Traefik & Kubernetes

The Kubernetes Ingress Controller, The Custom Resource Way.

Configuration Examples

Configuring KubernetesCRD and Deploying/Exposing Services

Resource Definition

  1. # All resources definition must be declared
  2. ---
  3. apiVersion: apiextensions.k8s.io/v1
  4. kind: CustomResourceDefinition
  5. metadata:
  6.   annotations:
  7.     controller-gen.kubebuilder.io/version: v0.16.1
  8.   name: ingressroutes.traefik.io
  9. spec:
  10.   group: traefik.io
  11.   names:
  12.     kind: IngressRoute
  13.     listKind: IngressRouteList
  14.     plural: ingressroutes
  15.     singular: ingressroute
  16.   scope: Namespaced
  17.   versions:
  18.   - name: v1alpha1
  19.     schema:
  20.       openAPIV3Schema:
  21.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  22.         properties:
  23.           apiVersion:
  24.             description: |-
  25.               APIVersion defines the versioned schema of this representation of an object.
  26.               Servers should convert recognized schemas to the latest internal value, and
  27.               may reject unrecognized values.
  28.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  29.             type: string
  30.           kind:
  31.             description: |-
  32.               Kind is a string value representing the REST resource this object represents.
  33.               Servers may infer this from the endpoint the client submits requests to.
  34.               Cannot be updated.
  35.               In CamelCase.
  36.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  37.             type: string
  38.           metadata:
  39.             type: object
  40.           spec:
  41.             description: IngressRouteSpec defines the desired state of IngressRoute.
  42.             properties:
  43.               entryPoints:
  44.                 description: |-
  45.                   EntryPoints defines the list of entry point names to bind to.
  46.                   Entry points have to be configured in the static configuration.
  47.                   More info: https://doc.traefik.io/traefik/v3.2/routing/entrypoints/
  48.                   Default: all.
  49.                 items:
  50.                   type: string
  51.                 type: array
  52.               routes:
  53.                 description: Routes defines the list of routes.
  54.                 items:
  55.                   description: Route holds the HTTP route configuration.
  56.                   properties:
  57.                     kind:
  58.                       description: |-
  59.                         Kind defines the kind of the route.
  60.                         Rule is the only supported kind.
  61.                       enum:
  62.                       - Rule
  63.                       type: string
  64.                     match:
  65.                       description: |-
  66.                         Match defines the router's rule.
  67.                         More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#rule
  68.                       type: string
  69.                     middlewares:
  70.                       description: |-
  71.                         Middlewares defines the list of references to Middleware resources.
  72.                         More info: https://doc.traefik.io/traefik/v3.2/routing/providers/kubernetes-crd/#kind-middleware
  73.                       items:
  74.                         description: MiddlewareRef is a reference to a Middleware
  75.                           resource.
  76.                         properties:
  77.                           name:
  78.                             description: Name defines the name of the referenced Middleware
  79.                               resource.
  80.                             type: string
  81.                           namespace:
  82.                             description: Namespace defines the namespace of the referenced
  83.                               Middleware resource.
  84.                             type: string
  85.                         required:
  86.                         - name
  87.                         type: object
  88.                       type: array
  89.                     priority:
  90.                       description: |-
  91.                         Priority defines the router's priority.
  92.                         More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#priority
  93.                       type: integer
  94.                     services:
  95.                       description: |-
  96.                         Services defines the list of Service.
  97.                         It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
  98.                       items:
  99.                         description: Service defines an upstream HTTP service to proxy
  100.                           traffic to.
  101.                         properties:
  102.                           healthCheck:
  103.                             description: Healthcheck defines health checks for ExternalName
  104.                               services.
  105.                             properties:
  106.                               followRedirects:
  107.                                 description: |-
  108.                                   FollowRedirects defines whether redirects should be followed during the health check calls.
  109.                                   Default: true
  110.                                 type: boolean
  111.                               headers:
  112.                                 additionalProperties:
  113.                                   type: string
  114.                                 description: Headers defines custom headers to be
  115.                                   sent to the health check endpoint.
  116.                                 type: object
  117.                               hostname:
  118.                                 description: Hostname defines the value of hostname
  119.                                   in the Host header of the health check request.
  120.                                 type: string
  121.                               interval:
  122.                                 anyOf:
  123.                                 - type: integer
  124.                                 - type: string
  125.                                 description: |-
  126.                                   Interval defines the frequency of the health check calls.
  127.                                   Default: 30s
  128.                                 x-kubernetes-int-or-string: true
  129.                               method:
  130.                                 description: Method defines the healthcheck method.
  131.                                 type: string
  132.                               mode:
  133.                                 description: |-
  134.                                   Mode defines the health check mode.
  135.                                   If defined to grpc, will use the gRPC health check protocol to probe the server.
  136.                                   Default: http
  137.                                 type: string
  138.                               path:
  139.                                 description: Path defines the server URL path for
  140.                                   the health check endpoint.
  141.                                 type: string
  142.                               port:
  143.                                 description: Port defines the server URL port for
  144.                                   the health check endpoint.
  145.                                 type: integer
  146.                               scheme:
  147.                                 description: Scheme replaces the server URL scheme
  148.                                   for the health check endpoint.
  149.                                 type: string
  150.                               status:
  151.                                 description: Status defines the expected HTTP status
  152.                                   code of the response to the health check request.
  153.                                 type: integer
  154.                               timeout:
  155.                                 anyOf:
  156.                                 - type: integer
  157.                                 - type: string
  158.                                 description: |-
  159.                                   Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  160.                                   Default: 5s
  161.                                 x-kubernetes-int-or-string: true
  162.                             type: object
  163.                           kind:
  164.                             description: Kind defines the kind of the Service.
  165.                             enum:
  166.                             - Service
  167.                             - TraefikService
  168.                             type: string
  169.                           name:
  170.                             description: |-
  171.                               Name defines the name of the referenced Kubernetes Service or TraefikService.
  172.                               The differentiation between the two is specified in the Kind field.
  173.                             type: string
  174.                           namespace:
  175.                             description: Namespace defines the namespace of the referenced
  176.                               Kubernetes Service or TraefikService.
  177.                             type: string
  178.                           nativeLB:
  179.                             description: |-
  180.                               NativeLB controls, when creating the load-balancer,
  181.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  182.                               The Kubernetes Service itself does load-balance to the pods.
  183.                               By default, NativeLB is false.
  184.                             type: boolean
  185.                           nodePortLB:
  186.                             description: |-
  187.                               NodePortLB controls, when creating the load-balancer,
  188.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  189.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  190.                               By default, NodePortLB is false.
  191.                             type: boolean
  192.                           passHostHeader:
  193.                             description: |-
  194.                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  195.                               By default, passHostHeader is true.
  196.                             type: boolean
  197.                           port:
  198.                             anyOf:
  199.                             - type: integer
  200.                             - type: string
  201.                             description: |-
  202.                               Port defines the port of a Kubernetes Service.
  203.                               This can be a reference to a named port.
  204.                             x-kubernetes-int-or-string: true
  205.                           responseForwarding:
  206.                             description: ResponseForwarding defines how Traefik forwards
  207.                               the response from the upstream Kubernetes Service to
  208.                               the client.
  209.                             properties:
  210.                               flushInterval:
  211.                                 description: |-
  212.                                   FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  213.                                   A negative value means to flush immediately after each write to the client.
  214.                                   This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  215.                                   for such responses, writes are flushed to the client immediately.
  216.                                   Default: 100ms
  217.                                 type: string
  218.                             type: object
  219.                           scheme:
  220.                             description: |-
  221.                               Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  222.                               It defaults to https when Kubernetes Service port is 443, http otherwise.
  223.                             type: string
  224.                           serversTransport:
  225.                             description: |-
  226.                               ServersTransport defines the name of ServersTransport resource to use.
  227.                               It allows to configure the transport between Traefik and your servers.
  228.                               Can only be used on a Kubernetes Service.
  229.                             type: string
  230.                           sticky:
  231.                             description: |-
  232.                               Sticky defines the sticky sessions configuration.
  233.                               More info: https://doc.traefik.io/traefik/v3.2/routing/services/#sticky-sessions
  234.                             properties:
  235.                               cookie:
  236.                                 description: Cookie defines the sticky cookie configuration.
  237.                                 properties:
  238.                                   httpOnly:
  239.                                     description: HTTPOnly defines whether the cookie
  240.                                       can be accessed by client-side APIs, such as
  241.                                       JavaScript.
  242.                                     type: boolean
  243.                                   maxAge:
  244.                                     description: |-
  245.                                       MaxAge indicates the number of seconds until the cookie expires.
  246.                                       When set to a negative number, the cookie expires immediately.
  247.                                       When set to zero, the cookie never expires.
  248.                                     type: integer
  249.                                   name:
  250.                                     description: Name defines the Cookie name.
  251.                                     type: string
  252.                                   sameSite:
  253.                                     description: |-
  254.                                       SameSite defines the same site policy.
  255.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  256.                                     type: string
  257.                                   secure:
  258.                                     description: Secure defines whether the cookie
  259.                                       can only be transmitted over an encrypted connection
  260.                                       (i.e. HTTPS).
  261.                                     type: boolean
  262.                                 type: object
  263.                             type: object
  264.                           strategy:
  265.                             description: |-
  266.                               Strategy defines the load balancing strategy between the servers.
  267.                               RoundRobin is the only supported value at the moment.
  268.                             type: string
  269.                           weight:
  270.                             description: |-
  271.                               Weight defines the weight and should only be specified when Name references a TraefikService object
  272.                               (and to be precise, one that embeds a Weighted Round Robin).
  273.                             type: integer
  274.                         required:
  275.                         - name
  276.                         type: object
  277.                       type: array
  278.                     syntax:
  279.                       description: |-
  280.                         Syntax defines the router's rule syntax.
  281.                         More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#rulesyntax
  282.                       type: string
  283.                   required:
  284.                   - kind
  285.                   - match
  286.                   type: object
  287.                 type: array
  288.               tls:
  289.                 description: |-
  290.                   TLS defines the TLS configuration.
  291.                   More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#tls
  292.                 properties:
  293.                   certResolver:
  294.                     description: |-
  295.                       CertResolver defines the name of the certificate resolver to use.
  296.                       Cert resolvers have to be configured in the static configuration.
  297.                       More info: https://doc.traefik.io/traefik/v3.2/https/acme/#certificate-resolvers
  298.                     type: string
  299.                   domains:
  300.                     description: |-
  301.                       Domains defines the list of domains that will be used to issue certificates.
  302.                       More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#domains
  303.                     items:
  304.                       description: Domain holds a domain name with SANs.
  305.                       properties:
  306.                         main:
  307.                           description: Main defines the main domain name.
  308.                           type: string
  309.                         sans:
  310.                           description: SANs defines the subject alternative domain
  311.                             names.
  312.                           items:
  313.                             type: string
  314.                           type: array
  315.                       type: object
  316.                     type: array
  317.                   options:
  318.                     description: |-
  319.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  320.                       If not defined, the `default` TLSOption is used.
  321.                       More info: https://doc.traefik.io/traefik/v3.2/https/tls/#tls-options
  322.                     properties:
  323.                       name:
  324.                         description: |-
  325.                           Name defines the name of the referenced TLSOption.
  326.                           More info: https://doc.traefik.io/traefik/v3.2/routing/providers/kubernetes-crd/#kind-tlsoption
  327.                         type: string
  328.                       namespace:
  329.                         description: |-
  330.                           Namespace defines the namespace of the referenced TLSOption.
  331.                           More info: https://doc.traefik.io/traefik/v3.2/routing/providers/kubernetes-crd/#kind-tlsoption
  332.                         type: string
  333.                     required:
  334.                     - name
  335.                     type: object
  336.                   secretName:
  337.                     description: SecretName is the name of the referenced Kubernetes
  338.                       Secret to specify the certificate details.
  339.                     type: string
  340.                   store:
  341.                     description: |-
  342.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  343.                       Please note that only `default` TLSStore can be used.
  344.                     properties:
  345.                       name:
  346.                         description: |-
  347.                           Name defines the name of the referenced TLSStore.
  348.                           More info: https://doc.traefik.io/traefik/v3.2/routing/providers/kubernetes-crd/#kind-tlsstore
  349.                         type: string
  350.                       namespace:
  351.                         description: |-
  352.                           Namespace defines the namespace of the referenced TLSStore.
  353.                           More info: https://doc.traefik.io/traefik/v3.2/routing/providers/kubernetes-crd/#kind-tlsstore
  354.                         type: string
  355.                     required:
  356.                     - name
  357.                     type: object
  358.                 type: object
  359.             required:
  360.             - routes
  361.             type: object
  362.         required:
  363.         - metadata
  364.         - spec
  365.         type: object
  366.     served: true
  367.     storage: true
  368. ---
  369. apiVersion: apiextensions.k8s.io/v1
  370. kind: CustomResourceDefinition
  371. metadata:
  372.   annotations:
  373.     controller-gen.kubebuilder.io/version: v0.16.1
  374.   name: ingressroutetcps.traefik.io
  375. spec:
  376.   group: traefik.io
  377.   names:
  378.     kind: IngressRouteTCP
  379.     listKind: IngressRouteTCPList
  380.     plural: ingressroutetcps
  381.     singular: ingressroutetcp
  382.   scope: Namespaced
  383.   versions:
  384.   - name: v1alpha1
  385.     schema:
  386.       openAPIV3Schema:
  387.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  388.         properties:
  389.           apiVersion:
  390.             description: |-
  391.               APIVersion defines the versioned schema of this representation of an object.
  392.               Servers should convert recognized schemas to the latest internal value, and
  393.               may reject unrecognized values.
  394.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  395.             type: string
  396.           kind:
  397.             description: |-
  398.               Kind is a string value representing the REST resource this object represents.
  399.               Servers may infer this from the endpoint the client submits requests to.
  400.               Cannot be updated.
  401.               In CamelCase.
  402.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  403.             type: string
  404.           metadata:
  405.             type: object
  406.           spec:
  407.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  408.             properties:
  409.               entryPoints:
  410.                 description: |-
  411.                   EntryPoints defines the list of entry point names to bind to.
  412.                   Entry points have to be configured in the static configuration.
  413.                   More info: https://doc.traefik.io/traefik/v3.2/routing/entrypoints/
  414.                   Default: all.
  415.                 items:
  416.                   type: string
  417.                 type: array
  418.               routes:
  419.                 description: Routes defines the list of routes.
  420.                 items:
  421.                   description: RouteTCP holds the TCP route configuration.
  422.                   properties:
  423.                     match:
  424.                       description: |-
  425.                         Match defines the router's rule.
  426.                         More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#rule_1
  427.                       type: string
  428.                     middlewares:
  429.                       description: Middlewares defines the list of references to MiddlewareTCP
  430.                         resources.
  431.                       items:
  432.                         description: ObjectReference is a generic reference to a Traefik
  433.                           resource.
  434.                         properties:
  435.                           name:
  436.                             description: Name defines the name of the referenced Traefik
  437.                               resource.
  438.                             type: string
  439.                           namespace:
  440.                             description: Namespace defines the namespace of the referenced
  441.                               Traefik resource.
  442.                             type: string
  443.                         required:
  444.                         - name
  445.                         type: object
  446.                       type: array
  447.                     priority:
  448.                       description: |-
  449.                         Priority defines the router's priority.
  450.                         More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#priority_1
  451.                       type: integer
  452.                     services:
  453.                       description: Services defines the list of TCP services.
  454.                       items:
  455.                         description: ServiceTCP defines an upstream TCP service to
  456.                           proxy traffic to.
  457.                         properties:
  458.                           name:
  459.                             description: Name defines the name of the referenced Kubernetes
  460.                               Service.
  461.                             type: string
  462.                           namespace:
  463.                             description: Namespace defines the namespace of the referenced
  464.                               Kubernetes Service.
  465.                             type: string
  466.                           nativeLB:
  467.                             description: |-
  468.                               NativeLB controls, when creating the load-balancer,
  469.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  470.                               The Kubernetes Service itself does load-balance to the pods.
  471.                               By default, NativeLB is false.
  472.                             type: boolean
  473.                           nodePortLB:
  474.                             description: |-
  475.                               NodePortLB controls, when creating the load-balancer,
  476.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  477.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  478.                               By default, NodePortLB is false.
  479.                             type: boolean
  480.                           port:
  481.                             anyOf:
  482.                             - type: integer
  483.                             - type: string
  484.                             description: |-
  485.                               Port defines the port of a Kubernetes Service.
  486.                               This can be a reference to a named port.
  487.                             x-kubernetes-int-or-string: true
  488.                           proxyProtocol:
  489.                             description: |-
  490.                               ProxyProtocol defines the PROXY protocol configuration.
  491.                               More info: https://doc.traefik.io/traefik/v3.2/routing/services/#proxy-protocol
  492.                             properties:
  493.                               version:
  494.                                 description: Version defines the PROXY Protocol version
  495.                                   to use.
  496.                                 type: integer
  497.                             type: object
  498.                           serversTransport:
  499.                             description: |-
  500.                               ServersTransport defines the name of ServersTransportTCP resource to use.
  501.                               It allows to configure the transport between Traefik and your servers.
  502.                               Can only be used on a Kubernetes Service.
  503.                             type: string
