Traefik & Kubernetes

The Kubernetes Ingress Controller, The Custom Resource Way.

Configuration Examples

Configuring KubernetesCRD and Deploying/Exposing Services

Resource Definition

  1. # All resources definition must be declared
  2. ---
  3. apiVersion: apiextensions.k8s.io/v1
  4. kind: CustomResourceDefinition
  5. metadata:
  6.   annotations:
  7.     controller-gen.kubebuilder.io/version: v0.16.1
  8.   name: ingressroutes.traefik.io
  9. spec:
  10.   group: traefik.io
  11.   names:
  12.     kind: IngressRoute
  13.     listKind: IngressRouteList
  14.     plural: ingressroutes
  15.     singular: ingressroute
  16.   scope: Namespaced
  17.   versions:
  18.   - name: v1alpha1
  19.     schema:
  20.       openAPIV3Schema:
  21.         description: IngressRoute is the CRD implementation of a Traefik HTTP Router.
  22.         properties:
  23.           apiVersion:
  24.             description: |-
  25.               APIVersion defines the versioned schema of this representation of an object.
  26.               Servers should convert recognized schemas to the latest internal value, and
  27.               may reject unrecognized values.
  28.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  29.             type: string
  30.           kind:
  31.             description: |-
  32.               Kind is a string value representing the REST resource this object represents.
  33.               Servers may infer this from the endpoint the client submits requests to.
  34.               Cannot be updated.
  35.               In CamelCase.
  36.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  37.             type: string
  38.           metadata:
  39.             type: object
  40.           spec:
  41.             description: IngressRouteSpec defines the desired state of IngressRoute.
  42.             properties:
  43.               entryPoints:
  44.                 description: |-
  45.                   EntryPoints defines the list of entry point names to bind to.
  46.                   Entry points have to be configured in the static configuration.
  47.                   More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/
  48.                   Default: all.
  49.                 items:
  50.                   type: string
  51.                 type: array
  52.               routes:
  53.                 description: Routes defines the list of routes.
  54.                 items:
  55.                   description: Route holds the HTTP route configuration.
  56.                   properties:
  57.                     kind:
  58.                       description: |-
  59.                         Kind defines the kind of the route.
  60.                         Rule is the only supported kind.
  61.                         If not defined, defaults to Rule.
  62.                       enum:
  63.                       - Rule
  64.                       type: string
  65.                     match:
  66.                       description: |-
  67.                         Match defines the router's rule.
  68.                         More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule
  69.                       type: string
  70.                     middlewares:
  71.                       description: |-
  72.                         Middlewares defines the list of references to Middleware resources.
  73.                         More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-middleware
  74.                       items:
  75.                         description: MiddlewareRef is a reference to a Middleware
  76.                           resource.
  77.                         properties:
  78.                           name:
  79.                             description: Name defines the name of the referenced Middleware
  80.                               resource.
  81.                             type: string
  82.                           namespace:
  83.                             description: Namespace defines the namespace of the referenced
  84.                               Middleware resource.
  85.                             type: string
  86.                         required:
  87.                         - name
  88.                         type: object
  89.                       type: array
  90.                     observability:
  91.                       description: |-
  92.                         Observability defines the observability configuration for a router.
  93.                         More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#observability
  94.                       properties:
  95.                         accessLogs:
  96.                           type: boolean
  97.                         metrics:
  98.                           type: boolean
  99.                         tracing:
  100.                           type: boolean
  101.                       type: object
  102.                     priority:
  103.                       description: |-
  104.                         Priority defines the router's priority.
  105.                         More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority
  106.                       type: integer
  107.                     services:
  108.                       description: |-
  109.                         Services defines the list of Service.
  110.                         It can contain any combination of TraefikService and/or reference to a Kubernetes Service.
  111.                       items:
  112.                         description: Service defines an upstream HTTP service to proxy
  113.                           traffic to.
  114.                         properties:
  115.                           healthCheck:
  116.                             description: Healthcheck defines health checks for ExternalName
  117.                               services.
  118.                             properties:
  119.                               followRedirects:
  120.                                 description: |-
  121.                                   FollowRedirects defines whether redirects should be followed during the health check calls.
  122.                                   Default: true
  123.                                 type: boolean
  124.                               headers:
  125.                                 additionalProperties:
  126.                                   type: string
  127.                                 description: Headers defines custom headers to be
  128.                                   sent to the health check endpoint.
  129.                                 type: object
  130.                               hostname:
  131.                                 description: Hostname defines the value of hostname
  132.                                   in the Host header of the health check request.
  133.                                 type: string
  134.                               interval:
  135.                                 anyOf:
  136.                                 - type: integer
  137.                                 - type: string
  138.                                 description: |-
  139.                                   Interval defines the frequency of the health check calls.
  140.                                   Default: 30s
  141.                                 x-kubernetes-int-or-string: true
  142.                               method:
  143.                                 description: Method defines the healthcheck method.
  144.                                 type: string
  145.                               mode:
  146.                                 description: |-
  147.                                   Mode defines the health check mode.
  148.                                   If defined to grpc, will use the gRPC health check protocol to probe the server.
  149.                                   Default: http
  150.                                 type: string
  151.                               path:
  152.                                 description: Path defines the server URL path for
  153.                                   the health check endpoint.
  154.                                 type: string
  155.                               port:
  156.                                 description: Port defines the server URL port for
  157.                                   the health check endpoint.
  158.                                 type: integer
  159.                               scheme:
  160.                                 description: Scheme replaces the server URL scheme
  161.                                   for the health check endpoint.
  162.                                 type: string
  163.                               status:
  164.                                 description: Status defines the expected HTTP status
  165.                                   code of the response to the health check request.
  166.                                 type: integer
  167.                               timeout:
  168.                                 anyOf:
  169.                                 - type: integer
  170.                                 - type: string
  171.                                 description: |-
  172.                                   Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  173.                                   Default: 5s
  174.                                 x-kubernetes-int-or-string: true
  175.                             type: object
  176.                           kind:
  177.                             description: Kind defines the kind of the Service.
  178.                             enum:
  179.                             - Service
  180.                             - TraefikService
  181.                             type: string
  182.                           name:
  183.                             description: |-
  184.                               Name defines the name of the referenced Kubernetes Service or TraefikService.
  185.                               The differentiation between the two is specified in the Kind field.
  186.                             type: string
  187.                           namespace:
  188.                             description: Namespace defines the namespace of the referenced
  189.                               Kubernetes Service or TraefikService.
  190.                             type: string
  191.                           nativeLB:
  192.                             description: |-
  193.                               NativeLB controls, when creating the load-balancer,
  194.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  195.                               The Kubernetes Service itself does load-balance to the pods.
  196.                               By default, NativeLB is false.
  197.                             type: boolean
  198.                           nodePortLB:
  199.                             description: |-
  200.                               NodePortLB controls, when creating the load-balancer,
  201.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  202.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  203.                               By default, NodePortLB is false.
  204.                             type: boolean
  205.                           passHostHeader:
  206.                             description: |-
  207.                               PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  208.                               By default, passHostHeader is true.
  209.                             type: boolean
  210.                           port:
  211.                             anyOf:
  212.                             - type: integer
  213.                             - type: string
  214.                             description: |-
  215.                               Port defines the port of a Kubernetes Service.
  216.                               This can be a reference to a named port.
  217.                             x-kubernetes-int-or-string: true
  218.                           responseForwarding:
  219.                             description: ResponseForwarding defines how Traefik forwards
  220.                               the response from the upstream Kubernetes Service to
  221.                               the client.
  222.                             properties:
  223.                               flushInterval:
  224.                                 description: |-
  225.                                   FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  226.                                   A negative value means to flush immediately after each write to the client.
  227.                                   This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  228.                                   for such responses, writes are flushed to the client immediately.
  229.                                   Default: 100ms
  230.                                 type: string
  231.                             type: object
  232.                           scheme:
  233.                             description: |-
  234.                               Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  235.                               It defaults to https when Kubernetes Service port is 443, http otherwise.
  236.                             type: string
  237.                           serversTransport:
  238.                             description: |-
  239.                               ServersTransport defines the name of ServersTransport resource to use.
  240.                               It allows to configure the transport between Traefik and your servers.
  241.                               Can only be used on a Kubernetes Service.
  242.                             type: string
  243.                           sticky:
  244.                             description: |-
  245.                               Sticky defines the sticky sessions configuration.
  246.                               More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions
  247.                             properties:
  248.                               cookie:
  249.                                 description: Cookie defines the sticky cookie configuration.
  250.                                 properties:
  251.                                   httpOnly:
  252.                                     description: HTTPOnly defines whether the cookie
  253.                                       can be accessed by client-side APIs, such as
  254.                                       JavaScript.
  255.                                     type: boolean
  256.                                   maxAge:
  257.                                     description: |-
  258.                                       MaxAge defines the number of seconds until the cookie expires.
  259.                                       When set to a negative number, the cookie expires immediately.
  260.                                       When set to zero, the cookie never expires.
  261.                                     type: integer
  262.                                   name:
  263.                                     description: Name defines the Cookie name.
  264.                                     type: string
  265.                                   path:
  266.                                     description: |-
  267.                                       Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
  268.                                       When not provided the cookie will be sent on every request to the domain.
  269.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
  270.                                     type: string
  271.                                   sameSite:
  272.                                     description: |-
  273.                                       SameSite defines the same site policy.
  274.                                       More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  275.                                     type: string
  276.                                   secure:
  277.                                     description: Secure defines whether the cookie
  278.                                       can only be transmitted over an encrypted connection
  279.                                       (i.e. HTTPS).
  280.                                     type: boolean
  281.                                 type: object
  282.                             type: object
  283.                           strategy:
  284.                             description: |-
  285.                               Strategy defines the load balancing strategy between the servers.
  286.                               RoundRobin is the only supported value at the moment.
  287.                             type: string
  288.                           weight:
  289.                             description: |-
  290.                               Weight defines the weight and should only be specified when Name references a TraefikService object
  291.                               (and to be precise, one that embeds a Weighted Round Robin).
  292.                             type: integer
  293.                         required:
  294.                         - name
  295.                         type: object
  296.                       type: array
  297.                     syntax:
  298.                       description: |-
  299.                         Syntax defines the router's rule syntax.
  300.                         More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax
  301.                       type: string
  302.                   required:
  303.                   - match
  304.                   type: object
  305.                 type: array
  306.               tls:
  307.                 description: |-
  308.                   TLS defines the TLS configuration.
  309.                   More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls
  310.                 properties:
  311.                   certResolver:
  312.                     description: |-
  313.                       CertResolver defines the name of the certificate resolver to use.
  314.                       Cert resolvers have to be configured in the static configuration.
  315.                       More info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers
  316.                     type: string
  317.                   domains:
  318.                     description: |-
  319.                       Domains defines the list of domains that will be used to issue certificates.
  320.                       More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains
  321.                     items:
  322.                       description: Domain holds a domain name with SANs.
  323.                       properties:
  324.                         main:
  325.                           description: Main defines the main domain name.
  326.                           type: string
  327.                         sans:
  328.                           description: SANs defines the subject alternative domain
  329.                             names.
  330.                           items:
  331.                             type: string
  332.                           type: array
  333.                       type: object
  334.                     type: array
  335.                   options:
  336.                     description: |-
  337.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  338.                       If not defined, the `default` TLSOption is used.
  339.                       More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options
  340.                     properties:
  341.                       name:
  342.                         description: |-
  343.                           Name defines the name of the referenced TLSOption.
  344.                           More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption
  345.                         type: string
  346.                       namespace:
  347.                         description: |-
  348.                           Namespace defines the namespace of the referenced TLSOption.
  349.                           More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption
  350.                         type: string
  351.                     required:
  352.                     - name
  353.                     type: object
  354.                   secretName:
  355.                     description: SecretName is the name of the referenced Kubernetes
  356.                       Secret to specify the certificate details.
  357.                     type: string
  358.                   store:
  359.                     description: |-
  360.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  361.                       Please note that only `default` TLSStore can be used.
  362.                     properties:
  363.                       name:
  364.                         description: |-
  365.                           Name defines the name of the referenced TLSStore.
  366.                           More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore
  367.                         type: string
  368.                       namespace:
  369.                         description: |-
  370.                           Namespace defines the namespace of the referenced TLSStore.
  371.                           More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore
  372.                         type: string
  373.                     required:
  374.                     - name
  375.                     type: object
  376.                 type: object
  377.             required:
  378.             - routes
  379.             type: object
  380.         required:
  381.         - metadata
  382.         - spec
  383.         type: object
  384.     served: true
  385.     storage: true
  386. ---
  387. apiVersion: apiextensions.k8s.io/v1
  388. kind: CustomResourceDefinition
  389. metadata:
  390.   annotations:
  391.     controller-gen.kubebuilder.io/version: v0.16.1
  392.   name: ingressroutetcps.traefik.io
  393. spec:
  394.   group: traefik.io
  395.   names:
  396.     kind: IngressRouteTCP
  397.     listKind: IngressRouteTCPList
  398.     plural: ingressroutetcps
  399.     singular: ingressroutetcp
  400.   scope: Namespaced
  401.   versions:
  402.   - name: v1alpha1
  403.     schema:
  404.       openAPIV3Schema:
  405.         description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router.
  406.         properties:
  407.           apiVersion:
  408.             description: |-
  409.               APIVersion defines the versioned schema of this representation of an object.
  410.               Servers should convert recognized schemas to the latest internal value, and
  411.               may reject unrecognized values.
  412.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  413.             type: string
  414.           kind:
  415.             description: |-
  416.               Kind is a string value representing the REST resource this object represents.
  417.               Servers may infer this from the endpoint the client submits requests to.
  418.               Cannot be updated.
  419.               In CamelCase.
  420.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  421.             type: string
  422.           metadata:
  423.             type: object
  424.           spec:
  425.             description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP.
  426.             properties:
  427.               entryPoints:
  428.                 description: |-
  429.                   EntryPoints defines the list of entry point names to bind to.
  430.                   Entry points have to be configured in the static configuration.
  431.                   More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/
  432.                   Default: all.
  433.                 items:
  434.                   type: string
  435.                 type: array
  436.               routes:
  437.                 description: Routes defines the list of routes.
  438.                 items:
  439.                   description: RouteTCP holds the TCP route configuration.
  440.                   properties:
  441.                     match:
  442.                       description: |-
  443.                         Match defines the router's rule.
  444.                         More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule_1
  445.                       type: string
  446.                     middlewares:
  447.                       description: Middlewares defines the list of references to MiddlewareTCP
  448.                         resources.
  449.                       items:
  450.                         description: ObjectReference is a generic reference to a Traefik
  451.                           resource.
  452.                         properties:
  453.                           name:
  454.                             description: Name defines the name of the referenced Traefik
  455.                               resource.
  456.                             type: string
  457.                           namespace:
  458.                             description: Namespace defines the namespace of the referenced
  459.                               Traefik resource.
  460.                             type: string
  461.                         required:
  462.                         - name
  463.                         type: object
  464.                       type: array
  465.                     priority:
  466.                       description: |-
  467.                         Priority defines the router's priority.
  468.                         More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority_1
  469.                       type: integer
  470.                     services:
  471.                       description: Services defines the list of TCP services.
  472.                       items:
  473.                         description: ServiceTCP defines an upstream TCP service to
  474.                           proxy traffic to.
  475.                         properties:
  476.                           name:
  477.                             description: Name defines the name of the referenced Kubernetes
  478.                               Service.
  479.                             type: string
  480.                           namespace:
  481.                             description: Namespace defines the namespace of the referenced
  482.                               Kubernetes Service.
  483.                             type: string
  484.                           nativeLB:
  485.                             description: |-
  486.                               NativeLB controls, when creating the load-balancer,
  487.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  488.                               The Kubernetes Service itself does load-balance to the pods.
  489.                               By default, NativeLB is false.
  490.                             type: boolean
  491.                           nodePortLB:
  492.                             description: |-
  493.                               NodePortLB controls, when creating the load-balancer,
  494.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  495.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  496.                               By default, NodePortLB is false.
  497.                             type: boolean
  498.                           port:
  499.                             anyOf:
  500.                             - type: integer
  501.                             - type: string
  502.                             description: |-
  503.                               Port defines the port of a Kubernetes Service.
  504.                               This can be a reference to a named port.
  505.                             x-kubernetes-int-or-string: true
  506.                           proxyProtocol:
  507.                             description: |-
  508.                               ProxyProtocol defines the PROXY protocol configuration.
  509.                               More info: https://doc.traefik.io/traefik/v3.3/routing/services/#proxy-protocol
  510.                             properties:
  511.                               version:
  512.                                 description: Version defines the PROXY Protocol version
  513.                                   to use.
  514.                                 type: integer
  515.                             type: object
  516.                           serversTransport:
  517.                             description: |-
  518.                               ServersTransport defines the name of ServersTransportTCP resource to use.
  519.                               It allows to configure the transport between Traefik and your servers.
