Add Support for Consul Connect

Co-authored-by: Florian Apolloner <apollo13@users.noreply.github.com>

docs/content/reference/dynamic-configuration/consul-catalog.yml

@@ -1 +1,2 @@
 - "traefik.enable=true"
+- "traefik.consulcatalog.connect=true"

docs/content/reference/dynamic-configuration/file.toml

@@ -278,6 +278,7 @@
       rootCAs = ["foobar", "foobar"]
       maxIdleConnsPerHost = 42
       disableHTTP2 = true
+      peerCertURI = "foobar"
 
       [[http.serversTransports.ServersTransport0.certificates]]
         certFile = "foobar"
@@ -296,6 +297,7 @@
       rootCAs = ["foobar", "foobar"]
       maxIdleConnsPerHost = 42
       disableHTTP2 = true
+      peerCertURI = "foobar"
 
       [[http.serversTransports.ServersTransport1.certificates]]
         certFile = "foobar"

docs/content/reference/dynamic-configuration/file.yaml

@@ -329,6 +329,7 @@ http:
         responseHeaderTimeout: 42s
         idleConnTimeout: 42s
       disableHTTP2: true
+      peerCertURI: foobar
     ServersTransport1:
       serverName: foobar
       insecureSkipVerify: true
@@ -346,6 +347,7 @@ http:
         responseHeaderTimeout: 42s
         idleConnTimeout: 42s
       disableHTTP2: true
+      peerCertURI: foobar
 tcp:
   routers:
     TCPRouter0:

docs/content/reference/dynamic-configuration/traefik.containo.us_middlewares.yaml

@@ -299,6 +299,7 @@ spec:
                       type: string
                     type: object
                   featurePolicy:
+                    description: 'Deprecated: use PermissionsPolicy instead.'
                     type: string
                   forceSTSHeader:
                     type: boolean
@@ -310,6 +311,8 @@ spec:
                     type: array
                   isDevelopment:
                     type: boolean
+                  permissionsPolicy:
+                    type: string
                   publicKey:
                     type: string
                   referrerPolicy:

docs/content/reference/dynamic-configuration/traefik.containo.us_serverstransports.yaml

@@ -78,6 +78,10 @@ spec:
                 description: If non-zero, controls the maximum idle (keep-alive) to
                   keep per-host. If zero, DefaultMaxIdleConnsPerHost is used.
                 type: integer
+              peerCertURI:
+                description: URI used to match against SAN URI during the peer certificate
+                  verification.
+                type: string
               rootCAsSecrets:
                 description: Add cert file for self-signed certificate.
                 items:

docs/content/reference/static-configuration/cli-ref.md

@@ -369,6 +369,12 @@ Enable ConsulCatalog backend with default settings. (Default: ```false```)
 `--providers.consulcatalog.cache`:  
 Use local agent caching for catalog reads. (Default: ```false```)
 
+`--providers.consulcatalog.connectaware`:  
+Enable Consul Connect support. (Default: ```false```)
+
+`--providers.consulcatalog.connectbydefault`:  
+Consider every service as Connect capable by default. (Default: ```false```)
+
 `--providers.consulcatalog.constraints`:  
 Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container.
 
@@ -376,7 +382,7 @@ Constraints is an expression that Traefik matches against the container's labels
 Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
 
 `--providers.consulcatalog.endpoint.address`:  
-The address of the Consul server (Default: ```127.0.0.1:8500```)
+The address of the Consul server
 
 `--providers.consulcatalog.endpoint.datacenter`:  
 Data center to use. If not provided, the default agent data center is used
@@ -423,6 +429,9 @@ Interval for check Consul API. Default 15s (Default: ```15```)
 `--providers.consulcatalog.requireconsistent`:  
 Forces the read to be fully consistent. (Default: ```false```)
 
+`--providers.consulcatalog.servicename`:  
+Name of the Traefik service in Consul Catalog (needs to be registered via the orchestrator or manually). (Default: ```traefik```)
+
 `--providers.consulcatalog.stale`:  
 Use stale consistency for catalog reads. (Default: ```false```)
 

docs/content/reference/static-configuration/env-ref.md

@@ -342,6 +342,12 @@ Enable ConsulCatalog backend with default settings. (Default: ```false```)
 `TRAEFIK_PROVIDERS_CONSULCATALOG_CACHE`:  
 Use local agent caching for catalog reads. (Default: ```false```)
 
+`TRAEFIK_PROVIDERS_CONSULCATALOG_CONNECTAWARE`:  
+Enable Consul Connect support. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_CONSULCATALOG_CONNECTBYDEFAULT`:  
+Consider every service as Connect capable by default. (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_CONSULCATALOG_CONSTRAINTS`:  
 Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container.
 
@@ -349,7 +355,7 @@ Constraints is an expression that Traefik matches against the container's labels
 Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
 
 `TRAEFIK_PROVIDERS_CONSULCATALOG_ENDPOINT_ADDRESS`:  
-The address of the Consul server (Default: ```127.0.0.1:8500```)
+The address of the Consul server
 
 `TRAEFIK_PROVIDERS_CONSULCATALOG_ENDPOINT_DATACENTER`:  
 Data center to use. If not provided, the default agent data center is used
@@ -396,6 +402,9 @@ Interval for check Consul API. Default 15s (Default: ```15```)
 `TRAEFIK_PROVIDERS_CONSULCATALOG_REQUIRECONSISTENT`:  
 Forces the read to be fully consistent. (Default: ```false```)
 
+`TRAEFIK_PROVIDERS_CONSULCATALOG_SERVICENAME`:  
+Name of the Traefik service in Consul Catalog (needs to be registered via the orchestrator or manually). (Default: ```traefik```)
+
 `TRAEFIK_PROVIDERS_CONSULCATALOG_STALE`:  
 Use stale consistency for catalog reads. (Default: ```false```)