2107.                 anyOf:
  2108.                 - type: integer
  2109.                 - type: string
  2110.                 description: DialTimeout is the amount of time to wait until a connection
  2111.                   to a backend server can be established.
  2112.                 x-kubernetes-int-or-string: true
  2113.               terminationDelay:
  2114.                 anyOf:
  2115.                 - type: integer
  2116.                 - type: string
  2117.                 description: TerminationDelay defines the delay to wait before fully
  2118.                   terminating the connection, after one connected peer has closed
  2119.                   its writing capability.
  2120.                 x-kubernetes-int-or-string: true
  2121.               tls:
  2122.                 description: TLS defines the TLS configuration
  2123.                 properties:
  2124.                   certificatesSecrets:
  2125.                     description: CertificatesSecrets defines a list of secret storing
  2126.                       client certificates for mTLS.
  2127.                     items:
  2128.                       type: string
  2129.                     type: array
  2130.                   insecureSkipVerify:
  2131.                     description: InsecureSkipVerify disables TLS certificate verification.
  2132.                     type: boolean
  2133.                   peerCertURI:
  2134.                     description: |-
  2135.                       MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.
  2136.                       PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.
  2137.                     type: string
  2138.                   rootCAsSecrets:
  2139.                     description: RootCAsSecrets defines a list of CA secret used to
  2140.                       validate self-signed certificates.
  2141.                     items:
  2142.                       type: string
  2143.                     type: array
  2144.                   serverName:
  2145.                     description: ServerName defines the server name used to contact
  2146.                       the server.
  2147.                     type: string
  2148.                   spiffe:
  2149.                     description: Spiffe defines the SPIFFE configuration.
  2150.                     properties:
  2151.                       ids:
  2152.                         description: IDs defines the allowed SPIFFE IDs (takes precedence
  2153.                           over the SPIFFE TrustDomain).
  2154.                         items:
  2155.                           type: string
  2156.                         type: array
  2157.                       trustDomain:
  2158.                         description: TrustDomain defines the allowed SPIFFE trust
  2159.                           domain.
  2160.                         type: string
  2161.                     type: object
  2162.                 type: object
  2163.             type: object
  2164.         required:
  2165.         - metadata
  2166.         - spec
  2167.         type: object
  2168.     served: true
  2169.     storage: true
  2170. ---
  2171. apiVersion: apiextensions.k8s.io/v1
  2172. kind: CustomResourceDefinition
  2173. metadata:
  2174.   annotations:
  2175.     controller-gen.kubebuilder.io/version: v0.14.0
  2176.   name: tlsoptions.traefik.io
  2177. spec:
  2178.   group: traefik.io
  2179.   names:
  2180.     kind: TLSOption
  2181.     listKind: TLSOptionList
  2182.     plural: tlsoptions
  2183.     singular: tlsoption
  2184.   scope: Namespaced
  2185.   versions:
  2186.   - name: v1alpha1
  2187.     schema:
  2188.       openAPIV3Schema:
  2189.         description: |-
  2190.           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
  2191.           More info: https://doc.traefik.io/traefik/v3.1/https/tls/#tls-options
  2192.         properties:
  2193.           apiVersion:
  2194.             description: |-
  2195.               APIVersion defines the versioned schema of this representation of an object.
  2196.               Servers should convert recognized schemas to the latest internal value, and
  2197.               may reject unrecognized values.
  2198.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2199.             type: string
  2200.           kind:
  2201.             description: |-
  2202.               Kind is a string value representing the REST resource this object represents.
  2203.               Servers may infer this from the endpoint the client submits requests to.
  2204.               Cannot be updated.
  2205.               In CamelCase.
  2206.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2207.             type: string
  2208.           metadata:
  2209.             type: object
  2210.           spec:
  2211.             description: TLSOptionSpec defines the desired state of a TLSOption.
  2212.             properties:
  2213.               alpnProtocols:
  2214.                 description: |-
  2215.                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
  2216.                   More info: https://doc.traefik.io/traefik/v3.1/https/tls/#alpn-protocols
  2217.                 items:
  2218.                   type: string
  2219.                 type: array
  2220.               cipherSuites:
  2221.                 description: |-
  2222.                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
  2223.                   More info: https://doc.traefik.io/traefik/v3.1/https/tls/#cipher-suites
  2224.                 items:
  2225.                   type: string
  2226.                 type: array
  2227.               clientAuth:
  2228.                 description: ClientAuth defines the server's policy for TLS Client
  2229.                   Authentication.
  2230.                 properties:
  2231.                   clientAuthType:
  2232.                     description: ClientAuthType defines the client authentication
  2233.                       type to apply.
  2234.                     enum:
  2235.                     - NoClientCert
  2236.                     - RequestClientCert
  2237.                     - RequireAnyClientCert
  2238.                     - VerifyClientCertIfGiven
  2239.                     - RequireAndVerifyClientCert
  2240.                     type: string
  2241.                   secretNames:
  2242.                     description: SecretNames defines the names of the referenced Kubernetes
  2243.                       Secret storing certificate details.
  2244.                     items:
  2245.                       type: string
  2246.                     type: array
  2247.                 type: object
  2248.               curvePreferences:
  2249.                 description: |-
  2250.                   CurvePreferences defines the preferred elliptic curves in a specific order.
  2251.                   More info: https://doc.traefik.io/traefik/v3.1/https/tls/#curve-preferences
  2252.                 items:
  2253.                   type: string
  2254.                 type: array
  2255.               maxVersion:
  2256.                 description: |-
  2257.                   MaxVersion defines the maximum TLS version that Traefik will accept.
  2258.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2259.                   Default: None.
  2260.                 type: string
  2261.               minVersion:
  2262.                 description: |-
  2263.                   MinVersion defines the minimum TLS version that Traefik will accept.
  2264.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2265.                   Default: VersionTLS10.
  2266.                 type: string
  2267.               preferServerCipherSuites:
  2268.                 description: |-
  2269.                   PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
  2270.                   It is enabled automatically when minVersion or maxVersion is set.
  2271.                   Deprecated: https://github.com/golang/go/issues/45430
  2272.                 type: boolean
  2273.               sniStrict:
  2274.                 description: SniStrict defines whether Traefik allows connections
  2275.                   from clients connections that do not specify a server_name extension.
  2276.                 type: boolean
  2277.             type: object
  2278.         required:
  2279.         - metadata
  2280.         - spec
  2281.         type: object
  2282.     served: true
  2283.     storage: true
  2284. ---
  2285. apiVersion: apiextensions.k8s.io/v1
  2286. kind: CustomResourceDefinition
  2287. metadata:
  2288.   annotations:
  2289.     controller-gen.kubebuilder.io/version: v0.14.0
  2290.   name: tlsstores.traefik.io
  2291. spec:
  2292.   group: traefik.io
  2293.   names:
  2294.     kind: TLSStore
  2295.     listKind: TLSStoreList
  2296.     plural: tlsstores
  2297.     singular: tlsstore
  2298.   scope: Namespaced
  2299.   versions:
  2300.   - name: v1alpha1
  2301.     schema:
  2302.       openAPIV3Schema:
  2303.         description: |-
  2304.           TLSStore is the CRD implementation of a Traefik TLS Store.
  2305.           For the time being, only the TLSStore named default is supported.
  2306.           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
  2307.           More info: https://doc.traefik.io/traefik/v3.1/https/tls/#certificates-stores
  2308.         properties:
  2309.           apiVersion:
  2310.             description: |-
  2311.               APIVersion defines the versioned schema of this representation of an object.
  2312.               Servers should convert recognized schemas to the latest internal value, and
  2313.               may reject unrecognized values.
  2314.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2315.             type: string
  2316.           kind:
  2317.             description: |-
  2318.               Kind is a string value representing the REST resource this object represents.
  2319.               Servers may infer this from the endpoint the client submits requests to.
  2320.               Cannot be updated.
  2321.               In CamelCase.