  504.                           terminationDelay:
  505.                             description: |-
  506.                               TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates
  507.                               it has closed the writing capability of its connection, to close the reading capability as well,
  508.                               hence fully terminating the connection.
  509.                               It is a duration in milliseconds, defaulting to 100.
  510.                               A negative value means an infinite deadline (i.e. the reading capability is never closed).
  511.                               Deprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead.
  512.                             type: integer
  513.                           tls:
  514.                             description: TLS determines whether to use TLS when dialing
  515.                               with the backend.
  516.                             type: boolean
  517.                           weight:
  518.                             description: Weight defines the weight used when balancing
  519.                               requests between multiple Kubernetes Service.
  520.                             type: integer
  521.                         required:
  522.                         - name
  523.                         - port
  524.                         type: object
  525.                       type: array
  526.                     syntax:
  527.                       description: |-
  528.                         Syntax defines the router's rule syntax.
  529.                         More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#rulesyntax_1
  530.                       type: string
  531.                   required:
  532.                   - match
  533.                   type: object
  534.                 type: array
  535.               tls:
  536.                 description: |-
  537.                   TLS defines the TLS configuration on a layer 4 / TCP Route.
  538.                   More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#tls_1
  539.                 properties:
  540.                   certResolver:
  541.                     description: |-
  542.                       CertResolver defines the name of the certificate resolver to use.
  543.                       Cert resolvers have to be configured in the static configuration.
  544.                       More info: https://doc.traefik.io/traefik/v3.2/https/acme/#certificate-resolvers
  545.                     type: string
  546.                   domains:
  547.                     description: |-
  548.                       Domains defines the list of domains that will be used to issue certificates.
  549.                       More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#domains
  550.                     items:
  551.                       description: Domain holds a domain name with SANs.
  552.                       properties:
  553.                         main:
  554.                           description: Main defines the main domain name.
  555.                           type: string
  556.                         sans:
  557.                           description: SANs defines the subject alternative domain
  558.                             names.
  559.                           items:
  560.                             type: string
  561.                           type: array
  562.                       type: object
  563.                     type: array
  564.                   options:
  565.                     description: |-
  566.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  567.                       If not defined, the `default` TLSOption is used.
  568.                       More info: https://doc.traefik.io/traefik/v3.2/https/tls/#tls-options
  569.                     properties:
  570.                       name:
  571.                         description: Name defines the name of the referenced Traefik
  572.                           resource.
  573.                         type: string
  574.                       namespace:
  575.                         description: Namespace defines the namespace of the referenced
  576.                           Traefik resource.
  577.                         type: string
  578.                     required:
  579.                     - name
  580.                     type: object
  581.                   passthrough:
  582.                     description: Passthrough defines whether a TLS router will terminate
  583.                       the TLS connection.
  584.                     type: boolean
  585.                   secretName:
  586.                     description: SecretName is the name of the referenced Kubernetes
  587.                       Secret to specify the certificate details.
  588.                     type: string
  589.                   store:
  590.                     description: |-
  591.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  592.                       Please note that only `default` TLSStore can be used.
  593.                     properties:
  594.                       name:
  595.                         description: Name defines the name of the referenced Traefik
  596.                           resource.
  597.                         type: string
  598.                       namespace:
  599.                         description: Namespace defines the namespace of the referenced
  600.                           Traefik resource.
  601.                         type: string
  602.                     required:
  603.                     - name
  604.                     type: object
  605.                 type: object
  606.             required:
  607.             - routes
  608.             type: object
  609.         required:
  610.         - metadata
  611.         - spec
  612.         type: object
  613.     served: true
  614.     storage: true
  615. ---
  616. apiVersion: apiextensions.k8s.io/v1
  617. kind: CustomResourceDefinition
  618. metadata:
  619.   annotations:
  620.     controller-gen.kubebuilder.io/version: v0.16.1
  621.   name: ingressrouteudps.traefik.io
  622. spec:
  623.   group: traefik.io
  624.   names:
  625.     kind: IngressRouteUDP
  626.     listKind: IngressRouteUDPList
  627.     plural: ingressrouteudps
  628.     singular: ingressrouteudp
  629.   scope: Namespaced
  630.   versions:
  631.   - name: v1alpha1
  632.     schema:
  633.       openAPIV3Schema:
  634.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  635.         properties:
  636.           apiVersion:
  637.             description: |-
  638.               APIVersion defines the versioned schema of this representation of an object.
  639.               Servers should convert recognized schemas to the latest internal value, and
  640.               may reject unrecognized values.
  641.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  642.             type: string
  643.           kind:
  644.             description: |-
  645.               Kind is a string value representing the REST resource this object represents.
  646.               Servers may infer this from the endpoint the client submits requests to.
  647.               Cannot be updated.
  648.               In CamelCase.
  649.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  650.             type: string
  651.           metadata:
  652.             type: object
  653.           spec:
  654.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  655.             properties:
  656.               entryPoints:
  657.                 description: |-
  658.                   EntryPoints defines the list of entry point names to bind to.
  659.                   Entry points have to be configured in the static configuration.
  660.                   More info: https://doc.traefik.io/traefik/v3.2/routing/entrypoints/
  661.                   Default: all.
  662.                 items:
  663.                   type: string
  664.                 type: array
  665.               routes:
  666.                 description: Routes defines the list of routes.
  667.                 items:
  668.                   description: RouteUDP holds the UDP route configuration.
  669.                   properties:
  670.                     services:
  671.                       description: Services defines the list of UDP services.
  672.                       items:
  673.                         description: ServiceUDP defines an upstream UDP service to
  674.                           proxy traffic to.
  675.                         properties:
  676.                           name:
  677.                             description: Name defines the name of the referenced Kubernetes
  678.                               Service.
  679.                             type: string
  680.                           namespace:
  681.                             description: Namespace defines the namespace of the referenced
  682.                               Kubernetes Service.
  683.                             type: string
  684.                           nativeLB:
  685.                             description: |-
  686.                               NativeLB controls, when creating the load-balancer,
  687.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  688.                               The Kubernetes Service itself does load-balance to the pods.
  689.                               By default, NativeLB is false.
  690.                             type: boolean
  691.                           nodePortLB:
  692.                             description: |-
  693.                               NodePortLB controls, when creating the load-balancer,
  694.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  695.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  696.                               By default, NodePortLB is false.
  697.                             type: boolean
  698.                           port:
  699.                             anyOf:
  700.                             - type: integer
  701.                             - type: string
  702.                             description: |-
  703.                               Port defines the port of a Kubernetes Service.
  704.                               This can be a reference to a named port.
  705.                             x-kubernetes-int-or-string: true
  706.                           weight:
  707.                             description: Weight defines the weight used when balancing
  708.                               requests between multiple Kubernetes Service.
  709.                             type: integer
  710.                         required:
  711.                         - name
  712.                         - port
  713.                         type: object
  714.                       type: array
  715.                   type: object
  716.                 type: array
  717.             required:
  718.             - routes
  719.             type: object
  720.         required:
  721.         - metadata
  722.         - spec
  723.         type: object
  724.     served: true
  725.     storage: true
  726. ---
  727. apiVersion: apiextensions.k8s.io/v1
  728. kind: CustomResourceDefinition
  729. metadata:
  730.   annotations:
  731.     controller-gen.kubebuilder.io/version: v0.16.1
  732.   name: middlewares.traefik.io
  733. spec:
  734.   group: traefik.io
  735.   names:
  736.     kind: Middleware
  737.     listKind: MiddlewareList
  738.     plural: middlewares
  739.     singular: middleware
  740.   scope: Namespaced
  741.   versions:
  742.   - name: v1alpha1
  743.     schema:
  744.       openAPIV3Schema:
  745.         description: |-
  746.           Middleware is the CRD implementation of a Traefik Middleware.
  747.           More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/overview/
  748.         properties:
  749.           apiVersion:
  750.             description: |-
  751.               APIVersion defines the versioned schema of this representation of an object.
  752.               Servers should convert recognized schemas to the latest internal value, and
  753.               may reject unrecognized values.
  754.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  755.             type: string
  756.           kind:
  757.             description: |-
  758.               Kind is a string value representing the REST resource this object represents.
  759.               Servers may infer this from the endpoint the client submits requests to.
  760.               Cannot be updated.
  761.               In CamelCase.
  762.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  763.             type: string
  764.           metadata:
  765.             type: object
  766.           spec:
  767.             description: MiddlewareSpec defines the desired state of a Middleware.
  768.             properties:
  769.               addPrefix:
  770.                 description: |-
  771.                   AddPrefix holds the add prefix middleware configuration.
  772.                   This middleware updates the path of a request before forwarding it.
  773.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/addprefix/
  774.                 properties:
  775.                   prefix:
  776.                     description: |-
  777.                       Prefix is the string to add before the current path in the requested URL.
  778.                       It should include a leading slash (/).
  779.                     type: string
  780.                 type: object
  781.               basicAuth:
  782.                 description: |-
  783.                   BasicAuth holds the basic auth middleware configuration.
  784.                   This middleware restricts access to your services to known users.
  785.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/basicauth/
  786.                 properties:
  787.                   headerField:
  788.                     description: |-
  789.                       HeaderField defines a header field to store the authenticated user.
  790.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/basicauth/#headerfield
  791.                     type: string
  792.                   realm:
  793.                     description: |-
  794.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  795.                       Default: traefik.
  796.                     type: string
  797.                   removeHeader:
  798.                     description: |-
  799.                       RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service.
  800.                       Default: false.
  801.                     type: boolean
  802.                   secret:
  803.                     description: Secret is the name of the referenced Kubernetes Secret
  804.                       containing user credentials.
  805.                     type: string
  806.                 type: object
  807.               buffering:
  808.                 description: |-
  809.                   Buffering holds the buffering middleware configuration.
  810.                   This middleware retries or limits the size of requests that can be forwarded to backends.
  811.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/buffering/#maxrequestbodybytes
  812.                 properties:
  813.                   maxRequestBodyBytes:
  814.                     description: |-
  815.                       MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).
  816.                       If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.
  817.                       Default: 0 (no maximum).
  818.                     format: int64
  819.                     type: integer
  820.                   maxResponseBodyBytes:
  821.                     description: |-
  822.                       MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes).
  823.                       If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead.
  824.                       Default: 0 (no maximum).
  825.                     format: int64
  826.                     type: integer
  827.                   memRequestBodyBytes:
  828.                     description: |-
  829.                       MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory.
  830.                       Default: 1048576 (1Mi).
  831.                     format: int64
  832.                     type: integer
  833.                   memResponseBodyBytes:
  834.                     description: |-
  835.                       MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory.
  836.                       Default: 1048576 (1Mi).
  837.                     format: int64
  838.                     type: integer
  839.                   retryExpression:
  840.                     description: |-
  841.                       RetryExpression defines the retry conditions.
  842.                       It is a logical combination of functions with operators AND (&&) and OR (||).
  843.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/buffering/#retryexpression
  844.                     type: string
  845.                 type: object
  846.               chain:
  847.                 description: |-
  848.                   Chain holds the configuration of the chain middleware.
  849.                   This middleware enables to define reusable combinations of other pieces of middleware.
  850.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/chain/
  851.                 properties:
  852.                   middlewares:
  853.                     description: Middlewares is the list of MiddlewareRef which composes
  854.                       the chain.
  855.                     items:
  856.                       description: MiddlewareRef is a reference to a Middleware resource.
  857.                       properties:
  858.                         name:
  859.                           description: Name defines the name of the referenced Middleware
  860.                             resource.
  861.                           type: string
  862.                         namespace:
  863.                           description: Namespace defines the namespace of the referenced
  864.                             Middleware resource.
  865.                           type: string
  866.                       required:
  867.                       - name
  868.                       type: object
  869.                     type: array
  870.                 type: object
  871.               circuitBreaker:
  872.                 description: CircuitBreaker holds the circuit breaker configuration.
  873.                 properties:
  874.                   checkPeriod:
  875.                     anyOf:
  876.                     - type: integer
  877.                     - type: string
  878.                     description: CheckPeriod is the interval between successive checks
  879.                       of the circuit breaker condition (when in standby state).
  880.                     x-kubernetes-int-or-string: true
  881.                   expression:
  882.                     description: Expression is the condition that triggers the tripped
  883.                       state.
  884.                     type: string
  885.                   fallbackDuration:
  886.                     anyOf:
  887.                     - type: integer
  888.                     - type: string
  889.                     description: FallbackDuration is the duration for which the circuit
  890.                       breaker will wait before trying to recover (from a tripped state).
  891.                     x-kubernetes-int-or-string: true
  892.                   recoveryDuration:
  893.                     anyOf:
  894.                     - type: integer
  895.                     - type: string
  896.                     description: RecoveryDuration is the duration for which the circuit
  897.                       breaker will try to recover (as soon as it is in recovering
  898.                       state).
  899.                     x-kubernetes-int-or-string: true
  900.                   responseCode:
  901.                     description: ResponseCode is the status code that the circuit
  902.                       breaker will return while it is in the open state.
  903.                     type: integer
  904.                 type: object
  905.               compress:
  906.                 description: |-
  907.                   Compress holds the compress middleware configuration.
  908.                   This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.
  909.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/compress/
  910.                 properties:
  911.                   defaultEncoding:
  912.                     description: DefaultEncoding specifies the default encoding if
  913.                       the `Accept-Encoding` header is not in the request or contains
  914.                       a wildcard (`*`).
  915.                     type: string
  916.                   encodings:
  917.                     description: Encodings defines the list of supported compression
  918.                       algorithms.
  919.                     items:
  920.                       type: string
  921.                     type: array
  922.                   excludedContentTypes:
  923.                     description: |-
  924.                       ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing.
  925.                       `application/grpc` is always excluded.
  926.                     items:
  927.                       type: string
  928.                     type: array
  929.                   includedContentTypes:
  930.                     description: IncludedContentTypes defines the list of content
  931.                       types to compare the Content-Type header of the responses before
  932.                       compressing.
  933.                     items:
  934.                       type: string
  935.                     type: array
  936.                   minResponseBodyBytes:
  937.                     description: |-
  938.                       MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed.
  939.                       Default: 1024.
  940.                     type: integer
  941.                 type: object
  942.               contentType:
  943.                 description: |-
  944.                   ContentType holds the content-type middleware configuration.
  945.                   This middleware exists to enable the correct behavior until at least the default one can be changed in a future version.
  946.                 properties:
  947.                   autoDetect:
  948.                     description: |-
  949.                       AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend,
  950.                       be automatically set to a value derived from the contents of the response.
  951.                       Deprecated: AutoDetect option is deprecated, Content-Type middleware is only meant to be used to enable the content-type detection, please remove any usage of this option.
  952.                     type: boolean
  953.                 type: object
  954.               digestAuth:
  955.                 description: |-
  956.                   DigestAuth holds the digest auth middleware configuration.
  957.                   This middleware restricts access to your services to known users.
  958.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/digestauth/
  959.                 properties:
  960.                   headerField:
  961.                     description: |-
  962.                       HeaderField defines a header field to store the authenticated user.
  963.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/basicauth/#headerfield
  964.                     type: string
  965.                   realm:
  966.                     description: |-
  967.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  968.                       Default: traefik.
  969.                     type: string
  970.                   removeHeader:
  971.                     description: RemoveHeader defines whether to remove the authorization
  972.                       header before forwarding the request to the backend.
  973.                     type: boolean
  974.                   secret:
  975.                     description: Secret is the name of the referenced Kubernetes Secret
  976.                       containing user credentials.
  977.                     type: string
  978.                 type: object
  979.               errors:
  980.                 description: |-
  981.                   ErrorPage holds the custom error middleware configuration.
  982.                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
  983.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/errorpages/
  984.                 properties:
  985.                   query:
  986.                     description: |-
  987.                       Query defines the URL for the error page (hosted by service).
  988.                       The {status} variable can be used in order to insert the status code in the URL.
  989.                     type: string
  990.                   service:
  991.                     description: |-
  992.                       Service defines the reference to a Kubernetes Service that will serve the error page.
  993.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/errorpages/#service
  994.                     properties:
  995.                       healthCheck:
  996.                         description: Healthcheck defines health checks for ExternalName
  997.                           services.
  998.                         properties:
  999.                           followRedirects:
  1000.                             description: |-
  1001.                               FollowRedirects defines whether redirects should be followed during the health check calls.
  1002.                               Default: true
  1003.                             type: boolean
  1004.                           headers:
  1005.                             additionalProperties:
  1006.                               type: string
  1007.                             description: Headers defines custom headers to be sent
  1008.                               to the health check endpoint.
  1009.                             type: object
  1010.                           hostname:
  1011.                             description: Hostname defines the value of hostname in
  1012.                               the Host header of the health check request.
  1013.                             type: string
  1014.                           interval:
  1015.                             anyOf:
  1016.                             - type: integer
  1017.                             - type: string
  1018.                             description: |-
  1019.                               Interval defines the frequency of the health check calls.
  1020.                               Default: 30s
  1021.                             x-kubernetes-int-or-string: true
  1022.                           method:
  1023.                             description: Method defines the healthcheck method.
  1024.                             type: string
  1025.                           mode:
  1026.                             description: |-
  1027.                               Mode defines the health check mode.
  1028.                               If defined to grpc, will use the gRPC health check protocol to probe the server.
  1029.                               Default: http
  1030.                             type: string
  1031.                           path:
  1032.                             description: Path defines the server URL path for the
  1033.                               health check endpoint.
  1034.                             type: string
  1035.                           port:
  1036.                             description: Port defines the server URL port for the
  1037.                               health check endpoint.