  520.                               Can only be used on a Kubernetes Service.
  521.                             type: string
  522.                           terminationDelay:
  523.                             description: |-
  524.                               TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates
  525.                               it has closed the writing capability of its connection, to close the reading capability as well,
  526.                               hence fully terminating the connection.
  527.                               It is a duration in milliseconds, defaulting to 100.
  528.                               A negative value means an infinite deadline (i.e. the reading capability is never closed).
  529.                               Deprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead.
  530.                             type: integer
  531.                           tls:
  532.                             description: TLS determines whether to use TLS when dialing
  533.                               with the backend.
  534.                             type: boolean
  535.                           weight:
  536.                             description: Weight defines the weight used when balancing
  537.                               requests between multiple Kubernetes Service.
  538.                             type: integer
  539.                         required:
  540.                         - name
  541.                         - port
  542.                         type: object
  543.                       type: array
  544.                     syntax:
  545.                       description: |-
  546.                         Syntax defines the router's rule syntax.
  547.                         More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax_1
  548.                       type: string
  549.                   required:
  550.                   - match
  551.                   type: object
  552.                 type: array
  553.               tls:
  554.                 description: |-
  555.                   TLS defines the TLS configuration on a layer 4 / TCP Route.
  556.                   More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls_1
  557.                 properties:
  558.                   certResolver:
  559.                     description: |-
  560.                       CertResolver defines the name of the certificate resolver to use.
  561.                       Cert resolvers have to be configured in the static configuration.
  562.                       More info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers
  563.                     type: string
  564.                   domains:
  565.                     description: |-
  566.                       Domains defines the list of domains that will be used to issue certificates.
  567.                       More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains
  568.                     items:
  569.                       description: Domain holds a domain name with SANs.
  570.                       properties:
  571.                         main:
  572.                           description: Main defines the main domain name.
  573.                           type: string
  574.                         sans:
  575.                           description: SANs defines the subject alternative domain
  576.                             names.
  577.                           items:
  578.                             type: string
  579.                           type: array
  580.                       type: object
  581.                     type: array
  582.                   options:
  583.                     description: |-
  584.                       Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
  585.                       If not defined, the `default` TLSOption is used.
  586.                       More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options
  587.                     properties:
  588.                       name:
  589.                         description: Name defines the name of the referenced Traefik
  590.                           resource.
  591.                         type: string
  592.                       namespace:
  593.                         description: Namespace defines the namespace of the referenced
  594.                           Traefik resource.
  595.                         type: string
  596.                     required:
  597.                     - name
  598.                     type: object
  599.                   passthrough:
  600.                     description: Passthrough defines whether a TLS router will terminate
  601.                       the TLS connection.
  602.                     type: boolean
  603.                   secretName:
  604.                     description: SecretName is the name of the referenced Kubernetes
  605.                       Secret to specify the certificate details.
  606.                     type: string
  607.                   store:
  608.                     description: |-
  609.                       Store defines the reference to the TLSStore, that will be used to store certificates.
  610.                       Please note that only `default` TLSStore can be used.
  611.                     properties:
  612.                       name:
  613.                         description: Name defines the name of the referenced Traefik
  614.                           resource.
  615.                         type: string
  616.                       namespace:
  617.                         description: Namespace defines the namespace of the referenced
  618.                           Traefik resource.
  619.                         type: string
  620.                     required:
  621.                     - name
  622.                     type: object
  623.                 type: object
  624.             required:
  625.             - routes
  626.             type: object
  627.         required:
  628.         - metadata
  629.         - spec
  630.         type: object
  631.     served: true
  632.     storage: true
  633. ---
  634. apiVersion: apiextensions.k8s.io/v1
  635. kind: CustomResourceDefinition
  636. metadata:
  637.   annotations:
  638.     controller-gen.kubebuilder.io/version: v0.16.1
  639.   name: ingressrouteudps.traefik.io
  640. spec:
  641.   group: traefik.io
  642.   names:
  643.     kind: IngressRouteUDP
  644.     listKind: IngressRouteUDPList
  645.     plural: ingressrouteudps
  646.     singular: ingressrouteudp
  647.   scope: Namespaced
  648.   versions:
  649.   - name: v1alpha1
  650.     schema:
  651.       openAPIV3Schema:
  652.         description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router.
  653.         properties:
  654.           apiVersion:
  655.             description: |-
  656.               APIVersion defines the versioned schema of this representation of an object.
  657.               Servers should convert recognized schemas to the latest internal value, and
  658.               may reject unrecognized values.
  659.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  660.             type: string
  661.           kind:
  662.             description: |-
  663.               Kind is a string value representing the REST resource this object represents.
  664.               Servers may infer this from the endpoint the client submits requests to.
  665.               Cannot be updated.
  666.               In CamelCase.
  667.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  668.             type: string
  669.           metadata:
  670.             type: object
  671.           spec:
  672.             description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.
  673.             properties:
  674.               entryPoints:
  675.                 description: |-
  676.                   EntryPoints defines the list of entry point names to bind to.
  677.                   Entry points have to be configured in the static configuration.
  678.                   More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/
  679.                   Default: all.
  680.                 items:
  681.                   type: string
  682.                 type: array
  683.               routes:
  684.                 description: Routes defines the list of routes.
  685.                 items:
  686.                   description: RouteUDP holds the UDP route configuration.
  687.                   properties:
  688.                     services:
  689.                       description: Services defines the list of UDP services.
  690.                       items:
  691.                         description: ServiceUDP defines an upstream UDP service to
  692.                           proxy traffic to.
  693.                         properties:
  694.                           name:
  695.                             description: Name defines the name of the referenced Kubernetes
  696.                               Service.
  697.                             type: string
  698.                           namespace:
  699.                             description: Namespace defines the namespace of the referenced
  700.                               Kubernetes Service.
  701.                             type: string
  702.                           nativeLB:
  703.                             description: |-
  704.                               NativeLB controls, when creating the load-balancer,
  705.                               whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  706.                               The Kubernetes Service itself does load-balance to the pods.
  707.                               By default, NativeLB is false.
  708.                             type: boolean
  709.                           nodePortLB:
  710.                             description: |-
  711.                               NodePortLB controls, when creating the load-balancer,
  712.                               whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  713.                               It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  714.                               By default, NodePortLB is false.
  715.                             type: boolean
  716.                           port:
  717.                             anyOf:
  718.                             - type: integer
  719.                             - type: string
  720.                             description: |-
  721.                               Port defines the port of a Kubernetes Service.
  722.                               This can be a reference to a named port.
  723.                             x-kubernetes-int-or-string: true
  724.                           weight:
  725.                             description: Weight defines the weight used when balancing
  726.                               requests between multiple Kubernetes Service.
  727.                             type: integer
  728.                         required:
  729.                         - name
  730.                         - port
  731.                         type: object
  732.                       type: array
  733.                   type: object
  734.                 type: array
  735.             required:
  736.             - routes
  737.             type: object
  738.         required:
  739.         - metadata
  740.         - spec
  741.         type: object
  742.     served: true
  743.     storage: true
  744. ---
  745. apiVersion: apiextensions.k8s.io/v1
  746. kind: CustomResourceDefinition
  747. metadata:
  748.   annotations:
  749.     controller-gen.kubebuilder.io/version: v0.16.1
  750.   name: middlewares.traefik.io
  751. spec:
  752.   group: traefik.io
  753.   names:
  754.     kind: Middleware
  755.     listKind: MiddlewareList
  756.     plural: middlewares
  757.     singular: middleware
  758.   scope: Namespaced
  759.   versions:
  760.   - name: v1alpha1
  761.     schema:
  762.       openAPIV3Schema:
  763.         description: |-
  764.           Middleware is the CRD implementation of a Traefik Middleware.
  765.           More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/overview/
  766.         properties:
  767.           apiVersion:
  768.             description: |-
  769.               APIVersion defines the versioned schema of this representation of an object.
  770.               Servers should convert recognized schemas to the latest internal value, and
  771.               may reject unrecognized values.
  772.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  773.             type: string
  774.           kind:
  775.             description: |-
  776.               Kind is a string value representing the REST resource this object represents.
  777.               Servers may infer this from the endpoint the client submits requests to.
  778.               Cannot be updated.
  779.               In CamelCase.
  780.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  781.             type: string
  782.           metadata:
  783.             type: object
  784.           spec:
  785.             description: MiddlewareSpec defines the desired state of a Middleware.
  786.             properties:
  787.               addPrefix:
  788.                 description: |-
  789.                   AddPrefix holds the add prefix middleware configuration.
  790.                   This middleware updates the path of a request before forwarding it.
  791.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/addprefix/
  792.                 properties:
  793.                   prefix:
  794.                     description: |-
  795.                       Prefix is the string to add before the current path in the requested URL.
  796.                       It should include a leading slash (/).
  797.                     type: string
  798.                 type: object
  799.               basicAuth:
  800.                 description: |-
  801.                   BasicAuth holds the basic auth middleware configuration.
  802.                   This middleware restricts access to your services to known users.
  803.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/
  804.                 properties:
  805.                   headerField:
  806.                     description: |-
  807.                       HeaderField defines a header field to store the authenticated user.
  808.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield
  809.                     type: string
  810.                   realm:
  811.                     description: |-
  812.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  813.                       Default: traefik.
  814.                     type: string
  815.                   removeHeader:
  816.                     description: |-
  817.                       RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service.
  818.                       Default: false.
  819.                     type: boolean
  820.                   secret:
  821.                     description: Secret is the name of the referenced Kubernetes Secret
  822.                       containing user credentials.
  823.                     type: string
  824.                 type: object
  825.               buffering:
  826.                 description: |-
  827.                   Buffering holds the buffering middleware configuration.
  828.                   This middleware retries or limits the size of requests that can be forwarded to backends.
  829.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#maxrequestbodybytes
  830.                 properties:
  831.                   maxRequestBodyBytes:
  832.                     description: |-
  833.                       MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).
  834.                       If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.
  835.                       Default: 0 (no maximum).
  836.                     format: int64
  837.                     type: integer
  838.                   maxResponseBodyBytes:
  839.                     description: |-
  840.                       MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes).
  841.                       If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead.
  842.                       Default: 0 (no maximum).
  843.                     format: int64
  844.                     type: integer
  845.                   memRequestBodyBytes:
  846.                     description: |-
  847.                       MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory.
  848.                       Default: 1048576 (1Mi).
  849.                     format: int64
  850.                     type: integer
  851.                   memResponseBodyBytes:
  852.                     description: |-
  853.                       MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory.
  854.                       Default: 1048576 (1Mi).
  855.                     format: int64
  856.                     type: integer
  857.                   retryExpression:
  858.                     description: |-
  859.                       RetryExpression defines the retry conditions.
  860.                       It is a logical combination of functions with operators AND (&&) and OR (||).
  861.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#retryexpression
  862.                     type: string
  863.                 type: object
  864.               chain:
  865.                 description: |-
  866.                   Chain holds the configuration of the chain middleware.
  867.                   This middleware enables to define reusable combinations of other pieces of middleware.
  868.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/chain/
  869.                 properties:
  870.                   middlewares:
  871.                     description: Middlewares is the list of MiddlewareRef which composes
  872.                       the chain.
  873.                     items:
  874.                       description: MiddlewareRef is a reference to a Middleware resource.
  875.                       properties:
  876.                         name:
  877.                           description: Name defines the name of the referenced Middleware
  878.                             resource.
  879.                           type: string
  880.                         namespace:
  881.                           description: Namespace defines the namespace of the referenced
  882.                             Middleware resource.
  883.                           type: string
  884.                       required:
  885.                       - name
  886.                       type: object
  887.                     type: array
  888.                 type: object
  889.               circuitBreaker:
  890.                 description: CircuitBreaker holds the circuit breaker configuration.
  891.                 properties:
  892.                   checkPeriod:
  893.                     anyOf:
  894.                     - type: integer
  895.                     - type: string
  896.                     description: CheckPeriod is the interval between successive checks
  897.                       of the circuit breaker condition (when in standby state).
  898.                     x-kubernetes-int-or-string: true
  899.                   expression:
  900.                     description: Expression is the condition that triggers the tripped
  901.                       state.
  902.                     type: string
  903.                   fallbackDuration:
  904.                     anyOf:
  905.                     - type: integer
  906.                     - type: string
  907.                     description: FallbackDuration is the duration for which the circuit
  908.                       breaker will wait before trying to recover (from a tripped state).
  909.                     x-kubernetes-int-or-string: true
  910.                   recoveryDuration:
  911.                     anyOf:
  912.                     - type: integer
  913.                     - type: string
  914.                     description: RecoveryDuration is the duration for which the circuit
  915.                       breaker will try to recover (as soon as it is in recovering
  916.                       state).
  917.                     x-kubernetes-int-or-string: true
  918.                   responseCode:
  919.                     description: ResponseCode is the status code that the circuit
  920.                       breaker will return while it is in the open state.
  921.                     type: integer
  922.                 type: object
  923.               compress:
  924.                 description: |-
  925.                   Compress holds the compress middleware configuration.
  926.                   This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.
  927.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/compress/
  928.                 properties:
  929.                   defaultEncoding:
  930.                     description: DefaultEncoding specifies the default encoding if
  931.                       the `Accept-Encoding` header is not in the request or contains
  932.                       a wildcard (`*`).
  933.                     type: string
  934.                   encodings:
  935.                     description: Encodings defines the list of supported compression
  936.                       algorithms.
  937.                     items:
  938.                       type: string
  939.                     type: array
  940.                   excludedContentTypes:
  941.                     description: |-
  942.                       ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing.
  943.                       `application/grpc` is always excluded.
  944.                     items:
  945.                       type: string
  946.                     type: array
  947.                   includedContentTypes:
  948.                     description: IncludedContentTypes defines the list of content
  949.                       types to compare the Content-Type header of the responses before
  950.                       compressing.
  951.                     items:
  952.                       type: string
  953.                     type: array
  954.                   minResponseBodyBytes:
  955.                     description: |-
  956.                       MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed.
  957.                       Default: 1024.
  958.                     type: integer
  959.                 type: object
  960.               contentType:
  961.                 description: |-
  962.                   ContentType holds the content-type middleware configuration.
  963.                   This middleware exists to enable the correct behavior until at least the default one can be changed in a future version.
  964.                 properties:
  965.                   autoDetect:
  966.                     description: |-
  967.                       AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend,
  968.                       be automatically set to a value derived from the contents of the response.
  969.                       Deprecated: AutoDetect option is deprecated, Content-Type middleware is only meant to be used to enable the content-type detection, please remove any usage of this option.
  970.                     type: boolean
  971.                 type: object
  972.               digestAuth:
  973.                 description: |-
  974.                   DigestAuth holds the digest auth middleware configuration.
  975.                   This middleware restricts access to your services to known users.
  976.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/digestauth/
  977.                 properties:
  978.                   headerField:
  979.                     description: |-
  980.                       HeaderField defines a header field to store the authenticated user.
  981.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield
  982.                     type: string
  983.                   realm:
  984.                     description: |-
  985.                       Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.
  986.                       Default: traefik.
  987.                     type: string
  988.                   removeHeader:
  989.                     description: RemoveHeader defines whether to remove the authorization
  990.                       header before forwarding the request to the backend.
  991.                     type: boolean
  992.                   secret:
  993.                     description: Secret is the name of the referenced Kubernetes Secret
  994.                       containing user credentials.
  995.                     type: string
  996.                 type: object
  997.               errors:
  998.                 description: |-
  999.                   ErrorPage holds the custom error middleware configuration.
  1000.                   This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
  1001.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/
  1002.                 properties:
  1003.                   query:
  1004.                     description: |-
  1005.                       Query defines the URL for the error page (hosted by service).
  1006.                       The {status} variable can be used in order to insert the status code in the URL.
  1007.                     type: string
  1008.                   service:
  1009.                     description: |-
  1010.                       Service defines the reference to a Kubernetes Service that will serve the error page.
  1011.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/#service
  1012.                     properties:
  1013.                       healthCheck:
  1014.                         description: Healthcheck defines health checks for ExternalName
  1015.                           services.
  1016.                         properties:
  1017.                           followRedirects:
  1018.                             description: |-
  1019.                               FollowRedirects defines whether redirects should be followed during the health check calls.
  1020.                               Default: true
  1021.                             type: boolean
  1022.                           headers:
  1023.                             additionalProperties:
  1024.                               type: string
  1025.                             description: Headers defines custom headers to be sent
  1026.                               to the health check endpoint.
  1027.                             type: object
  1028.                           hostname:
  1029.                             description: Hostname defines the value of hostname in
  1030.                               the Host header of the health check request.
  1031.                             type: string
  1032.                           interval:
  1033.                             anyOf:
  1034.                             - type: integer
  1035.                             - type: string
  1036.                             description: |-
  1037.                               Interval defines the frequency of the health check calls.
  1038.                               Default: 30s
  1039.                             x-kubernetes-int-or-string: true
  1040.                           method:
  1041.                             description: Method defines the healthcheck method.
  1042.                             type: string
  1043.                           mode:
  1044.                             description: |-
  1045.                               Mode defines the health check mode.
  1046.                               If defined to grpc, will use the gRPC health check protocol to probe the server.
  1047.                               Default: http
  1048.                             type: string
  1049.                           path:
  1050.                             description: Path defines the server URL path for the
  1051.                               health check endpoint.
  1052.                             type: string
  1053.                           port:
  1054.                             description: Port defines the server URL port for the
  1055.                               health check endpoint.
  1056.                             type: integer
  1057.                           scheme:
  1058.                             description: Scheme replaces the server URL scheme for
  1059.                               the health check endpoint.
  1060.                             type: string
  1061.                           status:
  1062.                             description: Status defines the expected HTTP status code
  1063.                               of the response to the health check request.
  1064.                             type: integer
  1065.                           timeout:
  1066.                             anyOf:
  1067.                             - type: integer
  1068.                             - type: string
  1069.                             description: |-
  1070.                               Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  1071.                               Default: 5s
  1072.                             x-kubernetes-int-or-string: true
  1073.                         type: object
  1074.                       kind:
  1075.                         description: Kind defines the kind of the Service.
  1076.                         enum:
  1077.                         - Service
  1078.                         - TraefikService
  1079.                         type: string
  1080.                       name:
  1081.                         description: |-
  1082.                           Name defines the name of the referenced Kubernetes Service or TraefikService.
  1083.                           The differentiation between the two is specified in the Kind field.
  1084.                         type: string
  1085.                       namespace:
  1086.                         description: Namespace defines the namespace of the referenced
  1087.                           Kubernetes Service or TraefikService.
  1088.                         type: string
  1089.                       nativeLB:
  1090.                         description: |-
  1091.                           NativeLB controls, when creating the load-balancer,
  1092.                           whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  1093.                           The Kubernetes Service itself does load-balance to the pods.
  1094.                           By default, NativeLB is false.
  1095.                         type: boolean
  1096.                       nodePortLB:
  1097.                         description: |-
  1098.                           NodePortLB controls, when creating the load-balancer,
  1099.                           whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  1100.                           It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  1101.                           By default, NodePortLB is false.
  1102.                         type: boolean
  1103.                       passHostHeader:
  1104.                         description: |-
  1105.                           PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  1106.                           By default, passHostHeader is true.
  1107.                         type: boolean
  1108.                       port:
  1109.                         anyOf:
  1110.                         - type: integer
  1111.                         - type: string
  1112.                         description: |-
  1113.                           Port defines the port of a Kubernetes Service.
  1114.                           This can be a reference to a named port.
  1115.                         x-kubernetes-int-or-string: true
  1116.                       responseForwarding:
  1117.                         description: ResponseForwarding defines how Traefik forwards
  1118.                           the response from the upstream Kubernetes Service to the
  1119.                           client.
  1120.                         properties:
  1121.                           flushInterval:
  1122.                             description: |-
  1123.                               FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  1124.                               A negative value means to flush immediately after each write to the client.
  1125.                               This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  1126.                               for such responses, writes are flushed to the client immediately.
  1127.                               Default: 100ms
  1128.                             type: string
  1129.                         type: object
  1130.                       scheme:
  1131.                         description: |-
  1132.                           Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  1133.                           It defaults to https when Kubernetes Service port is 443, http otherwise.
  1134.                         type: string
  1135.                       serversTransport:
  1136.                         description: |-
  1137.                           ServersTransport defines the name of ServersTransport resource to use.
  1138.                           It allows to configure the transport between Traefik and your servers.
  1139.                           Can only be used on a Kubernetes Service.
  1140.                         type: string
  1141.                       sticky:
  1142.                         description: |-
  1143.                           Sticky defines the sticky sessions configuration.
  1144.                           More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions
  1145.                         properties:
  1146.                           cookie:
  1147.                             description: Cookie defines the sticky cookie configuration.
  1148.                             properties:
  1149.                               httpOnly:
  1150.                                 description: HTTPOnly defines whether the cookie can
  1151.                                   be accessed by client-side APIs, such as JavaScript.
  1152.                                 type: boolean
  1153.                               maxAge:
  1154.                                 description: |-
  1155.                                   MaxAge defines the number of seconds until the cookie expires.
  1156.                                   When set to a negative number, the cookie expires immediately.
  1157.                                   When set to zero, the cookie never expires.
  1158.                                 type: integer
  1159.                               name:
  1160.                                 description: Name defines the Cookie name.
  1161.                                 type: string
  1162.                               path:
  1163.                                 description: |-
  1164.                                   Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
  1165.                                   When not provided the cookie will be sent on every request to the domain.
  1166.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
  1167.                                 type: string
  1168.                               sameSite:
  1169.                                 description: |-
  1170.                                   SameSite defines the same site policy.
  1171.                                   More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  1172.                                 type: string
  1173.                               secure:
  1174.                                 description: Secure defines whether the cookie can
  1175.                                   only be transmitted over an encrypted connection
  1176.                                   (i.e. HTTPS).
  1177.                                 type: boolean
  1178.                             type: object
  1179.                         type: object
  1180.                       strategy:
  1181.                         description: |-
  1182.                           Strategy defines the load balancing strategy between the servers.
  1183.                           RoundRobin is the only supported value at the moment.
  1184.                         type: string
  1185.                       weight:
  1186.                         description: |-
  1187.                           Weight defines the weight and should only be specified when Name references a TraefikService object
  1188.                           (and to be precise, one that embeds a Weighted Round Robin).
  1189.                         type: integer
  1190.                     required:
  1191.                     - name
  1192.                     type: object
  1193.                   status:
  1194.                     description: |-
  1195.                       Status defines which status or range of statuses should result in an error page.
  1196.                       It can be either a status code as a number (500),
  1197.                       as multiple comma-separated numbers (500,502),
  1198.                       as ranges by separating two codes with a dash (500-599),
  1199.                       or a combination of the two (404,418,500-599).
  1200.                     items:
  1201.                       type: string
  1202.                     type: array
  1203.                 type: object
  1204.               forwardAuth:
  1205.                 description: |-
  1206.                   ForwardAuth holds the forward auth middleware configuration.
  1207.                   This middleware delegates the request authentication to a Service.
  1208.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/
  1209.                 properties:
  1210.                   addAuthCookiesToResponse:
  1211.                     description: AddAuthCookiesToResponse defines the list of cookies
  1212.                       to copy from the authentication server response to the response.
  1213.                     items:
  1214.                       type: string
  1215.                     type: array
  1216.                   address:
  1217.                     description: Address defines the authentication server address.
  1218.                     type: string
  1219.                   authRequestHeaders:
  1220.                     description: |-
  1221.                       AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.
  1222.                       If not set or empty then all request headers are passed.
  1223.                     items:
  1224.                       type: string
  1225.                     type: array
  1226.                   authResponseHeaders:
  1227.                     description: AuthResponseHeaders defines the list of headers to
  1228.                       copy from the authentication server response and set on forwarded
  1229.                       request, replacing any existing conflicting headers.
  1230.                     items:
  1231.                       type: string
  1232.                     type: array
  1233.                   authResponseHeadersRegex:
  1234.                     description: |-
  1235.                       AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
  1236.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/#authresponseheadersregex
  1237.                     type: string
  1238.                   forwardBody:
  1239.                     description: ForwardBody defines whether to send the request body
  1240.                       to the authentication server.
  1241.                     type: boolean
  1242.                   maxBodySize:
  1243.                     description: MaxBodySize defines the maximum body size in bytes
  1244.                       allowed to be forwarded to the authentication server.
  1245.                     format: int64
  1246.                     type: integer
  1247.                   preserveLocationHeader:
  1248.                     description: PreserveLocationHeader defines whether to forward
  1249.                       the Location header to the client as is or prefix it with the
  1250.                       domain name of the authentication server.
  1251.                     type: boolean
  1252.                   tls:
  1253.                     description: TLS defines the configuration used to secure the
  1254.                       connection to the authentication server.
  1255.                     properties:
  1256.                       caOptional:
  1257.                         description: 'Deprecated: TLS client authentication is a server
  1258.                           side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634).'
  1259.                         type: boolean
  1260.                       caSecret:
  1261.                         description: |-
  1262.                           CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate.
  1263.                           The CA certificate is extracted from key `tls.ca` or `ca.crt`.
  1264.                         type: string
  1265.                       certSecret:
  1266.                         description: |-
  1267.                           CertSecret is the name of the referenced Kubernetes Secret containing the client certificate.
  1268.                           The client certificate is extracted from the keys `tls.crt` and `tls.key`.
  1269.                         type: string
  1270.                       insecureSkipVerify:
  1271.                         description: InsecureSkipVerify defines whether the server
  1272.                           certificates should be validated.
  1273.                         type: boolean
  1274.                     type: object
  1275.                   trustForwardHeader:
  1276.                     description: 'TrustForwardHeader defines whether to trust (ie:
  1277.                       forward) all X-Forwarded-* headers.'
  1278.                     type: boolean
  1279.                 type: object
  1280.               grpcWeb:
  1281.                 description: |-
  1282.                   GrpcWeb holds the gRPC web middleware configuration.
  1283.                   This middleware converts a gRPC web request to an HTTP/2 gRPC request.
  1284.                 properties:
  1285.                   allowOrigins:
  1286.                     description: |-
  1287.                       AllowOrigins is a list of allowable origins.
  1288.                       Can also be a wildcard origin "*".
  1289.                     items:
  1290.                       type: string
  1291.                     type: array
  1292.                 type: object
  1293.               headers:
  1294.                 description: |-
  1295.                   Headers holds the headers middleware configuration.
  1296.                   This middleware manages the requests and responses headers.
  1297.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/headers/#customrequestheaders
  1298.                 properties:
  1299.                   accessControlAllowCredentials:
  1300.                     description: AccessControlAllowCredentials defines whether the
  1301.                       request can include user credentials.
  1302.                     type: boolean
  1303.                   accessControlAllowHeaders:
  1304.                     description: AccessControlAllowHeaders defines the Access-Control-Request-Headers
  1305.                       values sent in preflight response.
  1306.                     items:
  1307.                       type: string
  1308.                     type: array
  1309.                   accessControlAllowMethods:
  1310.                     description: AccessControlAllowMethods defines the Access-Control-Request-Method
  1311.                       values sent in preflight response.
  1312.                     items:
  1313.                       type: string
  1314.                     type: array
  1315.                   accessControlAllowOriginList:
  1316.                     description: AccessControlAllowOriginList is a list of allowable
  1317.                       origins. Can also be a wildcard origin "*".
  1318.                     items:
  1319.                       type: string
  1320.                     type: array
  1321.                   accessControlAllowOriginListRegex:
  1322.                     description: AccessControlAllowOriginListRegex is a list of allowable
  1323.                       origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
  1324.                     items:
  1325.                       type: string
  1326.                     type: array
  1327.                   accessControlExposeHeaders:
  1328.                     description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers
  1329.                       values sent in preflight response.
  1330.                     items:
  1331.                       type: string
  1332.                     type: array
  1333.                   accessControlMaxAge:
  1334.                     description: AccessControlMaxAge defines the time that a preflight
  1335.                       request may be cached.
  1336.                     format: int64
  1337.                     type: integer
  1338.                   addVaryHeader:
  1339.                     description: AddVaryHeader defines whether the Vary header is
  1340.                       automatically added/updated when the AccessControlAllowOriginList
  1341.                       is set.
  1342.                     type: boolean
  1343.                   allowedHosts:
  1344.                     description: AllowedHosts defines the fully qualified list of
  1345.                       allowed domain names.
  1346.                     items:
  1347.                       type: string
  1348.                     type: array
  1349.                   browserXssFilter:
  1350.                     description: BrowserXSSFilter defines whether to add the X-XSS-Protection
  1351.                       header with the value 1; mode=block.
  1352.                     type: boolean
  1353.                   contentSecurityPolicy:
  1354.                     description: ContentSecurityPolicy defines the Content-Security-Policy
  1355.                       header value.
  1356.                     type: string
  1357.                   contentSecurityPolicyReportOnly:
  1358.                     description: ContentSecurityPolicyReportOnly defines the Content-Security-Policy-Report-Only
  1359.                       header value.
  1360.                     type: string
  1361.                   contentTypeNosniff:
  1362.                     description: ContentTypeNosniff defines whether to add the X-Content-Type-Options
  1363.                       header with the nosniff value.
  1364.                     type: boolean
  1365.                   customBrowserXSSValue:
  1366.                     description: |-
  1367.                       CustomBrowserXSSValue defines the X-XSS-Protection header value.
  1368.                       This overrides the BrowserXssFilter option.
  1369.                     type: string
  1370.                   customFrameOptionsValue:
  1371.                     description: |-
  1372.                       CustomFrameOptionsValue defines the X-Frame-Options header value.
  1373.                       This overrides the FrameDeny option.
  1374.                     type: string
  1375.                   customRequestHeaders:
  1376.                     additionalProperties:
  1377.                       type: string
  1378.                     description: CustomRequestHeaders defines the header names and
  1379.                       values to apply to the request.
  1380.                     type: object
  1381.                   customResponseHeaders:
  1382.                     additionalProperties:
  1383.                       type: string
  1384.                     description: CustomResponseHeaders defines the header names and
  1385.                       values to apply to the response.
  1386.                     type: object
  1387.                   featurePolicy:
  1388.                     description: 'Deprecated: FeaturePolicy option is deprecated,
  1389.                       please use PermissionsPolicy instead.'
  1390.                     type: string
  1391.                   forceSTSHeader:
  1392.                     description: ForceSTSHeader defines whether to add the STS header
  1393.                       even when the connection is HTTP.
  1394.                     type: boolean
  1395.                   frameDeny:
  1396.                     description: FrameDeny defines whether to add the X-Frame-Options
  1397.                       header with the DENY value.
  1398.                     type: boolean
  1399.                   hostsProxyHeaders:
  1400.                     description: HostsProxyHeaders defines the header keys that may
  1401.                       hold a proxied hostname value for the request.
  1402.                     items:
  1403.                       type: string
  1404.                     type: array
  1405.                   isDevelopment:
  1406.                     description: |-
  1407.                       IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing.
  1408.                       Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain.
  1409.                       If you would like your development environment to mimic production with complete Host blocking, SSL redirects,
  1410.                       and STS headers, leave this as false.
  1411.                     type: boolean
  1412.                   permissionsPolicy:
  1413.                     description: |-
  1414.                       PermissionsPolicy defines the Permissions-Policy header value.
  1415.                       This allows sites to control browser features.
  1416.                     type: string
  1417.                   publicKey:
  1418.                     description: PublicKey is the public key that implements HPKP
  1419.                       to prevent MITM attacks with forged certificates.
  1420.                     type: string
  1421.                   referrerPolicy:
  1422.                     description: |-
  1423.                       ReferrerPolicy defines the Referrer-Policy header value.
  1424.                       This allows sites to control whether browsers forward the Referer header to other sites.
  1425.                     type: string
  1426.                   sslForceHost:
  1427.                     description: 'Deprecated: SSLForceHost option is deprecated, please
  1428.                       use RedirectRegex instead.'
  1429.                     type: boolean
  1430.                   sslHost:
  1431.                     description: 'Deprecated: SSLHost option is deprecated, please
  1432.                       use RedirectRegex instead.'
  1433.                     type: string
  1434.                   sslProxyHeaders:
  1435.                     additionalProperties:
  1436.                       type: string
  1437.                     description: |-
  1438.                       SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request.
  1439.                       It can be useful when using other proxies (example: "X-Forwarded-Proto": "https").
  1440.                     type: object
  1441.                   sslRedirect:
  1442.                     description: 'Deprecated: SSLRedirect option is deprecated, please
  1443.                       use EntryPoint redirection or RedirectScheme instead.'
  1444.                     type: boolean
  1445.                   sslTemporaryRedirect:
  1446.                     description: 'Deprecated: SSLTemporaryRedirect option is deprecated,
  1447.                       please use EntryPoint redirection or RedirectScheme instead.'
  1448.                     type: boolean
  1449.                   stsIncludeSubdomains:
  1450.                     description: STSIncludeSubdomains defines whether the includeSubDomains
  1451.                       directive is appended to the Strict-Transport-Security header.
  1452.                     type: boolean
  1453.                   stsPreload:
  1454.                     description: STSPreload defines whether the preload flag is appended
  1455.                       to the Strict-Transport-Security header.
  1456.                     type: boolean
  1457.                   stsSeconds:
  1458.                     description: |-
  1459.                       STSSeconds defines the max-age of the Strict-Transport-Security header.
  1460.                       If set to 0, the header is not set.
  1461.                     format: int64
  1462.                     type: integer
  1463.                 type: object
  1464.               inFlightReq:
  1465.                 description: |-
  1466.                   InFlightReq holds the in-flight request middleware configuration.
  1467.                   This middleware limits the number of requests being processed and served concurrently.
  1468.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/
  1469.                 properties:
  1470.                   amount:
  1471.                     description: |-
  1472.                       Amount defines the maximum amount of allowed simultaneous in-flight request.
  1473.                       The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).
  1474.                     format: int64
  1475.                     type: integer
  1476.                   sourceCriterion:
  1477.                     description: |-
  1478.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1479.                       If several strategies are defined at the same time, an error will be raised.
  1480.                       If none are set, the default is to use the requestHost.
  1481.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/#sourcecriterion
  1482.                     properties:
  1483.                       ipStrategy:
  1484.                         description: |-
  1485.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1486.                           More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy
  1487.                         properties:
  1488.                           depth:
  1489.                             description: Depth tells Traefik to use the X-Forwarded-For
  1490.                               header and take the IP located at the depth position
  1491.                               (starting from the right).
  1492.                             type: integer
  1493.                           excludedIPs:
  1494.                             description: ExcludedIPs configures Traefik to scan the
  1495.                               X-Forwarded-For header and select the first IP not in
  1496.                               the list.
  1497.                             items:
  1498.                               type: string
  1499.                             type: array
  1500.                           ipv6Subnet:
  1501.                             description: IPv6Subnet configures Traefik to consider
  1502.                               all IPv6 addresses from the defined subnet as originating
  1503.                               from the same IP. Applies to RemoteAddrStrategy and
  1504.                               DepthStrategy.
  1505.                             type: integer
  1506.                         type: object
  1507.                       requestHeaderName:
  1508.                         description: RequestHeaderName defines the name of the header
  1509.                           used to group incoming requests.
  1510.                         type: string
  1511.                       requestHost:
  1512.                         description: RequestHost defines whether to consider the request
  1513.                           Host as the source.
  1514.                         type: boolean
  1515.                     type: object
  1516.                 type: object
  1517.               ipAllowList:
  1518.                 description: |-
  1519.                   IPAllowList holds the IP allowlist middleware configuration.
  1520.                   This middleware limits allowed requests based on the client IP.
  1521.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/
  1522.                 properties:
  1523.                   ipStrategy:
  1524.                     description: |-
  1525.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1526.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy
  1527.                     properties:
  1528.                       depth:
  1529.                         description: Depth tells Traefik to use the X-Forwarded-For
  1530.                           header and take the IP located at the depth position (starting
  1531.                           from the right).
  1532.                         type: integer
  1533.                       excludedIPs:
  1534.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1535.                           header and select the first IP not in the list.
  1536.                         items:
  1537.                           type: string
  1538.                         type: array
  1539.                       ipv6Subnet:
  1540.                         description: IPv6Subnet configures Traefik to consider all
  1541.                           IPv6 addresses from the defined subnet as originating from
  1542.                           the same IP. Applies to RemoteAddrStrategy and DepthStrategy.
  1543.                         type: integer
  1544.                     type: object
  1545.                   rejectStatusCode:
  1546.                     description: |-
  1547.                       RejectStatusCode defines the HTTP status code used for refused requests.
