Move code to pkg

pkg/provider/acme/account.go

@@ -0,0 +1,89 @@
+package acme
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+
+	"github.com/containous/traefik/pkg/log"
+	"github.com/go-acme/lego/certcrypto"
+	"github.com/go-acme/lego/registration"
+)
+
+// Account is used to store lets encrypt registration info
+type Account struct {
+	Email        string
+	Registration *registration.Resource
+	PrivateKey   []byte
+	KeyType      certcrypto.KeyType
+}
+
+const (
+	// RegistrationURLPathV1Regexp is a regexp which match ACME registration URL in the V1 format
+	RegistrationURLPathV1Regexp = `^.*/acme/reg/\d+$`
+)
+
+// NewAccount creates an account
+func NewAccount(ctx context.Context, email string, keyTypeValue string) (*Account, error) {
+	keyType := GetKeyType(ctx, keyTypeValue)
+
+	// Create a user. New accounts need an email and private key to start
+	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Account{
+		Email:      email,
+		PrivateKey: x509.MarshalPKCS1PrivateKey(privateKey),
+		KeyType:    keyType,
+	}, nil
+}
+
+// GetEmail returns email
+func (a *Account) GetEmail() string {
+	return a.Email
+}
+
+// GetRegistration returns lets encrypt registration resource
+func (a *Account) GetRegistration() *registration.Resource {
+	return a.Registration
+}
+
+// GetPrivateKey returns private key
+func (a *Account) GetPrivateKey() crypto.PrivateKey {
+	privateKey, err := x509.ParsePKCS1PrivateKey(a.PrivateKey)
+	if err != nil {
+		log.WithoutContext().WithField(log.ProviderName, "acme").
+			Errorf("Cannot unmarshal private key %+v: %v", a.PrivateKey, err)
+		return nil
+	}
+
+	return privateKey
+}
+
+// GetKeyType used to determine which algo to used
+func GetKeyType(ctx context.Context, value string) certcrypto.KeyType {
+	logger := log.FromContext(ctx)
+
+	switch value {
+	case "EC256":
+		return certcrypto.EC256
+	case "EC384":
+		return certcrypto.EC384
+	case "RSA2048":
+		return certcrypto.RSA2048
+	case "RSA4096":
+		return certcrypto.RSA4096
+	case "RSA8192":
+		return certcrypto.RSA8192
+	case "":
+		logger.Infof("The key type is empty. Use default key type %v.", certcrypto.RSA4096)
+		return certcrypto.RSA4096
+	default:
+		logger.Infof("Unable to determine the key type value %q: falling back on %v.", value, certcrypto.RSA4096)
+		return certcrypto.RSA4096
+	}
+}

pkg/provider/acme/challenge_http.go

@@ -0,0 +1,94 @@
+package acme
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/containous/mux"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/go-acme/lego/challenge"
+	"github.com/go-acme/lego/challenge/http01"
+)
+
+var _ challenge.ProviderTimeout = (*challengeHTTP)(nil)
+
+type challengeHTTP struct {
+	Store Store
+}
+
+// Present presents a challenge to obtain new ACME certificate.
+func (c *challengeHTTP) Present(domain, token, keyAuth string) error {
+	return c.Store.SetHTTPChallengeToken(token, domain, []byte(keyAuth))
+}
+
+// CleanUp cleans the challenges when certificate is obtained.
+func (c *challengeHTTP) CleanUp(domain, token, keyAuth string) error {
+	return c.Store.RemoveHTTPChallengeToken(token, domain)
+}
+
+// Timeout calculates the maximum of time allowed to resolved an ACME challenge.
+func (c *challengeHTTP) Timeout() (timeout, interval time.Duration) {
+	return 60 * time.Second, 5 * time.Second
+}
+
+// Append adds routes on internal router
+func (p *Provider) Append(router *mux.Router) {
+	router.Methods(http.MethodGet).
+		Path(http01.ChallengePath("{token}")).
+		Handler(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+			vars := mux.Vars(req)
+
+			ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+			logger := log.FromContext(ctx)
+
+			if token, ok := vars["token"]; ok {
+				domain, _, err := net.SplitHostPort(req.Host)
+				if err != nil {
+					logger.Debugf("Unable to split host and port: %v. Fallback to request host.", err)
+					domain = req.Host
+				}
+
+				tokenValue := getTokenValue(ctx, token, domain, p.Store)
+				if len(tokenValue) > 0 {
+					rw.WriteHeader(http.StatusOK)
+					_, err = rw.Write(tokenValue)
+					if err != nil {
+						logger.Errorf("Unable to write token: %v", err)
+					}
+					return
+				}
+			}
+			rw.WriteHeader(http.StatusNotFound)
+		}))
+}
+
+func getTokenValue(ctx context.Context, token, domain string, store Store) []byte {
+	logger := log.FromContext(ctx)
+	logger.Debugf("Retrieving the ACME challenge for token %v...", token)
+
+	var result []byte
+
+	operation := func() error {
+		var err error
+		result, err = store.GetHTTPChallengeToken(token, domain)
+		return err
+	}
+
+	notify := func(err error, time time.Duration) {
+		logger.Errorf("Error getting challenge for token retrying in %s", time)
+	}
+
+	ebo := backoff.NewExponentialBackOff()
+	ebo.MaxElapsedTime = 60 * time.Second
+	err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
+	if err != nil {
+		logger.Errorf("Cannot retrieve the ACME challenge for token %v: %v", token, err)
+		return []byte{}
+	}
+
+	return result
+}