  1038.                             type: integer
  1039.                           scheme:
  1040.                             description: Scheme replaces the server URL scheme for
  1041.                               the health check endpoint.
  1042.                             type: string
  1043.                           status:
  1044.                             description: Status defines the expected HTTP status code
  1045.                               of the response to the health check request.
  1046.                             type: integer
  1047.                           timeout:
  1048.                             anyOf:
  1049.                             - type: integer
  1050.                             - type: string
  1051.                             description: |-
  1052.                               Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  1053.                               Default: 5s
  1054.                             x-kubernetes-int-or-string: true
  1055.                         type: object
  1056.                       kind:
  1057.                         description: Kind defines the kind of the Service.
  1058.                         enum:
  1059.                         - Service
  1060.                         - TraefikService
  1061.                         type: string
  1062.                       name:
  1063.                         description: |-
  1064.                           Name defines the name of the referenced Kubernetes Service or TraefikService.
  1065.                           The differentiation between the two is specified in the Kind field.
  1066.                         type: string
  1067.                       namespace:
  1068.                         description: Namespace defines the namespace of the referenced
  1069.                           Kubernetes Service or TraefikService.
  1070.                         type: string
  1071.                       nativeLB:
  1072.                         description: |-
  1073.                           NativeLB controls, when creating the load-balancer,
  1074.                           whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  1075.                           The Kubernetes Service itself does load-balance to the pods.
  1076.                           By default, NativeLB is false.
  1077.                         type: boolean
  1078.                       nodePortLB:
  1079.                         description: |-
  1080.                           NodePortLB controls, when creating the load-balancer,
  1081.                           whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  1082.                           It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  1083.                           By default, NodePortLB is false.
  1084.                         type: boolean
  1085.                       passHostHeader:
  1086.                         description: |-
  1087.                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  1088.                           By default, passHostHeader is true.
  1089.                         type: boolean
  1090.                       port:
  1091.                         anyOf:
  1092.                         - type: integer
  1093.                         - type: string
  1094.                         description: |-
  1095.                           Port defines the port of a Kubernetes Service.
  1096.                           This can be a reference to a named port.
  1097.                         x-kubernetes-int-or-string: true
  1098.                       responseForwarding:
  1099.                         description: ResponseForwarding defines how Traefik forwards
  1100.                           the response from the upstream Kubernetes Service to the
  1101.                           client.
  1102.                         properties:
  1103.                           flushInterval:
  1104.                             description: |-
  1105.                               FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  1106.                               A negative value means to flush immediately after each write to the client.
  1107.                               This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  1108.                               for such responses, writes are flushed to the client immediately.
  1109.                               Default: 100ms
  1110.                             type: string
  1111.                         type: object
  1112.                       scheme:
  1113.                         description: |-
  1114.                           Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  1115.                           It defaults to https when Kubernetes Service port is 443, http otherwise.
  1116.                         type: string
  1117.                       serversTransport:
  1118.                         description: |-
  1119.                           ServersTransport defines the name of ServersTransport resource to use.
  1120.                           It allows to configure the transport between Traefik and your servers.
  1121.                           Can only be used on a Kubernetes Service.
  1122.                         type: string
  1123.                       sticky:
  1124.                         description: |-
  1125.                           Sticky defines the sticky sessions configuration.
  1126.                           More info: https://doc.traefik.io/traefik/v3.2/routing/services/#sticky-sessions
  1127.                         properties:
  1128.                           cookie:
  1129.                             description: Cookie defines the sticky cookie configuration.
  1130.                             properties:
  1131.                               httpOnly:
  1132.                                 description: HTTPOnly defines whether the cookie can
  1133.                                   be accessed by client-side APIs, such as JavaScript.
  1134.                                 type: boolean
  1135.                               maxAge:
  1136.                                 description: |-
  1137.                                   MaxAge indicates the number of seconds until the cookie expires.
  1138.                                   When set to a negative number, the cookie expires immediately.
  1139.                                   When set to zero, the cookie never expires.
  1140.                                 type: integer
  1141.                               name:
  1142.                                 description: Name defines the Cookie name.
  1143.                                 type: string
  1144.                               sameSite:
  1145.                                 description: |-
  1146.                                   SameSite defines the same site policy.
  1147.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  1148.                                 type: string
  1149.                               secure:
  1150.                                 description: Secure defines whether the cookie can
  1151.                                   only be transmitted over an encrypted connection
  1152.                                   (i.e. HTTPS).
  1153.                                 type: boolean
  1154.                             type: object
  1155.                         type: object
  1156.                       strategy:
  1157.                         description: |-
  1158.                           Strategy defines the load balancing strategy between the servers.
  1159.                           RoundRobin is the only supported value at the moment.
  1160.                         type: string
  1161.                       weight:
  1162.                         description: |-
  1163.                           Weight defines the weight and should only be specified when Name references a TraefikService object
  1164.                           (and to be precise, one that embeds a Weighted Round Robin).
  1165.                         type: integer
  1166.                     required:
  1167.                     - name
  1168.                     type: object
  1169.                   status:
  1170.                     description: |-
  1171.                       Status defines which status or range of statuses should result in an error page.
  1172.                       It can be either a status code as a number (500),
  1173.                       as multiple comma-separated numbers (500,502),
  1174.                       as ranges by separating two codes with a dash (500-599),
  1175.                       or a combination of the two (404,418,500-599).
  1176.                     items:
  1177.                       type: string
  1178.                     type: array
  1179.                 type: object
  1180.               forwardAuth:
  1181.                 description: |-
  1182.                   ForwardAuth holds the forward auth middleware configuration.
  1183.                   This middleware delegates the request authentication to a Service.
  1184.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/forwardauth/
  1185.                 properties:
  1186.                   addAuthCookiesToResponse:
  1187.                     description: AddAuthCookiesToResponse defines the list of cookies
  1188.                       to copy from the authentication server response to the response.
  1189.                     items:
  1190.                       type: string
  1191.                     type: array
  1192.                   address:
  1193.                     description: Address defines the authentication server address.
  1194.                     type: string
  1195.                   authRequestHeaders:
  1196.                     description: |-
  1197.                       AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
  1198.                       If not set or empty then all request headers are passed.
  1199.                     items:
  1200.                       type: string
  1201.                     type: array
  1202.                   authResponseHeaders:
  1203.                     description: AuthResponseHeaders defines the list of headers to
  1204.                       copy from the authentication server response and set on forwarded
  1205.                       request, replacing any existing conflicting headers.
  1206.                     items:
  1207.                       type: string
  1208.                     type: array
  1209.                   authResponseHeadersRegex:
  1210.                     description: |-
  1211.                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
  1212.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/forwardauth/#authresponseheadersregex
  1213.                     type: string
  1214.                   tls:
  1215.                     description: TLS defines the configuration used to secure the
  1216.                       connection to the authentication server.
  1217.                     properties:
  1218.                       caOptional:
  1219.                         description: 'Deprecated: TLS client authentication is a server
  1220.                           side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634).'
  1221.                         type: boolean
  1222.                       caSecret:
  1223.                         description: |-
  1224.                           CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate.
  1225.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  1226.                         type: string
  1227.                       certSecret:
  1228.                         description: |-
  1229.                           CertSecret is the name of the referenced Kubernetes Secret containing the client certificate.
  1230.                           The client certificate is extracted from the keys `tls.crt` and `tls.key`.
  1231.                         type: string
  1232.                       insecureSkipVerify:
  1233.                         description: InsecureSkipVerify defines whether the server
  1234.                           certificates should be validated.
  1235.                         type: boolean
  1236.                     type: object
  1237.                   trustForwardHeader:
  1238.                     description: 'TrustForwardHeader defines whether to trust (ie:
  1239.                       forward) all X-Forwarded-* headers.'
  1240.                     type: boolean
  1241.                 type: object
  1242.               grpcWeb:
  1243.                 description: |-
  1244.                   GrpcWeb holds the gRPC web middleware configuration.
  1245.                   This middleware converts a gRPC web request to an HTTP/2 gRPC request.
  1246.                 properties:
  1247.                   allowOrigins:
  1248.                     description: |-
  1249.                       AllowOrigins is a list of allowable origins.
  1250.                       Can also be a wildcard origin "*".
  1251.                     items:
  1252.                       type: string
  1253.                     type: array
  1254.                 type: object
  1255.               headers:
  1256.                 description: |-
  1257.                   Headers holds the headers middleware configuration.
  1258.                   This middleware manages the requests and responses headers.
  1259.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/headers/#customrequestheaders
  1260.                 properties:
  1261.                   accessControlAllowCredentials:
  1262.                     description: AccessControlAllowCredentials defines whether the
  1263.                       request can include user credentials.
  1264.                     type: boolean
  1265.                   accessControlAllowHeaders:
  1266.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  1267.                       values sent in preflight response.
  1268.                     items:
  1269.                       type: string
  1270.                     type: array
  1271.                   accessControlAllowMethods:
  1272.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  1273.                       values sent in preflight response.
  1274.                     items:
  1275.                       type: string
  1276.                     type: array
  1277.                   accessControlAllowOriginList:
  1278.                     description: AccessControlAllowOriginList is a list of allowable
  1279.                       origins. Can also be a wildcard origin "*".
  1280.                     items:
  1281.                       type: string
  1282.                     type: array
  1283.                   accessControlAllowOriginListRegex:
  1284.                     description: AccessControlAllowOriginListRegex is a list of allowable
  1285.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  1286.                     items:
  1287.                       type: string
  1288.                     type: array
  1289.                   accessControlExposeHeaders:
  1290.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  1291.                       values sent in preflight response.
  1292.                     items:
  1293.                       type: string
  1294.                     type: array
  1295.                   accessControlMaxAge:
  1296.                     description: AccessControlMaxAge defines the time that a preflight
  1297.                       request may be cached.
  1298.                     format: int64
  1299.                     type: integer
  1300.                   addVaryHeader:
  1301.                     description: AddVaryHeader defines whether the Vary header is
  1302.                       automatically added/updated when the AccessControlAllowOriginList
  1303.                       is set.
  1304.                     type: boolean
  1305.                   allowedHosts:
  1306.                     description: AllowedHosts defines the fully qualified list of
  1307.                       allowed domain names.
  1308.                     items:
  1309.                       type: string
  1310.                     type: array
  1311.                   browserXssFilter:
  1312.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  1313.                       header with the value 1; mode=block.
  1314.                     type: boolean
  1315.                   contentSecurityPolicy:
  1316.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  1317.                       header value.
  1318.                     type: string
  1319.                   contentSecurityPolicyReportOnly:
  1320.                     description: ContentSecurityPolicyReportOnly defines the Content-Security-Policy-Report-Only
  1321.                       header value.
  1322.                     type: string
  1323.                   contentTypeNosniff:
  1324.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  1325.                       header with the nosniff value.
  1326.                     type: boolean
  1327.                   customBrowserXSSValue:
  1328.                     description: |-
  1329.                       CustomBrowserXSSValue defines the X-XSS-Protection header value.
  1330.                       This overrides the BrowserXssFilter option.
  1331.                     type: string
  1332.                   customFrameOptionsValue:
  1333.                     description: |-
  1334.                       CustomFrameOptionsValue defines the X-Frame-Options header value.
  1335.                       This overrides the FrameDeny option.
  1336.                     type: string
  1337.                   customRequestHeaders:
  1338.                     additionalProperties:
  1339.                       type: string
  1340.                     description: CustomRequestHeaders defines the header names and
  1341.                       values to apply to the request.
  1342.                     type: object
  1343.                   customResponseHeaders:
  1344.                     additionalProperties:
  1345.                       type: string
  1346.                     description: CustomResponseHeaders defines the header names and
  1347.                       values to apply to the response.
  1348.                     type: object
  1349.                   featurePolicy:
  1350.                     description: 'Deprecated: FeaturePolicy option is deprecated,
  1351.                       please use PermissionsPolicy instead.'
  1352.                     type: string
  1353.                   forceSTSHeader:
  1354.                     description: ForceSTSHeader defines whether to add the STS header
  1355.                       even when the connection is HTTP.
  1356.                     type: boolean
  1357.                   frameDeny:
  1358.                     description: FrameDeny defines whether to add the X-Frame-Options
  1359.                       header with the DENY value.
  1360.                     type: boolean
  1361.                   hostsProxyHeaders:
  1362.                     description: HostsProxyHeaders defines the header keys that may
  1363.                       hold a proxied hostname value for the request.
  1364.                     items:
  1365.                       type: string
  1366.                     type: array
  1367.                   isDevelopment:
  1368.                     description: |-
  1369.                       IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing.
  1370.                       Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain.
  1371.                       If you would like your development environment to mimic production with complete Host blocking, SSL redirects,
  1372.                       and STS headers, leave this as false.
  1373.                     type: boolean
  1374.                   permissionsPolicy:
  1375.                     description: |-
  1376.                       PermissionsPolicy defines the Permissions-Policy header value.
  1377.                       This allows sites to control browser features.
  1378.                     type: string
  1379.                   publicKey:
  1380.                     description: PublicKey is the public key that implements HPKP
  1381.                       to prevent MITM attacks with forged certificates.
  1382.                     type: string
  1383.                   referrerPolicy:
  1384.                     description: |-
  1385.                       ReferrerPolicy defines the Referrer-Policy header value.
  1386.                       This allows sites to control whether browsers forward the Referer header to other sites.
  1387.                     type: string
  1388.                   sslForceHost:
  1389.                     description: 'Deprecated: SSLForceHost option is deprecated, please
  1390.                       use RedirectRegex instead.'
  1391.                     type: boolean
  1392.                   sslHost:
  1393.                     description: 'Deprecated: SSLHost option is deprecated, please
  1394.                       use RedirectRegex instead.'
  1395.                     type: string
  1396.                   sslProxyHeaders:
  1397.                     additionalProperties:
  1398.                       type: string
  1399.                     description: |-
  1400.                       SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request.
  1401.                       It can be useful when using other proxies (example: "X-Forwarded-Proto": "https").
  1402.                     type: object
  1403.                   sslRedirect:
  1404.                     description: 'Deprecated: SSLRedirect option is deprecated, please
  1405.                       use EntryPoint redirection or RedirectScheme instead.'
  1406.                     type: boolean
  1407.                   sslTemporaryRedirect:
  1408.                     description: 'Deprecated: SSLTemporaryRedirect option is deprecated,
  1409.                       please use EntryPoint redirection or RedirectScheme instead.'
  1410.                     type: boolean
  1411.                   stsIncludeSubdomains:
  1412.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  1413.                       directive is appended to the Strict-Transport-Security header.
  1414.                     type: boolean
  1415.                   stsPreload:
  1416.                     description: STSPreload defines whether the preload flag is appended
  1417.                       to the Strict-Transport-Security header.
  1418.                     type: boolean
  1419.                   stsSeconds:
  1420.                     description: |-
  1421.                       STSSeconds defines the max-age of the Strict-Transport-Security header.
  1422.                       If set to 0, the header is not set.
  1423.                     format: int64
  1424.                     type: integer
  1425.                 type: object
  1426.               inFlightReq:
  1427.                 description: |-
  1428.                   InFlightReq holds the in-flight request middleware configuration.
  1429.                   This middleware limits the number of requests being processed and served concurrently.
  1430.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/inflightreq/
  1431.                 properties:
  1432.                   amount:
  1433.                     description: |-
  1434.                       Amount defines the maximum amount of allowed simultaneous in-flight request.
  1435.                       The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).
  1436.                     format: int64
  1437.                     type: integer
  1438.                   sourceCriterion:
  1439.                     description: |-
  1440.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1441.                       If several strategies are defined at the same time, an error will be raised.
  1442.                       If none are set, the default is to use the requestHost.
  1443.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/inflightreq/#sourcecriterion
  1444.                     properties:
  1445.                       ipStrategy:
  1446.                         description: |-
  1447.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1448.                           More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/ipallowlist/#ipstrategy
  1449.                         properties:
  1450.                           depth:
  1451.                             description: Depth tells Traefik to use the X-Forwarded-For
  1452.                               header and take the IP located at the depth position
  1453.                               (starting from the right).
  1454.                             type: integer
  1455.                           excludedIPs:
  1456.                             description: ExcludedIPs configures Traefik to scan the
  1457.                               X-Forwarded-For header and select the first IP not in
  1458.                               the list.
  1459.                             items:
  1460.                               type: string
  1461.                             type: array
  1462.                           ipv6Subnet:
  1463.                             description: IPv6Subnet configures Traefik to consider
  1464.                               all IPv6 addresses from the defined subnet as originating
  1465.                               from the same IP. Applies to RemoteAddrStrategy and
  1466.                               DepthStrategy.
  1467.                             type: integer
  1468.                         type: object
  1469.                       requestHeaderName:
  1470.                         description: RequestHeaderName defines the name of the header
  1471.                           used to group incoming requests.
  1472.                         type: string
  1473.                       requestHost:
  1474.                         description: RequestHost defines whether to consider the request
  1475.                           Host as the source.
  1476.                         type: boolean
  1477.                     type: object
  1478.                 type: object
  1479.               ipAllowList:
  1480.                 description: |-
  1481.                   IPAllowList holds the IP allowlist middleware configuration.
  1482.                   This middleware limits allowed requests based on the client IP.
  1483.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/ipallowlist/
  1484.                 properties:
  1485.                   ipStrategy:
  1486.                     description: |-
  1487.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1488.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/ipallowlist/#ipstrategy
  1489.                     properties:
  1490.                       depth:
  1491.                         description: Depth tells Traefik to use the X-Forwarded-For
  1492.                           header and take the IP located at the depth position (starting
  1493.                           from the right).
  1494.                         type: integer
  1495.                       excludedIPs:
  1496.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1497.                           header and select the first IP not in the list.
  1498.                         items:
  1499.                           type: string
  1500.                         type: array
  1501.                       ipv6Subnet:
  1502.                         description: IPv6Subnet configures Traefik to consider all
  1503.                           IPv6 addresses from the defined subnet as originating from
  1504.                           the same IP. Applies to RemoteAddrStrategy and DepthStrategy.
  1505.                         type: integer
  1506.                     type: object
  1507.                   rejectStatusCode:
  1508.                     description: |-
  1509.                       RejectStatusCode defines the HTTP status code used for refused requests.