  1548.                       If not set, the default is 403 (Forbidden).
  1549.                     type: integer
  1550.                   sourceRange:
  1551.                     description: SourceRange defines the set of allowed IPs (or ranges
  1552.                       of allowed IPs by using CIDR notation).
  1553.                     items:
  1554.                       type: string
  1555.                     type: array
  1556.                 type: object
  1557.               ipWhiteList:
  1558.                 description: 'Deprecated: please use IPAllowList instead.'
  1559.                 properties:
  1560.                   ipStrategy:
  1561.                     description: |-
  1562.                       IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1563.                       More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy
  1564.                     properties:
  1565.                       depth:
  1566.                         description: Depth tells Traefik to use the X-Forwarded-For
  1567.                           header and take the IP located at the depth position (starting
  1568.                           from the right).
  1569.                         type: integer
  1570.                       excludedIPs:
  1571.                         description: ExcludedIPs configures Traefik to scan the X-Forwarded-For
  1572.                           header and select the first IP not in the list.
  1573.                         items:
  1574.                           type: string
  1575.                         type: array
  1576.                       ipv6Subnet:
  1577.                         description: IPv6Subnet configures Traefik to consider all
  1578.                           IPv6 addresses from the defined subnet as originating from
  1579.                           the same IP. Applies to RemoteAddrStrategy and DepthStrategy.
  1580.                         type: integer
  1581.                     type: object
  1582.                   sourceRange:
  1583.                     description: SourceRange defines the set of allowed IPs (or ranges
  1584.                       of allowed IPs by using CIDR notation). Required.
  1585.                     items:
  1586.                       type: string
  1587.                     type: array
  1588.                 type: object
  1589.               passTLSClientCert:
  1590.                 description: |-
  1591.                   PassTLSClientCert holds the pass TLS client cert middleware configuration.
  1592.                   This middleware adds the selected data from the passed client TLS certificate to a header.
  1593.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/passtlsclientcert/
  1594.                 properties:
  1595.                   info:
  1596.                     description: Info selects the specific client certificate details
  1597.                       you want to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1598.                     properties:
  1599.                       issuer:
  1600.                         description: Issuer defines the client certificate issuer
  1601.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1602.                         properties:
  1603.                           commonName:
  1604.                             description: CommonName defines whether to add the organizationalUnit
  1605.                               information into the issuer.
  1606.                             type: boolean
  1607.                           country:
  1608.                             description: Country defines whether to add the country
  1609.                               information into the issuer.
  1610.                             type: boolean
  1611.                           domainComponent:
  1612.                             description: DomainComponent defines whether to add the
  1613.                               domainComponent information into the issuer.
  1614.                             type: boolean
  1615.                           locality:
  1616.                             description: Locality defines whether to add the locality
  1617.                               information into the issuer.
  1618.                             type: boolean
  1619.                           organization:
  1620.                             description: Organization defines whether to add the organization
  1621.                               information into the issuer.
  1622.                             type: boolean
  1623.                           province:
  1624.                             description: Province defines whether to add the province
  1625.                               information into the issuer.
  1626.                             type: boolean
  1627.                           serialNumber:
  1628.                             description: SerialNumber defines whether to add the serialNumber
  1629.                               information into the issuer.
  1630.                             type: boolean
  1631.                         type: object
  1632.                       notAfter:
  1633.                         description: NotAfter defines whether to add the Not After
  1634.                           information from the Validity part.
  1635.                         type: boolean
  1636.                       notBefore:
  1637.                         description: NotBefore defines whether to add the Not Before
  1638.                           information from the Validity part.
  1639.                         type: boolean
  1640.                       sans:
  1641.                         description: Sans defines whether to add the Subject Alternative
  1642.                           Name information from the Subject Alternative Name part.
  1643.                         type: boolean
  1644.                       serialNumber:
  1645.                         description: SerialNumber defines whether to add the client
  1646.                           serialNumber information.
  1647.                         type: boolean
  1648.                       subject:
  1649.                         description: Subject defines the client certificate subject
  1650.                           details to add to the X-Forwarded-Tls-Client-Cert-Info header.
  1651.                         properties:
  1652.                           commonName:
  1653.                             description: CommonName defines whether to add the organizationalUnit
  1654.                               information into the subject.
  1655.                             type: boolean
  1656.                           country:
  1657.                             description: Country defines whether to add the country
  1658.                               information into the subject.
  1659.                             type: boolean
  1660.                           domainComponent:
  1661.                             description: DomainComponent defines whether to add the
  1662.                               domainComponent information into the subject.
  1663.                             type: boolean
  1664.                           locality:
  1665.                             description: Locality defines whether to add the locality
  1666.                               information into the subject.
  1667.                             type: boolean
  1668.                           organization:
  1669.                             description: Organization defines whether to add the organization
  1670.                               information into the subject.
  1671.                             type: boolean
  1672.                           organizationalUnit:
  1673.                             description: OrganizationalUnit defines whether to add
  1674.                               the organizationalUnit information into the subject.
  1675.                             type: boolean
  1676.                           province:
  1677.                             description: Province defines whether to add the province
  1678.                               information into the subject.
  1679.                             type: boolean
  1680.                           serialNumber:
  1681.                             description: SerialNumber defines whether to add the serialNumber
  1682.                               information into the subject.
  1683.                             type: boolean
  1684.                         type: object
  1685.                     type: object
  1686.                   pem:
  1687.                     description: PEM sets the X-Forwarded-Tls-Client-Cert header with
  1688.                       the certificate.
  1689.                     type: boolean
  1690.                 type: object
  1691.               plugin:
  1692.                 additionalProperties:
  1693.                   x-kubernetes-preserve-unknown-fields: true
  1694.                 description: |-
  1695.                   Plugin defines the middleware plugin configuration.
  1696.                   More info: https://doc.traefik.io/traefik/plugins/
  1697.                 type: object
  1698.               rateLimit:
  1699.                 description: |-
  1700.                   RateLimit holds the rate limit configuration.
  1701.                   This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
  1702.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ratelimit/
  1703.                 properties:
  1704.                   average:
  1705.                     description: |-
  1706.                       Average is the maximum rate, by default in requests/s, allowed for the given source.
  1707.                       It defaults to 0, which means no rate limiting.
  1708.                       The rate is actually defined by dividing Average by Period. So for a rate below 1req/s,
  1709.                       one needs to define a Period larger than a second.
  1710.                     format: int64
  1711.                     type: integer
  1712.                   burst:
  1713.                     description: |-
  1714.                       Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time.
  1715.                       It defaults to 1.
  1716.                     format: int64
  1717.                     type: integer
  1718.                   period:
  1719.                     anyOf:
  1720.                     - type: integer
  1721.                     - type: string
  1722.                     description: |-
  1723.                       Period, in combination with Average, defines the actual maximum rate, such as:
  1724.                       r = Average / Period. It defaults to a second.
  1725.                     x-kubernetes-int-or-string: true
  1726.                   sourceCriterion:
  1727.                     description: |-
  1728.                       SourceCriterion defines what criterion is used to group requests as originating from a common source.
  1729.                       If several strategies are defined at the same time, an error will be raised.
  1730.                       If none are set, the default is to use the request's remote address field (as an ipStrategy).
  1731.                     properties:
  1732.                       ipStrategy:
  1733.                         description: |-
  1734.                           IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
  1735.                           More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy
  1736.                         properties:
  1737.                           depth:
  1738.                             description: Depth tells Traefik to use the X-Forwarded-For
  1739.                               header and take the IP located at the depth position
  1740.                               (starting from the right).
  1741.                             type: integer
  1742.                           excludedIPs:
  1743.                             description: ExcludedIPs configures Traefik to scan the
  1744.                               X-Forwarded-For header and select the first IP not in
  1745.                               the list.
  1746.                             items:
  1747.                               type: string
  1748.                             type: array
  1749.                           ipv6Subnet:
  1750.                             description: IPv6Subnet configures Traefik to consider
  1751.                               all IPv6 addresses from the defined subnet as originating
  1752.                               from the same IP. Applies to RemoteAddrStrategy and
  1753.                               DepthStrategy.
  1754.                             type: integer
  1755.                         type: object
  1756.                       requestHeaderName:
  1757.                         description: RequestHeaderName defines the name of the header
  1758.                           used to group incoming requests.
  1759.                         type: string
  1760.                       requestHost:
  1761.                         description: RequestHost defines whether to consider the request
  1762.                           Host as the source.
  1763.                         type: boolean
  1764.                     type: object
  1765.                 type: object
  1766.               redirectRegex:
  1767.                 description: |-
  1768.                   RedirectRegex holds the redirect regex middleware configuration.
  1769.                   This middleware redirects a request using regex matching and replacement.
  1770.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectregex/#regex
  1771.                 properties:
  1772.                   permanent:
  1773.                     description: Permanent defines whether the redirection is permanent
  1774.                       (301).
  1775.                     type: boolean
  1776.                   regex:
  1777.                     description: Regex defines the regex used to match and capture
  1778.                       elements from the request URL.
  1779.                     type: string
  1780.                   replacement:
  1781.                     description: Replacement defines how to modify the URL to have
  1782.                       the new target URL.
  1783.                     type: string
  1784.                 type: object
  1785.               redirectScheme:
  1786.                 description: |-
  1787.                   RedirectScheme holds the redirect scheme middleware configuration.
  1788.                   This middleware redirects requests from a scheme/port to another.
  1789.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectscheme/
  1790.                 properties:
  1791.                   permanent:
  1792.                     description: Permanent defines whether the redirection is permanent
  1793.                       (301).
  1794.                     type: boolean
  1795.                   port:
  1796.                     description: Port defines the port of the new URL.
  1797.                     type: string
  1798.                   scheme:
  1799.                     description: Scheme defines the scheme of the new URL.
  1800.                     type: string
  1801.                 type: object
  1802.               replacePath:
  1803.                 description: |-
  1804.                   ReplacePath holds the replace path middleware configuration.
  1805.                   This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
  1806.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepath/
  1807.                 properties:
  1808.                   path:
  1809.                     description: Path defines the path to use as replacement in the
  1810.                       request URL.
  1811.                     type: string
  1812.                 type: object
  1813.               replacePathRegex:
  1814.                 description: |-
  1815.                   ReplacePathRegex holds the replace path regex middleware configuration.
  1816.                   This middleware replaces the path of a URL using regex matching and replacement.
  1817.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepathregex/
  1818.                 properties:
  1819.                   regex:
  1820.                     description: Regex defines the regular expression used to match
  1821.                       and capture the path from the request URL.
  1822.                     type: string
  1823.                   replacement:
  1824.                     description: Replacement defines the replacement path format,
  1825.                       which can include captured variables.
  1826.                     type: string
  1827.                 type: object
  1828.               retry:
  1829.                 description: |-
  1830.                   Retry holds the retry middleware configuration.
  1831.                   This middleware reissues requests a given number of times to a backend server if that server does not reply.
  1832.                   As soon as the server answers, the middleware stops retrying, regardless of the response status.
  1833.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/retry/
  1834.                 properties:
  1835.                   attempts:
  1836.                     description: Attempts defines how many times the request should
  1837.                       be retried.
  1838.                     type: integer
  1839.                   initialInterval:
  1840.                     anyOf:
  1841.                     - type: integer
  1842.                     - type: string
  1843.                     description: |-
  1844.                       InitialInterval defines the first wait time in the exponential backoff series.
  1845.                       The maximum interval is calculated as twice the initialInterval.
  1846.                       If unspecified, requests will be retried immediately.
  1847.                       The value of initialInterval should be provided in seconds or as a valid duration format,
  1848.                       see https://pkg.go.dev/time#ParseDuration.
  1849.                     x-kubernetes-int-or-string: true
  1850.                 type: object
  1851.               stripPrefix:
  1852.                 description: |-
  1853.                   StripPrefix holds the strip prefix middleware configuration.
  1854.                   This middleware removes the specified prefixes from the URL path.
  1855.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefix/
  1856.                 properties:
  1857.                   forceSlash:
  1858.                     description: |-
  1859.                       Deprecated: ForceSlash option is deprecated, please remove any usage of this option.
  1860.                       ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.
  1861.                       Default: true.
  1862.                     type: boolean
  1863.                   prefixes:
  1864.                     description: Prefixes defines the prefixes to strip from the request
  1865.                       URL.
  1866.                     items:
  1867.                       type: string
  1868.                     type: array
  1869.                 type: object
  1870.               stripPrefixRegex:
  1871.                 description: |-
  1872.                   StripPrefixRegex holds the strip prefix regex middleware configuration.
  1873.                   This middleware removes the matching prefixes from the URL path.
  1874.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefixregex/
  1875.                 properties:
  1876.                   regex:
  1877.                     description: Regex defines the regular expression to match the
  1878.                       path prefix from the request URL.
  1879.                     items:
  1880.                       type: string
  1881.                     type: array
  1882.                 type: object
  1883.             type: object
  1884.         required:
  1885.         - metadata
  1886.         - spec
  1887.         type: object
  1888.     served: true
  1889.     storage: true
  1890. ---
  1891. apiVersion: apiextensions.k8s.io/v1
  1892. kind: CustomResourceDefinition
  1893. metadata:
  1894.   annotations:
  1895.     controller-gen.kubebuilder.io/version: v0.16.1
  1896.   name: middlewaretcps.traefik.io
  1897. spec:
  1898.   group: traefik.io
  1899.   names:
  1900.     kind: MiddlewareTCP
  1901.     listKind: MiddlewareTCPList
  1902.     plural: middlewaretcps
  1903.     singular: middlewaretcp
  1904.   scope: Namespaced
  1905.   versions:
  1906.   - name: v1alpha1
  1907.     schema:
  1908.       openAPIV3Schema:
  1909.         description: |-
  1910.           MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
  1911.           More info: https://doc.traefik.io/traefik/v3.3/middlewares/overview/
  1912.         properties:
  1913.           apiVersion:
  1914.             description: |-
  1915.               APIVersion defines the versioned schema of this representation of an object.
  1916.               Servers should convert recognized schemas to the latest internal value, and
  1917.               may reject unrecognized values.
  1918.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  1919.             type: string
  1920.           kind:
  1921.             description: |-
  1922.               Kind is a string value representing the REST resource this object represents.
  1923.               Servers may infer this from the endpoint the client submits requests to.
  1924.               Cannot be updated.
  1925.               In CamelCase.
  1926.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  1927.             type: string
  1928.           metadata:
  1929.             type: object
  1930.           spec:
  1931.             description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.
  1932.             properties:
  1933.               inFlightConn:
  1934.                 description: InFlightConn defines the InFlightConn middleware configuration.
  1935.                 properties:
  1936.                   amount:
  1937.                     description: |-
  1938.                       Amount defines the maximum amount of allowed simultaneous connections.
  1939.                       The middleware closes the connection if there are already amount connections opened.
  1940.                     format: int64
  1941.                     type: integer
  1942.                 type: object
  1943.               ipAllowList:
  1944.                 description: |-
  1945.                   IPAllowList defines the IPAllowList middleware configuration.
  1946.                   This middleware accepts/refuses connections based on the client IP.
  1947.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipallowlist/
  1948.                 properties:
  1949.                   sourceRange:
  1950.                     description: SourceRange defines the allowed IPs (or ranges of
  1951.                       allowed IPs by using CIDR notation).
  1952.                     items:
  1953.                       type: string
  1954.                     type: array
  1955.                 type: object
  1956.               ipWhiteList:
  1957.                 description: |-
  1958.                   IPWhiteList defines the IPWhiteList middleware configuration.
  1959.                   This middleware accepts/refuses connections based on the client IP.
  1960.                   Deprecated: please use IPAllowList instead.
  1961.                   More info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipwhitelist/
  1962.                 properties:
  1963.                   sourceRange:
  1964.                     description: SourceRange defines the allowed IPs (or ranges of
  1965.                       allowed IPs by using CIDR notation).
  1966.                     items:
  1967.                       type: string
  1968.                     type: array
  1969.                 type: object
  1970.             type: object
  1971.         required:
  1972.         - metadata
  1973.         - spec
  1974.         type: object
  1975.     served: true
  1976.     storage: true
  1977. ---
  1978. apiVersion: apiextensions.k8s.io/v1
  1979. kind: CustomResourceDefinition
  1980. metadata:
  1981.   annotations:
  1982.     controller-gen.kubebuilder.io/version: v0.16.1
  1983.   name: serverstransports.traefik.io
  1984. spec:
  1985.   group: traefik.io
  1986.   names:
  1987.     kind: ServersTransport
  1988.     listKind: ServersTransportList
  1989.     plural: serverstransports
  1990.     singular: serverstransport
  1991.   scope: Namespaced
  1992.   versions:
  1993.   - name: v1alpha1
  1994.     schema:
  1995.       openAPIV3Schema:
  1996.         description: |-
  1997.           ServersTransport is the CRD implementation of a ServersTransport.
  1998.           If no serversTransport is specified, the default@internal will be used.
  1999.           The default@internal serversTransport is created from the static configuration.
  2000.           More info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_1
  2001.         properties:
  2002.           apiVersion:
  2003.             description: |-
  2004.               APIVersion defines the versioned schema of this representation of an object.
  2005.               Servers should convert recognized schemas to the latest internal value, and
  2006.               may reject unrecognized values.
  2007.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2008.             type: string
  2009.           kind:
  2010.             description: |-
  2011.               Kind is a string value representing the REST resource this object represents.
  2012.               Servers may infer this from the endpoint the client submits requests to.
  2013.               Cannot be updated.
  2014.               In CamelCase.
  2015.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2016.             type: string
  2017.           metadata:
  2018.             type: object
  2019.           spec:
  2020.             description: ServersTransportSpec defines the desired state of a ServersTransport.
  2021.             properties:
  2022.               certificatesSecrets:
  2023.                 description: CertificatesSecrets defines a list of secret storing
  2024.                   client certificates for mTLS.
  2025.                 items:
  2026.                   type: string
  2027.                 type: array
  2028.               disableHTTP2:
  2029.                 description: DisableHTTP2 disables HTTP/2 for connections with backend
  2030.                   servers.
  2031.                 type: boolean
  2032.               forwardingTimeouts:
  2033.                 description: ForwardingTimeouts defines the timeouts for requests
  2034.                   forwarded to the backend servers.
  2035.                 properties:
  2036.                   dialTimeout:
  2037.                     anyOf:
  2038.                     - type: integer
  2039.                     - type: string
  2040.                     description: DialTimeout is the amount of time to wait until a
  2041.                       connection to a backend server can be established.
  2042.                     x-kubernetes-int-or-string: true
  2043.                   idleConnTimeout:
  2044.                     anyOf:
  2045.                     - type: integer
  2046.                     - type: string
  2047.                     description: IdleConnTimeout is the maximum period for which an
  2048.                       idle HTTP keep-alive connection will remain open before closing
  2049.                       itself.
  2050.                     x-kubernetes-int-or-string: true
  2051.                   pingTimeout:
  2052.                     anyOf:
  2053.                     - type: integer
  2054.                     - type: string
  2055.                     description: PingTimeout is the timeout after which the HTTP/2
  2056.                       connection will be closed if a response to ping is not received.
  2057.                     x-kubernetes-int-or-string: true
  2058.                   readIdleTimeout:
  2059.                     anyOf:
  2060.                     - type: integer
  2061.                     - type: string
  2062.                     description: ReadIdleTimeout is the timeout after which a health
  2063.                       check using ping frame will be carried out if no frame is received
  2064.                       on the HTTP/2 connection.
  2065.                     x-kubernetes-int-or-string: true
  2066.                   responseHeaderTimeout:
  2067.                     anyOf:
  2068.                     - type: integer
  2069.                     - type: string
  2070.                     description: ResponseHeaderTimeout is the amount of time to wait
  2071.                       for a server's response headers after fully writing the request