pkg/provider/acme/challenge_tls.go

@@ -0,0 +1,55 @@
+package acme
+
+import (
+	"crypto/tls"
+
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/go-acme/lego/challenge"
+	"github.com/go-acme/lego/challenge/tlsalpn01"
+)
+
+var _ challenge.Provider = (*challengeTLSALPN)(nil)
+
+type challengeTLSALPN struct {
+	Store Store
+}
+
+func (c *challengeTLSALPN) Present(domain, token, keyAuth string) error {
+	log.WithoutContext().WithField(log.ProviderName, "acme").
+		Debugf("TLS Challenge Present temp certificate for %s", domain)
+
+	certPEMBlock, keyPEMBlock, err := tlsalpn01.ChallengeBlocks(domain, keyAuth)
+	if err != nil {
+		return err
+	}
+
+	cert := &Certificate{Certificate: certPEMBlock, Key: keyPEMBlock, Domain: types.Domain{Main: "TEMP-" + domain}}
+	return c.Store.AddTLSChallenge(domain, cert)
+}
+
+func (c *challengeTLSALPN) CleanUp(domain, token, keyAuth string) error {
+	log.WithoutContext().WithField(log.ProviderName, "acme").
+		Debugf("TLS Challenge CleanUp temp certificate for %s", domain)
+
+	return c.Store.RemoveTLSChallenge(domain)
+}
+
+// GetTLSALPNCertificate Get the temp certificate for ACME TLS-ALPN-O1 challenge.
+func (p *Provider) GetTLSALPNCertificate(domain string) (*tls.Certificate, error) {
+	cert, err := p.Store.GetTLSChallenge(domain)
+	if err != nil {
+		return nil, err
+	}
+
+	if cert == nil {
+		return nil, nil
+	}
+
+	certificate, err := tls.X509KeyPair(cert.Certificate, cert.Key)
+	if err != nil {
+		return nil, err
+	}
+
+	return &certificate, nil
+}

pkg/provider/acme/local_store.go

@@ -0,0 +1,252 @@
+package acme
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"regexp"
+	"sync"
+
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/safe"
+)
+
+var _ Store = (*LocalStore)(nil)
+
+// LocalStore Stores implementation for local file
+type LocalStore struct {
+	filename     string
+	storedData   *StoredData
+	SaveDataChan chan *StoredData `json:"-"`
+	lock         sync.RWMutex
+}
+
+// NewLocalStore initializes a new LocalStore with a file name
+func NewLocalStore(filename string) *LocalStore {
+	store := &LocalStore{filename: filename, SaveDataChan: make(chan *StoredData)}
+	store.listenSaveAction()
+	return store
+}
+
+func (s *LocalStore) get() (*StoredData, error) {
+	if s.storedData == nil {
+		s.storedData = &StoredData{
+			HTTPChallenges: make(map[string]map[string][]byte),
+			TLSChallenges:  make(map[string]*Certificate),
+		}
+
+		hasData, err := CheckFile(s.filename)
+		if err != nil {
+			return nil, err
+		}
+
+		if hasData {
+			logger := log.WithoutContext().WithField(log.ProviderName, "acme")
+
+			f, err := os.Open(s.filename)
+			if err != nil {
+				return nil, err
+			}
+			defer f.Close()
+
+			file, err := ioutil.ReadAll(f)
+			if err != nil {
+				return nil, err
+			}
+
+			if len(file) > 0 {
+				if err := json.Unmarshal(file, s.storedData); err != nil {
+					return nil, err
+				}
+			}
+
+			// Check if ACME Account is in ACME V1 format
+			if s.storedData.Account != nil && s.storedData.Account.Registration != nil {
+				isOldRegistration, err := regexp.MatchString(RegistrationURLPathV1Regexp, s.storedData.Account.Registration.URI)
+				if err != nil {
+					return nil, err
+				}
+				if isOldRegistration {
+					logger.Debug("Reseting ACME account.")
+					s.storedData.Account = nil
+					s.SaveDataChan <- s.storedData
+				}
+			}
+
+			// Delete all certificates with no value
+			var certificates []*Certificate
+			for _, certificate := range s.storedData.Certificates {
+				if len(certificate.Certificate) == 0 || len(certificate.Key) == 0 {
+					logger.Debugf("Deleting empty certificate %v for %v", certificate, certificate.Domain.ToStrArray())
+					continue
+				}
+				certificates = append(certificates, certificate)
+			}
+
+			if len(certificates) < len(s.storedData.Certificates) {
+				s.storedData.Certificates = certificates
+				s.SaveDataChan <- s.storedData
+			}
+		}
+	}
+
+	return s.storedData, nil
+}
+
+// listenSaveAction listens to a chan to store ACME data in json format into LocalStore.filename
+func (s *LocalStore) listenSaveAction() {
+	safe.Go(func() {
+		logger := log.WithoutContext().WithField(log.ProviderName, "acme")
+		for object := range s.SaveDataChan {
+			data, err := json.MarshalIndent(object, "", "  ")
+			if err != nil {
+				logger.Error(err)
+			}
+
+			err = ioutil.WriteFile(s.filename, data, 0600)
+			if err != nil {
+				logger.Error(err)
+			}
+		}
+	})
+}
+
+// GetAccount returns ACME Account
+func (s *LocalStore) GetAccount() (*Account, error) {
+	storedData, err := s.get()
+	if err != nil {
+		return nil, err
+	}
+
+	return storedData.Account, nil
+}
+
+// SaveAccount stores ACME Account
+func (s *LocalStore) SaveAccount(account *Account) error {
+	storedData, err := s.get()
+	if err != nil {
+		return err
+	}
+
+	storedData.Account = account
+	s.SaveDataChan <- storedData
+
+	return nil
+}
+
+// GetCertificates returns ACME Certificates list
+func (s *LocalStore) GetCertificates() ([]*Certificate, error) {
+	storedData, err := s.get()
+	if err != nil {
+		return nil, err
+	}
+
+	return storedData.Certificates, nil
+}
+
+// SaveCertificates stores ACME Certificates list
+func (s *LocalStore) SaveCertificates(certificates []*Certificate) error {
+	storedData, err := s.get()
+	if err != nil {
+		return err
+	}
+
+	storedData.Certificates = certificates
+	s.SaveDataChan <- storedData
+
+	return nil
+}
+
+// GetHTTPChallengeToken Get the http challenge token from the store
+func (s *LocalStore) GetHTTPChallengeToken(token, domain string) ([]byte, error) {
+	s.lock.RLock()
+	defer s.lock.RUnlock()
+
+	if s.storedData.HTTPChallenges == nil {
+		s.storedData.HTTPChallenges = map[string]map[string][]byte{}
+	}
+
+	if _, ok := s.storedData.HTTPChallenges[token]; !ok {
+		return nil, fmt.Errorf("cannot find challenge for token %v", token)
+	}
+
+	result, ok := s.storedData.HTTPChallenges[token][domain]
+	if !ok {
+		return nil, fmt.Errorf("cannot find challenge for token %v", token)
+	}
+	return result, nil
+}
+
+// SetHTTPChallengeToken Set the http challenge token in the store
+func (s *LocalStore) SetHTTPChallengeToken(token, domain string, keyAuth []byte) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.HTTPChallenges == nil {
+		s.storedData.HTTPChallenges = map[string]map[string][]byte{}
+	}
+
+	if _, ok := s.storedData.HTTPChallenges[token]; !ok {
+		s.storedData.HTTPChallenges[token] = map[string][]byte{}
+	}
+
+	s.storedData.HTTPChallenges[token][domain] = keyAuth
+	return nil
+}
+
+// RemoveHTTPChallengeToken Remove the http challenge token in the store
+func (s *LocalStore) RemoveHTTPChallengeToken(token, domain string) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.HTTPChallenges == nil {
+		return nil
+	}
+
+	if _, ok := s.storedData.HTTPChallenges[token]; ok {
+		delete(s.storedData.HTTPChallenges[token], domain)
+		if len(s.storedData.HTTPChallenges[token]) == 0 {
+			delete(s.storedData.HTTPChallenges, token)
+		}
+	}
+	return nil
+}
+
+// AddTLSChallenge Add a certificate to the ACME TLS-ALPN-01 certificates storage
+func (s *LocalStore) AddTLSChallenge(domain string, cert *Certificate) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.TLSChallenges == nil {
+		s.storedData.TLSChallenges = make(map[string]*Certificate)
+	}
+
+	s.storedData.TLSChallenges[domain] = cert
+	return nil
+}
+
+// GetTLSChallenge Get a certificate from the ACME TLS-ALPN-01 certificates storage
+func (s *LocalStore) GetTLSChallenge(domain string) (*Certificate, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.TLSChallenges == nil {
+		s.storedData.TLSChallenges = make(map[string]*Certificate)
+	}
+
+	return s.storedData.TLSChallenges[domain], nil
+}
+
+// RemoveTLSChallenge Remove a certificate from the ACME TLS-ALPN-01 certificates storage
+func (s *LocalStore) RemoveTLSChallenge(domain string) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.TLSChallenges == nil {
+		return nil
+	}
+
+	delete(s.storedData.TLSChallenges, domain)
+	return nil
+}