  1510.                       If not set, the default is 403 (Forbidden).
  1511.                     type: integer
  1512.                   sourceRange:
  1513.                     description: SourceRange defines the set of allowed IPs (or ranges
  1514.                       of allowed IPs by using CIDR notation).
  1515.                     items:
  1516.                       type: string
  1517.                     type: array
  1518.                 type: object
  1519.               ipWhiteList:
  1520.                 description: 'Deprecated: please use IPAllowList instead.'
  1521.                 properties:
  1522.                   ipStrategy:
  1523.                     description: |-
  1524.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1525.                       More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/ipallowlist/#ipstrategy
  1526.                     properties:
  1527.                       depth:
  1528.                         description: Depth tells Traefik to use the X-Forwarded-For
  1529.                           header and take the IP located at the depth position (starting
  1530.                           from the right).
  1531.                         type: integer
  1532.                       excludedIPs:
  1533.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1534.                           header and select the first IP not in the list.
  1535.                         items:
  1536.                           type: string
  1537.                         type: array
  1538.                       ipv6Subnet:
  1539.                         description: IPv6Subnet configures Traefik to consider all
  1540.                           IPv6 addresses from the defined subnet as originating from
  1541.                           the same IP. Applies to RemoteAddrStrategy and DepthStrategy.
  1542.                         type: integer
  1543.                     type: object
  1544.                   sourceRange:
  1545.                     description: SourceRange defines the set of allowed IPs (or ranges
  1546.                       of allowed IPs by using CIDR notation). Required.
  1547.                     items:
  1548.                       type: string
  1549.                     type: array
  1550.                 type: object
  1551.               passTLSClientCert:
  1552.                 description: |-
  1553.                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
  1554.                   This middleware adds the selected data from the passed client TLS certificate to a header.
  1555.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/passtlsclientcert/
  1556.                 properties:
  1557.                   info:
  1558.                     description: Info selects the specific client certificate details
  1559.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1560.                     properties:
  1561.                       issuer:
  1562.                         description: Issuer defines the client certificate issuer
  1563.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1564.                         properties:
  1565.                           commonName:
  1566.                             description: CommonName defines whether to add the organizationalUnit
  1567.                               information into the issuer.
  1568.                             type: boolean
  1569.                           country:
  1570.                             description: Country defines whether to add the country
  1571.                               information into the issuer.
  1572.                             type: boolean
  1573.                           domainComponent:
  1574.                             description: DomainComponent defines whether to add the
  1575.                               domainComponent information into the issuer.
  1576.                             type: boolean
  1577.                           locality:
  1578.                             description: Locality defines whether to add the locality
  1579.                               information into the issuer.
  1580.                             type: boolean
  1581.                           organization:
  1582.                             description: Organization defines whether to add the organization
  1583.                               information into the issuer.
  1584.                             type: boolean
  1585.                           province:
  1586.                             description: Province defines whether to add the province
  1587.                               information into the issuer.
  1588.                             type: boolean
  1589.                           serialNumber:
  1590.                             description: SerialNumber defines whether to add the serialNumber
  1591.                               information into the issuer.
  1592.                             type: boolean
  1593.                         type: object
  1594.                       notAfter:
  1595.                         description: NotAfter defines whether to add the Not After
  1596.                           information from the Validity part.
  1597.                         type: boolean
  1598.                       notBefore:
  1599.                         description: NotBefore defines whether to add the Not Before
  1600.                           information from the Validity part.
  1601.                         type: boolean
  1602.                       sans:
  1603.                         description: Sans defines whether to add the Subject Alternative
  1604.                           Name information from the Subject Alternative Name part.
  1605.                         type: boolean
  1606.                       serialNumber:
  1607.                         description: SerialNumber defines whether to add the client
  1608.                           serialNumber information.
  1609.                         type: boolean
  1610.                       subject:
  1611.                         description: Subject defines the client certificate subject
  1612.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1613.                         properties:
  1614.                           commonName:
  1615.                             description: CommonName defines whether to add the organizationalUnit
  1616.                               information into the subject.
  1617.                             type: boolean
  1618.                           country:
  1619.                             description: Country defines whether to add the country
  1620.                               information into the subject.
  1621.                             type: boolean
  1622.                           domainComponent:
  1623.                             description: DomainComponent defines whether to add the
  1624.                               domainComponent information into the subject.
  1625.                             type: boolean
  1626.                           locality:
  1627.                             description: Locality defines whether to add the locality
  1628.                               information into the subject.
  1629.                             type: boolean
  1630.                           organization:
  1631.                             description: Organization defines whether to add the organization
  1632.                               information into the subject.
  1633.                             type: boolean
  1634.                           organizationalUnit:
  1635.                             description: OrganizationalUnit defines whether to add
  1636.                               the organizationalUnit information into the subject.
  1637.                             type: boolean
  1638.                           province:
  1639.                             description: Province defines whether to add the province
  1640.                               information into the subject.
  1641.                             type: boolean
  1642.                           serialNumber:
  1643.                             description: SerialNumber defines whether to add the serialNumber
  1644.                               information into the subject.
  1645.                             type: boolean
  1646.                         type: object
  1647.                     type: object
  1648.                   pem:
  1649.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  1650.                       the certificate.
  1651.                     type: boolean
  1652.                 type: object
  1653.               plugin:
  1654.                 additionalProperties:
  1655.                   x-kubernetes-preserve-unknown-fields: true
  1656.                 description: |-
  1657.                   Plugin defines the middleware plugin configuration.
  1658.                   More info: https://doc.traefik.io/traefik/plugins/
  1659.                 type: object
  1660.               rateLimit:
  1661.                 description: |-
  1662.                   RateLimit holds the rate limit configuration.
  1663.                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
  1664.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/ratelimit/
  1665.                 properties:
  1666.                   average:
  1667.                     description: |-
  1668.                       Average is the maximum rate, by default in requests/s, allowed for the given source.
  1669.                       It defaults to 0, which means no rate limiting.
  1670.                       The rate is actually defined by dividing Average by Period. So for a rate below 1req/s,
  1671.                       one needs to define a Period larger than a second.
  1672.                     format: int64
  1673.                     type: integer
  1674.                   burst:
  1675.                     description: |-
  1676.                       Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time.
  1677.                       It defaults to 1.
  1678.                     format: int64
  1679.                     type: integer
  1680.                   period:
  1681.                     anyOf:
  1682.                     - type: integer
  1683.                     - type: string
  1684.                     description: |-
  1685.                       Period, in combination with Average, defines the actual maximum rate, such as:
  1686.                       r = Average / Period. It defaults to a second.
  1687.                     x-kubernetes-int-or-string: true
  1688.                   sourceCriterion:
  1689.                     description: |-
  1690.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1691.                       If several strategies are defined at the same time, an error will be raised.
  1692.                       If none are set, the default is to use the request's remote address field (as an ipStrategy).
  1693.                     properties:
  1694.                       ipStrategy:
  1695.                         description: |-
  1696.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1697.                           More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/ipallowlist/#ipstrategy
  1698.                         properties:
  1699.                           depth:
  1700.                             description: Depth tells Traefik to use the X-Forwarded-For
  1701.                               header and take the IP located at the depth position
  1702.                               (starting from the right).
  1703.                             type: integer
  1704.                           excludedIPs:
  1705.                             description: ExcludedIPs configures Traefik to scan the
  1706.                               X-Forwarded-For header and select the first IP not in
  1707.                               the list.
  1708.                             items:
  1709.                               type: string
  1710.                             type: array
  1711.                           ipv6Subnet:
  1712.                             description: IPv6Subnet configures Traefik to consider
  1713.                               all IPv6 addresses from the defined subnet as originating
  1714.                               from the same IP. Applies to RemoteAddrStrategy and
  1715.                               DepthStrategy.
  1716.                             type: integer
  1717.                         type: object
  1718.                       requestHeaderName:
  1719.                         description: RequestHeaderName defines the name of the header
  1720.                           used to group incoming requests.
  1721.                         type: string
  1722.                       requestHost:
  1723.                         description: RequestHost defines whether to consider the request
  1724.                           Host as the source.
  1725.                         type: boolean
  1726.                     type: object
  1727.                 type: object
  1728.               redirectRegex:
  1729.                 description: |-
  1730.                   RedirectRegex holds the redirect regex middleware configuration.
  1731.                   This middleware redirects a request using regex matching and replacement.
  1732.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/redirectregex/#regex
  1733.                 properties:
  1734.                   permanent:
  1735.                     description: Permanent defines whether the redirection is permanent
  1736.                       (301).
  1737.                     type: boolean
  1738.                   regex:
  1739.                     description: Regex defines the regex used to match and capture
  1740.                       elements from the request URL.
  1741.                     type: string
  1742.                   replacement:
  1743.                     description: Replacement defines how to modify the URL to have
  1744.                       the new target URL.
  1745.                     type: string
  1746.                 type: object
  1747.               redirectScheme:
  1748.                 description: |-
  1749.                   RedirectScheme holds the redirect scheme middleware configuration.
  1750.                   This middleware redirects requests from a scheme/port to another.
  1751.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/redirectscheme/
  1752.                 properties:
  1753.                   permanent:
  1754.                     description: Permanent defines whether the redirection is permanent
  1755.                       (301).
  1756.                     type: boolean
  1757.                   port:
  1758.                     description: Port defines the port of the new URL.
  1759.                     type: string
  1760.                   scheme:
  1761.                     description: Scheme defines the scheme of the new URL.
  1762.                     type: string
  1763.                 type: object
  1764.               replacePath:
  1765.                 description: |-
  1766.                   ReplacePath holds the replace path middleware configuration.
  1767.                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
  1768.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/replacepath/
  1769.                 properties:
  1770.                   path:
  1771.                     description: Path defines the path to use as replacement in the
  1772.                       request URL.
  1773.                     type: string
  1774.                 type: object
  1775.               replacePathRegex:
  1776.                 description: |-
  1777.                   ReplacePathRegex holds the replace path regex middleware configuration.
  1778.                   This middleware replaces the path of a URL using regex matching and replacement.
  1779.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/replacepathregex/
  1780.                 properties:
  1781.                   regex:
  1782.                     description: Regex defines the regular expression used to match
  1783.                       and capture the path from the request URL.
  1784.                     type: string
  1785.                   replacement:
  1786.                     description: Replacement defines the replacement path format,
  1787.                       which can include captured variables.
  1788.                     type: string
  1789.                 type: object
  1790.               retry:
  1791.                 description: |-
  1792.                   Retry holds the retry middleware configuration.
  1793.                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
  1794.                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
  1795.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/retry/
  1796.                 properties:
  1797.                   attempts:
  1798.                     description: Attempts defines how many times the request should
  1799.                       be retried.
  1800.                     type: integer
  1801.                   initialInterval:
  1802.                     anyOf:
  1803.                     - type: integer
  1804.                     - type: string
  1805.                     description: |-
  1806.                       InitialInterval defines the first wait time in the exponential backoff series.
  1807.                       The maximum interval is calculated as twice the initialInterval.
  1808.                       If unspecified, requests will be retried immediately.
  1809.                       The value of initialInterval should be provided in seconds or as a valid duration format,
  1810.                       see https://pkg.go.dev/time#ParseDuration.
  1811.                     x-kubernetes-int-or-string: true
  1812.                 type: object
  1813.               stripPrefix:
  1814.                 description: |-
  1815.                   StripPrefix holds the strip prefix middleware configuration.
  1816.                   This middleware removes the specified prefixes from the URL path.
  1817.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/stripprefix/
  1818.                 properties:
  1819.                   forceSlash:
  1820.                     description: |-
  1821.                       Deprecated: ForceSlash option is deprecated, please remove any usage of this option.
  1822.                       ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.
  1823.                       Default: true.
  1824.                     type: boolean
  1825.                   prefixes:
  1826.                     description: Prefixes defines the prefixes to strip from the request
  1827.                       URL.
  1828.                     items:
  1829.                       type: string
  1830.                     type: array
  1831.                 type: object
  1832.               stripPrefixRegex:
  1833.                 description: |-
  1834.                   StripPrefixRegex holds the strip prefix regex middleware configuration.
  1835.                   This middleware removes the matching prefixes from the URL path.
  1836.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/http/stripprefixregex/
  1837.                 properties:
  1838.                   regex:
  1839.                     description: Regex defines the regular expression to match the
  1840.                       path prefix from the request URL.
  1841.                     items:
  1842.                       type: string
  1843.                     type: array
  1844.                 type: object
  1845.             type: object
  1846.         required:
  1847.         - metadata
  1848.         - spec
  1849.         type: object
  1850.     served: true
  1851.     storage: true
  1852. ---
  1853. apiVersion: apiextensions.k8s.io/v1
  1854. kind: CustomResourceDefinition
  1855. metadata:
  1856.   annotations:
  1857.     controller-gen.kubebuilder.io/version: v0.16.1
  1858.   name: middlewaretcps.traefik.io
  1859. spec:
  1860.   group: traefik.io
  1861.   names:
  1862.     kind: MiddlewareTCP
  1863.     listKind: MiddlewareTCPList
  1864.     plural: middlewaretcps
  1865.     singular: middlewaretcp
  1866.   scope: Namespaced
  1867.   versions:
  1868.   - name: v1alpha1
  1869.     schema:
  1870.       openAPIV3Schema:
  1871.         description: |-
  1872.           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  1873.           More info: https://doc.traefik.io/traefik/v3.2/middlewares/overview/
  1874.         properties:
  1875.           apiVersion:
  1876.             description: |-
  1877.               APIVersion defines the versioned schema of this representation of an object.
  1878.               Servers should convert recognized schemas to the latest internal value, and
  1879.               may reject unrecognized values.
  1880.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1881.             type: string
  1882.           kind:
  1883.             description: |-
  1884.               Kind is a string value representing the REST resource this object represents.
  1885.               Servers may infer this from the endpoint the client submits requests to.
  1886.               Cannot be updated.
  1887.               In CamelCase.
  1888.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1889.             type: string
  1890.           metadata:
  1891.             type: object
  1892.           spec:
  1893.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  1894.             properties:
  1895.               inFlightConn:
  1896.                 description: InFlightConn defines the InFlightConn middleware configuration.
  1897.                 properties:
  1898.                   amount:
  1899.                     description: |-
  1900.                       Amount defines the maximum amount of allowed simultaneous connections.
  1901.                       The middleware closes the connection if there are already amount connections opened.
  1902.                     format: int64
  1903.                     type: integer
  1904.                 type: object
  1905.               ipAllowList:
  1906.                 description: |-
  1907.                   IPAllowList defines the IPAllowList middleware configuration.
  1908.                   This middleware accepts/refuses connections based on the client IP.
  1909.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/tcp/ipallowlist/
  1910.                 properties:
  1911.                   sourceRange:
  1912.                     description: SourceRange defines the allowed IPs (or ranges of
  1913.                       allowed IPs by using CIDR notation).
  1914.                     items:
  1915.                       type: string
  1916.                     type: array
  1917.                 type: object
  1918.               ipWhiteList:
  1919.                 description: |-
  1920.                   IPWhiteList defines the IPWhiteList middleware configuration.
  1921.                   This middleware accepts/refuses connections based on the client IP.
  1922.                   Deprecated: please use IPAllowList instead.
  1923.                   More info: https://doc.traefik.io/traefik/v3.2/middlewares/tcp/ipwhitelist/
  1924.                 properties:
  1925.                   sourceRange:
  1926.                     description: SourceRange defines the allowed IPs (or ranges of
  1927.                       allowed IPs by using CIDR notation).
  1928.                     items:
  1929.                       type: string
  1930.                     type: array
  1931.                 type: object
  1932.             type: object
  1933.         required:
  1934.         - metadata
  1935.         - spec
  1936.         type: object
  1937.     served: true
  1938.     storage: true
  1939. ---
  1940. apiVersion: apiextensions.k8s.io/v1
  1941. kind: CustomResourceDefinition
  1942. metadata:
  1943.   annotations:
  1944.     controller-gen.kubebuilder.io/version: v0.16.1
  1945.   name: serverstransports.traefik.io
  1946. spec:
  1947.   group: traefik.io
  1948.   names:
  1949.     kind: ServersTransport
  1950.     listKind: ServersTransportList
  1951.     plural: serverstransports
  1952.     singular: serverstransport
  1953.   scope: Namespaced
  1954.   versions:
  1955.   - name: v1alpha1
  1956.     schema:
  1957.       openAPIV3Schema:
  1958.         description: |-
  1959.           ServersTransport is the CRD implementation of a ServersTransport.
  1960.           If no serversTransport is specified, the default@internal will be used.
  1961.           The default@internal serversTransport is created from the static configuration.
  1962.           More info: https://doc.traefik.io/traefik/v3.2/routing/services/#serverstransport_1
  1963.         properties:
  1964.           apiVersion:
  1965.             description: |-
  1966.               APIVersion defines the versioned schema of this representation of an object.
  1967.               Servers should convert recognized schemas to the latest internal value, and
  1968.               may reject unrecognized values.
  1969.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1970.             type: string
  1971.           kind:
  1972.             description: |-
  1973.               Kind is a string value representing the REST resource this object represents.
  1974.               Servers may infer this from the endpoint the client submits requests to.
  1975.               Cannot be updated.
  1976.               In CamelCase.
  1977.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1978.             type: string
  1979.           metadata:
  1980.             type: object
  1981.           spec:
  1982.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  1983.             properties:
  1984.               certificatesSecrets:
  1985.                 description: CertificatesSecrets defines a list of secret storing
  1986.                   client certificates for mTLS.
  1987.                 items:
  1988.                   type: string
  1989.                 type: array
  1990.               disableHTTP2:
  1991.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  1992.                   servers.
  1993.                 type: boolean
  1994.               forwardingTimeouts:
  1995.                 description: ForwardingTimeouts defines the timeouts for requests
  1996.                   forwarded to the backend servers.
  1997.                 properties:
  1998.                   dialTimeout:
  1999.                     anyOf:
  2000.                     - type: integer
  2001.                     - type: string
  2002.                     description: DialTimeout is the amount of time to wait until a
  2003.                       connection to a backend server can be established.
  2004.                     x-kubernetes-int-or-string: true
  2005.                   idleConnTimeout:
  2006.                     anyOf:
  2007.                     - type: integer
  2008.                     - type: string
  2009.                     description: IdleConnTimeout is the maximum period for which an
  2010.                       idle HTTP keep-alive connection will remain open before closing
  2011.                       itself.
  2012.                     x-kubernetes-int-or-string: true
  2013.                   pingTimeout:
  2014.                     anyOf:
  2015.                     - type: integer
  2016.                     - type: string
  2017.                     description: PingTimeout is the timeout after which the HTTP/2
  2018.                       connection will be closed if a response to ping is not received.
  2019.                     x-kubernetes-int-or-string: true
  2020.                   readIdleTimeout:
  2021.                     anyOf:
  2022.                     - type: integer
  2023.                     - type: string
  2024.                     description: ReadIdleTimeout is the timeout after which a health
  2025.                       check using ping frame will be carried out if no frame is received