  2322.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2323.             type: string
  2324.           metadata:
  2325.             type: object
  2326.           spec:
  2327.             description: TLSStoreSpec defines the desired state of a TLSStore.
  2328.             properties:
  2329.               certificates:
  2330.                 description: Certificates is a list of secret names, each secret holding
  2331.                   a key/certificate pair to add to the store.
  2332.                 items:
  2333.                   description: Certificate holds a secret name for the TLSStore resource.
  2334.                   properties:
  2335.                     secretName:
  2336.                       description: SecretName is the name of the referenced Kubernetes
  2337.                         Secret to specify the certificate details.
  2338.                       type: string
  2339.                   required:
  2340.                   - secretName
  2341.                   type: object
  2342.                 type: array
  2343.               defaultCertificate:
  2344.                 description: DefaultCertificate defines the default certificate configuration.
  2345.                 properties:
  2346.                   secretName:
  2347.                     description: SecretName is the name of the referenced Kubernetes
  2348.                       Secret to specify the certificate details.
  2349.                     type: string
  2350.                 required:
  2351.                 - secretName
  2352.                 type: object
  2353.               defaultGeneratedCert:
  2354.                 description: DefaultGeneratedCert defines the default generated certificate
  2355.                   configuration.
  2356.                 properties:
  2357.                   domain:
  2358.                     description: Domain is the domain definition for the DefaultCertificate.
  2359.                     properties:
  2360.                       main:
  2361.                         description: Main defines the main domain name.
  2362.                         type: string
  2363.                       sans:
  2364.                         description: SANs defines the subject alternative domain names.
  2365.                         items:
  2366.                           type: string
  2367.                         type: array
  2368.                     type: object
  2369.                   resolver:
  2370.                     description: Resolver is the name of the resolver that will be
  2371.                       used to issue the DefaultCertificate.
  2372.                     type: string
  2373.                 type: object
  2374.             type: object
  2375.         required:
  2376.         - metadata
  2377.         - spec
  2378.         type: object
  2379.     served: true
  2380.     storage: true
  2381. ---
  2382. apiVersion: apiextensions.k8s.io/v1
  2383. kind: CustomResourceDefinition
  2384. metadata:
  2385.   annotations:
  2386.     controller-gen.kubebuilder.io/version: v0.14.0
  2387.   name: traefikservices.traefik.io
  2388. spec:
  2389.   group: traefik.io
  2390.   names:
  2391.     kind: TraefikService
  2392.     listKind: TraefikServiceList
  2393.     plural: traefikservices
  2394.     singular: traefikservice
  2395.   scope: Namespaced
  2396.   versions:
  2397.   - name: v1alpha1
  2398.     schema:
  2399.       openAPIV3Schema:
  2400.         description: |-
  2401.           TraefikService is the CRD implementation of a Traefik Service.
  2402.           TraefikService object allows to:
  2403.           - Apply weight to Services on load-balancing
  2404.           - Mirror traffic on services
  2405.           More info: https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#kind-traefikservice
  2406.         properties:
  2407.           apiVersion:
  2408.             description: |-
  2409.               APIVersion defines the versioned schema of this representation of an object.
  2410.               Servers should convert recognized schemas to the latest internal value, and
  2411.               may reject unrecognized values.
  2412.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2413.             type: string
  2414.           kind:
  2415.             description: |-
  2416.               Kind is a string value representing the REST resource this object represents.
  2417.               Servers may infer this from the endpoint the client submits requests to.
  2418.               Cannot be updated.
  2419.               In CamelCase.
  2420.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2421.             type: string
  2422.           metadata:
  2423.             type: object
  2424.           spec:
  2425.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  2426.             properties:
  2427.               mirroring:
  2428.                 description: Mirroring defines the Mirroring service configuration.
  2429.                 properties:
  2430.                   healthCheck:
  2431.                     description: Healthcheck defines health checks for ExternalName
  2432.                       services.
  2433.                     properties:
  2434.                       followRedirects:
  2435.                         description: |-
  2436.                           FollowRedirects defines whether redirects should be followed during the health check calls.
  2437.                           Default: true
  2438.                         type: boolean
  2439.                       headers:
  2440.                         additionalProperties:
  2441.                           type: string
  2442.                         description: Headers defines custom headers to be sent to
  2443.                           the health check endpoint.
  2444.                         type: object
  2445.                       hostname:
  2446.                         description: Hostname defines the value of hostname in the
  2447.                           Host header of the health check request.
  2448.                         type: string
  2449.                       interval:
  2450.                         anyOf:
  2451.                         - type: integer
  2452.                         - type: string
  2453.                         description: |-
  2454.                           Interval defines the frequency of the health check calls.
  2455.                           Default: 30s
  2456.                         x-kubernetes-int-or-string: true
  2457.                       method:
  2458.                         description: Method defines the healthcheck method.
  2459.                         type: string
  2460.                       mode:
  2461.                         description: |-
  2462.                           Mode defines the health check mode.
  2463.                           If defined to grpc, will use the gRPC health check protocol to probe the server.
  2464.                           Default: http
  2465.                         type: string
  2466.                       path:
  2467.                         description: Path defines the server URL path for the health
  2468.                           check endpoint.
  2469.                         type: string
  2470.                       port:
  2471.                         description: Port defines the server URL port for the health
  2472.                           check endpoint.
  2473.                         type: integer
  2474.                       scheme:
  2475.                         description: Scheme replaces the server URL scheme for the
  2476.                           health check endpoint.
  2477.                         type: string
  2478.                       status:
  2479.                         description: Status defines the expected HTTP status code
  2480.                           of the response to the health check request.
  2481.                         type: integer
  2482.                       timeout:
  2483.                         anyOf:
  2484.                         - type: integer
  2485.                         - type: string
  2486.                         description: |-
  2487.                           Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2488.                           Default: 5s
  2489.                         x-kubernetes-int-or-string: true
  2490.                     type: object
  2491.                   kind:
  2492.                     description: Kind defines the kind of the Service.
  2493.                     enum:
  2494.                     - Service
  2495.                     - TraefikService
  2496.                     type: string
  2497.                   maxBodySize:
  2498.                     description: |-
  2499.                       MaxBodySize defines the maximum size allowed for the body of the request.
  2500.                       If the body is larger, the request is not mirrored.
  2501.                       Default value is -1, which means unlimited size.
  2502.                     format: int64
  2503.                     type: integer
  2504.                   mirrors:
  2505.                     description: Mirrors defines the list of mirrors where Traefik
  2506.                       will duplicate the traffic.
  2507.                     items:
  2508.                       description: MirrorService holds the mirror configuration.
  2509.                       properties:
  2510.                         healthCheck:
  2511.                           description: Healthcheck defines health checks for ExternalName
  2512.                             services.
  2513.                           properties:
  2514.                             followRedirects:
  2515.                               description: |-
  2516.                                 FollowRedirects defines whether redirects should be followed during the health check calls.
  2517.                                 Default: true
  2518.                               type: boolean
  2519.                             headers:
  2520.                               additionalProperties:
  2521.                                 type: string
  2522.                               description: Headers defines custom headers to be sent
  2523.                                 to the health check endpoint.
  2524.                               type: object
  2525.                             hostname:
  2526.                               description: Hostname defines the value of hostname
  2527.                                 in the Host header of the health check request.
  2528.                               type: string
  2529.                             interval:
  2530.                               anyOf:
  2531.                               - type: integer
  2532.                               - type: string
  2533.                               description: |-
  2534.                                 Interval defines the frequency of the health check calls.
  2535.                                 Default: 30s
  2536.                               x-kubernetes-int-or-string: true
  2537.                             method:
  2538.                               description: Method defines the healthcheck method.
  2539.                               type: string
  2540.                             mode:
  2541.                               description: |-
  2542.                                 Mode defines the health check mode.
  2543.                                 If defined to grpc, will use the gRPC health check protocol to probe the server.
  2544.                                 Default: http
  2545.                               type: string
  2546.                             path:
  2547.                               description: Path defines the server URL path for the
  2548.                                 health check endpoint.
  2549.                               type: string
  2550.                             port:
  2551.                               description: Port defines the server URL port for the
  2552.                                 health check endpoint.
  2553.                               type: integer
  2554.                             scheme:
  2555.                               description: Scheme replaces the server URL scheme for
  2556.                                 the health check endpoint.
  2557.                               type: string
  2558.                             status:
  2559.                               description: Status defines the expected HTTP status
  2560.                                 code of the response to the health check request.
  2561.                               type: integer
  2562.                             timeout:
  2563.                               anyOf:
  2564.                               - type: integer
  2565.                               - type: string
  2566.                               description: |-
  2567.                                 Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2568.                                 Default: 5s
  2569.                               x-kubernetes-int-or-string: true
  2570.                           type: object
  2571.                         kind:
  2572.                           description: Kind defines the kind of the Service.
  2573.                           enum:
  2574.                           - Service
  2575.                           - TraefikService
  2576.                           type: string
  2577.                         name:
  2578.                           description: |-
  2579.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2580.                             The differentiation between the two is specified in the Kind field.
  2581.                           type: string
  2582.                         namespace:
  2583.                           description: Namespace defines the namespace of the referenced
  2584.                             Kubernetes Service or TraefikService.
  2585.                           type: string
  2586.                         nativeLB:
  2587.                           description: |-
  2588.                             NativeLB controls, when creating the load-balancer,
  2589.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2590.                             The Kubernetes Service itself does load-balance to the pods.
  2591.                             By default, NativeLB is false.
  2592.                           type: boolean
  2593.                         nodePortLB:
  2594.                           description: |-
  2595.                             NodePortLB controls, when creating the load-balancer,
  2596.                             whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2597.                             It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2598.                             By default, NodePortLB is false.
  2599.                           type: boolean
  2600.                         passHostHeader:
  2601.                           description: |-
  2602.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2603.                             By default, passHostHeader is true.
  2604.                           type: boolean
  2605.                         percent:
  2606.                           description: |-
  2607.                             Percent defines the part of the traffic to mirror.
  2608.                             Supported values: 0 to 100.
  2609.                           type: integer
  2610.                         port:
  2611.                           anyOf:
  2612.                           - type: integer
  2613.                           - type: string
  2614.                           description: |-
  2615.                             Port defines the port of a Kubernetes Service.
  2616.                             This can be a reference to a named port.
  2617.                           x-kubernetes-int-or-string: true
  2618.                         responseForwarding:
  2619.                           description: ResponseForwarding defines how Traefik forwards
  2620.                             the response from the upstream Kubernetes Service to the
  2621.                             client.
  2622.                           properties:
  2623.                             flushInterval:
  2624.                               description: |-
  2625.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2626.                                 A negative value means to flush immediately after each write to the client.
  2627.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2628.                                 for such responses, writes are flushed to the client immediately.
  2629.                                 Default: 100ms
  2630.                               type: string
  2631.                           type: object
  2632.                         scheme:
  2633.                           description: |-
  2634.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2635.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2636.                           type: string
  2637.                         serversTransport:
  2638.                           description: |-
  2639.                             ServersTransport defines the name of ServersTransport resource to use.
  2640.                             It allows to configure the transport between Traefik and your servers.
  2641.                             Can only be used on a Kubernetes Service.
  2642.                           type: string
  2643.                         sticky:
  2644.                           description: |-
  2645.                             Sticky defines the sticky sessions configuration.
  2646.                             More info: https://doc.traefik.io/traefik/v3.1/routing/services/#sticky-sessions
  2647.                           properties:
  2648.                             cookie:
  2649.                               description: Cookie defines the sticky cookie configuration.
  2650.                               properties:
  2651.                                 httpOnly:
  2652.                                   description: HTTPOnly defines whether the cookie
  2653.                                     can be accessed by client-side APIs, such as JavaScript.
  2654.                                   type: boolean
  2655.                                 maxAge:
  2656.                                   description: |-
  2657.                                     MaxAge indicates the number of seconds until the cookie expires.
  2658.                                     When set to a negative number, the cookie expires immediately.
  2659.                                     When set to zero, the cookie never expires.
  2660.                                   type: integer
  2661.                                 name:
  2662.                                   description: Name defines the Cookie name.
  2663.                                   type: string
  2664.                                 sameSite:
  2665.                                   description: |-
  2666.                                     SameSite defines the same site policy.
  2667.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2668.                                   type: string
  2669.                                 secure:
  2670.                                   description: Secure defines whether the cookie can
  2671.                                     only be transmitted over an encrypted connection
  2672.                                     (i.e. HTTPS).
  2673.                                   type: boolean
  2674.                               type: object
  2675.                           type: object
  2676.                         strategy:
  2677.                           description: |-
  2678.                             Strategy defines the load balancing strategy between the servers.
  2679.                             RoundRobin is the only supported value at the moment.
  2680.                           type: string
  2681.                         weight:
  2682.                           description: |-