pkg/provider/acme/local_store_unix.go

@@ -0,0 +1,35 @@
+// +build !windows
+
+package acme
+
+import (
+	"fmt"
+	"os"
+)
+
+// CheckFile checks file permissions and content size
+func CheckFile(name string) (bool, error) {
+	f, err := os.Open(name)
+	if err != nil {
+		if os.IsNotExist(err) {
+			f, err = os.Create(name)
+			if err != nil {
+				return false, err
+			}
+			return false, f.Chmod(0600)
+		}
+		return false, err
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	if fi.Mode().Perm()&0077 != 0 {
+		return false, fmt.Errorf("permissions %o for %s are too open, please use 600", fi.Mode().Perm(), name)
+	}
+
+	return fi.Size() > 0, nil
+}

pkg/provider/acme/local_store_windows.go

@@ -0,0 +1,27 @@
+package acme
+
+import "os"
+
+// CheckFile checks file content size
+// Do not check file permissions on Windows right now
+func CheckFile(name string) (bool, error) {
+	f, err := os.Open(name)
+	if err != nil {
+		if os.IsNotExist(err) {
+			f, err = os.Create(name)
+			if err != nil {
+				return false, err
+			}
+			return false, f.Chmod(0600)
+		}
+		return false, err
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	return fi.Size() > 0, nil
+}