  2026.                       on the HTTP/2 connection.
  2027.                     x-kubernetes-int-or-string: true
  2028.                   responseHeaderTimeout:
  2029.                     anyOf:
  2030.                     - type: integer
  2031.                     - type: string
  2032.                     description: ResponseHeaderTimeout is the amount of time to wait
  2033.                       for a server's response headers after fully writing the request
  2034.                       (including its body, if any).
  2035.                     x-kubernetes-int-or-string: true
  2036.                 type: object
  2037.               insecureSkipVerify:
  2038.                 description: InsecureSkipVerify disables SSL certificate verification.
  2039.                 type: boolean
  2040.               maxIdleConnsPerHost:
  2041.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  2042.                   to keep per-host.
  2043.                 type: integer
  2044.               peerCertURI:
  2045.                 description: PeerCertURI defines the peer cert URI used to match against
  2046.                   SAN URI during the peer certificate verification.
  2047.                 type: string
  2048.               rootCAsSecrets:
  2049.                 description: RootCAsSecrets defines a list of CA secret used to validate
  2050.                   self-signed certificate.
  2051.                 items:
  2052.                   type: string
  2053.                 type: array
  2054.               serverName:
  2055.                 description: ServerName defines the server name used to contact the
  2056.                   server.
  2057.                 type: string
  2058.               spiffe:
  2059.                 description: Spiffe defines the SPIFFE configuration.
  2060.                 properties:
  2061.                   ids:
  2062.                     description: IDs defines the allowed SPIFFE IDs (takes precedence
  2063.                       over the SPIFFE TrustDomain).
  2064.                     items:
  2065.                       type: string
  2066.                     type: array
  2067.                   trustDomain:
  2068.                     description: TrustDomain defines the allowed SPIFFE trust domain.
  2069.                     type: string
  2070.                 type: object
  2071.             type: object
  2072.         required:
  2073.         - metadata
  2074.         - spec
  2075.         type: object
  2076.     served: true
  2077.     storage: true
  2078. ---
  2079. apiVersion: apiextensions.k8s.io/v1
  2080. kind: CustomResourceDefinition
  2081. metadata:
  2082.   annotations:
  2083.     controller-gen.kubebuilder.io/version: v0.16.1
  2084.   name: serverstransporttcps.traefik.io
  2085. spec:
  2086.   group: traefik.io
  2087.   names:
  2088.     kind: ServersTransportTCP
  2089.     listKind: ServersTransportTCPList
  2090.     plural: serverstransporttcps
  2091.     singular: serverstransporttcp
  2092.   scope: Namespaced
  2093.   versions:
  2094.   - name: v1alpha1
  2095.     schema:
  2096.       openAPIV3Schema:
  2097.         description: |-
  2098.           ServersTransportTCP is the CRD implementation of a TCPServersTransport.
  2099.           If no tcpServersTransport is specified, a default one named default@internal will be used.
  2100.           The default@internal tcpServersTransport can be configured in the static configuration.
  2101.           More info: https://doc.traefik.io/traefik/v3.2/routing/services/#serverstransport_3
  2102.         properties:
  2103.           apiVersion:
  2104.             description: |-
  2105.               APIVersion defines the versioned schema of this representation of an object.
  2106.               Servers should convert recognized schemas to the latest internal value, and
  2107.               may reject unrecognized values.
  2108.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2109.             type: string
  2110.           kind:
  2111.             description: |-
  2112.               Kind is a string value representing the REST resource this object represents.
  2113.               Servers may infer this from the endpoint the client submits requests to.
  2114.               Cannot be updated.
  2115.               In CamelCase.
  2116.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2117.             type: string
  2118.           metadata:
  2119.             type: object
  2120.           spec:
  2121.             description: ServersTransportTCPSpec defines the desired state of a ServersTransportTCP.
  2122.             properties:
  2123.               dialKeepAlive:
  2124.                 anyOf:
  2125.                 - type: integer
  2126.                 - type: string
  2127.                 description: DialKeepAlive is the interval between keep-alive probes
  2128.                   for an active network connection. If zero, keep-alive probes are
  2129.                   sent with a default value (currently 15 seconds), if supported by
  2130.                   the protocol and operating system. Network protocols or operating
  2131.                   systems that do not support keep-alives ignore this field. If negative,
  2132.                   keep-alive probes are disabled.
  2133.                 x-kubernetes-int-or-string: true
  2134.               dialTimeout:
  2135.                 anyOf:
  2136.                 - type: integer
  2137.                 - type: string
  2138.                 description: DialTimeout is the amount of time to wait until a connection
  2139.                   to a backend server can be established.
  2140.                 x-kubernetes-int-or-string: true
  2141.               terminationDelay:
  2142.                 anyOf:
  2143.                 - type: integer
  2144.                 - type: string
  2145.                 description: TerminationDelay defines the delay to wait before fully
  2146.                   terminating the connection, after one connected peer has closed
  2147.                   its writing capability.
  2148.                 x-kubernetes-int-or-string: true
  2149.               tls:
  2150.                 description: TLS defines the TLS configuration
  2151.                 properties:
  2152.                   certificatesSecrets:
  2153.                     description: CertificatesSecrets defines a list of secret storing
  2154.                       client certificates for mTLS.
  2155.                     items:
  2156.                       type: string
  2157.                     type: array
  2158.                   insecureSkipVerify:
  2159.                     description: InsecureSkipVerify disables TLS certificate verification.
  2160.                     type: boolean
  2161.                   peerCertURI:
  2162.                     description: |-
  2163.                       MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.
  2164.                       PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.
  2165.                     type: string
  2166.                   rootCAsSecrets:
  2167.                     description: RootCAsSecrets defines a list of CA secret used to
  2168.                       validate self-signed certificates.
  2169.                     items:
  2170.                       type: string
  2171.                     type: array
  2172.                   serverName:
  2173.                     description: ServerName defines the server name used to contact
  2174.                       the server.
  2175.                     type: string
  2176.                   spiffe:
  2177.                     description: Spiffe defines the SPIFFE configuration.
  2178.                     properties:
  2179.                       ids:
  2180.                         description: IDs defines the allowed SPIFFE IDs (takes precedence
  2181.                           over the SPIFFE TrustDomain).
  2182.                         items:
  2183.                           type: string
  2184.                         type: array
  2185.                       trustDomain:
  2186.                         description: TrustDomain defines the allowed SPIFFE trust
  2187.                           domain.
  2188.                         type: string
  2189.                     type: object
  2190.                 type: object
  2191.             type: object
  2192.         required:
  2193.         - metadata
  2194.         - spec
  2195.         type: object
  2196.     served: true
  2197.     storage: true
  2198. ---
  2199. apiVersion: apiextensions.k8s.io/v1
  2200. kind: CustomResourceDefinition
  2201. metadata:
  2202.   annotations:
  2203.     controller-gen.kubebuilder.io/version: v0.16.1
  2204.   name: tlsoptions.traefik.io
  2205. spec:
  2206.   group: traefik.io
  2207.   names:
  2208.     kind: TLSOption
  2209.     listKind: TLSOptionList
  2210.     plural: tlsoptions
  2211.     singular: tlsoption
  2212.   scope: Namespaced
  2213.   versions:
  2214.   - name: v1alpha1
  2215.     schema:
  2216.       openAPIV3Schema:
  2217.         description: |-
  2218.           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
  2219.           More info: https://doc.traefik.io/traefik/v3.2/https/tls/#tls-options
  2220.         properties:
  2221.           apiVersion:
  2222.             description: |-
  2223.               APIVersion defines the versioned schema of this representation of an object.
  2224.               Servers should convert recognized schemas to the latest internal value, and
  2225.               may reject unrecognized values.
  2226.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2227.             type: string
  2228.           kind:
  2229.             description: |-
  2230.               Kind is a string value representing the REST resource this object represents.
  2231.               Servers may infer this from the endpoint the client submits requests to.
  2232.               Cannot be updated.
  2233.               In CamelCase.
  2234.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2235.             type: string
  2236.           metadata:
  2237.             type: object
  2238.           spec:
  2239.             description: TLSOptionSpec defines the desired state of a TLSOption.
  2240.             properties:
  2241.               alpnProtocols:
  2242.                 description: |-
  2243.                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
  2244.                   More info: https://doc.traefik.io/traefik/v3.2/https/tls/#alpn-protocols
  2245.                 items:
  2246.                   type: string
  2247.                 type: array
  2248.               cipherSuites:
  2249.                 description: |-
  2250.                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
  2251.                   More info: https://doc.traefik.io/traefik/v3.2/https/tls/#cipher-suites
  2252.                 items:
  2253.                   type: string
  2254.                 type: array
  2255.               clientAuth:
  2256.                 description: ClientAuth defines the server's policy for TLS Client
  2257.                   Authentication.
  2258.                 properties:
  2259.                   clientAuthType:
  2260.                     description: ClientAuthType defines the client authentication
  2261.                       type to apply.
  2262.                     enum:
  2263.                     - NoClientCert
  2264.                     - RequestClientCert
  2265.                     - RequireAnyClientCert
  2266.                     - VerifyClientCertIfGiven
  2267.                     - RequireAndVerifyClientCert
  2268.                     type: string
  2269.                   secretNames:
  2270.                     description: SecretNames defines the names of the referenced Kubernetes
  2271.                       Secret storing certificate details.
  2272.                     items:
  2273.                       type: string
  2274.                     type: array
  2275.                 type: object
  2276.               curvePreferences:
  2277.                 description: |-
  2278.                   CurvePreferences defines the preferred elliptic curves in a specific order.
  2279.                   More info: https://doc.traefik.io/traefik/v3.2/https/tls/#curve-preferences
  2280.                 items:
  2281.                   type: string
  2282.                 type: array
  2283.               maxVersion:
  2284.                 description: |-
  2285.                   MaxVersion defines the maximum TLS version that Traefik will accept.
  2286.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2287.                   Default: None.
  2288.                 type: string
  2289.               minVersion:
  2290.                 description: |-
  2291.                   MinVersion defines the minimum TLS version that Traefik will accept.
  2292.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2293.                   Default: VersionTLS10.
  2294.                 type: string
  2295.               preferServerCipherSuites:
  2296.                 description: |-
  2297.                   PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
  2298.                   It is enabled automatically when minVersion or maxVersion is set.
  2299.                   Deprecated: https://github.com/golang/go/issues/45430
  2300.                 type: boolean
  2301.               sniStrict:
  2302.                 description: SniStrict defines whether Traefik allows connections
  2303.                   from clients connections that do not specify a server_name extension.
  2304.                 type: boolean
  2305.             type: object
  2306.         required:
  2307.         - metadata
  2308.         - spec
  2309.         type: object
  2310.     served: true
  2311.     storage: true
  2312. ---
  2313. apiVersion: apiextensions.k8s.io/v1
  2314. kind: CustomResourceDefinition
  2315. metadata:
  2316.   annotations:
  2317.     controller-gen.kubebuilder.io/version: v0.16.1
  2318.   name: tlsstores.traefik.io
  2319. spec:
  2320.   group: traefik.io
  2321.   names:
  2322.     kind: TLSStore
  2323.     listKind: TLSStoreList
  2324.     plural: tlsstores
  2325.     singular: tlsstore
  2326.   scope: Namespaced
  2327.   versions:
  2328.   - name: v1alpha1
  2329.     schema:
  2330.       openAPIV3Schema:
  2331.         description: |-
  2332.           TLSStore is the CRD implementation of a Traefik TLS Store.
  2333.           For the time being, only the TLSStore named default is supported.
  2334.           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
  2335.           More info: https://doc.traefik.io/traefik/v3.2/https/tls/#certificates-stores
  2336.         properties:
  2337.           apiVersion:
  2338.             description: |-
  2339.               APIVersion defines the versioned schema of this representation of an object.
  2340.               Servers should convert recognized schemas to the latest internal value, and
  2341.               may reject unrecognized values.
  2342.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2343.             type: string
  2344.           kind:
  2345.             description: |-
  2346.               Kind is a string value representing the REST resource this object represents.
  2347.               Servers may infer this from the endpoint the client submits requests to.
  2348.               Cannot be updated.
  2349.               In CamelCase.
  2350.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2351.             type: string
  2352.           metadata:
  2353.             type: object
  2354.           spec:
  2355.             description: TLSStoreSpec defines the desired state of a TLSStore.
  2356.             properties:
  2357.               certificates:
  2358.                 description: Certificates is a list of secret names, each secret holding
  2359.                   a key/certificate pair to add to the store.
  2360.                 items:
  2361.                   description: Certificate holds a secret name for the TLSStore resource.
  2362.                   properties:
  2363.                     secretName:
  2364.                       description: SecretName is the name of the referenced Kubernetes
  2365.                         Secret to specify the certificate details.
  2366.                       type: string
  2367.                   required:
  2368.                   - secretName
  2369.                   type: object
  2370.                 type: array
  2371.               defaultCertificate:
  2372.                 description: DefaultCertificate defines the default certificate configuration.
  2373.                 properties:
  2374.                   secretName:
  2375.                     description: SecretName is the name of the referenced Kubernetes
  2376.                       Secret to specify the certificate details.
  2377.                     type: string
  2378.                 required:
  2379.                 - secretName
  2380.                 type: object
  2381.               defaultGeneratedCert:
  2382.                 description: DefaultGeneratedCert defines the default generated certificate
  2383.                   configuration.
  2384.                 properties:
  2385.                   domain:
  2386.                     description: Domain is the domain definition for the DefaultCertificate.
  2387.                     properties:
  2388.                       main:
  2389.                         description: Main defines the main domain name.
  2390.                         type: string
  2391.                       sans:
  2392.                         description: SANs defines the subject alternative domain names.
  2393.                         items:
  2394.                           type: string
  2395.                         type: array
  2396.                     type: object
  2397.                   resolver:
  2398.                     description: Resolver is the name of the resolver that will be
  2399.                       used to issue the DefaultCertificate.
  2400.                     type: string
  2401.                 type: object
  2402.             type: object
  2403.         required:
  2404.         - metadata
  2405.         - spec
  2406.         type: object
  2407.     served: true
  2408.     storage: true
  2409. ---
  2410. apiVersion: apiextensions.k8s.io/v1
  2411. kind: CustomResourceDefinition
  2412. metadata:
  2413.   annotations:
  2414.     controller-gen.kubebuilder.io/version: v0.16.1
  2415.   name: traefikservices.traefik.io
  2416. spec:
  2417.   group: traefik.io
  2418.   names:
  2419.     kind: TraefikService
  2420.     listKind: TraefikServiceList
  2421.     plural: traefikservices
  2422.     singular: traefikservice
  2423.   scope: Namespaced
  2424.   versions:
  2425.   - name: v1alpha1
  2426.     schema:
  2427.       openAPIV3Schema:
  2428.         description: |-
  2429.           TraefikService is the CRD implementation of a Traefik Service.
  2430.           TraefikService object allows to:
  2431.           - Apply weight to Services on load-balancing
  2432.           - Mirror traffic on services
  2433.           More info: https://doc.traefik.io/traefik/v3.2/routing/providers/kubernetes-crd/#kind-traefikservice
  2434.         properties:
  2435.           apiVersion:
  2436.             description: |-
  2437.               APIVersion defines the versioned schema of this representation of an object.
  2438.               Servers should convert recognized schemas to the latest internal value, and
  2439.               may reject unrecognized values.
  2440.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2441.             type: string
  2442.           kind:
  2443.             description: |-
  2444.               Kind is a string value representing the REST resource this object represents.
  2445.               Servers may infer this from the endpoint the client submits requests to.
  2446.               Cannot be updated.
  2447.               In CamelCase.
  2448.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2449.             type: string
  2450.           metadata:
  2451.             type: object
  2452.           spec:
  2453.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  2454.             properties:
  2455.               mirroring:
  2456.                 description: Mirroring defines the Mirroring service configuration.
  2457.                 properties:
  2458.                   healthCheck:
  2459.                     description: Healthcheck defines health checks for ExternalName
  2460.                       services.
  2461.                     properties:
  2462.                       followRedirects:
  2463.                         description: |-
  2464.                           FollowRedirects defines whether redirects should be followed during the health check calls.
  2465.                           Default: true
  2466.                         type: boolean
  2467.                       headers:
  2468.                         additionalProperties:
  2469.                           type: string
  2470.                         description: Headers defines custom headers to be sent to
  2471.                           the health check endpoint.
  2472.                         type: object
  2473.                       hostname:
  2474.                         description: Hostname defines the value of hostname in the
  2475.                           Host header of the health check request.
  2476.                         type: string
  2477.                       interval:
  2478.                         anyOf:
  2479.                         - type: integer
  2480.                         - type: string
  2481.                         description: |-
  2482.                           Interval defines the frequency of the health check calls.
  2483.                           Default: 30s
  2484.                         x-kubernetes-int-or-string: true
  2485.                       method:
  2486.                         description: Method defines the healthcheck method.
  2487.                         type: string
  2488.                       mode:
  2489.                         description: |-
  2490.                           Mode defines the health check mode.
  2491.                           If defined to grpc, will use the gRPC health check protocol to probe the server.
  2492.                           Default: http
  2493.                         type: string
  2494.                       path:
  2495.                         description: Path defines the server URL path for the health
  2496.                           check endpoint.
  2497.                         type: string
  2498.                       port:
  2499.                         description: Port defines the server URL port for the health
  2500.                           check endpoint.
  2501.                         type: integer
  2502.                       scheme:
  2503.                         description: Scheme replaces the server URL scheme for the
  2504.                           health check endpoint.
  2505.                         type: string
  2506.                       status:
  2507.                         description: Status defines the expected HTTP status code
  2508.                           of the response to the health check request.
  2509.                         type: integer
  2510.                       timeout:
  2511.                         anyOf:
  2512.                         - type: integer
  2513.                         - type: string
  2514.                         description: |-
  2515.                           Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2516.                           Default: 5s
  2517.                         x-kubernetes-int-or-string: true
  2518.                     type: object
  2519.                   kind:
  2520.                     description: Kind defines the kind of the Service.
  2521.                     enum:
  2522.                     - Service
  2523.                     - TraefikService
  2524.                     type: string
  2525.                   maxBodySize:
  2526.                     description: |-
  2527.                       MaxBodySize defines the maximum size allowed for the body of the request.
  2528.                       If the body is larger, the request is not mirrored.
  2529.                       Default value is -1, which means unlimited size.
  2530.                     format: int64
  2531.                     type: integer
  2532.                   mirrorBody:
  2533.                     description: |-
  2534.                       MirrorBody defines whether the body of the request should be mirrored.
  2535.                       Default value is true.
  2536.                     type: boolean
  2537.                   mirrors:
  2538.                     description: Mirrors defines the list of mirrors where Traefik
  2539.                       will duplicate the traffic.
  2540.                     items:
  2541.                       description: MirrorService holds the mirror configuration.
  2542.                       properties:
  2543.                         healthCheck:
  2544.                           description: Healthcheck defines health checks for ExternalName
  2545.                             services.
  2546.                           properties:
  2547.                             followRedirects:
  2548.                               description: |-
  2549.                                 FollowRedirects defines whether redirects should be followed during the health check calls.
  2550.                                 Default: true
  2551.                               type: boolean
  2552.                             headers:
  2553.                               additionalProperties:
  2554.                                 type: string
  2555.                               description: Headers defines custom headers to be sent
  2556.                                 to the health check endpoint.
  2557.                               type: object
  2558.                             hostname:
  2559.                               description: Hostname defines the value of hostname
  2560.                                 in the Host header of the health check request.
  2561.                               type: string
  2562.                             interval:
  2563.                               anyOf:
  2564.                               - type: integer
  2565.                               - type: string
  2566.                               description: |-
  2567.                                 Interval defines the frequency of the health check calls.
  2568.                                 Default: 30s
  2569.                               x-kubernetes-int-or-string: true
  2570.                             method:
  2571.                               description: Method defines the healthcheck method.
  2572.                               type: string
  2573.                             mode:
  2574.                               description: |-
  2575.                                 Mode defines the health check mode.
  2576.                                 If defined to grpc, will use the gRPC health check protocol to probe the server.
  2577.                                 Default: http
  2578.                               type: string
  2579.                             path:
  2580.                               description: Path defines the server URL path for the
  2581.                                 health check endpoint.
  2582.                               type: string
  2583.                             port:
  2584.                               description: Port defines the server URL port for the
  2585.                                 health check endpoint.
  2586.                               type: integer
  2587.                             scheme:
  2588.                               description: Scheme replaces the server URL scheme for