  2072.                       (including its body, if any).
  2073.                     x-kubernetes-int-or-string: true
  2074.                 type: object
  2075.               insecureSkipVerify:
  2076.                 description: InsecureSkipVerify disables SSL certificate verification.
  2077.                 type: boolean
  2078.               maxIdleConnsPerHost:
  2079.                 description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
  2080.                   to keep per-host.
  2081.                 type: integer
  2082.               peerCertURI:
  2083.                 description: PeerCertURI defines the peer cert URI used to match against
  2084.                   SAN URI during the peer certificate verification.
  2085.                 type: string
  2086.               rootCAsSecrets:
  2087.                 description: RootCAsSecrets defines a list of CA secret used to validate
  2088.                   self-signed certificate.
  2089.                 items:
  2090.                   type: string
  2091.                 type: array
  2092.               serverName:
  2093.                 description: ServerName defines the server name used to contact the
  2094.                   server.
  2095.                 type: string
  2096.               spiffe:
  2097.                 description: Spiffe defines the SPIFFE configuration.
  2098.                 properties:
  2099.                   ids:
  2100.                     description: IDs defines the allowed SPIFFE IDs (takes precedence
  2101.                       over the SPIFFE TrustDomain).
  2102.                     items:
  2103.                       type: string
  2104.                     type: array
  2105.                   trustDomain:
  2106.                     description: TrustDomain defines the allowed SPIFFE trust domain.
  2107.                     type: string
  2108.                 type: object
  2109.             type: object
  2110.         required:
  2111.         - metadata
  2112.         - spec
  2113.         type: object
  2114.     served: true
  2115.     storage: true
  2116. ---
  2117. apiVersion: apiextensions.k8s.io/v1
  2118. kind: CustomResourceDefinition
  2119. metadata:
  2120.   annotations:
  2121.     controller-gen.kubebuilder.io/version: v0.16.1
  2122.   name: serverstransporttcps.traefik.io
  2123. spec:
  2124.   group: traefik.io
  2125.   names:
  2126.     kind: ServersTransportTCP
  2127.     listKind: ServersTransportTCPList
  2128.     plural: serverstransporttcps
  2129.     singular: serverstransporttcp
  2130.   scope: Namespaced
  2131.   versions:
  2132.   - name: v1alpha1
  2133.     schema:
  2134.       openAPIV3Schema:
  2135.         description: |-
  2136.           ServersTransportTCP is the CRD implementation of a TCPServersTransport.
  2137.           If no tcpServersTransport is specified, a default one named default@internal will be used.
  2138.           The default@internal tcpServersTransport can be configured in the static configuration.
  2139.           More info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_3
  2140.         properties:
  2141.           apiVersion:
  2142.             description: |-
  2143.               APIVersion defines the versioned schema of this representation of an object.
  2144.               Servers should convert recognized schemas to the latest internal value, and
  2145.               may reject unrecognized values.
  2146.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2147.             type: string
  2148.           kind:
  2149.             description: |-
  2150.               Kind is a string value representing the REST resource this object represents.
  2151.               Servers may infer this from the endpoint the client submits requests to.
  2152.               Cannot be updated.
  2153.               In CamelCase.
  2154.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2155.             type: string
  2156.           metadata:
  2157.             type: object
  2158.           spec:
  2159.             description: ServersTransportTCPSpec defines the desired state of a ServersTransportTCP.
  2160.             properties:
  2161.               dialKeepAlive:
  2162.                 anyOf:
  2163.                 - type: integer
  2164.                 - type: string
  2165.                 description: DialKeepAlive is the interval between keep-alive probes
  2166.                   for an active network connection. If zero, keep-alive probes are
  2167.                   sent with a default value (currently 15 seconds), if supported by
  2168.                   the protocol and operating system. Network protocols or operating
  2169.                   systems that do not support keep-alives ignore this field. If negative,
  2170.                   keep-alive probes are disabled.
  2171.                 x-kubernetes-int-or-string: true
  2172.               dialTimeout:
  2173.                 anyOf:
  2174.                 - type: integer
  2175.                 - type: string
  2176.                 description: DialTimeout is the amount of time to wait until a connection
  2177.                   to a backend server can be established.
  2178.                 x-kubernetes-int-or-string: true
  2179.               terminationDelay:
  2180.                 anyOf:
  2181.                 - type: integer
  2182.                 - type: string
  2183.                 description: TerminationDelay defines the delay to wait before fully
  2184.                   terminating the connection, after one connected peer has closed
  2185.                   its writing capability.
  2186.                 x-kubernetes-int-or-string: true
  2187.               tls:
  2188.                 description: TLS defines the TLS configuration
  2189.                 properties:
  2190.                   certificatesSecrets:
  2191.                     description: CertificatesSecrets defines a list of secret storing
  2192.                       client certificates for mTLS.
  2193.                     items:
  2194.                       type: string
  2195.                     type: array
  2196.                   insecureSkipVerify:
  2197.                     description: InsecureSkipVerify disables TLS certificate verification.
  2198.                     type: boolean
  2199.                   peerCertURI:
  2200.                     description: |-
  2201.                       MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.
  2202.                       PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.
  2203.                     type: string
  2204.                   rootCAsSecrets:
  2205.                     description: RootCAsSecrets defines a list of CA secret used to
  2206.                       validate self-signed certificates.
  2207.                     items:
  2208.                       type: string
  2209.                     type: array
  2210.                   serverName:
  2211.                     description: ServerName defines the server name used to contact
  2212.                       the server.
  2213.                     type: string
  2214.                   spiffe:
  2215.                     description: Spiffe defines the SPIFFE configuration.
  2216.                     properties:
  2217.                       ids:
  2218.                         description: IDs defines the allowed SPIFFE IDs (takes precedence
  2219.                           over the SPIFFE TrustDomain).
  2220.                         items:
  2221.                           type: string
  2222.                         type: array
  2223.                       trustDomain:
  2224.                         description: TrustDomain defines the allowed SPIFFE trust
  2225.                           domain.
  2226.                         type: string
  2227.                     type: object
  2228.                 type: object
  2229.             type: object
  2230.         required:
  2231.         - metadata
  2232.         - spec
  2233.         type: object
  2234.     served: true
  2235.     storage: true
  2236. ---
  2237. apiVersion: apiextensions.k8s.io/v1
  2238. kind: CustomResourceDefinition
  2239. metadata:
  2240.   annotations:
  2241.     controller-gen.kubebuilder.io/version: v0.16.1
  2242.   name: tlsoptions.traefik.io
  2243. spec:
  2244.   group: traefik.io
  2245.   names:
  2246.     kind: TLSOption
  2247.     listKind: TLSOptionList
  2248.     plural: tlsoptions
  2249.     singular: tlsoption
  2250.   scope: Namespaced
  2251.   versions:
  2252.   - name: v1alpha1
  2253.     schema:
  2254.       openAPIV3Schema:
  2255.         description: |-
  2256.           TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
  2257.           More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options
  2258.         properties:
  2259.           apiVersion:
  2260.             description: |-
  2261.               APIVersion defines the versioned schema of this representation of an object.
  2262.               Servers should convert recognized schemas to the latest internal value, and
  2263.               may reject unrecognized values.
  2264.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2265.             type: string
  2266.           kind:
  2267.             description: |-
  2268.               Kind is a string value representing the REST resource this object represents.
  2269.               Servers may infer this from the endpoint the client submits requests to.
  2270.               Cannot be updated.
  2271.               In CamelCase.
  2272.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2273.             type: string
  2274.           metadata:
  2275.             type: object
  2276.           spec:
  2277.             description: TLSOptionSpec defines the desired state of a TLSOption.
  2278.             properties:
  2279.               alpnProtocols:
  2280.                 description: |-
  2281.                   ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
  2282.                   More info: https://doc.traefik.io/traefik/v3.3/https/tls/#alpn-protocols
  2283.                 items:
  2284.                   type: string
  2285.                 type: array
  2286.               cipherSuites:
  2287.                 description: |-
  2288.                   CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
  2289.                   More info: https://doc.traefik.io/traefik/v3.3/https/tls/#cipher-suites
  2290.                 items:
  2291.                   type: string
  2292.                 type: array
  2293.               clientAuth:
  2294.                 description: ClientAuth defines the server's policy for TLS Client
  2295.                   Authentication.
  2296.                 properties:
  2297.                   clientAuthType:
  2298.                     description: ClientAuthType defines the client authentication
  2299.                       type to apply.
  2300.                     enum:
  2301.                     - NoClientCert
  2302.                     - RequestClientCert
  2303.                     - RequireAnyClientCert
  2304.                     - VerifyClientCertIfGiven
  2305.                     - RequireAndVerifyClientCert
  2306.                     type: string
  2307.                   secretNames:
  2308.                     description: SecretNames defines the names of the referenced Kubernetes
  2309.                       Secret storing certificate details.
  2310.                     items:
  2311.                       type: string
  2312.                     type: array
  2313.                 type: object
  2314.               curvePreferences:
  2315.                 description: |-
  2316.                   CurvePreferences defines the preferred elliptic curves in a specific order.
  2317.                   More info: https://doc.traefik.io/traefik/v3.3/https/tls/#curve-preferences
  2318.                 items:
  2319.                   type: string
  2320.                 type: array
  2321.               maxVersion:
  2322.                 description: |-
  2323.                   MaxVersion defines the maximum TLS version that Traefik will accept.
  2324.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2325.                   Default: None.
  2326.                 type: string
  2327.               minVersion:
  2328.                 description: |-
  2329.                   MinVersion defines the minimum TLS version that Traefik will accept.
  2330.                   Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
  2331.                   Default: VersionTLS10.
  2332.                 type: string
  2333.               preferServerCipherSuites:
  2334.                 description: |-
  2335.                   PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
  2336.                   It is enabled automatically when minVersion or maxVersion is set.
  2337.                   Deprecated: https://github.com/golang/go/issues/45430
  2338.                 type: boolean
  2339.               sniStrict:
  2340.                 description: SniStrict defines whether Traefik allows connections
  2341.                   from clients connections that do not specify a server_name extension.
  2342.                 type: boolean
  2343.             type: object
  2344.         required:
  2345.         - metadata
  2346.         - spec
  2347.         type: object
  2348.     served: true
  2349.     storage: true
  2350. ---
  2351. apiVersion: apiextensions.k8s.io/v1
  2352. kind: CustomResourceDefinition
  2353. metadata:
  2354.   annotations:
  2355.     controller-gen.kubebuilder.io/version: v0.16.1
  2356.   name: tlsstores.traefik.io
  2357. spec:
  2358.   group: traefik.io
  2359.   names:
  2360.     kind: TLSStore
  2361.     listKind: TLSStoreList
  2362.     plural: tlsstores
  2363.     singular: tlsstore
  2364.   scope: Namespaced
  2365.   versions:
  2366.   - name: v1alpha1
  2367.     schema:
  2368.       openAPIV3Schema:
  2369.         description: |-
  2370.           TLSStore is the CRD implementation of a Traefik TLS Store.
  2371.           For the time being, only the TLSStore named default is supported.
  2372.           This means that you cannot have two stores that are named default in different Kubernetes namespaces.
  2373.           More info: https://doc.traefik.io/traefik/v3.3/https/tls/#certificates-stores
  2374.         properties:
  2375.           apiVersion:
  2376.             description: |-
  2377.               APIVersion defines the versioned schema of this representation of an object.
  2378.               Servers should convert recognized schemas to the latest internal value, and
  2379.               may reject unrecognized values.
  2380.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2381.             type: string
  2382.           kind:
  2383.             description: |-
  2384.               Kind is a string value representing the REST resource this object represents.
  2385.               Servers may infer this from the endpoint the client submits requests to.
  2386.               Cannot be updated.
  2387.               In CamelCase.
  2388.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2389.             type: string
  2390.           metadata:
  2391.             type: object
  2392.           spec:
  2393.             description: TLSStoreSpec defines the desired state of a TLSStore.
  2394.             properties:
  2395.               certificates:
  2396.                 description: Certificates is a list of secret names, each secret holding
  2397.                   a key/certificate pair to add to the store.
  2398.                 items:
  2399.                   description: Certificate holds a secret name for the TLSStore resource.
  2400.                   properties:
  2401.                     secretName:
  2402.                       description: SecretName is the name of the referenced Kubernetes
  2403.                         Secret to specify the certificate details.
  2404.                       type: string
  2405.                   required:
  2406.                   - secretName
  2407.                   type: object
  2408.                 type: array
  2409.               defaultCertificate:
  2410.                 description: DefaultCertificate defines the default certificate configuration.
  2411.                 properties:
  2412.                   secretName:
  2413.                     description: SecretName is the name of the referenced Kubernetes
  2414.                       Secret to specify the certificate details.
  2415.                     type: string
  2416.                 required:
  2417.                 - secretName
  2418.                 type: object
  2419.               defaultGeneratedCert:
  2420.                 description: DefaultGeneratedCert defines the default generated certificate
  2421.                   configuration.
  2422.                 properties:
  2423.                   domain:
  2424.                     description: Domain is the domain definition for the DefaultCertificate.
  2425.                     properties:
  2426.                       main:
  2427.                         description: Main defines the main domain name.
  2428.                         type: string
  2429.                       sans:
  2430.                         description: SANs defines the subject alternative domain names.
  2431.                         items:
  2432.                           type: string
  2433.                         type: array
  2434.                     type: object
  2435.                   resolver:
  2436.                     description: Resolver is the name of the resolver that will be
  2437.                       used to issue the DefaultCertificate.
  2438.                     type: string
  2439.                 type: object
  2440.             type: object
  2441.         required:
  2442.         - metadata
  2443.         - spec
  2444.         type: object
  2445.     served: true
  2446.     storage: true
  2447. ---
  2448. apiVersion: apiextensions.k8s.io/v1
  2449. kind: CustomResourceDefinition
  2450. metadata:
  2451.   annotations:
  2452.     controller-gen.kubebuilder.io/version: v0.16.1
  2453.   name: traefikservices.traefik.io
  2454. spec:
  2455.   group: traefik.io
  2456.   names:
  2457.     kind: TraefikService
  2458.     listKind: TraefikServiceList
  2459.     plural: traefikservices
  2460.     singular: traefikservice
  2461.   scope: Namespaced
  2462.   versions:
  2463.   - name: v1alpha1
  2464.     schema:
  2465.       openAPIV3Schema:
  2466.         description: |-
  2467.           TraefikService is the CRD implementation of a Traefik Service.
  2468.           TraefikService object allows to:
  2469.           - Apply weight to Services on load-balancing
  2470.           - Mirror traffic on services
  2471.           More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-traefikservice
  2472.         properties:
  2473.           apiVersion:
  2474.             description: |-
  2475.               APIVersion defines the versioned schema of this representation of an object.
  2476.               Servers should convert recognized schemas to the latest internal value, and
  2477.               may reject unrecognized values.
  2478.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
  2479.             type: string
  2480.           kind:
  2481.             description: |-
  2482.               Kind is a string value representing the REST resource this object represents.
  2483.               Servers may infer this from the endpoint the client submits requests to.
  2484.               Cannot be updated.
  2485.               In CamelCase.
  2486.               More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
  2487.             type: string
  2488.           metadata:
  2489.             type: object
  2490.           spec:
  2491.             description: TraefikServiceSpec defines the desired state of a TraefikService.
  2492.             properties:
  2493.               mirroring:
  2494.                 description: Mirroring defines the Mirroring service configuration.
  2495.                 properties:
  2496.                   healthCheck:
  2497.                     description: Healthcheck defines health checks for ExternalName
  2498.                       services.
  2499.                     properties:
  2500.                       followRedirects:
  2501.                         description: |-
  2502.                           FollowRedirects defines whether redirects should be followed during the health check calls.
  2503.                           Default: true
  2504.                         type: boolean
  2505.                       headers:
  2506.                         additionalProperties:
  2507.                           type: string
  2508.                         description: Headers defines custom headers to be sent to
  2509.                           the health check endpoint.
  2510.                         type: object
  2511.                       hostname:
  2512.                         description: Hostname defines the value of hostname in the
  2513.                           Host header of the health check request.
  2514.                         type: string
  2515.                       interval:
  2516.                         anyOf:
  2517.                         - type: integer
  2518.                         - type: string
  2519.                         description: |-
  2520.                           Interval defines the frequency of the health check calls.
  2521.                           Default: 30s
  2522.                         x-kubernetes-int-or-string: true
  2523.                       method:
  2524.                         description: Method defines the healthcheck method.
  2525.                         type: string
  2526.                       mode:
  2527.                         description: |-
  2528.                           Mode defines the health check mode.
  2529.                           If defined to grpc, will use the gRPC health check protocol to probe the server.
  2530.                           Default: http
  2531.                         type: string
  2532.                       path:
  2533.                         description: Path defines the server URL path for the health
  2534.                           check endpoint.
  2535.                         type: string
  2536.                       port:
  2537.                         description: Port defines the server URL port for the health
  2538.                           check endpoint.
  2539.                         type: integer
  2540.                       scheme:
  2541.                         description: Scheme replaces the server URL scheme for the
  2542.                           health check endpoint.
  2543.                         type: string
  2544.                       status:
  2545.                         description: Status defines the expected HTTP status code
  2546.                           of the response to the health check request.
  2547.                         type: integer
  2548.                       timeout:
  2549.                         anyOf:
  2550.                         - type: integer
  2551.                         - type: string
  2552.                         description: |-
  2553.                           Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2554.                           Default: 5s
  2555.                         x-kubernetes-int-or-string: true
  2556.                     type: object
  2557.                   kind:
  2558.                     description: Kind defines the kind of the Service.
  2559.                     enum:
  2560.                     - Service
  2561.                     - TraefikService
  2562.                     type: string
  2563.                   maxBodySize:
  2564.                     description: |-
  2565.                       MaxBodySize defines the maximum size allowed for the body of the request.
  2566.                       If the body is larger, the request is not mirrored.
  2567.                       Default value is -1, which means unlimited size.
  2568.                     format: int64
  2569.                     type: integer
  2570.                   mirrorBody:
  2571.                     description: |-
  2572.                       MirrorBody defines whether the body of the request should be mirrored.
  2573.                       Default value is true.
  2574.                     type: boolean
  2575.                   mirrors:
  2576.                     description: Mirrors defines the list of mirrors where Traefik
  2577.                       will duplicate the traffic.
  2578.                     items:
  2579.                       description: MirrorService holds the mirror configuration.
  2580.                       properties:
  2581.                         healthCheck:
  2582.                           description: Healthcheck defines health checks for ExternalName
  2583.                             services.
  2584.                           properties:
  2585.                             followRedirects:
  2586.                               description: |-
  2587.                                 FollowRedirects defines whether redirects should be followed during the health check calls.
  2588.                                 Default: true
  2589.                               type: boolean
  2590.                             headers:
  2591.                               additionalProperties:
  2592.                                 type: string
  2593.                               description: Headers defines custom headers to be sent
  2594.                                 to the health check endpoint.
  2595.                               type: object
  2596.                             hostname:
  2597.                               description: Hostname defines the value of hostname
  2598.                                 in the Host header of the health check request.
  2599.                               type: string
  2600.                             interval:
  2601.                               anyOf:
  2602.                               - type: integer
  2603.                               - type: string
  2604.                               description: |-
  2605.                                 Interval defines the frequency of the health check calls.
  2606.                                 Default: 30s
  2607.                               x-kubernetes-int-or-string: true
  2608.                             method:
  2609.                               description: Method defines the healthcheck method.
  2610.                               type: string
  2611.                             mode:
  2612.                               description: |-
  2613.                                 Mode defines the health check mode.
  2614.                                 If defined to grpc, will use the gRPC health check protocol to probe the server.
  2615.                                 Default: http
  2616.                               type: string
  2617.                             path:
  2618.                               description: Path defines the server URL path for the
  2619.                                 health check endpoint.
  2620.                               type: string
  2621.                             port:
  2622.                               description: Port defines the server URL port for the
  2623.                                 health check endpoint.
  2624.                               type: integer
  2625.                             scheme:
  2626.                               description: Scheme replaces the server URL scheme for
  2627.                                 the health check endpoint.
  2628.                               type: string
  2629.                             status:
  2630.                               description: Status defines the expected HTTP status
  2631.                                 code of the response to the health check request.
  2632.                               type: integer
  2633.                             timeout:
  2634.                               anyOf:
  2635.                               - type: integer
  2636.                               - type: string
  2637.                               description: |-
  2638.                                 Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2639.                                 Default: 5s
  2640.                               x-kubernetes-int-or-string: true
  2641.                           type: object
  2642.                         kind:
  2643.                           description: Kind defines the kind of the Service.
  2644.                           enum:
  2645.                           - Service
  2646.                           - TraefikService
  2647.                           type: string
  2648.                         name:
  2649.                           description: |-