pkg/provider/acme/provider.go

@@ -0,0 +1,825 @@
+package acme
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io/ioutil"
+	fmtlog "log"
+	"net/url"
+	"reflect"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/containous/flaeg/parse"
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/rules"
+	"github.com/containous/traefik/pkg/safe"
+	traefiktls "github.com/containous/traefik/pkg/tls"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/containous/traefik/pkg/version"
+	"github.com/go-acme/lego/certificate"
+	"github.com/go-acme/lego/challenge"
+	"github.com/go-acme/lego/challenge/dns01"
+	"github.com/go-acme/lego/lego"
+	legolog "github.com/go-acme/lego/log"
+	"github.com/go-acme/lego/providers/dns"
+	"github.com/go-acme/lego/registration"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	// oscpMustStaple enables OSCP stapling as from https://github.com/go-acme/lego/issues/270
+	oscpMustStaple = false
+)
+
+// Configuration holds ACME configuration provided by users
+type Configuration struct {
+	Email         string         `description:"Email address used for registration"`
+	ACMELogging   bool           `description:"Enable debug logging of ACME actions."`
+	CAServer      string         `description:"CA server to use."`
+	Storage       string         `description:"Storage to use."`
+	EntryPoint    string         `description:"EntryPoint to use."`
+	KeyType       string         `description:"KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'. Default to 'RSA4096'"`
+	OnHostRule    bool           `description:"Enable certificate generation on frontends Host rules."`
+	DNSChallenge  *DNSChallenge  `description:"Activate DNS-01 Challenge"`
+	HTTPChallenge *HTTPChallenge `description:"Activate HTTP-01 Challenge"`
+	TLSChallenge  *TLSChallenge  `description:"Activate TLS-ALPN-01 Challenge"`
+	Domains       []types.Domain `description:"CN and SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='*.main.net'. No SANs for wildcards domain. Wildcard domains only accepted with DNSChallenge"`
+}
+
+// Certificate is a struct which contains all data needed from an ACME certificate
+type Certificate struct {
+	Domain      types.Domain
+	Certificate []byte
+	Key         []byte
+}
+
+// DNSChallenge contains DNS challenge Configuration
+type DNSChallenge struct {
+	Provider                string             `description:"Use a DNS-01 based challenge provider rather than HTTPS."`
+	DelayBeforeCheck        parse.Duration     `description:"Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."`
+	Resolvers               types.DNSResolvers `description:"Use following DNS servers to resolve the FQDN authority."`
+	DisablePropagationCheck bool               `description:"Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready. [not recommended]"`
+
+	preCheckTimeout  time.Duration
+	preCheckInterval time.Duration
+}
+
+// HTTPChallenge contains HTTP challenge Configuration
+type HTTPChallenge struct {
+	EntryPoint string `description:"HTTP challenge EntryPoint"`
+}
+
+// TLSChallenge contains TLS challenge Configuration
+type TLSChallenge struct{}
+
+// Provider holds configurations of the provider.
+type Provider struct {
+	*Configuration
+	Store                  Store
+	certificates           []*Certificate
+	account                *Account
+	client                 *lego.Client
+	certsChan              chan *Certificate
+	configurationChan      chan<- config.Message
+	tlsManager             *traefiktls.Manager
+	clientMutex            sync.Mutex
+	configFromListenerChan chan config.Configuration
+	pool                   *safe.Pool
+	resolvingDomains       map[string]struct{}
+	resolvingDomainsMutex  sync.RWMutex
+}
+
+// SetTLSManager sets the tls manager to use
+func (p *Provider) SetTLSManager(tlsManager *traefiktls.Manager) {
+	p.tlsManager = tlsManager
+}
+
+// SetConfigListenerChan initializes the configFromListenerChan
+func (p *Provider) SetConfigListenerChan(configFromListenerChan chan config.Configuration) {
+	p.configFromListenerChan = configFromListenerChan
+}
+
+// ListenConfiguration sets a new Configuration into the configFromListenerChan
+func (p *Provider) ListenConfiguration(config config.Configuration) {
+	p.configFromListenerChan <- config
+}
+
+// ListenRequest resolves new certificates for a domain from an incoming request and return a valid Certificate to serve (onDemand option)
+func (p *Provider) ListenRequest(domain string) (*tls.Certificate, error) {
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+
+	acmeCert, err := p.resolveCertificate(ctx, types.Domain{Main: domain}, false)
+	if acmeCert == nil || err != nil {
+		return nil, err
+	}
+
+	cert, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
+
+	return &cert, err
+}
+
+// Init for compatibility reason the BaseProvider implements an empty Init
+func (p *Provider) Init() error {
+
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+	logger := log.FromContext(ctx)
+
+	if p.ACMELogging {
+		legolog.Logger = fmtlog.New(logger.WriterLevel(logrus.InfoLevel), "legolog: ", 0)
+	} else {
+		legolog.Logger = fmtlog.New(ioutil.Discard, "", 0)
+	}
+
+	if len(p.Configuration.Storage) == 0 {
+		return errors.New("unable to initialize ACME provider with no storage location for the certificates")
+	}
+	p.Store = NewLocalStore(p.Configuration.Storage)
+
+	var err error
+	p.account, err = p.Store.GetAccount()
+	if err != nil {
+		return fmt.Errorf("unable to get ACME account : %v", err)
+	}
+
+	// Reset Account if caServer changed, thus registration URI can be updated
+	if p.account != nil && p.account.Registration != nil && !isAccountMatchingCaServer(ctx, p.account.Registration.URI, p.CAServer) {
+		logger.Info("Account URI does not match the current CAServer. The account will be reset.")
+		p.account = nil
+	}
+
+	p.certificates, err = p.Store.GetCertificates()
+	if err != nil {
+		return fmt.Errorf("unable to get ACME certificates : %v", err)
+	}
+
+	// Init the currently resolved domain map
+	p.resolvingDomains = make(map[string]struct{})
+
+	return nil
+}
+
+func isAccountMatchingCaServer(ctx context.Context, accountURI string, serverURI string) bool {
+	logger := log.FromContext(ctx)
+
+	aru, err := url.Parse(accountURI)
+	if err != nil {
+		logger.Infof("Unable to parse account.Registration URL: %v", err)
+		return false
+	}
+
+	cau, err := url.Parse(serverURI)
+	if err != nil {
+		logger.Infof("Unable to parse CAServer URL: %v", err)
+		return false
+	}
+
+	return cau.Hostname() == aru.Hostname()
+}
+
+// Provide allows the file provider to provide configurations to traefik
+// using the given Configuration channel.
+func (p *Provider) Provide(configurationChan chan<- config.Message, pool *safe.Pool) error {
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+