  2683.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2684.                             (and to be precise, one that embeds a Weighted Round Robin).
  2685.                           type: integer
  2686.                       required:
  2687.                       - name
  2688.                       type: object
  2689.                     type: array
  2690.                   name:
  2691.                     description: |-
  2692.                       Name defines the name of the referenced Kubernetes Service or TraefikService.
  2693.                       The differentiation between the two is specified in the Kind field.
  2694.                     type: string
  2695.                   namespace:
  2696.                     description: Namespace defines the namespace of the referenced
  2697.                       Kubernetes Service or TraefikService.
  2698.                     type: string
  2699.                   nativeLB:
  2700.                     description: |-
  2701.                       NativeLB controls, when creating the load-balancer,
  2702.                       whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2703.                       The Kubernetes Service itself does load-balance to the pods.
  2704.                       By default, NativeLB is false.
  2705.                     type: boolean
  2706.                   nodePortLB:
  2707.                     description: |-
  2708.                       NodePortLB controls, when creating the load-balancer,
  2709.                       whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2710.                       It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2711.                       By default, NodePortLB is false.
  2712.                     type: boolean
  2713.                   passHostHeader:
  2714.                     description: |-
  2715.                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2716.                       By default, passHostHeader is true.
  2717.                     type: boolean
  2718.                   port:
  2719.                     anyOf:
  2720.                     - type: integer
  2721.                     - type: string
  2722.                     description: |-
  2723.                       Port defines the port of a Kubernetes Service.
  2724.                       This can be a reference to a named port.
  2725.                     x-kubernetes-int-or-string: true
  2726.                   responseForwarding:
  2727.                     description: ResponseForwarding defines how Traefik forwards the
  2728.                       response from the upstream Kubernetes Service to the client.
  2729.                     properties:
  2730.                       flushInterval:
  2731.                         description: |-
  2732.                           FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2733.                           A negative value means to flush immediately after each write to the client.
  2734.                           This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2735.                           for such responses, writes are flushed to the client immediately.
  2736.                           Default: 100ms
  2737.                         type: string
  2738.                     type: object
  2739.                   scheme:
  2740.                     description: |-
  2741.                       Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2742.                       It defaults to https when Kubernetes Service port is 443, http otherwise.
  2743.                     type: string
  2744.                   serversTransport:
  2745.                     description: |-
  2746.                       ServersTransport defines the name of ServersTransport resource to use.
  2747.                       It allows to configure the transport between Traefik and your servers.
  2748.                       Can only be used on a Kubernetes Service.
  2749.                     type: string
  2750.                   sticky:
  2751.                     description: |-
  2752.                       Sticky defines the sticky sessions configuration.
  2753.                       More info: https://doc.traefik.io/traefik/v3.1/routing/services/#sticky-sessions
  2754.                     properties:
  2755.                       cookie:
  2756.                         description: Cookie defines the sticky cookie configuration.
  2757.                         properties:
  2758.                           httpOnly:
  2759.                             description: HTTPOnly defines whether the cookie can be
  2760.                               accessed by client-side APIs, such as JavaScript.
  2761.                             type: boolean
  2762.                           maxAge:
  2763.                             description: |-
  2764.                               MaxAge indicates the number of seconds until the cookie expires.
  2765.                               When set to a negative number, the cookie expires immediately.
  2766.                               When set to zero, the cookie never expires.
  2767.                             type: integer
  2768.                           name:
  2769.                             description: Name defines the Cookie name.
  2770.                             type: string
  2771.                           sameSite:
  2772.                             description: |-
  2773.                               SameSite defines the same site policy.
  2774.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2775.                             type: string
  2776.                           secure:
  2777.                             description: Secure defines whether the cookie can only
  2778.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2779.                             type: boolean
  2780.                         type: object
  2781.                     type: object
  2782.                   strategy:
  2783.                     description: |-
  2784.                       Strategy defines the load balancing strategy between the servers.
  2785.                       RoundRobin is the only supported value at the moment.
  2786.                     type: string
  2787.                   weight:
  2788.                     description: |-
  2789.                       Weight defines the weight and should only be specified when Name references a TraefikService object
  2790.                       (and to be precise, one that embeds a Weighted Round Robin).
  2791.                     type: integer
  2792.                 required:
  2793.                 - name
  2794.                 type: object
  2795.               weighted:
  2796.                 description: Weighted defines the Weighted Round Robin configuration.
  2797.                 properties:
  2798.                   services:
  2799.                     description: Services defines the list of Kubernetes Service and/or
  2800.                       TraefikService to load-balance, with weight.
  2801.                     items:
  2802.                       description: Service defines an upstream HTTP service to proxy
  2803.                         traffic to.
  2804.                       properties:
  2805.                         healthCheck:
  2806.                           description: Healthcheck defines health checks for ExternalName
  2807.                             services.
  2808.                           properties:
  2809.                             followRedirects:
  2810.                               description: |-
  2811.                                 FollowRedirects defines whether redirects should be followed during the health check calls.
  2812.                                 Default: true
  2813.                               type: boolean
  2814.                             headers:
  2815.                               additionalProperties:
  2816.                                 type: string
  2817.                               description: Headers defines custom headers to be sent
  2818.                                 to the health check endpoint.
  2819.                               type: object
  2820.                             hostname:
  2821.                               description: Hostname defines the value of hostname
  2822.                                 in the Host header of the health check request.
  2823.                               type: string
  2824.                             interval:
  2825.                               anyOf:
  2826.                               - type: integer
  2827.                               - type: string
  2828.                               description: |-
  2829.                                 Interval defines the frequency of the health check calls.
  2830.                                 Default: 30s
  2831.                               x-kubernetes-int-or-string: true
  2832.                             method:
  2833.                               description: Method defines the healthcheck method.
  2834.                               type: string
  2835.                             mode:
  2836.                               description: |-
  2837.                                 Mode defines the health check mode.
  2838.                                 If defined to grpc, will use the gRPC health check protocol to probe the server.
  2839.                                 Default: http
  2840.                               type: string
  2841.                             path:
  2842.                               description: Path defines the server URL path for the
  2843.                                 health check endpoint.
  2844.                               type: string
  2845.                             port:
  2846.                               description: Port defines the server URL port for the
  2847.                                 health check endpoint.
  2848.                               type: integer
  2849.                             scheme:
  2850.                               description: Scheme replaces the server URL scheme for
  2851.                                 the health check endpoint.