  2650.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2651.                             The differentiation between the two is specified in the Kind field.
  2652.                           type: string
  2653.                         namespace:
  2654.                           description: Namespace defines the namespace of the referenced
  2655.                             Kubernetes Service or TraefikService.
  2656.                           type: string
  2657.                         nativeLB:
  2658.                           description: |-
  2659.                             NativeLB controls, when creating the load-balancer,
  2660.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2661.                             The Kubernetes Service itself does load-balance to the pods.
  2662.                             By default, NativeLB is false.
  2663.                           type: boolean
  2664.                         nodePortLB:
  2665.                           description: |-
  2666.                             NodePortLB controls, when creating the load-balancer,
  2667.                             whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2668.                             It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2669.                             By default, NodePortLB is false.
  2670.                           type: boolean
  2671.                         passHostHeader:
  2672.                           description: |-
  2673.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2674.                             By default, passHostHeader is true.
  2675.                           type: boolean
  2676.                         percent:
  2677.                           description: |-
  2678.                             Percent defines the part of the traffic to mirror.
  2679.                             Supported values: 0 to 100.
  2680.                           type: integer
  2681.                         port:
  2682.                           anyOf:
  2683.                           - type: integer
  2684.                           - type: string
  2685.                           description: |-
  2686.                             Port defines the port of a Kubernetes Service.
  2687.                             This can be a reference to a named port.
  2688.                           x-kubernetes-int-or-string: true
  2689.                         responseForwarding:
  2690.                           description: ResponseForwarding defines how Traefik forwards
  2691.                             the response from the upstream Kubernetes Service to the
  2692.                             client.
  2693.                           properties:
  2694.                             flushInterval:
  2695.                               description: |-
  2696.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2697.                                 A negative value means to flush immediately after each write to the client.
  2698.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2699.                                 for such responses, writes are flushed to the client immediately.
  2700.                                 Default: 100ms
  2701.                               type: string
  2702.                           type: object
  2703.                         scheme:
  2704.                           description: |-
  2705.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2706.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  2707.                           type: string
  2708.                         serversTransport:
  2709.                           description: |-
  2710.                             ServersTransport defines the name of ServersTransport resource to use.
  2711.                             It allows to configure the transport between Traefik and your servers.
  2712.                             Can only be used on a Kubernetes Service.
  2713.                           type: string
  2714.                         sticky:
  2715.                           description: |-
  2716.                             Sticky defines the sticky sessions configuration.
  2717.                             More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions
  2718.                           properties:
  2719.                             cookie:
  2720.                               description: Cookie defines the sticky cookie configuration.
  2721.                               properties:
  2722.                                 httpOnly:
  2723.                                   description: HTTPOnly defines whether the cookie
  2724.                                     can be accessed by client-side APIs, such as JavaScript.
  2725.                                   type: boolean
  2726.                                 maxAge:
  2727.                                   description: |-
  2728.                                     MaxAge defines the number of seconds until the cookie expires.
  2729.                                     When set to a negative number, the cookie expires immediately.
  2730.                                     When set to zero, the cookie never expires.
  2731.                                   type: integer
  2732.                                 name:
  2733.                                   description: Name defines the Cookie name.
  2734.                                   type: string
  2735.                                 path:
  2736.                                   description: |-
  2737.                                     Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
  2738.                                     When not provided the cookie will be sent on every request to the domain.
  2739.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
  2740.                                   type: string
  2741.                                 sameSite:
  2742.                                   description: |-
  2743.                                     SameSite defines the same site policy.
  2744.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2745.                                   type: string
  2746.                                 secure:
  2747.                                   description: Secure defines whether the cookie can
  2748.                                     only be transmitted over an encrypted connection
  2749.                                     (i.e. HTTPS).
  2750.                                   type: boolean
  2751.                               type: object
  2752.                           type: object
  2753.                         strategy:
  2754.                           description: |-
  2755.                             Strategy defines the load balancing strategy between the servers.
  2756.                             RoundRobin is the only supported value at the moment.
  2757.                           type: string
  2758.                         weight:
  2759.                           description: |-
  2760.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  2761.                             (and to be precise, one that embeds a Weighted Round Robin).
  2762.                           type: integer
  2763.                       required:
  2764.                       - name
  2765.                       type: object
  2766.                     type: array
  2767.                   name:
  2768.                     description: |-
  2769.                       Name defines the name of the referenced Kubernetes Service or TraefikService.
  2770.                       The differentiation between the two is specified in the Kind field.
  2771.                     type: string
  2772.                   namespace:
  2773.                     description: Namespace defines the namespace of the referenced
  2774.                       Kubernetes Service or TraefikService.
  2775.                     type: string
  2776.                   nativeLB:
  2777.                     description: |-
  2778.                       NativeLB controls, when creating the load-balancer,
  2779.                       whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2780.                       The Kubernetes Service itself does load-balance to the pods.
  2781.                       By default, NativeLB is false.
  2782.                     type: boolean
  2783.                   nodePortLB:
  2784.                     description: |-
  2785.                       NodePortLB controls, when creating the load-balancer,
  2786.                       whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2787.                       It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2788.                       By default, NodePortLB is false.
  2789.                     type: boolean
  2790.                   passHostHeader:
  2791.                     description: |-
  2792.                       PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2793.                       By default, passHostHeader is true.
  2794.                     type: boolean
  2795.                   port:
  2796.                     anyOf:
  2797.                     - type: integer
  2798.                     - type: string
  2799.                     description: |-
  2800.                       Port defines the port of a Kubernetes Service.
  2801.                       This can be a reference to a named port.
  2802.                     x-kubernetes-int-or-string: true
  2803.                   responseForwarding:
  2804.                     description: ResponseForwarding defines how Traefik forwards the
  2805.                       response from the upstream Kubernetes Service to the client.
  2806.                     properties:
  2807.                       flushInterval:
  2808.                         description: |-
  2809.                           FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2810.                           A negative value means to flush immediately after each write to the client.
  2811.                           This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  2812.                           for such responses, writes are flushed to the client immediately.
  2813.                           Default: 100ms
  2814.                         type: string
  2815.                     type: object
  2816.                   scheme:
  2817.                     description: |-
  2818.                       Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  2819.                       It defaults to https when Kubernetes Service port is 443, http otherwise.
  2820.                     type: string
  2821.                   serversTransport:
  2822.                     description: |-
  2823.                       ServersTransport defines the name of ServersTransport resource to use.
  2824.                       It allows to configure the transport between Traefik and your servers.
  2825.                       Can only be used on a Kubernetes Service.
  2826.                     type: string
  2827.                   sticky:
  2828.                     description: |-
  2829.                       Sticky defines the sticky sessions configuration.
  2830.                       More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions
  2831.                     properties:
  2832.                       cookie:
  2833.                         description: Cookie defines the sticky cookie configuration.
  2834.                         properties:
  2835.                           httpOnly:
  2836.                             description: HTTPOnly defines whether the cookie can be
  2837.                               accessed by client-side APIs, such as JavaScript.
  2838.                             type: boolean
  2839.                           maxAge:
  2840.                             description: |-
  2841.                               MaxAge defines the number of seconds until the cookie expires.
  2842.                               When set to a negative number, the cookie expires immediately.
  2843.                               When set to zero, the cookie never expires.
  2844.                             type: integer
  2845.                           name:
  2846.                             description: Name defines the Cookie name.
  2847.                             type: string
  2848.                           path:
  2849.                             description: |-
  2850.                               Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
  2851.                               When not provided the cookie will be sent on every request to the domain.
  2852.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
  2853.                             type: string
  2854.                           sameSite:
  2855.                             description: |-
  2856.                               SameSite defines the same site policy.
  2857.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  2858.                             type: string
  2859.                           secure:
  2860.                             description: Secure defines whether the cookie can only
  2861.                               be transmitted over an encrypted connection (i.e. HTTPS).
  2862.                             type: boolean
  2863.                         type: object
  2864.                     type: object
  2865.                   strategy:
  2866.                     description: |-
  2867.                       Strategy defines the load balancing strategy between the servers.
  2868.                       RoundRobin is the only supported value at the moment.
  2869.                     type: string
  2870.                   weight:
  2871.                     description: |-
  2872.                       Weight defines the weight and should only be specified when Name references a TraefikService object
  2873.                       (and to be precise, one that embeds a Weighted Round Robin).
  2874.                     type: integer
  2875.                 required:
  2876.                 - name
  2877.                 type: object
  2878.               weighted:
  2879.                 description: Weighted defines the Weighted Round Robin configuration.
  2880.                 properties:
  2881.                   services:
  2882.                     description: Services defines the list of Kubernetes Service and/or
  2883.                       TraefikService to load-balance, with weight.
  2884.                     items:
  2885.                       description: Service defines an upstream HTTP service to proxy
  2886.                         traffic to.
  2887.                       properties:
  2888.                         healthCheck:
  2889.                           description: Healthcheck defines health checks for ExternalName
  2890.                             services.
  2891.                           properties:
  2892.                             followRedirects:
  2893.                               description: |-
  2894.                                 FollowRedirects defines whether redirects should be followed during the health check calls.
  2895.                                 Default: true
  2896.                               type: boolean
  2897.                             headers:
  2898.                               additionalProperties:
  2899.                                 type: string
  2900.                               description: Headers defines custom headers to be sent
  2901.                                 to the health check endpoint.
  2902.                               type: object
  2903.                             hostname:
  2904.                               description: Hostname defines the value of hostname
  2905.                                 in the Host header of the health check request.
  2906.                               type: string
  2907.                             interval:
  2908.                               anyOf:
  2909.                               - type: integer
  2910.                               - type: string
  2911.                               description: |-
  2912.                                 Interval defines the frequency of the health check calls.
  2913.                                 Default: 30s
  2914.                               x-kubernetes-int-or-string: true
  2915.                             method:
  2916.                               description: Method defines the healthcheck method.
  2917.                               type: string
  2918.                             mode:
  2919.                               description: |-
  2920.                                 Mode defines the health check mode.
  2921.                                 If defined to grpc, will use the gRPC health check protocol to probe the server.
  2922.                                 Default: http
  2923.                               type: string
  2924.                             path:
  2925.                               description: Path defines the server URL path for the
  2926.                                 health check endpoint.
  2927.                               type: string
  2928.                             port:
  2929.                               description: Port defines the server URL port for the
  2930.                                 health check endpoint.
  2931.                               type: integer
  2932.                             scheme:
  2933.                               description: Scheme replaces the server URL scheme for
  2934.                                 the health check endpoint.
  2935.                               type: string
  2936.                             status:
  2937.                               description: Status defines the expected HTTP status
  2938.                                 code of the response to the health check request.
  2939.                               type: integer
  2940.                             timeout:
  2941.                               anyOf:
  2942.                               - type: integer
  2943.                               - type: string
  2944.                               description: |-
  2945.                                 Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
  2946.                                 Default: 5s
  2947.                               x-kubernetes-int-or-string: true
  2948.                           type: object
  2949.                         kind:
  2950.                           description: Kind defines the kind of the Service.
  2951.                           enum:
  2952.                           - Service
  2953.                           - TraefikService
  2954.                           type: string
  2955.                         name:
  2956.                           description: |-
  2957.                             Name defines the name of the referenced Kubernetes Service or TraefikService.
  2958.                             The differentiation between the two is specified in the Kind field.
  2959.                           type: string
  2960.                         namespace:
  2961.                           description: Namespace defines the namespace of the referenced
  2962.                             Kubernetes Service or TraefikService.
  2963.                           type: string
  2964.                         nativeLB:
  2965.                           description: |-
  2966.                             NativeLB controls, when creating the load-balancer,
  2967.                             whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
  2968.                             The Kubernetes Service itself does load-balance to the pods.
  2969.                             By default, NativeLB is false.
  2970.                           type: boolean
  2971.                         nodePortLB:
  2972.                           description: |-
  2973.                             NodePortLB controls, when creating the load-balancer,
  2974.                             whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
  2975.                             It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
  2976.                             By default, NodePortLB is false.
  2977.                           type: boolean
  2978.                         passHostHeader:
  2979.                           description: |-
  2980.                             PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.
  2981.                             By default, passHostHeader is true.
  2982.                           type: boolean
  2983.                         port:
  2984.                           anyOf:
  2985.                           - type: integer
  2986.                           - type: string
  2987.                           description: |-
  2988.                             Port defines the port of a Kubernetes Service.
  2989.                             This can be a reference to a named port.
  2990.                           x-kubernetes-int-or-string: true
  2991.                         responseForwarding:
  2992.                           description: ResponseForwarding defines how Traefik forwards
  2993.                             the response from the upstream Kubernetes Service to the
  2994.                             client.
  2995.                           properties:
  2996.                             flushInterval:
  2997.                               description: |-
  2998.                                 FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.
  2999.                                 A negative value means to flush immediately after each write to the client.
  3000.                                 This configuration is ignored when ReverseProxy recognizes a response as a streaming response;
  3001.                                 for such responses, writes are flushed to the client immediately.
  3002.                                 Default: 100ms
  3003.                               type: string
  3004.                           type: object
  3005.                         scheme:
  3006.                           description: |-
  3007.                             Scheme defines the scheme to use for the request to the upstream Kubernetes Service.
  3008.                             It defaults to https when Kubernetes Service port is 443, http otherwise.
  3009.                           type: string
  3010.                         serversTransport:
  3011.                           description: |-
  3012.                             ServersTransport defines the name of ServersTransport resource to use.
  3013.                             It allows to configure the transport between Traefik and your servers.
  3014.                             Can only be used on a Kubernetes Service.
  3015.                           type: string
  3016.                         sticky:
  3017.                           description: |-
  3018.                             Sticky defines the sticky sessions configuration.
  3019.                             More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions
  3020.                           properties:
  3021.                             cookie:
  3022.                               description: Cookie defines the sticky cookie configuration.
  3023.                               properties:
  3024.                                 httpOnly:
  3025.                                   description: HTTPOnly defines whether the cookie
  3026.                                     can be accessed by client-side APIs, such as JavaScript.
  3027.                                   type: boolean
  3028.                                 maxAge:
  3029.                                   description: |-
  3030.                                     MaxAge defines the number of seconds until the cookie expires.
  3031.                                     When set to a negative number, the cookie expires immediately.
  3032.                                     When set to zero, the cookie never expires.
  3033.                                   type: integer
  3034.                                 name:
  3035.                                   description: Name defines the Cookie name.
  3036.                                   type: string
  3037.                                 path:
  3038.                                   description: |-
  3039.                                     Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
  3040.                                     When not provided the cookie will be sent on every request to the domain.
  3041.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
  3042.                                   type: string
  3043.                                 sameSite:
  3044.                                   description: |-
  3045.                                     SameSite defines the same site policy.
  3046.                                     More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  3047.                                   type: string
  3048.                                 secure:
  3049.                                   description: Secure defines whether the cookie can
  3050.                                     only be transmitted over an encrypted connection
  3051.                                     (i.e. HTTPS).
  3052.                                   type: boolean
  3053.                               type: object
  3054.                           type: object
  3055.                         strategy:
  3056.                           description: |-
  3057.                             Strategy defines the load balancing strategy between the servers.
  3058.                             RoundRobin is the only supported value at the moment.
  3059.                           type: string
  3060.                         weight:
  3061.                           description: |-
  3062.                             Weight defines the weight and should only be specified when Name references a TraefikService object
  3063.                             (and to be precise, one that embeds a Weighted Round Robin).
  3064.                           type: integer
  3065.                       required:
  3066.                       - name
  3067.                       type: object
  3068.                     type: array
  3069.                   sticky:
  3070.                     description: |-
  3071.                       Sticky defines whether sticky sessions are enabled.
  3072.                       More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#stickiness-and-load-balancing
  3073.                     properties:
  3074.                       cookie:
  3075.                         description: Cookie defines the sticky cookie configuration.
  3076.                         properties:
  3077.                           httpOnly:
  3078.                             description: HTTPOnly defines whether the cookie can be
  3079.                               accessed by client-side APIs, such as JavaScript.
  3080.                             type: boolean
  3081.                           maxAge:
  3082.                             description: |-
  3083.                               MaxAge defines the number of seconds until the cookie expires.
  3084.                               When set to a negative number, the cookie expires immediately.
  3085.                               When set to zero, the cookie never expires.
  3086.                             type: integer
  3087.                           name:
  3088.                             description: Name defines the Cookie name.
  3089.                             type: string
  3090.                           path:
  3091.                             description: |-
  3092.                               Path defines the path that must exist in the requested URL for the browser to send the Cookie header.
  3093.                               When not provided the cookie will be sent on every request to the domain.
  3094.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value
  3095.                             type: string
  3096.                           sameSite:
  3097.                             description: |-
  3098.                               SameSite defines the same site policy.
  3099.                               More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
  3100.                             type: string
  3101.                           secure:
  3102.                             description: Secure defines whether the cookie can only
  3103.                               be transmitted over an encrypted connection (i.e. HTTPS).
  3104.                             type: boolean
  3105.                         type: object
  3106.                     type: object
  3107.                 type: object
  3108.             type: object
  3109.         required:
  3110.         - metadata
  3111.         - spec
  3112.         type: object
  3113.     served: true
  3114.     storage: true