+	p.pool = pool
+
+	p.watchCertificate(ctx)
+	p.watchNewDomains(ctx)
+
+	p.configurationChan = configurationChan
+	p.refreshCertificates()
+
+	p.deleteUnnecessaryDomains(ctx)
+	for i := 0; i < len(p.Domains); i++ {
+		domain := p.Domains[i]
+		safe.Go(func() {
+			if _, err := p.resolveCertificate(ctx, domain, true); err != nil {
+				log.WithoutContext().WithField(log.ProviderName, "acme").
+					Errorf("Unable to obtain ACME certificate for domains %q : %v", strings.Join(domain.ToStrArray(), ","), err)
+			}
+		})
+	}
+
+	p.renewCertificates(ctx)
+
+	ticker := time.NewTicker(24 * time.Hour)
+	pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case <-ticker.C:
+				p.renewCertificates(ctx)
+			case <-stop:
+				ticker.Stop()
+				return
+			}
+		}
+	})
+
+	return nil
+}
+
+func (p *Provider) getClient() (*lego.Client, error) {
+	p.clientMutex.Lock()
+	defer p.clientMutex.Unlock()
+
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+	logger := log.FromContext(ctx)
+
+	if p.client != nil {
+		return p.client, nil
+	}
+
+	account, err := p.initAccount(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	logger.Debug("Building ACME client...")
+
+	caServer := "https://acme-v02.api.letsencrypt.org/directory"
+	if len(p.CAServer) > 0 {
+		caServer = p.CAServer
+	}
+	logger.Debug(caServer)
+
+	config := lego.NewConfig(account)
+	config.CADirURL = caServer
+	config.Certificate.KeyType = account.KeyType
+	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
+
+	client, err := lego.NewClient(config)
+	if err != nil {
+		return nil, err
+	}
+
+	// New users will need to register; be sure to save it
+	if account.GetRegistration() == nil {
+		logger.Info("Register...")
+
+		reg, errR := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
+		if errR != nil {
+			return nil, errR
+		}
+
+		account.Registration = reg
+	}
+
+	// Save the account once before all the certificates generation/storing
+	// No certificate can be generated if account is not initialized
+	err = p.Store.SaveAccount(account)
+	if err != nil {
+		return nil, err
+	}
+
+	switch {
+	case p.DNSChallenge != nil && len(p.DNSChallenge.Provider) > 0:
+		logger.Debugf("Using DNS Challenge provider: %s", p.DNSChallenge.Provider)
+
+		var provider challenge.Provider
+		provider, err = dns.NewDNSChallengeProviderByName(p.DNSChallenge.Provider)
+		if err != nil {
+			return nil, err
+		}
+
+		err = client.Challenge.SetDNS01Provider(provider,
+			dns01.CondOption(len(p.DNSChallenge.Resolvers) > 0, dns01.AddRecursiveNameservers(p.DNSChallenge.Resolvers)),
+			dns01.CondOption(p.DNSChallenge.DisablePropagationCheck || p.DNSChallenge.DelayBeforeCheck > 0,
+				dns01.AddPreCheck(func(_, _ string) (bool, error) {
+					if p.DNSChallenge.DelayBeforeCheck > 0 {
+						log.Debugf("Delaying %d rather than validating DNS propagation now.", p.DNSChallenge.DelayBeforeCheck)
+						time.Sleep(time.Duration(p.DNSChallenge.DelayBeforeCheck))
+					}
+					return true, nil
+				})),
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		// Same default values than LEGO
+		p.DNSChallenge.preCheckTimeout = 60 * time.Second
+		p.DNSChallenge.preCheckInterval = 2 * time.Second
+
+		// Set the precheck timeout into the DNSChallenge provider
+		if challengeProviderTimeout, ok := provider.(challenge.ProviderTimeout); ok {
+			p.DNSChallenge.preCheckTimeout, p.DNSChallenge.preCheckInterval = challengeProviderTimeout.Timeout()
+		}
+
+	case p.HTTPChallenge != nil && len(p.HTTPChallenge.EntryPoint) > 0:
+		logger.Debug("Using HTTP Challenge provider.")
+
+		err = client.Challenge.SetHTTP01Provider(&challengeHTTP{Store: p.Store})
+		if err != nil {
+			return nil, err
+		}
+
+	case p.TLSChallenge != nil:
+		logger.Debug("Using TLS Challenge provider.")
+
+		err = client.Challenge.SetTLSALPN01Provider(&challengeTLSALPN{Store: p.Store})
+		if err != nil {
+			return nil, err
+		}
+
+	default:
+		return nil, errors.New("ACME challenge not specified, please select TLS or HTTP or DNS Challenge")
+	}
+
+	p.client = client
+	return p.client, nil
+}
+
+func (p *Provider) initAccount(ctx context.Context) (*Account, error) {
+	if p.account == nil || len(p.account.Email) == 0 {
+		var err error
+		p.account, err = NewAccount(ctx, p.Email, p.KeyType)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Set the KeyType if not already defined in the account
+	if len(p.account.KeyType) == 0 {
+		p.account.KeyType = GetKeyType(ctx, p.KeyType)
+	}
+
+	return p.account, nil
+}
+
+func (p *Provider) resolveDomains(ctx context.Context, domains []string) {
+	if len(domains) == 0 {
+		log.FromContext(ctx).Debug("No domain parsed in provider ACME")
+		return
+	}
+
+	log.FromContext(ctx).Debugf("Try to challenge certificate for domain %v founded in HostSNI rule", domains)
+
+	var domain types.Domain
+	if len(domains) > 0 {
+		domain = types.Domain{Main: domains[0]}
+		if len(domains) > 1 {
+			domain.SANs = domains[1:]
+		}
+
+		safe.Go(func() {
+			if _, err := p.resolveCertificate(ctx, domain, false); err != nil {
+				log.FromContext(ctx).Errorf("Unable to obtain ACME certificate for domains %q: %v", strings.Join(domains, ","), err)
+			}
+		})
+	}
+}
+
+func (p *Provider) watchNewDomains(ctx context.Context) {
+	p.pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case config := <-p.configFromListenerChan:
+				if config.TCP != nil {
+					for routerName, route := range config.TCP.Routers {
+						ctxRouter := log.With(ctx, log.Str(log.RouterName, routerName), log.Str(log.Rule, route.Rule))
+
+						domains, err := rules.ParseHostSNI(route.Rule)
+						if err != nil {
+							log.FromContext(ctxRouter).Errorf("Error parsing domains in provider ACME: %v", err)
+							continue
+						}
+						p.resolveDomains(ctxRouter, domains)
+					}
+				}
+
+				for routerName, route := range config.HTTP.Routers {
+					ctxRouter := log.With(ctx, log.Str(log.RouterName, routerName), log.Str(log.Rule, route.Rule))
+
+					domains, err := rules.ParseDomains(route.Rule)
+					if err != nil {
+						log.FromContext(ctxRouter).Errorf("Error parsing domains in provider ACME: %v", err)
+						continue
+					}
+					p.resolveDomains(ctxRouter, domains)
+				}
+			case <-stop:
+				return
+			}
+		}
+	})
+}
+
+func (p *Provider) resolveCertificate(ctx context.Context, domain types.Domain, domainFromConfigurationFile bool) (*certificate.Resource, error) {
+	domains, err := p.getValidDomains(ctx, domain, domainFromConfigurationFile)
+	if err != nil {
+		return nil, err
+	}
+
+	// Check provided certificates
+	uncheckedDomains := p.getUncheckedDomains(ctx, domains, !domainFromConfigurationFile)
+	if len(uncheckedDomains) == 0 {
+		return nil, nil
+	}
+
+	p.addResolvingDomains(uncheckedDomains)
+	defer p.removeResolvingDomains(uncheckedDomains)
+