  2852.                               type: string
  2853.                             status:
  2854.                               description: Status defines the expected HTTP status
  2855.                                 code of the response to the health check request.
  2856.                               type: integer
  2857.                             timeout:
  2858.                               anyOf:
  2859.                               - type: integer
  2860.                               - type: string
  2861.                               description: |-
  2862.                                 Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2863.                                 Default: 5s
  2864.                               x-kubernetes-int-or-string: true
  2865.                           type: object
  2866.                         kind:
  2867.                           description: Kind defines the kind of the Service.
  2868.                           enum:
  2869.                           - Service
  2870.                           - TraefikService
  2871.                           type: string
  2872.                         name:
  2873.                           description: |-
  2874.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2875.                             The differentiation between the two is specified in the Kind field.
  2876.                           type: string
  2877.                         namespace:
  2878.                           description: Namespace defines the namespace of the referenced
  2879.                             Kubernetes Service or TraefikService.
  2880.                           type: string
  2881.                         nativeLB:
  2882.                           description: |-
  2883.                             NativeLB controls, when creating the load-balancer,
  2884.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2885.                             The Kubernetes Service itself does load-balance to the pods.
  2886.                             By default, NativeLB is false.
  2887.                           type: boolean
  2888.                         nodePortLB:
  2889.                           description: |-
  2890.                             NodePortLB controls, when creating the load-balancer,
  2891.                             whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2892.                             It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2893.                             By default, NodePortLB is false.
  2894.                           type: boolean
  2895.                         passHostHeader:
  2896.                           description: |-
  2897.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2898.                             By default, passHostHeader is true.
  2899.                           type: boolean
  2900.                         port:
  2901.                           anyOf:
  2902.                           - type: integer
  2903.                           - type: string
  2904.                           description: |-
  2905.                             Port defines the port of a Kubernetes Service.
  2906.                             This can be a reference to a named port.
  2907.                           x-kubernetes-int-or-string: true
  2908.                         responseForwarding:
  2909.                           description: ResponseForwarding defines how Traefik forwards
  2910.                             the response from the upstream Kubernetes Service to the
  2911.                             client.
  2912.                           properties:
  2913.                             flushInterval:
  2914.                               description: |-
  2915.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2916.                                 A negative value means to flush immediately after each write to the client.
  2917.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2918.                                 for such responses, writes are flushed to the client immediately.
  2919.                                 Default: 100ms
  2920.                               type: string
  2921.                           type: object
  2922.                         scheme:
  2923.                           description: |-
  2924.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2925.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2926.                           type: string
  2927.                         serversTransport:
  2928.                           description: |-
  2929.                             ServersTransport defines the name of ServersTransport resource to use.
  2930.                             It allows to configure the transport between Traefik and your servers.
  2931.                             Can only be used on a Kubernetes Service.
  2932.                           type: string
  2933.                         sticky:
  2934.                           description: |-
  2935.                             Sticky defines the sticky sessions configuration.
  2936.                             More info: https://doc.traefik.io/traefik/v3.1/routing/services/#sticky-sessions
  2937.                           properties:
  2938.                             cookie:
  2939.                               description: Cookie defines the sticky cookie configuration.
  2940.                               properties:
  2941.                                 httpOnly:
  2942.                                   description: HTTPOnly defines whether the cookie
  2943.                                     can be accessed by client-side APIs, such as JavaScript.
  2944.                                   type: boolean
  2945.                                 maxAge:
  2946.                                   description: |-
  2947.                                     MaxAge indicates the number of seconds until the cookie expires.
  2948.                                     When set to a negative number, the cookie expires immediately.
  2949.                                     When set to zero, the cookie never expires.
  2950.                                   type: integer
  2951.                                 name:
  2952.                                   description: Name defines the Cookie name.
  2953.                                   type: string
  2954.                                 sameSite:
  2955.                                   description: |-
  2956.                                     SameSite defines the same site policy.
  2957.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2958.                                   type: string
  2959.                                 secure:
  2960.                                   description: Secure defines whether the cookie can
  2961.                                     only be transmitted over an encrypted connection
  2962.                                     (i.e. HTTPS).
  2963.                                   type: boolean
  2964.                               type: object
  2965.                           type: object
  2966.                         strategy:
  2967.                           description: |-
  2968.                             Strategy defines the load balancing strategy between the servers.
  2969.                             RoundRobin is the only supported value at the moment.
  2970.                           type: string
  2971.                         weight:
  2972.                           description: |-
  2973.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2974.                             (and to be precise, one that embeds a Weighted Round Robin).
  2975.                           type: integer
  2976.                       required:
  2977.                       - name
  2978.                       type: object
  2979.                     type: array
  2980.                   sticky:
  2981.                     description: |-
  2982.                       Sticky defines whether sticky sessions are enabled.
  2983.                       More info: https://doc.traefik.io/traefik/v3.1/routing/providers/kubernetes-crd/#stickiness-and-load-balancing
  2984.                     properties:
  2985.                       cookie:
  2986.                         description: Cookie defines the sticky cookie configuration.
  2987.                         properties:
  2988.                           httpOnly:
  2989.                             description: HTTPOnly defines whether the cookie can be
  2990.                               accessed by client-side APIs, such as JavaScript.
  2991.                             type: boolean
  2992.                           maxAge:
  2993.                             description: |-
  2994.                               MaxAge indicates the number of seconds until the cookie expires.
  2995.                               When set to a negative number, the cookie expires immediately.
  2996.                               When set to zero, the cookie never expires.
  2997.                             type: integer
  2998.                           name:
  2999.                             description: Name defines the Cookie name.
  3000.                             type: string
  3001.                           sameSite:
  3002.                             description: |-
  3003.                               SameSite defines the same site policy.
  3004.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  3005.                             type: string
  3006.                           secure:
  3007.                             description: Secure defines whether the cookie can only
  3008.                               be transmitted over an encrypted connection (i.e. HTTPS).
  3009.                             type: boolean
  3010.                         type: object
  3011.                     type: object
  3012.                 type: object
  3013.             type: object
  3014.         required:
  3015.         - metadata
  3016.         - spec
  3017.         type: object
  3018.     served: true
  3019.     storage: true