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: traefik-ingress-controller

rules:
  - apiGroups:
      - ""
    resources:
      - services
      - secrets
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - traefik.io
    resources:
      - middlewares
      - middlewaretcps
      - ingressroutes
      - traefikservices
      - ingressroutetcps
      - ingressrouteudps
      - tlsoptions
      - tlsstores
      - serverstransports
      - serverstransporttcps
    verbs:
      - get
      - list
      - watch

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: traefik-ingress-controller

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
  - kind: ServiceAccount
    name: traefik-ingress-controller
    namespace: default

Traefik

apiVersion: v1
kind: ServiceAccount
metadata:
  name: traefik-ingress-controller

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v3.3
          args:
            - --log.level=DEBUG
            - --api
            - --api.insecure
            - --entryPoints.web.address=:80
            - --entryPoints.tcpep.address=:8000
            - --entryPoints.udpep.address=:9000/udp
            - --providers.kubernetescrd
          ports:
            - name: web
              containerPort: 80
            - name: admin
              containerPort: 8080
            - name: tcpep
              containerPort: 8000
            - name: udpep
              containerPort: 9000

---
apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: TCP
      port: 80
      name: web
      targetPort: 80
    - protocol: TCP
      port: 8080
      name: admin
      targetPort: 8080
    - protocol: TCP
      port: 8000
      name: tcpep
      targetPort: 8000

---
apiVersion: v1
kind: Service
metadata:
  name: traefikudp
spec:
  type: LoadBalancer
  selector:
    app: traefik
  ports:
    - protocol: UDP
      port: 9000
      name: udpep
      targetPort: 9000

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: myingressroute
  namespace: default

spec:
  entryPoints:
    - web

  routes:
  - match: Host(`foo`) && PathPrefix(`/bar`)
    kind: Rule
    services:
    - name: whoami
      port: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroute.tcp
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressroute.udp
  namespace: default

spec:
  entryPoints:
    - udpep
  routes:
  - services:
      - name: whoamiudp
        port: 8080

Whoami

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  namespace: default
  labels:
    app: traefiklabs
    name: whoami

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoami
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: whoami

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamitcp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamitcp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamitcp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamitcp
    spec:
      containers:
        - name: whoamitcp
          image: traefik/whoamitcp
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamitcp
  namespace: default

spec:
  ports:
    - protocol: TCP
      port: 8080
  selector:
    app: traefiklabs
    task: whoamitcp

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoamiudp
  namespace: default
  labels:
    app: traefiklabs
    name: whoamiudp

spec:
  replicas: 2
  selector:
    matchLabels:
      app: traefiklabs
      task: whoamiudp
  template:
    metadata:
      labels:
        app: traefiklabs
        task: whoamiudp
    spec:
      containers:
        - name: whoamiudp
          image: traefik/whoamiudp:latest
          ports:
            - containerPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: whoamiudp
  namespace: default

spec:
  ports:
    - port: 8080
  selector:
    app: traefiklabs
    task: whoamiudp

Routing Configuration

Custom Resource Definition (CRD)

  • You can find an exhaustive list, generated from Traefik’s source code, of the custom resources and their attributes in the reference page.
  • Validate that the prerequisites are fulfilled before using the Traefik custom resources.
  • Traefik CRDs are building blocks that you can assemble according to your needs.

You can find an excerpt of the available custom resources in the table below:

KindPurposeConcept Behind
IngressRouteHTTP RoutingHTTP router
MiddlewareTweaks the HTTP requests before they are sent to your serviceHTTP Middlewares
TraefikServiceAbstraction for HTTP loadbalancing/mirroringHTTP service
IngressRouteTCPTCP RoutingTCP router
MiddlewareTCPTweaks the TCP requests before they are sent to your serviceTCP Middlewares
IngressRouteUDPUDP RoutingUDP router
TLSOptionsAllows to configure some parameters of the TLS connectionTLSOptions
TLSStoresAllows to configure the default TLS storeTLSStores
ServersTransportAllows to configure the transport between Traefik and the backendsServersTransport
ServersTransportTCPAllows to configure the transport between Traefik and the backendsTCP ServersTransport

Kind: IngressRoute

IngressRoute is the CRD implementation of a Traefik HTTP router.

Register the IngressRoute kind in the Kubernetes cluster before creating IngressRoute objects.

IngressRoute Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: foo
  namespace: bar
spec:
  entryPoints:                      # [1]
    - foo
  routes:                           # [2]
  - kind: Rule
    match: Host(`test.example.com`) # [3]
    priority: 10                    # [4]
    middlewares:                    # [5]
    - name: middleware1             # [6]
      namespace: default            # [7]
    observability:                  # [8]
      accesslogs: true              # [9]    
      metrics: true                 # [10]
      tracing: true                 # [11]
    services:                       # [12]
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80                      # [13]
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      serversTransport: transport   # [14]
      healthCheck:                  # [15]
        path: /health
        interval: 15s
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
          sameSite: none
          maxAge: 42  
          path: /foo
      strategy: RoundRobin
      weight: 10
      nativeLB: true                # [16]
      nodePortLB: true              # [17]
  tls:                              # [18]
    secretName: supersecret         # [19]
    options:                        # [20]
      name: opt                     # [21]
      namespace: default            # [22]
    certResolver: foo               # [23]
    domains:                        # [24]
    - main: example.net             # [25]
      sans:                         # [26]
      - a.example.net
      - b.example.net
RefAttributePurpose
[1]entryPointsList of entry points names
[2]routesList of routes
[3]routes[n].matchDefines the rule corresponding to an underlying router.
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]routes[n].middlewaresList of reference to Middleware
[6]middlewares[n].nameDefines the Middleware name
[7]middlewares[n].namespaceDefines the Middleware namespace. It can be omitted when the Middleware is in the IngressRoute namespace.
[8]routes[n].observabilityDefines the route observability configuration.
[9]observability.accesslogsDefines whether the route will produce access-logs.
[10]observability.metricsDefines whether the route will produce metrics.
[11]observability.tracingDefines whether the route will produce traces.
[12]routes[n].servicesList of any combination of TraefikService and reference to a Kubernetes service (See below for ExternalName Service setup)
[13]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[14]services[n].serversTransportDefines the reference to a ServersTransport. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[15]services[n].healthCheckDefines the HealthCheck when service references a Kubernetes service of type ExternalName.
[16]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[17]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is NodePort.
[18]tlsDefines TLS certificate configuration
[19]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[20]tls.optionsDefines the reference to a TLSOption
[21]options.nameDefines the TLSOption name
[22]options.namespaceDefines the TLSOption namespace
[23]tls.certResolverDefines the reference to a CertResolver
[24]tls.domainsList of domains
[25]domains[n].mainDefines the main domain name
[26]domains[n].sansList of SANs (alternative domains)

Declaring an IngressRoute

IngressRoute

# All resources definition must be declared
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test-name
  namespace: default
spec:
  entryPoints:
    - web
  routes:
  - kind: Rule
    match: Host(`test.example.com`)
    middlewares:
    - name: middleware1
      namespace: default
    priority: 10
    services:
    - kind: Service
      name: foo
      namespace: default
      passHostHeader: true
      port: 80
      responseForwarding:
        flushInterval: 1ms
      scheme: https
      sticky:
        cookie:
          httpOnly: true
          name: cookie
          secure: true
      strategy: RoundRobin
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret

Middlewares

# All resources definition must be declared
# Prefixing with /foo
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: middleware1
  namespace: default
spec:
  addPrefix:
    prefix: /foo

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Configuring Backend Protocol

There are 3 ways to configure the backend protocol for communication between Traefik and your pods:

  • Setting the scheme explicitly (http/https/h2c)
  • Configuring the name of the kubernetes service port to start with https (https)
  • Setting the kubernetes service port to use port 443 (https)

If you do not configure the above, Traefik will assume an http connection.

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRoute service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRoute service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRoute

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Load Balancing

More information in the dedicated server load balancing section.

Declaring and using Kubernetes Service Load Balancing

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: svc1
      namespace: default
    - name: svc2
      namespace: default

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the service NativeLB option to true. Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: Host(`example.net`)
    kind: Rule
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: Middleware

Middleware is the CRD implementation of a Traefik middleware.

Register the Middleware kind in the Kubernetes cluster before creating Middleware objects or referencing middlewares in the IngressRoute objects.

Declaring and Referencing a Middleware

Middleware

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: stripprefix
  namespace: foo

spec:
  stripPrefix:
    prefixes:
      - /stripit

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: stripprefix
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a Middleware from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available middlewares in the dedicated middlewares section.

Kind: TraefikService

TraefikService is the CRD implementation of a “Traefik Service”.

Register the TraefikService kind in the Kubernetes cluster before creating TraefikService objects, referencing services in the IngressRoute objects, or recursively in others TraefikService objects.

Disambiguate Traefik and Kubernetes Services

As the field name can reference different types of objects, use the field kind to avoid any ambiguity.

The field kind allows the following values:

TraefikService object allows to use any (valid) combinations of:

Weighted Round Robin

More information in the dedicated Weighted Round Robin service load balancing section.

Declaring and Using Weighted Round Robin

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: svc1
        port: 80
        weight: 1
      - name: wrr2
        kind: TraefikService
        weight: 1
      - name: mirror1
        kind: TraefikService
        weight: 1

---
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr2
  namespace: default

spec:
  weighted:
    services:
      - name: svc2
        port: 80
        weight: 1
      - name: svc3
        port: 80
        weight: 1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2
---
apiVersion: v1
kind: Service
metadata:
  name: svc3
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app3

Mirroring

More information in the dedicated mirroring service section.

Declaring and Using Mirroring

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: mirror1
      namespace: default
      kind: TraefikService

Mirroring k8s Service

# Mirroring from a k8s Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: svc1                      # svc1 receives 100% of the traffic
    port: 80
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 15% of this traffic
        kind: TraefikService
        percent: 15

Mirroring Traefik Service

# Mirroring from a Traefik Service
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: mirror1
  namespace: default

spec:
  mirroring:
    name: wrr1                      # wrr1 receives 100% of the traffic
    kind: TraefikService
    mirrors:
      - name: svc2                  # svc2 receives a copy of 20% of this traffic
        port: 80
        percent: 20
      - name: svc3                  # svc3 receives a copy of 10% of this traffic
        kind: TraefikService
        percent: 10

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: svc1
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app1
---
apiVersion: v1
kind: Service
metadata:
  name: svc2
  namespace: default

spec:
  ports:
    - name: http
      port: 80
  selector:
    app: traefiklabs
    task: app2

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the current resource.