+	logger := log.FromContext(ctx)
+	logger.Debugf("Loading ACME certificates %+v...", uncheckedDomains)
+
+	client, err := p.getClient()
+	if err != nil {
+		return nil, fmt.Errorf("cannot get ACME client %v", err)
+	}
+
+	var cert *certificate.Resource
+	bundle := true
+	if p.useCertificateWithRetry(uncheckedDomains) {
+		cert, err = obtainCertificateWithRetry(ctx, domains, client, p.DNSChallenge.preCheckTimeout, p.DNSChallenge.preCheckInterval, bundle)
+	} else {
+		request := certificate.ObtainRequest{
+			Domains:    domains,
+			Bundle:     bundle,
+			MustStaple: oscpMustStaple,
+		}
+		cert, err = client.Certificate.Obtain(request)
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("unable to generate a certificate for the domains %v: %v", uncheckedDomains, err)
+	}
+	if cert == nil {
+		return nil, fmt.Errorf("domains %v do not generate a certificate", uncheckedDomains)
+	}
+	if len(cert.Certificate) == 0 || len(cert.PrivateKey) == 0 {
+		return nil, fmt.Errorf("domains %v generate certificate with no value: %v", uncheckedDomains, cert)
+	}
+
+	logger.Debugf("Certificates obtained for domains %+v", uncheckedDomains)
+
+	if len(uncheckedDomains) > 1 {
+		domain = types.Domain{Main: uncheckedDomains[0], SANs: uncheckedDomains[1:]}
+	} else {
+		domain = types.Domain{Main: uncheckedDomains[0]}
+	}
+	p.addCertificateForDomain(domain, cert.Certificate, cert.PrivateKey)
+
+	return cert, nil
+}
+
+func (p *Provider) removeResolvingDomains(resolvingDomains []string) {
+	p.resolvingDomainsMutex.Lock()
+	defer p.resolvingDomainsMutex.Unlock()
+
+	for _, domain := range resolvingDomains {
+		delete(p.resolvingDomains, domain)
+	}
+}
+
+func (p *Provider) addResolvingDomains(resolvingDomains []string) {
+	p.resolvingDomainsMutex.Lock()
+	defer p.resolvingDomainsMutex.Unlock()
+
+	for _, domain := range resolvingDomains {
+		p.resolvingDomains[domain] = struct{}{}
+	}
+}
+
+func (p *Provider) useCertificateWithRetry(domains []string) bool {
+	// Check if we can use the retry mechanism only if we use the DNS Challenge and if is there are at least 2 domains to check
+	if p.DNSChallenge != nil && len(domains) > 1 {
+		rootDomain := ""
+		for _, searchWildcardDomain := range domains {
+			// Search a wildcard domain if not already found
+			if len(rootDomain) == 0 && strings.HasPrefix(searchWildcardDomain, "*.") {
+				rootDomain = strings.TrimPrefix(searchWildcardDomain, "*.")
+				if len(rootDomain) > 0 {
+					// Look for a root domain which matches the wildcard domain
+					for _, searchRootDomain := range domains {
+						if rootDomain == searchRootDomain {
+							// If the domains list contains a wildcard domain and its root domain, we can use the retry mechanism to obtain the certificate
+							return true
+						}
+					}
+				}
+				// There is only one wildcard domain in the slice, if its root domain has not been found, the retry mechanism does not have to be used
+				return false
+			}
+		}
+	}
+
+	return false
+}
+
+func obtainCertificateWithRetry(ctx context.Context, domains []string, client *lego.Client, timeout, interval time.Duration, bundle bool) (*certificate.Resource, error) {
+	logger := log.FromContext(ctx)
+
+	var cert *certificate.Resource
+	var err error
+
+	operation := func() error {
+		request := certificate.ObtainRequest{
+			Domains:    domains,
+			Bundle:     bundle,
+			MustStaple: oscpMustStaple,
+		}
+		cert, err = client.Certificate.Obtain(request)
+		return err
+	}
+
+	notify := func(err error, time time.Duration) {
+		logger.Errorf("Error obtaining certificate retrying in %s", time)
+	}
+
+	// Define a retry backOff to let LEGO tries twice to obtain a certificate for both wildcard and root domain
+	ebo := backoff.NewExponentialBackOff()
+	ebo.MaxElapsedTime = 2 * timeout
+	ebo.MaxInterval = interval
+	rbo := backoff.WithMaxRetries(ebo, 2)
+
+	err = backoff.RetryNotify(safe.OperationWithRecover(operation), rbo, notify)
+	if err != nil {
+		logger.Errorf("Error obtaining certificate: %v", err)
+		return nil, err
+	}
+
+	return cert, nil
+}
+
+func (p *Provider) addCertificateForDomain(domain types.Domain, certificate []byte, key []byte) {
+	p.certsChan <- &Certificate{Certificate: certificate, Key: key, Domain: domain}
+}
+
+// deleteUnnecessaryDomains deletes from the configuration :
+// - Duplicated domains
+// - Domains which are checked by wildcard domain
+func (p *Provider) deleteUnnecessaryDomains(ctx context.Context) {
+	var newDomains []types.Domain
+
+	logger := log.FromContext(ctx)
+
+	for idxDomainToCheck, domainToCheck := range p.Domains {
+		keepDomain := true
+
+		for idxDomain, domain := range p.Domains {
+			if idxDomainToCheck == idxDomain {
+				continue
+			}
+
+			if reflect.DeepEqual(domain, domainToCheck) {
+				if idxDomainToCheck > idxDomain {
+					logger.Warnf("The domain %v is duplicated in the configuration but will be process by ACME provider only once.", domainToCheck)
+					keepDomain = false
+				}
+				break
+			}
+
+			// Check if CN or SANS to check already exists
+			// or can not be checked by a wildcard
+			var newDomainsToCheck []string
+			for _, domainProcessed := range domainToCheck.ToStrArray() {
+				if idxDomain < idxDomainToCheck && isDomainAlreadyChecked(domainProcessed, domain.ToStrArray()) {
+					// The domain is duplicated in a CN
+					logger.Warnf("Domain %q is duplicated in the configuration or validated by the domain %v. It will be processed once.", domainProcessed, domain)
+					continue
+				} else if domain.Main != domainProcessed && strings.HasPrefix(domain.Main, "*") && isDomainAlreadyChecked(domainProcessed, []string{domain.Main}) {
+					// Check if a wildcard can validate the domain
+					logger.Warnf("Domain %q will not be processed by ACME provider because it is validated by the wildcard %q", domainProcessed, domain.Main)
+					continue
+				}
+				newDomainsToCheck = append(newDomainsToCheck, domainProcessed)
+			}
+
+			// Delete the domain if both Main and SANs can be validated by the wildcard domain
+			// otherwise keep the unchecked values
+			if newDomainsToCheck == nil {
+				keepDomain = false
+				break
+			}
+			domainToCheck.Set(newDomainsToCheck)
+		}
+
+		if keepDomain {
+			newDomains = append(newDomains, domainToCheck)
+		}
+	}
+
+	p.Domains = newDomains
+}
+
+func (p *Provider) watchCertificate(ctx context.Context) {
+	p.certsChan = make(chan *Certificate)
+
+	p.pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case cert := <-p.certsChan:
+				certUpdated := false
+				for _, domainsCertificate := range p.certificates {
+					if reflect.DeepEqual(cert.Domain, domainsCertificate.Domain) {
+						domainsCertificate.Certificate = cert.Certificate
+						domainsCertificate.Key = cert.Key
+						certUpdated = true
+						break
+					}