  2589.                                 the health check endpoint.
  2590.                               type: string
  2591.                             status:
  2592.                               description: Status defines the expected HTTP status
  2593.                                 code of the response to the health check request.
  2594.                               type: integer
  2595.                             timeout:
  2596.                               anyOf:
  2597.                               - type: integer
  2598.                               - type: string
  2599.                               description: |-
  2600.                                 Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2601.                                 Default: 5s
  2602.                               x-kubernetes-int-or-string: true
  2603.                           type: object
  2604.                         kind:
  2605.                           description: Kind defines the kind of the Service.
  2606.                           enum:
  2607.                           - Service
  2608.                           - TraefikService
  2609.                           type: string
  2610.                         name:
  2611.                           description: |-
  2612.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2613.                             The differentiation between the two is specified in the Kind field.
  2614.                           type: string
  2615.                         namespace:
  2616.                           description: Namespace defines the namespace of the referenced
  2617.                             Kubernetes Service or TraefikService.
  2618.                           type: string
  2619.                         nativeLB:
  2620.                           description: |-
  2621.                             NativeLB controls, when creating the load-balancer,
  2622.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2623.                             The Kubernetes Service itself does load-balance to the pods.
  2624.                             By default, NativeLB is false.
  2625.                           type: boolean
  2626.                         nodePortLB:
  2627.                           description: |-
  2628.                             NodePortLB controls, when creating the load-balancer,
  2629.                             whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2630.                             It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2631.                             By default, NodePortLB is false.
  2632.                           type: boolean
  2633.                         passHostHeader:
  2634.                           description: |-
  2635.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2636.                             By default, passHostHeader is true.
  2637.                           type: boolean
  2638.                         percent:
  2639.                           description: |-
  2640.                             Percent defines the part of the traffic to mirror.
  2641.                             Supported values: 0 to 100.
  2642.                           type: integer
  2643.                         port:
  2644.                           anyOf:
  2645.                           - type: integer
  2646.                           - type: string
  2647.                           description: |-
  2648.                             Port defines the port of a Kubernetes Service.
  2649.                             This can be a reference to a named port.
  2650.                           x-kubernetes-int-or-string: true
  2651.                         responseForwarding:
  2652.                           description: ResponseForwarding defines how Traefik forwards
  2653.                             the response from the upstream Kubernetes Service to the
  2654.                             client.
  2655.                           properties:
  2656.                             flushInterval:
  2657.                               description: |-
  2658.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2659.                                 A negative value means to flush immediately after each write to the client.
  2660.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2661.                                 for such responses, writes are flushed to the client immediately.
  2662.                                 Default: 100ms
  2663.                               type: string
  2664.                           type: object
  2665.                         scheme:
  2666.                           description: |-
  2667.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2668.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2669.                           type: string
  2670.                         serversTransport:
  2671.                           description: |-
  2672.                             ServersTransport defines the name of ServersTransport resource to use.
  2673.                             It allows to configure the transport between Traefik and your servers.
  2674.                             Can only be used on a Kubernetes Service.
  2675.                           type: string
  2676.                         sticky:
  2677.                           description: |-
  2678.                             Sticky defines the sticky sessions configuration.
  2679.                             More info: https://doc.traefik.io/traefik/v3.2/routing/services/#sticky-sessions
  2680.                           properties:
  2681.                             cookie:
  2682.                               description: Cookie defines the sticky cookie configuration.
  2683.                               properties:
  2684.                                 httpOnly:
  2685.                                   description: HTTPOnly defines whether the cookie
  2686.                                     can be accessed by client-side APIs, such as JavaScript.
  2687.                                   type: boolean
  2688.                                 maxAge:
  2689.                                   description: |-
  2690.                                     MaxAge indicates the number of seconds until the cookie expires.
  2691.                                     When set to a negative number, the cookie expires immediately.
  2692.                                     When set to zero, the cookie never expires.
  2693.                                   type: integer
  2694.                                 name:
  2695.                                   description: Name defines the Cookie name.
  2696.                                   type: string
  2697.                                 sameSite:
  2698.                                   description: |-
  2699.                                     SameSite defines the same site policy.
  2700.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2701.                                   type: string
  2702.                                 secure:
  2703.                                   description: Secure defines whether the cookie can
  2704.                                     only be transmitted over an encrypted connection
  2705.                                     (i.e. HTTPS).
  2706.                                   type: boolean
  2707.                               type: object
  2708.                           type: object
  2709.                         strategy:
  2710.                           description: |-
  2711.                             Strategy defines the load balancing strategy between the servers.
  2712.                             RoundRobin is the only supported value at the moment.
  2713.                           type: string
  2714.                         weight:
  2715.                           description: |-
  2716.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2717.                             (and to be precise, one that embeds a Weighted Round Robin).
  2718.                           type: integer
  2719.                       required:
  2720.                       - name
  2721.                       type: object
  2722.                     type: array
  2723.                   name:
  2724.                     description: |-
  2725.                       Name defines the name of the referenced Kubernetes Service or TraefikService.
  2726.                       The differentiation between the two is specified in the Kind field.
  2727.                     type: string
  2728.                   namespace:
  2729.                     description: Namespace defines the namespace of the referenced
  2730.                       Kubernetes Service or TraefikService.
  2731.                     type: string
  2732.                   nativeLB:
  2733.                     description: |-
  2734.                       NativeLB controls, when creating the load-balancer,
  2735.                       whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2736.                       The Kubernetes Service itself does load-balance to the pods.
  2737.                       By default, NativeLB is false.
  2738.                     type: boolean
  2739.                   nodePortLB:
  2740.                     description: |-
  2741.                       NodePortLB controls, when creating the load-balancer,
  2742.                       whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2743.                       It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2744.                       By default, NodePortLB is false.
  2745.                     type: boolean
  2746.                   passHostHeader:
  2747.                     description: |-
  2748.                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2749.                       By default, passHostHeader is true.
  2750.                     type: boolean
  2751.                   port:
  2752.                     anyOf:
  2753.                     - type: integer
  2754.                     - type: string
  2755.                     description: |-
  2756.                       Port defines the port of a Kubernetes Service.
  2757.                       This can be a reference to a named port.
  2758.                     x-kubernetes-int-or-string: true
  2759.                   responseForwarding:
  2760.                     description: ResponseForwarding defines how Traefik forwards the
  2761.                       response from the upstream Kubernetes Service to the client.
  2762.                     properties:
  2763.                       flushInterval:
  2764.                         description: |-
  2765.                           FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2766.                           A negative value means to flush immediately after each write to the client.
  2767.                           This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2768.                           for such responses, writes are flushed to the client immediately.
  2769.                           Default: 100ms
  2770.                         type: string
  2771.                     type: object
  2772.                   scheme:
  2773.                     description: |-
  2774.                       Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2775.                       It defaults to https when Kubernetes Service port is 443, http otherwise.
  2776.                     type: string
  2777.                   serversTransport:
  2778.                     description: |-
  2779.                       ServersTransport defines the name of ServersTransport resource to use.
  2780.                       It allows to configure the transport between Traefik and your servers.
  2781.                       Can only be used on a Kubernetes Service.
  2782.                     type: string
  2783.                   sticky:
  2784.                     description: |-
  2785.                       Sticky defines the sticky sessions configuration.
  2786.                       More info: https://doc.traefik.io/traefik/v3.2/routing/services/#sticky-sessions
  2787.                     properties:
  2788.                       cookie:
  2789.                         description: Cookie defines the sticky cookie configuration.
  2790.                         properties:
  2791.                           httpOnly:
  2792.                             description: HTTPOnly defines whether the cookie can be
  2793.                               accessed by client-side APIs, such as JavaScript.
  2794.                             type: boolean
  2795.                           maxAge:
  2796.                             description: |-
  2797.                               MaxAge indicates the number of seconds until the cookie expires.
  2798.                               When set to a negative number, the cookie expires immediately.
  2799.                               When set to zero, the cookie never expires.
  2800.                             type: integer
  2801.                           name:
  2802.                             description: Name defines the Cookie name.
  2803.                             type: string
  2804.                           sameSite:
  2805.                             description: |-
  2806.                               SameSite defines the same site policy.
  2807.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2808.                             type: string
  2809.                           secure:
  2810.                             description: Secure defines whether the cookie can only
  2811.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2812.                             type: boolean
  2813.                         type: object
  2814.                     type: object
  2815.                   strategy:
  2816.                     description: |-
  2817.                       Strategy defines the load balancing strategy between the servers.
  2818.                       RoundRobin is the only supported value at the moment.
  2819.                     type: string
  2820.                   weight:
  2821.                     description: |-
  2822.                       Weight defines the weight and should only be specified when Name references a TraefikService object
  2823.                       (and to be precise, one that embeds a Weighted Round Robin).
  2824.                     type: integer
  2825.                 required:
  2826.                 - name
  2827.                 type: object
  2828.               weighted:
  2829.                 description: Weighted defines the Weighted Round Robin configuration.
  2830.                 properties:
  2831.                   services:
  2832.                     description: Services defines the list of Kubernetes Service and/or
  2833.                       TraefikService to load-balance, with weight.
  2834.                     items:
  2835.                       description: Service defines an upstream HTTP service to proxy
  2836.                         traffic to.
  2837.                       properties:
  2838.                         healthCheck:
  2839.                           description: Healthcheck defines health checks for ExternalName
  2840.                             services.
  2841.                           properties:
  2842.                             followRedirects:
  2843.                               description: |-
  2844.                                 FollowRedirects defines whether redirects should be followed during the health check calls.
  2845.                                 Default: true
  2846.                               type: boolean
  2847.                             headers:
  2848.                               additionalProperties:
  2849.                                 type: string
  2850.                               description: Headers defines custom headers to be sent
  2851.                                 to the health check endpoint.
  2852.                               type: object
  2853.                             hostname:
  2854.                               description: Hostname defines the value of hostname
  2855.                                 in the Host header of the health check request.
  2856.                               type: string
  2857.                             interval:
  2858.                               anyOf:
  2859.                               - type: integer
  2860.                               - type: string
  2861.                               description: |-
  2862.                                 Interval defines the frequency of the health check calls.
  2863.                                 Default: 30s
  2864.                               x-kubernetes-int-or-string: true
  2865.                             method:
  2866.                               description: Method defines the healthcheck method.
  2867.                               type: string
  2868.                             mode:
  2869.                               description: |-
  2870.                                 Mode defines the health check mode.
  2871.                                 If defined to grpc, will use the gRPC health check protocol to probe the server.
  2872.                                 Default: http
  2873.                               type: string
  2874.                             path:
  2875.                               description: Path defines the server URL path for the
  2876.                                 health check endpoint.
  2877.                               type: string
  2878.                             port:
  2879.                               description: Port defines the server URL port for the
  2880.                                 health check endpoint.
  2881.                               type: integer
  2882.                             scheme:
  2883.                               description: Scheme replaces the server URL scheme for
  2884.                                 the health check endpoint.
  2885.                               type: string
  2886.                             status:
  2887.                               description: Status defines the expected HTTP status
  2888.                                 code of the response to the health check request.
  2889.                               type: integer
  2890.                             timeout:
  2891.                               anyOf:
  2892.                               - type: integer
  2893.                               - type: string
  2894.                               description: |-
  2895.                                 Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2896.                                 Default: 5s
  2897.                               x-kubernetes-int-or-string: true
  2898.                           type: object
  2899.                         kind:
  2900.                           description: Kind defines the kind of the Service.
  2901.                           enum:
  2902.                           - Service
  2903.                           - TraefikService
  2904.                           type: string
  2905.                         name:
  2906.                           description: |-
  2907.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2908.                             The differentiation between the two is specified in the Kind field.
  2909.                           type: string
  2910.                         namespace:
  2911.                           description: Namespace defines the namespace of the referenced
  2912.                             Kubernetes Service or TraefikService.
  2913.                           type: string
  2914.                         nativeLB:
  2915.                           description: |-
  2916.                             NativeLB controls, when creating the load-balancer,
  2917.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2918.                             The Kubernetes Service itself does load-balance to the pods.
  2919.                             By default, NativeLB is false.
  2920.                           type: boolean
  2921.                         nodePortLB:
  2922.                           description: |-
  2923.                             NodePortLB controls, when creating the load-balancer,
  2924.                             whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2925.                             It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2926.                             By default, NodePortLB is false.
  2927.                           type: boolean
  2928.                         passHostHeader:
  2929.                           description: |-
  2930.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2931.                             By default, passHostHeader is true.
  2932.                           type: boolean
  2933.                         port:
  2934.                           anyOf:
  2935.                           - type: integer
  2936.                           - type: string
  2937.                           description: |-
  2938.                             Port defines the port of a Kubernetes Service.
  2939.                             This can be a reference to a named port.
  2940.                           x-kubernetes-int-or-string: true
  2941.                         responseForwarding:
  2942.                           description: ResponseForwarding defines how Traefik forwards
  2943.                             the response from the upstream Kubernetes Service to the
  2944.                             client.
  2945.                           properties:
  2946.                             flushInterval:
  2947.                               description: |-
  2948.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2949.                                 A negative value means to flush immediately after each write to the client.
  2950.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2951.                                 for such responses, writes are flushed to the client immediately.
  2952.                                 Default: 100ms
  2953.                               type: string
  2954.                           type: object
  2955.                         scheme:
  2956.                           description: |-
  2957.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2958.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2959.                           type: string
  2960.                         serversTransport:
  2961.                           description: |-
  2962.                             ServersTransport defines the name of ServersTransport resource to use.
  2963.                             It allows to configure the transport between Traefik and your servers.
  2964.                             Can only be used on a Kubernetes Service.
  2965.                           type: string
  2966.                         sticky:
  2967.                           description: |-
  2968.                             Sticky defines the sticky sessions configuration.
  2969.                             More info: https://doc.traefik.io/traefik/v3.2/routing/services/#sticky-sessions
  2970.                           properties:
  2971.                             cookie:
  2972.                               description: Cookie defines the sticky cookie configuration.
  2973.                               properties:
  2974.                                 httpOnly:
  2975.                                   description: HTTPOnly defines whether the cookie
  2976.                                     can be accessed by client-side APIs, such as JavaScript.
  2977.                                   type: boolean
  2978.                                 maxAge:
  2979.                                   description: |-
  2980.                                     MaxAge indicates the number of seconds until the cookie expires.
  2981.                                     When set to a negative number, the cookie expires immediately.
  2982.                                     When set to zero, the cookie never expires.
  2983.                                   type: integer
  2984.                                 name:
  2985.                                   description: Name defines the Cookie name.
  2986.                                   type: string
  2987.                                 sameSite:
  2988.                                   description: |-
  2989.                                     SameSite defines the same site policy.
  2990.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2991.                                   type: string
  2992.                                 secure:
  2993.                                   description: Secure defines whether the cookie can
  2994.                                     only be transmitted over an encrypted connection
  2995.                                     (i.e. HTTPS).
  2996.                                   type: boolean
  2997.                               type: object
  2998.                           type: object
  2999.                         strategy:
  3000.                           description: |-
  3001.                             Strategy defines the load balancing strategy between the servers.
  3002.                             RoundRobin is the only supported value at the moment.
  3003.                           type: string
  3004.                         weight:
  3005.                           description: |-
  3006.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  3007.                             (and to be precise, one that embeds a Weighted Round Robin).
  3008.                           type: integer
  3009.                       required:
  3010.                       - name
  3011.                       type: object
  3012.                     type: array
  3013.                   sticky:
  3014.                     description: |-
  3015.                       Sticky defines whether sticky sessions are enabled.
  3016.                       More info: https://doc.traefik.io/traefik/v3.2/routing/providers/kubernetes-crd/#stickiness-and-load-balancing
  3017.                     properties:
  3018.                       cookie:
  3019.                         description: Cookie defines the sticky cookie configuration.
  3020.                         properties:
  3021.                           httpOnly:
  3022.                             description: HTTPOnly defines whether the cookie can be
  3023.                               accessed by client-side APIs, such as JavaScript.
  3024.                             type: boolean
  3025.                           maxAge:
  3026.                             description: |-
  3027.                               MaxAge indicates the number of seconds until the cookie expires.
  3028.                               When set to a negative number, the cookie expires immediately.
  3029.                               When set to zero, the cookie never expires.
  3030.                             type: integer
  3031.                           name:
  3032.                             description: Name defines the Cookie name.
  3033.                             type: string
  3034.                           sameSite:
  3035.                             description: |-
  3036.                               SameSite defines the same site policy.
  3037.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  3038.                             type: string
  3039.                           secure:
  3040.                             description: Secure defines whether the cookie can only
  3041.                               be transmitted over an encrypted connection (i.e. HTTPS).
  3042.                             type: boolean
  3043.                         type: object
  3044.                     type: object
  3045.                 type: object
  3046.             type: object
  3047.         required:
  3048.         - metadata
  3049.         - spec
  3050.         type: object
  3051.     served: true
  3052.     storage: true