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - secrets
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.io
    resources:
      - middlewares
      - middlewaretcps
      - ingressroutes
      - traefikservices
      - ingressroutetcps
      - ingressrouteudps
      - tlsoptions
      - tlsstores
      - serverstransports
      - serverstransporttcps
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default

Traefik

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v3.1
          args:
            - --log.level=DEBUG
            - --api
            - --api.insecure
            - --entryPoints.web.address=:80
            - --entryPoints.tcpep.address=:8000
            - --entryPoints.udpep.address=:9000/udp
            - --providers.kubernetescrd
          ports:
            - name: web
              containerPort: 80
            - name: admin
              containerPort: 8080
            - name: tcpep
              containerPort: 8000
            - name: udpep
              containerPort: 9000

---
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: TCP
      port: 80
      name: web
      targetPort: 80
    - protocol: TCP
      port: 8080
      name: admin
      targetPort: 8080
    - protocol: TCP
      port: 8000
      name: tcpep
      targetPort: 8000

---
apiVersion: v1
kind: Service
metadata:
  name: traefikudp
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: UDP
      port: 9000
      name: udpep
      targetPort: 9000

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: myingressroute
  namespace: default

spec:
  entryPoints:
    - web

  routes:
  - match: Host(`foo`) && PathPrefix(`/bar`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroute.tcp
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressroute.udp
  namespace: default

spec:
  entryPoints:
    - udpep
  routes:
  - services:
      - name: whoamiudp
        port: 8080

Whoami

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  namespace: default
  labels:
    app: traefiklabs
    name: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoami
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: whoami

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamitcp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamitcp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamitcp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamitcp
    spec:
      containers:
        - name: whoamitcp
          image: traefik/whoamitcp
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamitcp
  namespace: default

spec:
  ports:
    - protocol: TCP
      port: 8080
  selector:
    app: traefiklabs
    task: whoamitcp

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamiudp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamiudp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: traefik/whoamiudp:latest
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
  namespace: default

spec:
  ports:
    - port: 8080
  selector:
    app: traefiklabs
    task: whoamiudp

Routing Configuration

Custom Resource Definition (CRD)

  • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
  • Validate that the prerequisites are fulfilled before using the Traefik custom resources.
  • Traefik CRDs are building blocks that you can assemble according to your needs.

You can find an excerpt of the available custom resources in the table below:

KindPurposeConcept Behind
IngressRouteHTTP RoutingHTTP router
MiddlewareTweaks the HTTP requests before they are sent to your serviceHTTP Middlewares
TraefikServiceAbstraction for HTTP loadbalancing/mirroringHTTP service
IngressRouteTCPTCP RoutingTCP router
MiddlewareTCPTweaks the TCP requests before they are sent to your serviceTCP Middlewares
IngressRouteUDPUDP RoutingUDP router
TLSOptionsAllows to configure some parameters of the TLS connectionTLSOptions
TLSStoresAllows to configure the default TLS storeTLSStores
ServersTransportAllows to configure the transport between Traefik and the backendsServersTransport
ServersTransportTCPAllows to configure the transport between Traefik and the backendsTCP ServersTransport

Kind: IngressRoute

IngressRoute is the CRD implementation of a Traefik HTTP router.

Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

IngressRoute Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: foo
  namespace: bar
spec:
  entryPoints:                      # [1]
    - foo
  routes:                           # [2]
  - kind: Rule
    match: Host(`test.example.com`) # [3]
    priority: 10                    # [4]
    middlewares:                    # [5]
    - name: middleware1             # [6]
      namespace: default            # [7]
    services:                       # [8]
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80                      # [9]
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      serversTransport: transport   # [10]
      healthCheck:                  # [11]
        path: /health
        interval: 15s
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
          sameSite: none
          maxAge: 42  
      strategy: RoundRobin
      weight: 10
      nativeLB: true                # [12]
      nodePortLB: true              # [13]
  tls:                              # [14]
    secretName: supersecret         # [15]
    options:                        # [16]
      name: opt                     # [17]
      namespace: default            # [18]
    certResolver: foo               # [19]
    domains:                        # [20]
    - main: example.net             # [21]
      sans:                         # [22]
      - a.example.net
      - b.example.net
RefAttributePurpose
[1]entryPointsList of entry points names
[2]routesList of routes
[3]routes[n].matchDefines the rule corresponding to an underlying router.
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]routes[n].middlewaresList of reference to Middleware
[6]middlewares[n].nameDefines the Middleware name
[7]middlewares[n].namespaceDefines the Middleware namespace. It can be omitted when the Middleware is in the IngressRoute namespace.
[8]routes[n].servicesList of any combination of TraefikService and reference to a Kubernetes service (See below for ExternalName Service setup)
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].serversTransportDefines the reference to a ServersTransport. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[11]services[n].healthCheckDefines the HealthCheck when service references a Kubernetes service of type ExternalName.
[12]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[13]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
[14]tlsDefines TLS certificate configuration
[15]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[16]tls.optionsDefines the reference to a TLSOption
[17]options.nameDefines the TLSOption name
[18]options.namespaceDefines the TLSOption namespace
[19]tls.certResolverDefines the reference to a CertResolver
[20]tls.domainsList of domains
[21]domains[n].mainDefines the main domain name
[22]domains[n].sansList of SANs (alternative domains)

Declaring an IngressRoute

IngressRoute

# All resources definition must be declared
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test-name
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - kind: Rule
    match: Host(`test.example.com`)
    middlewares:
    - name: middleware1
      namespace: default
    priority: 10
    services:
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
      strategy: RoundRobin
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret

Middlewares

# All resources definition must be declared
# Prefixing with /foo
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: middleware1
  namespace: default
spec:
  addPrefix:
    prefix: /foo

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Configuring Backend Protocol

There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

  • Setting the scheme explicitly (http/https/h2c)
  • Configuring the name of the kubernetes service port to start with https (https)
  • Setting the kubernetes service port to use port 443 (https)

If you do not configure the above, Traefik will assume an http connection.