+				}
+				if !certUpdated {
+					p.certificates = append(p.certificates, cert)
+				}
+
+				err := p.saveCertificates()
+				if err != nil {
+					log.FromContext(ctx).Error(err)
+				}
+			case <-stop:
+				return
+			}
+		}
+	})
+}
+
+func (p *Provider) saveCertificates() error {
+	err := p.Store.SaveCertificates(p.certificates)
+
+	p.refreshCertificates()
+
+	return err
+}
+
+func (p *Provider) refreshCertificates() {
+	conf := config.Message{
+		ProviderName: "ACME",
+		Configuration: &config.Configuration{
+			HTTP: &config.HTTPConfiguration{
+				Routers:     map[string]*config.Router{},
+				Middlewares: map[string]*config.Middleware{},
+				Services:    map[string]*config.Service{},
+			},
+			TLS: []*traefiktls.Configuration{},
+		},
+	}
+
+	for _, cert := range p.certificates {
+		cert := &traefiktls.Certificate{CertFile: traefiktls.FileOrContent(cert.Certificate), KeyFile: traefiktls.FileOrContent(cert.Key)}
+		conf.Configuration.TLS = append(conf.Configuration.TLS, &traefiktls.Configuration{Certificate: cert})
+	}
+	p.configurationChan <- conf
+}
+
+func (p *Provider) renewCertificates(ctx context.Context) {
+	logger := log.FromContext(ctx)
+
+	logger.Info("Testing certificate renew...")
+	for _, cert := range p.certificates {
+		crt, err := getX509Certificate(ctx, cert)
+		// If there's an error, we assume the cert is broken, and needs update
+		// <= 30 days left, renew certificate
+		if err != nil || crt == nil || crt.NotAfter.Before(time.Now().Add(24*30*time.Hour)) {
+			client, err := p.getClient()
+			if err != nil {
+				logger.Infof("Error renewing certificate from LE : %+v, %v", cert.Domain, err)
+				continue
+			}
+
+			logger.Infof("Renewing certificate from LE : %+v", cert.Domain)
+
+			renewedCert, err := client.Certificate.Renew(certificate.Resource{
+				Domain:      cert.Domain.Main,
+				PrivateKey:  cert.Key,
+				Certificate: cert.Certificate,
+			}, true, oscpMustStaple)
+
+			if err != nil {
+				logger.Errorf("Error renewing certificate from LE: %v, %v", cert.Domain, err)
+				continue
+			}
+
+			if len(renewedCert.Certificate) == 0 || len(renewedCert.PrivateKey) == 0 {
+				logger.Errorf("domains %v renew certificate with no value: %v", cert.Domain.ToStrArray(), cert)
+				continue
+			}
+
+			p.addCertificateForDomain(cert.Domain, renewedCert.Certificate, renewedCert.PrivateKey)
+		}
+	}
+}
+
+// Get provided certificate which check a domains list (Main and SANs)
+// from static and dynamic provided certificates
+func (p *Provider) getUncheckedDomains(ctx context.Context, domainsToCheck []string, checkConfigurationDomains bool) []string {
+	p.resolvingDomainsMutex.RLock()
+	defer p.resolvingDomainsMutex.RUnlock()
+
+	log.FromContext(ctx).Debugf("Looking for provided certificate(s) to validate %q...", domainsToCheck)
+
+	allDomains := p.tlsManager.GetStore("default").GetAllDomains()
+
+	// Get ACME certificates
+	for _, cert := range p.certificates {
+		allDomains = append(allDomains, strings.Join(cert.Domain.ToStrArray(), ","))
+	}
+
+	// Get currently resolved domains
+	for domain := range p.resolvingDomains {
+		allDomains = append(allDomains, domain)
+	}
+
+	// Get Configuration Domains
+	if checkConfigurationDomains {
+		for i := 0; i < len(p.Domains); i++ {
+			allDomains = append(allDomains, strings.Join(p.Domains[i].ToStrArray(), ","))
+		}
+	}
+
+	return searchUncheckedDomains(ctx, domainsToCheck, allDomains)
+}
+
+func searchUncheckedDomains(ctx context.Context, domainsToCheck []string, existentDomains []string) []string {
+	var uncheckedDomains []string
+	for _, domainToCheck := range domainsToCheck {
+		if !isDomainAlreadyChecked(domainToCheck, existentDomains) {
+			uncheckedDomains = append(uncheckedDomains, domainToCheck)
+		}
+	}
+
+	logger := log.FromContext(ctx)
+	if len(uncheckedDomains) == 0 {
+		logger.Debugf("No ACME certificate generation required for domains %q.", domainsToCheck)
+	} else {
+		logger.Debugf("Domains %q need ACME certificates generation for domains %q.", domainsToCheck, strings.Join(uncheckedDomains, ","))
+	}
+	return uncheckedDomains
+}
+
+func getX509Certificate(ctx context.Context, cert *Certificate) (*x509.Certificate, error) {
+	logger := log.FromContext(ctx)
+
+	tlsCert, err := tls.X509KeyPair(cert.Certificate, cert.Key)
+	if err != nil {
+		logger.Errorf("Failed to load TLS key pair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", cert.Domain.Main, strings.Join(cert.Domain.SANs, ","), err)
+		return nil, err
+	}
+
+	crt := tlsCert.Leaf
+	if crt == nil {
+		crt, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			logger.Errorf("Failed to parse TLS key pair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", cert.Domain.Main, strings.Join(cert.Domain.SANs, ","), err)
+		}
+	}
+
+	return crt, err
+}
+
+// getValidDomains checks if given domain is allowed to generate a ACME certificate and return it
+func (p *Provider) getValidDomains(ctx context.Context, domain types.Domain, wildcardAllowed bool) ([]string, error) {
+	domains := domain.ToStrArray()
+	if len(domains) == 0 {
+		return nil, errors.New("unable to generate a certificate in ACME provider when no domain is given")
+	}
+
+	if strings.HasPrefix(domain.Main, "*") {
+		if !wildcardAllowed {
+			return nil, fmt.Errorf("unable to generate a wildcard certificate in ACME provider for domain %q from a 'Host' rule", strings.Join(domains, ","))
+		}
+
+		if p.DNSChallenge == nil {
+			return nil, fmt.Errorf("unable to generate a wildcard certificate in ACME provider for domain %q : ACME needs a DNSChallenge", strings.Join(domains, ","))
+		}
+
+		if strings.HasPrefix(domain.Main, "*.*") {
+			return nil, fmt.Errorf("unable to generate a wildcard certificate in ACME provider for domain %q : ACME does not allow '*.*' wildcard domain", strings.Join(domains, ","))
+		}
+	}
+
+	for _, san := range domain.SANs {
+		if strings.HasPrefix(san, "*") {
+			return nil, fmt.Errorf("unable to generate a certificate in ACME provider for domains %q: SAN %q can not be a wildcard domain", strings.Join(domains, ","), san)
+		}
+	}
+
+	var cleanDomains []string
+	for _, domain := range domains {
+		canonicalDomain := types.CanonicalDomain(domain)
+		cleanDomain := dns01.UnFqdn(canonicalDomain)
+		if canonicalDomain != cleanDomain {
+			log.FromContext(ctx).Warnf("FQDN detected, please remove the trailing dot: %s", canonicalDomain)
+		}
+		cleanDomains = append(cleanDomains, cleanDomain)
+	}
+
+	return cleanDomains, nil
+}
+
+func isDomainAlreadyChecked(domainToCheck string, existentDomains []string) bool {
+	for _, certDomains := range existentDomains {
+		for _, certDomain := range strings.Split(certDomains, ",") {
+			if types.MatchDomain(domainToCheck, certDomain) {
+				return true
+			}
+		}
+	}
+	return false
+}