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - secrets
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.io
    resources:
      - middlewares
      - middlewaretcps
      - ingressroutes
      - traefikservices
      - ingressroutetcps
      - ingressrouteudps
      - tlsoptions
      - tlsstores
      - serverstransports
      - serverstransporttcps
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default

Traefik

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v3.2
          args:
            - --log.level=DEBUG
            - --api
            - --api.insecure
            - --entryPoints.web.address=:80
            - --entryPoints.tcpep.address=:8000
            - --entryPoints.udpep.address=:9000/udp
            - --providers.kubernetescrd
          ports:
            - name: web
              containerPort: 80
            - name: admin
              containerPort: 8080
            - name: tcpep
              containerPort: 8000
            - name: udpep
              containerPort: 9000

---
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: TCP
      port: 80
      name: web
      targetPort: 80
    - protocol: TCP
      port: 8080
      name: admin
      targetPort: 8080
    - protocol: TCP
      port: 8000
      name: tcpep
      targetPort: 8000

---
apiVersion: v1
kind: Service
metadata:
  name: traefikudp
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: UDP
      port: 9000
      name: udpep
      targetPort: 9000

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: myingressroute
  namespace: default

spec:
  entryPoints:
    - web

  routes:
  - match: Host(`foo`) && PathPrefix(`/bar`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroute.tcp
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressroute.udp
  namespace: default

spec:
  entryPoints:
    - udpep
  routes:
  - services:
      - name: whoamiudp
        port: 8080

Whoami

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  namespace: default
  labels:
    app: traefiklabs
    name: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoami
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: whoami

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamitcp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamitcp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamitcp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamitcp
    spec:
      containers:
        - name: whoamitcp
          image: traefik/whoamitcp
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamitcp
  namespace: default

spec:
  ports:
    - protocol: TCP
      port: 8080
  selector:
    app: traefiklabs
    task: whoamitcp

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamiudp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamiudp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: traefik/whoamiudp:latest
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
  namespace: default

spec:
  ports:
    - port: 8080
  selector:
    app: traefiklabs
    task: whoamiudp

Routing Configuration

Custom Resource Definition (CRD)

  • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
  • Validate that the prerequisites are fulfilled before using the Traefik custom resources.
  • Traefik CRDs are building blocks that you can assemble according to your needs.