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRoute service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRoute

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Load Balancing

More information in the dedicated server load balancing section.

Declaring and using Kubernetes Service Load Balancing

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: svc1
      namespace: default
    - name: svc2
      namespace: default

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the service NativeLB option to true. Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: Middleware

Middleware is the CRD implementation of a Traefik middleware.

Register the Middleware kind in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

Declaring and Referencing a Middleware

Middleware

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: foo

spec:
  stripPrefix:
    prefixes:
      - /stripit

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: stripprefix
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available middlewares in the dedicated middlewares section.

Kind: TraefikService

TraefikService is the CRD implementation of a “Traefik Service”.

Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the IngressRoute objects, or recursively in others TraefikService objects.

Disambiguate Traefik and Kubernetes Services

As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

The field kind allows the following values:

TraefikService object allows to use any (valid) combinations of:

Weighted Round Robin

More information in the dedicated Weighted Round Robin service load balancing section.

Declaring and Using Weighted Round Robin

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: svc1
        port: 80
        weight: 1
      - name: wrr2
        kind: TraefikService
        weight: 1
      - name: mirror1
        kind: TraefikService
        weight: 1

---
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr2
  namespace: default

spec:
  weighted:
    services:
      - name: svc2
        port: 80
        weight: 1
      - name: svc3
        port: 80
        weight: 1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2
---
apiVersion: v1
kind: Service
metadata:
  name: svc3
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app3

Mirroring

More information in the dedicated mirroring service section.

Declaring and Using Mirroring

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: mirror1
      namespace: default
      kind: TraefikService

Mirroring k8s Service

# Mirroring from a k8s Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: svc1                      # svc1 receives 100% of the traffic
    port: 80
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 15% of this traffic
        kind: TraefikService
        percent: 15

Mirroring Traefik Service

# Mirroring from a Traefik Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: wrr1                      # wrr1 receives 100% of the traffic
    kind: TraefikService
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 10% of this traffic
        kind: TraefikService
        percent: 10

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax (service@provider) should be used to refer to the TraefikService, just as in the middleware case.

Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

Stickiness and load-balancing

As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

Stickiness on two load-balancing levels

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: whoami1
        kind: Service
        port: 80
        weight: 1
        sticky:
          cookie:
            name: lvl2
      - name: whoami2
        kind: Service
        weight: 1
        port: 80
        sticky:
          cookie:
            name: lvl2
    sticky:
      cookie:
        name: lvl1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: whoami1

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami1

---
apiVersion: v1
kind: Service
metadata:
  name: whoami2

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami2

Deployment (to illustrate replicas)

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami1
  labels:
    app: whoami1

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami1
  template:
    metadata:
      labels:
        app: whoami1
    spec:
      containers:
        - name: whoami1
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami2
  labels:
    app: whoami2

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami2
  template:
    metadata:
      labels:
        app: whoami2
    spec:
      containers:
        - name: whoami2
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

Kind: IngressRouteTCP

IngressRouteTCP is the CRD implementation of a Traefik TCP router.

Register the IngressRouteTCP kind in the Kubernetes cluster before creating IngressRouteTCP objects.

IngressRouteTCP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:                    # [1]
    - footcp
  routes:                         # [2]
  - match: HostSNI(`*`)           # [3]
    priority: 10                  # [4]
    middlewares:
    - name: middleware1           # [5]
      namespace: default          # [6]
    services:                     # [7]
    - name: foo                   # [8]
      port: 8080                  # [9]
      weight: 10                  # [10]
      proxyProtocol:              # [11]
        version: 1                # [12]
      serversTransport: transport # [13]
      nativeLB: true              # [14]
      nodePortLB: true            # [15]

  tls:                            # [16]
    secretName: supersecret       # [17]
    options:                      # [18]
      name: opt                   # [19]
      namespace: default          # [20]
    certResolver: foo             # [21]
    domains:                      # [22]
    - main: example.net           # [23]
      sans:                       # [24]
      - a.example.net
      - b.example.net
    passthrough: false            # [25]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].matchDefines the rule of the underlying router
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]middlewares[n].nameDefines the MiddlewareTCP name
[6]middlewares[n].namespaceDefines the MiddlewareTCP namespace
[7]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[8]services[n].nameDefines the name of a Kubernetes service
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].weightDefines the weight to apply to the server load balancing
[11]services[n].proxyProtocolDefines the PROXY protocol configuration
[12]services[n].proxyProtocol.versionDefines the PROXY protocol version
[13]services[n].serversTransportDefines the reference to a ServersTransportTCP. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[14]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[15]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is
[16]tlsDefines TLS certificate configuration
[17]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[18]tls.optionsDefines the reference to a TLSOption
[19]tls.options.nameDefines the TLSOption name
[20]tls.options.namespaceDefines the TLSOption namespace
[21]tls.certResolverDefines the reference to a CertResolver
[22]tls.domainsList of domains
[23]tls.domains[n].mainDefines the main domain name
[24]tls.domains[n].sansList of SANs (alternative domains)
[25]tls.passthroughIf true, delegates the TLS termination to the backend

Declaring an IngressRouteTCP

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:
    - footcp
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    priority: 10
    services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret
    passthrough: false

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteTCP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

Only on IngressRouteTCP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

On both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the TCP service NativeLB option to true. By default, NativeLB is false.

Examples

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: MiddlewareTCP

MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.

Register the MiddlewareTCP kind in the Kubernetes cluster before creating MiddlewareTCP objects or referencing TCP middlewares in the IngressRouteTCP objects.

Declaring and Referencing a MiddlewareTCP

Middleware

apiVersion: traefik.io/v1alpha1
kind: MiddlewareTCP
metadata:
  name: ipallowlist
spec:
  ipAllowList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/allowlist`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: ipallowlist
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the TCP middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a MiddlewareTCP from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available TCP middlewares in the dedicated middlewares section.

Kind: IngressRouteUDP

IngressRouteUDP is the CRD implementation of a Traefik UDP router.

Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

IngressRouteUDP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:                  # [1]
    - fooudp
  routes:                       # [2]
  - services:                   # [3]
    - name: foo                 # [4]
      port: 8080                # [5]
      weight: 10                # [6]
      nativeLB: true            # [7]
      nodePortLB: true          # [8]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[4]services[n].nameDefines the name of a Kubernetes service
[5]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[6]services[n].weightDefines the weight to apply to the server load balancing
[7]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[8]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is NodePort.