Additionally, when the definition of the TraefikService is from another provider, the cross-provider syntax (service@provider) should be used to refer to the TraefikService, just as in the middleware case.

Specifying a namespace attribute in this case would not make any sense, and will be ignored (except if the provider is kubernetescrd).

Stickiness and load-balancing

As explained in the section about Sticky sessions, for stickiness to work all the way, it must be specified at each load-balancing level.

When stickiness is enabled, Traefik uses Kubernetes serving endpoints status to detect and mark servers as fenced. Fenced servers can still process requests tied to sticky cookies, while they are terminating.

For instance, in the example below, there is a first level of load-balancing because there is a (Weighted Round Robin) load-balancing of the two whoami services, and there is a second level because each whoami service is a replicaset and is thus handled as a load-balancer of servers.

Stickiness on two load-balancing levels

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/foo`)
    kind: Rule
    services:
    - name: wrr1
      namespace: default
      kind: TraefikService

Weighted Round Robin

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: wrr1
  namespace: default

spec:
  weighted:
    services:
      - name: whoami1
        kind: Service
        port: 80
        weight: 1
        sticky:
          cookie:
            name: lvl2
      - name: whoami2
        kind: Service
        weight: 1
        port: 80
        sticky:
          cookie:
            name: lvl2
    sticky:
      cookie:
        name: lvl1

K8s Service

apiVersion: v1
kind: Service
metadata:
  name: whoami1

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami1

---
apiVersion: v1
kind: Service
metadata:
  name: whoami2

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
  selector:
    app: whoami2

Deployment (to illustrate replicas)

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami1
  labels:
    app: whoami1

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami1
  template:
    metadata:
      labels:
        app: whoami1
    spec:
      containers:
        - name: whoami1
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: default
  name: whoami2
  labels:
    app: whoami2

spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami2
  template:
    metadata:
      labels:
        app: whoami2
    spec:
      containers:
        - name: whoami2
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80

To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:

curl -H Host:example.com -b "lvl1=default-whoami1-80; lvl2=http://10.42.0.6:80" http://localhost:8000/foo

assuming 10.42.0.6 is the IP address of one of the replicas (a pod then) of the whoami1 service.

Kind: IngressRouteTCP

IngressRouteTCP is the CRD implementation of a Traefik TCP router.

Register the IngressRouteTCP kind in the Kubernetes cluster before creating IngressRouteTCP objects.

IngressRouteTCP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:                    # [1]
    - footcp
  routes:                         # [2]
  - match: HostSNI(`*`)           # [3]
    priority: 10                  # [4]
    middlewares:
    - name: middleware1           # [5]
      namespace: default          # [6]
    services:                     # [7]
    - name: foo                   # [8]
      port: 8080                  # [9]
      weight: 10                  # [10]
      proxyProtocol:              # [11]
        version: 1                # [12]
      serversTransport: transport # [13]
      nativeLB: true              # [14]
      nodePortLB: true            # [15]
      tls: false                  # [16]

  tls:                            # [17]
    secretName: supersecret       # [18]
    options:                      # [19]
      name: opt                   # [20]
      namespace: default          # [21]
    certResolver: foo             # [22]
    domains:                      # [23]
    - main: example.net           # [24]
      sans:                       # [25]
      - a.example.net
      - b.example.net
    passthrough: false            # [26]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].matchDefines the rule of the underlying router
[4]routes[n].priorityDefines the priority to disambiguate rules of the same length, for route matching
[5]middlewares[n].nameDefines the MiddlewareTCP name
[6]middlewares[n].namespaceDefines the MiddlewareTCP namespace
[7]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[8]services[n].nameDefines the name of a Kubernetes service
[9]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[10]services[n].weightDefines the weight to apply to the server load balancing
[11]services[n].proxyProtocolDefines the PROXY protocol configuration
[12]services[n].proxyProtocol.versionDefines the PROXY protocol version
[13]services[n].serversTransportDefines the reference to a ServersTransportTCP. The ServersTransport namespace is assumed to be the Kubernetes service namespace (see ServersTransport reference).
[14]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[15]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs when the service type is of type NodePort.
[16]services[n].tlsDefines whether to use TLS when dialing with the target service.
[17]tlsDefines TLS certificate configuration
[18]tls.secretNameDefines the secret name used to store the certificate (in the IngressRoute namespace)
[19]tls.optionsDefines the reference to a TLSOption
[20]tls.options.nameDefines the TLSOption name
[21]tls.options.namespaceDefines the TLSOption namespace
[22]tls.certResolverDefines the reference to a CertResolver
[23]tls.domainsList of domains
[24]tls.domains[n].mainDefines the main domain name
[25]tls.domains[n].sansList of SANs (alternative domains)
[26]tls.passthroughIf true, delegates the TLS termination to the backend

Declaring an IngressRouteTCP

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ingressroutetcpfoo

spec:
  entryPoints:
    - footcp
  routes:
  # Match is the rule corresponding to an underlying router.
  - match: HostSNI(`*`)
    priority: 10
    services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10
  tls:
    certResolver: foo
    domains:
    - main: example.net
      sans:
      - a.example.net
      - b.example.net
    options:
      name: opt
      namespace: default
    secretName: supersecret
    passthrough: false

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: opt
  namespace: default

spec:
  minVersion: VersionTLS12

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteTCP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteTCP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

Only on IngressRouteTCP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

On both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the TCP service NativeLB option to true. By default, NativeLB is false.

Examples

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - match: HostSNI(`*`)
    services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: MiddlewareTCP

MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.

Register the MiddlewareTCP kind in the Kubernetes cluster before creating MiddlewareTCP objects or referencing TCP middlewares in the IngressRouteTCP objects.

Declaring and Referencing a MiddlewareTCP

Middleware

apiVersion: traefik.io/v1alpha1
kind: MiddlewareTCP
metadata:
  name: ipallowlist
spec:
  ipAllowList:
    sourceRange:
      - 127.0.0.1/32
      - 192.168.1.7

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/allowlist`)
    kind: Rule
    services:
    - name: whoami
      port: 80
    middlewares:
    - name: ipallowlist
      namespace: foo

Cross-provider namespace

As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource (in the reference to the middleware) with the provider namespace, when the definition of the TCP middleware comes from another provider. In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored. Additionally, when you want to reference a MiddlewareTCP from the CRD Provider, you have to append the namespace of the resource in the resource-name as Traefik appends the namespace internally automatically.

More information about available TCP middlewares in the dedicated middlewares section.

Kind: IngressRouteUDP

IngressRouteUDP is the CRD implementation of a Traefik UDP router.

Register the IngressRouteUDP kind in the Kubernetes cluster before creating IngressRouteUDP objects.

IngressRouteUDP Attributes

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:                  # [1]
    - fooudp
  routes:                       # [2]
  - services:                   # [3]
    - name: foo                 # [4]
      port: 8080                # [5]
      weight: 10                # [6]
      nativeLB: true            # [7]
      nodePortLB: true          # [8]
RefAttributePurpose
[1]entryPointsList of entrypoints names
[2]routesList of routes
[3]routes[n].servicesList of Kubernetes service definitions (See below for ExternalName Service setup)
[4]services[n].nameDefines the name of a Kubernetes service
[5]services[n].portDefines the port of a Kubernetes service. This can be a reference to a named port.
[6]services[n].weightDefines the weight to apply to the server load balancing
[7]services[n].nativeLBControls, when creating the load-balancer, whether the LB’s children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.
[8]services[n].nodePortLBControls, when creating the load-balancer, whether the LB’s children are directly the nodes internal IPs using the nodePort when the service type is NodePort.

Declaring an IngressRouteUDP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo

spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
    - name: bar
      port: 8081
      weight: 10

Using Kubernetes ExternalName Service

Traefik backends creation needs a port to be set, however Kubernetes ExternalName Service could be defined without any port. Accordingly, Traefik supports defining a port in two ways:

  • only on IngressRouteUDP service
  • on both sides, you’ll be warned if the ports don’t match, and the IngressRouteUDP service port is used

Thus, in case of two sides port definition, Traefik expects a match between ports.

Examples

IngressRouteUDP

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName

ExternalName Service

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Both sides

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: external-svc
      port: 80

---
apiVersion: v1
kind: Service
metadata:
  name: external-svc
  namespace: default
spec:
  externalName: external.domain
  type: ExternalName
  ports:
    - port: 80

Kubernetes Service Native Load-Balancing

To avoid creating the server load-balancer with the pods IPs and use Kubernetes Service clusterIP directly, one should set the UDP service NativeLB option to true. By default, NativeLB is false.

Example

---
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: test.route
  namespace: default

spec:
  entryPoints:
    - foo

  routes:
  - services:
    - name: svc
      port: 80
      # Here, nativeLB instructs to build the servers load balancer with the Kubernetes Service clusterIP only.
      nativeLB: true

---
apiVersion: v1
kind: Service
metadata:
  name: svc
  namespace: default
spec:
  type: ClusterIP
  ...

Kind: TLSOption

TLSOption is the CRD implementation of a Traefik “TLS Option”.

Register the TLSOption kind in the Kubernetes cluster before creating TLSOption objects or referencing TLS options in the IngressRoute / IngressRouteTCP objects.

TLSOption Attributes

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption                             # [1]
  namespace: default

spec:
  minVersion: VersionTLS12                      # [2]
  maxVersion: VersionTLS13                      # [3]
  curvePreferences:                             # [4]
    - CurveP521
    - CurveP384
  cipherSuites:                                 # [5]
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:                                   # [6]
    secretNames:                                # [7]
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven     # [8]
  sniStrict: true                               # [9]
  alpnProtocols:                                # [10]
    - foobar
RefAttributePurpose
[1]nameDefines the name of the TLSOption resource. One can use default as name to redefine the default TLSOption.
[2]minVersionDefines the minimum TLS version that is acceptable.
[3]maxVersionDefines the maximum TLS version that is acceptable.
[4]cipherSuiteslist of supported cipher suites for TLS versions up to TLS 1.2.
[5]curvePreferencesList of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
[6]clientAuthdetermines the server’s policy for TLS Client Authentication.
[7]clientAuth.secretNameslist of names of the referenced Kubernetes Secrets (in TLSOption namespace). The secret must contain a certificate under either a tls.ca or a ca.crt key.
[8]clientAuth.clientAuthTypedefines the client authentication type to apply. The available values are: NoClientCert, RequestClientCert, VerifyClientCertIfGiven and RequireAndVerifyClientCert.
[9]sniStrictif true, Traefik won’t allow connections from clients connections that do not specify a server_name extension.
[10]alpnProtocolsList of supported application level protocols for the TLS handshake, in order of preference.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a TLSOption

TLSOption

apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: mytlsoption
  namespace: default

spec:
  minVersion: VersionTLS12
  sniStrict: true
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_RSA_WITH_AES_256_GCM_SHA384
  clientAuth:
    secretNames:
      - secret-ca1
      - secret-ca2
    clientAuthType: VerifyClientCertIfGiven

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls:
    options: 
      name: mytlsoption
      namespace: default

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: secret-ca1
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-ca2
  namespace: default

data:
  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=

References and namespaces

If the optional namespace attribute is not set, the configuration will be applied with the namespace of the IngressRoute.

Additionally, when the definition of the TLS option is from another provider, the cross-provider syntax (middlewarename@provider) should be used to refer to the TLS option. Specifying a namespace attribute in this case would not make any sense, and will be ignored.

Kind: TLSStore

TLSStore is the CRD implementation of a Traefik “TLS Store”.

Register the TLSStore kind in the Kubernetes cluster before creating TLSStore objects.

Default TLS Store

Traefik currently only uses the TLS Store named “default”. This default TLSStore should be in a namespace discoverable by Traefik. Since it is used by default on IngressRoute and IngressRouteTCP objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default TLSStore.

TLSStore Attributes

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  certificates:                            # [1]
    - secretName: foo                      
    - secretName: bar
  defaultCertificate:                      # [2]
    secretName: secret
RefAttributePurpose
[1]certificatesList of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store.
[2]defaultCertificateName of a Kubernetes Secret that holds the default key/certificate pair for the store.

Declaring and referencing a TLSStore

TLSStore

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
  name: default

spec:
  defaultCertificate:
    secretName:  supersecret

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ingressroutebar

spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`example.com`) && PathPrefix(`/stripit`)
    kind: Rule
    services:
    - name: whoami
      port: 80
  tls: {}

Secret

apiVersion: v1
kind: Secret
metadata:
  name: supersecret

data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=

Kind: ServersTransport

ServersTransport is the CRD implementation of a ServersTransport.

Default serversTransport

If no serversTransport is specified, the default@internal will be used. The default@internal serversTransport is created from the static configuration.

ServersTransport Attributes

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: foobar                        # [1]
  insecureSkipVerify: true                  # [2]
  rootCAsSecrets:                           # [3]
    - foobar
    - foobar
  certificatesSecrets:                      # [4]
    - foobar
    - foobar
  maxIdleConnsPerHost: 1                    # [5]
  forwardingTimeouts:                       # [6]
    dialTimeout: 42s                        # [7]
    responseHeaderTimeout: 42s              # [8]
    idleConnTimeout: 42s                    # [9]
  peerCertURI: foobar                       # [10]
  disableHTTP2: true                        # [11]
  spiffe:                                   # [12] 
    ids:                                    # [13]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [14]
RefAttributePurpose
[1]serverNameServerName used to contact the server.
[2]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[3]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[4]certificatesSecretsCertificates to present to the server for mTLS.
[5]maxIdleConnsPerHostControls the maximum idle (keep-alive) connections to keep per-host. If zero, defaultMaxIdleConnsPerHost is used.
[6]forwardingTimeoutsTimeouts for requests forwarded to the servers.
[7]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[8]responseHeaderTimeoutThe amount of time to wait for a server’s response headers after fully writing the request (including its body, if any). If zero, no timeout exists.
[9]idleConnTimeoutThe maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists.
[10]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[11]disableHTTP2Disables HTTP/2 for connections with servers.
[12]spiffeThe spiffe configuration.
[13]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[14]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransport

ServersTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

ServersTransport reference

By default, the referenced ServersTransport CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransport CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransport CRD is defined in another provider the cross-provider format name@provider should be used.

Kind: ServersTransportTCP

ServersTransportTCP is the CRD implementation of a ServersTransportTCP.

Default serversTransportTCP

If no serversTransportTCP is specified, the default@internal will be used. The default@internal serversTransportTCP is created from the static configuration.

ServersTransportTCP Attributes

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  dialTimeout: 42s                          # [1]
  dialKeepAlive: 42s                        # [2]
  terminationDelay: 42s                     # [3]
  tls:                                      # [4]
    serverName: foobar                      # [5]
    insecureSkipVerify: true                # [6]
    peerCertURI: foobar                     # [7]
    rootCAsSecrets:                         # [8]
      - foobar
      - foobar
    certificatesSecrets:                    # [9]
      - foobar
      - foobar
  spiffe:                                   # [10] 
    ids:                                    # [11]
    - spiffe://trust-domain/id1
    - spiffe://trust-domain/id2
    trustDomain: "spiffe://trust-domain"    # [12]
RefAttributePurpose
[1]dialTimeoutThe amount of time to wait until a connection to a server can be established. If zero, no timeout exists.
[2]dialKeepAliveThe interval between keep-alive probes for an active network connection. If zero, keep-alive probes are sent with a default value (currently 15 seconds), if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field. If negative, keep-alive probes are disabled.
[3]terminationDelayDefines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability.
[4]tlsThe TLS configuration.
[5]serverNameServerName used to contact the server.
[6]insecureSkipVerifyControls whether the server’s certificate chain and host name is verified.
[7]peerCertURIURI used to match against SAN URIs during the server’s certificate verification.
[8]rootCAsSecretsDefines the set of root certificate authorities to use when verifying server certificates. The secret must contain a certificate under either a tls.ca or a ca.crt key.
[9]certificatesSecretsCertificates to present to the server for mTLS.
[10]spiffeThe SPIFFE configuration.
[11]idsDefines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).
[12]trustDomainDefines the allowed SPIFFE trust domain.

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.

Declaring and referencing a ServersTransportTCP

ServersTransportTCP

apiVersion: traefik.io/v1alpha1
kind: ServersTransportTCP
metadata:
  name: mytransport
  namespace: default

spec:
  tls:
    serverName: example.org
    insecureSkipVerify: true

IngressRouteTCP

apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - tcpep
  routes:
  - match: HostSNI(`bar`)
    services:
      - name: whoamitcp
        port: 8080
        serversTransport: mytransport

ServersTransportTCP reference

By default, the referenced ServersTransportTCP CRD must be defined in the same Kubernetes service namespace.

To reference a ServersTransportTCP CRD from another namespace, the value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled.

If the ServersTransportTCP CRD is defined in another provider the cross-provider format name@provider should be used.

Further

Also see the full example with Let’s Encrypt.

Using Traefik OSS in Production?

If you are using Traefik at work, consider adding enterprise-grade API gateway capabilities or commercial support for Traefik OSS.

Adding API Gateway capabilities to Traefik OSS is fast and seamless. There’s no rip and replace and all configurations remain intact. See it in action via this short video.