You can find an excerpt of the available custom resources in the table below:

KindPurposeConcept Behind
IngressRouteHTTP RoutingHTTP router
MiddlewareTweaks the HTTP requests before they are sent to your serviceHTTP Middlewares
TraefikServiceAbstraction for HTTP loadbalancing/mirroringHTTP service
IngressRouteTCPTCP RoutingTCP router
MiddlewareTCPTweaks the TCP requests before they are sent to your serviceTCP Middlewares
IngressRouteUDPUDP RoutingUDP router
TLSOptionsAllows to configure some parameters of the TLS connectionTLSOptions
TLSStoresAllows to configure the default TLS storeTLSStores
ServersTransportAllows to configure the transport between Traefik and the backendsServersTransport
ServersTransportTCPAllows to configure the transport between Traefik and the backendsTCP ServersTransport

Kind: IngressRoute

IngressRoute is the CRD implementation of a Traefik HTTP router.

Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

IngressRoute Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: foo
  namespace: bar
spec:
  entryPoints:                      # [1]
    - foo
  routes:                           # [2]
  - kind: Rule
    match: Host(`test.example.com`) # [3]
    priority: 10                    # [4]
    middlewares:                    # [5]
    - name: middleware1             # [6]
      namespace: default            # [7]
    services:                       # [8]
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80                      # [9]
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      serversTransport: transport   # [10]
      healthCheck:                  # [11]
        path: /health
        interval: 15s
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
          sameSite: none
          maxAge: 42  
      strategy: RoundRobin
      weight: 10
      nativeLB: true                # [12]
      nodePortLB: true              # [13]
  tls:                              # [14]
    secretName: supersecret         # [15]
    options:                        # [16]
      name: opt                     # [17]
      namespace: default            # [18]
    certResolver: foo               # [19]
    domains:                        # [20]
    - main: example.net             # [21]
      sans:                         # [22]
      - a.example.net
      - b.example.net
RefAttributePurpose
[1]entryPointsList of entry points names
[2]routesList of routes
[3]routes[n].matchDefines the rule corresponding to an underlying router.
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]routes[n].middlewaresList of reference to Middleware
[6]middlewares[n].nameDefines the Middleware name
[7]middlewares[n].namespaceDefines the Middleware namespace. It can be omitted when the Middleware is in the IngressRoute namespace.
[8]routes[n].servicesList of any combination of TraefikService and reference to a Kubernetes service (See below for ExternalName Service setup)
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].serversTransportDefines the reference to a ServersTransport. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[11]services[n].healthCheckDefines the HealthCheck when service references a Kubernetes service of type ExternalName.
[12]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[13]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
[14]tlsDefines TLS certificate configuration
[15]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[16]tls.optionsDefines the reference to a TLSOption
[17]options.nameDefines the TLSOption name
[18]options.namespaceDefines the TLSOption namespace
[19]tls.certResolverDefines the reference to a CertResolver
[20]tls.domainsList of domains
[21]domains[n].mainDefines the main domain name
[22]domains[n].sansList of SANs (alternative domains)

Declaring an IngressRoute

IngressRoute

# All resources definition must be declared
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test-name
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - kind: Rule
    match: Host(`test.example.com`)
    middlewares:
    - name: middleware1
      namespace: default
    priority: 10
    services:
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
      strategy: RoundRobin
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret

Middlewares

# All resources definition must be declared
# Prefixing with /foo
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: middleware1
  namespace: default
spec:
  addPrefix:
    prefix: /foo

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Configuring Backend Protocol

There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

  • Setting the scheme explicitly (http/https/h2c)
  • Configuring the name of the kubernetes service port to start with https (https)
  • Setting the kubernetes service port to use port 443 (https)

If you do not configure the above, Traefik will assume an http connection.

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRoute service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRoute

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Load Balancing

More information in the dedicated server load balancing section.

Declaring and using Kubernetes Service Load Balancing

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: svc1
      namespace: default
    - name: svc2
      namespace: default

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the service NativeLB option to true. Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: Middleware

Middleware is the CRD implementation of a Traefik middleware.

Register the Middleware kind in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

Declaring and Referencing a Middleware

Middleware

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: foo

spec:
  stripPrefix:
    prefixes:
      - /stripit

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: stripprefix
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available middlewares in the dedicated middlewares section.

Kind: TraefikService

TraefikService is the CRD implementation of a “Traefik Service”.

Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the IngressRoute objects, or recursively in others TraefikService objects.

Disambiguate Traefik and Kubernetes Services

As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

The field kind allows the following values:

TraefikService object allows to use any (valid) combinations of:

Weighted Round Robin

More information in the dedicated Weighted Round Robin service load balancing section.

Declaring and Using Weighted Round Robin

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: svc1
        port: 80
        weight: 1
      - name: wrr2
        kind: TraefikService
        weight: 1
      - name: mirror1
        kind: TraefikService
        weight: 1

---
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr2
  namespace: default

spec:
  weighted:
    services:
      - name: svc2
        port: 80
        weight: 1
      - name: svc3
        port: 80
        weight: 1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2
---
apiVersion: v1
kind: Service
metadata:
  name: svc3
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app3

Mirroring

More information in the dedicated mirroring service section.

Declaring and Using Mirroring

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: mirror1
      namespace: default
      kind: TraefikService

Mirroring k8s Service

# Mirroring from a k8s Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: svc1                      # svc1 receives 100% of the traffic
    port: 80
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 15% of this traffic
        kind: TraefikService
        percent: 15

Mirroring Traefik Service

# Mirroring from a Traefik Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: wrr1                      # wrr1 receives 100% of the traffic
    kind: TraefikService
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 10% of this traffic
        kind: TraefikService
        percent: 10

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax (service@provider) should be used to refer to the TraefikService, just as in the middleware case.

Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

Stickiness and load-balancing

As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

Stickiness on two load-balancing levels

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: whoami1
        kind: Service
        port: 80
        weight: 1
        sticky:
          cookie:
            name: lvl2
      - name: whoami2
        kind: Service
        weight: 1
        port: 80
        sticky:
          cookie:
            name: lvl2
    sticky:
      cookie:
        name: lvl1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: whoami1

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami1

---
apiVersion: v1
kind: Service
metadata:
  name: whoami2

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami2

Deployment (to illustrate replicas)

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami1
  labels:
    app: whoami1

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami1
  template:
    metadata:
      labels:
        app: whoami1
    spec:
      containers:
        - name: whoami1
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami2
  labels:
    app: whoami2

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami2
  template:
    metadata:
      labels:
        app: whoami2
    spec:
      containers:
        - name: whoami2
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

Kind: IngressRouteTCP

IngressRouteTCP is the CRD implementation of a Traefik TCP router.

Register the IngressRouteTCP kind in the Kubernetes cluster before creating IngressRouteTCP objects.

IngressRouteTCP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:                    # [1]
    - footcp
  routes:                         # [2]
  - match: HostSNI(`*`)           # [3]
    priority: 10                  # [4]
    middlewares:
    - name: middleware1           # [5]
      namespace: default          # [6]
    services:                     # [7]
    - name: foo                   # [8]
      port: 8080                  # [9]
      weight: 10                  # [10]
      proxyProtocol:              # [11]
        version: 1                # [12]
      serversTransport: transport # [13]
      nativeLB: true              # [14]
      nodePortLB: true            # [15]

  tls:                            # [16]
    secretName: supersecret       # [17]
    options:                      # [18]
      name: opt                   # [19]
      namespace: default          # [20]
    certResolver: foo             # [21]
    domains:                      # [22]
    - main: example.net           # [23]
      sans:                       # [24]
      - a.example.net
      - b.example.net
    passthrough: false            # [25]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].matchDefines the rule of the underlying router
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]middlewares[n].nameDefines the MiddlewareTCP name
[6]middlewares[n].namespaceDefines the MiddlewareTCP namespace
[7]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[8]services[n].nameDefines the name of a Kubernetes service
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].weightDefines the weight to apply to the server load balancing
[11]services[n].proxyProtocolDefines the PROXY protocol configuration
[12]services[n].proxyProtocol.versionDefines the PROXY protocol version
[13]services[n].serversTransportDefines the reference to a ServersTransportTCP. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[14]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[15]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is
[16]tlsDefines TLS certificate configuration
[17]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[18]tls.optionsDefines the reference to a TLSOption
[19]tls.options.nameDefines the TLSOption name
[20]tls.options.namespaceDefines the TLSOption namespace
[21]tls.certResolverDefines the reference to a CertResolver
[22]tls.domainsList of domains
[23]tls.domains[n].mainDefines the main domain name
[24]tls.domains[n].sansList of SANs (alternative domains)
[25]tls.passthroughIf true, delegates the TLS termination to the backend

Declaring an IngressRouteTCP

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:
    - footcp
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    priority: 10
    services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret
    passthrough: false

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteTCP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

Only on IngressRouteTCP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

On both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the TCP service NativeLB option to true. By default, NativeLB is false.

Examples

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: MiddlewareTCP

MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.

Register the MiddlewareTCP kind in the Kubernetes cluster before creating MiddlewareTCP objects or referencing TCP middlewares in the IngressRouteTCP objects.

Declaring and Referencing a MiddlewareTCP

Middleware

apiVersion: traefik.io/v1alpha1
kind: MiddlewareTCP
metadata:
  name: ipallowlist
spec:
  ipAllowList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/allowlist`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: ipallowlist
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the TCP middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a MiddlewareTCP from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available TCP middlewares in the dedicated middlewares section.

Kind: IngressRouteUDP

IngressRouteUDP is the CRD implementation of a Traefik UDP router.

Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

IngressRouteUDP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:                  # [1]
    - fooudp
  routes:                       # [2]
  - services:                   # [3]
    - name: foo                 # [4]
      port: 8080                # [5]
      weight: 10                # [6]
      nativeLB: true            # [7]
      nodePortLB: true          # [8]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[4]services[n].nameDefines the name of a Kubernetes service
[5]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[6]services[n].weightDefines the weight to apply to the server load balancing
[7]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[8]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is NodePort.

Declaring an IngressRouteUDP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteUDP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteUDP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRouteUDP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the UDP service NativeLB option to true. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: TLSOption

TLSOption is the CRD implementation of a Traefik “TLS Option”.

Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the IngressRoute / IngressRouteTCP objects.

TLSOption Attributes

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption                             # [1]
  namespace: default

spec:
  minVersion: VersionTLS12                      # [2]
  maxVersion: VersionTLS13                      # [3]
  curvePreferences:                             # [4]
    - CurveP521
    - CurveP384
  cipherSuites:                                 # [5]
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:                                   # [6]
    secretNames:                                # [7]
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven     # [8]
  sniStrict: true                               # [9]
  alpnProtocols:                                # [10]
    - foobar
RefAttributePurpose
[1]nameDefines the name of the TLSOption resource. One can use default as name to redefine the default TLSOption.
[2]minVersionDefines the minimum TLS version that is acceptable.
[3]maxVersionDefines the maximum TLS version that is acceptable.
[4]cipherSuiteslist of supported cipher suites for TLS versions up to TLS 1.2.
[5]curvePreferencesList of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
[6]clientAuthdetermines the server’s policy for TLS Client Authentication.
[7]clientAuth.secretNameslist of names of the referenced Kubernetes Secrets (in TLSOption namespace). The secret must contain a certificate under either a tls.ca or a ca.crt key.
[8]clientAuth.clientAuthTypedefines the client authentication type to apply. The available values are: NoClientCert, RequestClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
[9]sniStrictif true, Traefik won’t allow connections from clients connections that do not specify a server_name extension.
[10]alpnProtocolsList of supported application level protocols for the TLS handshake, in order of preference.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a TLSOption

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption
  namespace: default

spec:
  minVersion: VersionTLS12
  sniStrict: true
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:
    secretNames:
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    options: 
      name: mytlsoption
      namespace: default

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: secret-ca1
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-ca2
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

Additionally, when the definition of the TLS option is from another provider, the cross-provider syntax (middlewarename@provider) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

Kind: TLSStore

TLSStore is the CRD implementation of a Traefik “TLS Store”.

Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects.

Default TLS Store

Traefik currently only uses the TLS Store named “default”. This default TLSStore should be in a namespace discoverable by Traefik. Since it is used by default on IngressRoute and IngressRouteTCP objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default TLSStore.

TLSStore Attributes

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  certificates:                            # [1]
    - secretName: foo                      
    - secretName: bar
  defaultCertificate:                      # [2]
    secretName: secret
RefAttributePurpose
[1]certificatesList of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store.
[2]defaultCertificateName of a Kubernetes Secret that holds the default key/certificate pair for the store.

Declaring and referencing a TLSStore

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  defaultCertificate:
    secretName:  supersecret

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls: {}

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Kind: ServersTransport

ServersTransport is the CRD implementation of a ServersTransport.

Default serversTransport

If no serversTransport is specified, the default@internal will be used. The default@internal serversTransport is created from the static configuration.

ServersTransport Attributes

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: foobar                        # [1]
  insecureSkipVerify: true                  # [2]
  rootCAsSecrets:                           # [3]
    - foobar
    - foobar
  certificatesSecrets:                      # [4]
    - foobar
    - foobar
  maxIdleConnsPerHost: 1                    # [5]
  forwardingTimeouts:                       # [6]
    dialTimeout: 42s                        # [7]
    responseHeaderTimeout: 42s              # [8]
    idleConnTimeout: 42s                    # [9]
  peerCertURI: foobar                       # [10]
  disableHTTP2: true                        # [11]
  spiffe:                                   # [12] 
    ids:                                    # [13]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [14]
RefAttributePurpose
[1]serverNameServerName used to contact the server.
[2]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[3]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[4]certificatesSecretsCertificates to present to the server for mTLS.
[5]maxIdleConnsPerHostControls the maximum idle (keep-alive) connections to keep per-host. If zero, defaultMaxIdleConnsPerHost is used.
[6]forwardingTimeoutsTimeouts for requests forwarded to the servers.
[7]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[8]responseHeaderTimeoutThe amount of time to wait for a server’s response headers after fully writing the request (including its body, if any). If zero, no timeout exists.
[9]idleConnTimeoutThe maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists.
[10]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[11]disableHTTP2Disables HTTP/2 for connections with servers.
[12]spiffeThe spiffe configuration.
[13]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[14]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransport

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

ServersTransport reference

By default, the referenced ServersTransport CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransport CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransport CRD is defined in another provider the cross-provider format name@provider should be used.

Kind: ServersTransportTCP

ServersTransportTCP is the CRD implementation of a ServersTransportTCP.

Default serversTransportTCP

If no serversTransportTCP is specified, the default@internal will be used. The default@internal serversTransportTCP is created from the static configuration.

ServersTransportTCP Attributes

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  dialTimeout: 42s                          # [1]
  dialKeepAlive: 42s                        # [2]
  terminationDelay: 42s                     # [3]
  tls:                                      # [4]
    serverName: foobar                      # [5]
    insecureSkipVerify: true                # [6]
    peerCertURI: foobar                     # [7]
    rootCAsSecrets:                         # [8]
      - foobar
      - foobar
    certificatesSecrets:                    # [9]
      - foobar
      - foobar
  spiffe:                                   # [10] 
    ids:                                    # [11]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [12]
RefAttributePurpose
[1]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[2]dialKeepAliveThe interval between keep-alive probes for an active network connection. If zero, keep-alive probes are sent with a default value (currently 15 seconds), if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field. If negative, keep-alive probes are disabled.
[3]terminationDelayDefines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability.
[4]tlsThe TLS configuration.
[5]serverNameServerName used to contact the server.
[6]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[7]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[8]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[9]certificatesSecretsCertificates to present to the server for mTLS.
[10]spiffeThe SPIFFE configuration.
[11]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[12]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransportTCP

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  tls:
    serverName: example.org
    insecureSkipVerify: true

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080
        serversTransport: mytransport

ServersTransportTCP reference

By default, the referenced ServersTransportTCP CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransportTCP CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransportTCP CRD is defined in another provider the cross-provider format name@provider should be used.

Further

Also see the full example with Let’s Encrypt.

Using Traefik OSS in Production?

If you are using Traefik at work, consider adding enterprise-grade API gateway capabilities or commercial support for Traefik OSS.

Adding API Gateway capabilities to Traefik OSS is fast and seamless. There’s no rip and replace and all configurations remain intact. See it in action via this short video.