Declaring an IngressRouteUDP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteUDP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteUDP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRouteUDP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the UDP service NativeLB option to true. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: TLSOption

TLSOption is the CRD implementation of a Traefik “TLS Option”.

Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the IngressRoute / IngressRouteTCP objects.

TLSOption Attributes

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption                             # [1]
  namespace: default

spec:
  minVersion: VersionTLS12                      # [2]
  maxVersion: VersionTLS13                      # [3]
  curvePreferences:                             # [4]
    - CurveP521
    - CurveP384
  cipherSuites:                                 # [5]
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:                                   # [6]
    secretNames:                                # [7]
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven     # [8]
  sniStrict: true                               # [9]
  alpnProtocols:                                # [10]
    - foobar
RefAttributePurpose
[1]nameDefines the name of the TLSOption resource. One can use default as name to redefine the default TLSOption.
[2]minVersionDefines the minimum TLS version that is acceptable.
[3]maxVersionDefines the maximum TLS version that is acceptable.
[4]cipherSuiteslist of supported cipher suites for TLS versions up to TLS 1.2.
[5]curvePreferencesList of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
[6]clientAuthdetermines the server’s policy for TLS Client Authentication.
[7]clientAuth.secretNameslist of names of the referenced Kubernetes Secrets (in TLSOption namespace). The secret must contain a certificate under either a tls.ca or a ca.crt key.
[8]clientAuth.clientAuthTypedefines the client authentication type to apply. The available values are: NoClientCert, RequestClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
[9]sniStrictif true, Traefik won’t allow connections from clients connections that do not specify a server_name extension.
[10]alpnProtocolsList of supported application level protocols for the TLS handshake, in order of preference.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a TLSOption

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption
  namespace: default

spec:
  minVersion: VersionTLS12
  sniStrict: true
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:
    secretNames:
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    options: 
      name: mytlsoption
      namespace: default

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: secret-ca1
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-ca2
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

Additionally, when the definition of the TLS option is from another provider, the cross-provider syntax (middlewarename@provider) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

Kind: TLSStore

TLSStore is the CRD implementation of a Traefik “TLS Store”.

Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects.

Default TLS Store

Traefik currently only uses the TLS Store named “default”. This default TLSStore should be in a namespace discoverable by Traefik. Since it is used by default on IngressRoute and IngressRouteTCP objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default TLSStore.

TLSStore Attributes

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  certificates:                            # [1]
    - secretName: foo                      
    - secretName: bar
  defaultCertificate:                      # [2]
    secretName: secret
RefAttributePurpose
[1]certificatesList of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store.
[2]defaultCertificateName of a Kubernetes Secret that holds the default key/certificate pair for the store.

Declaring and referencing a TLSStore

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  defaultCertificate:
    secretName:  supersecret

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls: {}

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Kind: ServersTransport

ServersTransport is the CRD implementation of a ServersTransport.

Default serversTransport

If no serversTransport is specified, the default@internal will be used. The default@internal serversTransport is created from the static configuration.

ServersTransport Attributes

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: foobar                        # [1]
  insecureSkipVerify: true                  # [2]
  rootCAsSecrets:                           # [3]
    - foobar
    - foobar
  certificatesSecrets:                      # [4]
    - foobar
    - foobar
  maxIdleConnsPerHost: 1                    # [5]
  forwardingTimeouts:                       # [6]
    dialTimeout: 42s                        # [7]
    responseHeaderTimeout: 42s              # [8]
    idleConnTimeout: 42s                    # [9]
  peerCertURI: foobar                       # [10]
  disableHTTP2: true                        # [11]
  spiffe:                                   # [12] 
    ids:                                    # [13]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [14]
RefAttributePurpose
[1]serverNameServerName used to contact the server.
[2]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[3]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[4]certificatesSecretsCertificates to present to the server for mTLS.
[5]maxIdleConnsPerHostControls the maximum idle (keep-alive) connections to keep per-host. If zero, defaultMaxIdleConnsPerHost is used.
[6]forwardingTimeoutsTimeouts for requests forwarded to the servers.
[7]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[8]responseHeaderTimeoutThe amount of time to wait for a server’s response headers after fully writing the request (including its body, if any). If zero, no timeout exists.
[9]idleConnTimeoutThe maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists.
[10]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[11]disableHTTP2Disables HTTP/2 for connections with servers.
[12]spiffeThe spiffe configuration.
[13]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[14]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransport

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

ServersTransport reference

By default, the referenced ServersTransport CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransport CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransport CRD is defined in another provider the cross-provider format name@provider should be used.

Kind: ServersTransportTCP

ServersTransportTCP is the CRD implementation of a ServersTransportTCP.

Default serversTransportTCP

If no serversTransportTCP is specified, the default@internal will be used. The default@internal serversTransportTCP is created from the static configuration.

ServersTransportTCP Attributes

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  dialTimeout: 42s                          # [1]
  dialKeepAlive: 42s                        # [2]
  terminationDelay: 42s                     # [3]
  tls:                                      # [4]
    serverName: foobar                      # [5]
    insecureSkipVerify: true                # [6]
    peerCertURI: foobar                     # [7]
    rootCAsSecrets:                         # [8]
      - foobar
      - foobar
    certificatesSecrets:                    # [9]
      - foobar
      - foobar
  spiffe:                                   # [10] 
    ids:                                    # [11]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [12]
RefAttributePurpose
[1]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[2]dialKeepAliveThe interval between keep-alive probes for an active network connection. If zero, keep-alive probes are sent with a default value (currently 15 seconds), if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field. If negative, keep-alive probes are disabled.
[3]terminationDelayDefines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability.
[4]tlsThe TLS configuration.
[5]serverNameServerName used to contact the server.
[6]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[7]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[8]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[9]certificatesSecretsCertificates to present to the server for mTLS.
[10]spiffeThe SPIFFE configuration.
[11]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[12]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransportTCP

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  tls:
    serverName: example.org
    insecureSkipVerify: true

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080
        serversTransport: mytransport

ServersTransportTCP reference

By default, the referenced ServersTransportTCP CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransportTCP CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransportTCP CRD is defined in another provider the cross-provider format name@provider should be used.

Further

Also see the full example with Let’s Encrypt.

Using Traefik OSS in Production? Consider Adding Advanced Capabilities.

Add API Gateway or API Management capabilities seamlessly to your existing Traefik deployments. No rip and replace. No learning curve.