pkg/provider/acme/provider_test.go

@@ -0,0 +1,660 @@
+package acme
+
+import (
+	"context"
+	"crypto/tls"
+	"testing"
+
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/go-acme/lego/certcrypto"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetUncheckedCertificates(t *testing.T) {
+	t.Skip("Needs TLS Manager")
+	wildcardMap := make(map[string]*tls.Certificate)
+	wildcardMap["*.traefik.wtf"] = &tls.Certificate{}
+
+	wildcardSafe := &safe.Safe{}
+	wildcardSafe.Set(wildcardMap)
+
+	domainMap := make(map[string]*tls.Certificate)
+	domainMap["traefik.wtf"] = &tls.Certificate{}
+
+	domainSafe := &safe.Safe{}
+	domainSafe.Set(domainMap)
+
+	// FIXME Add a test for DefaultCertificate
+	testCases := []struct {
+		desc             string
+		dynamicCerts     *safe.Safe
+		resolvingDomains map[string]struct{}
+		acmeCertificates []*Certificate
+		domains          []string
+		expectedDomains  []string
+	}{
+		{
+			desc:            "wildcard to generate",
+			domains:         []string{"*.traefik.wtf"},
+			expectedDomains: []string{"*.traefik.wtf"},
+		},
+		{
+			desc:            "wildcard already exists in dynamic certificates",
+			domains:         []string{"*.traefik.wtf"},
+			dynamicCerts:    wildcardSafe,
+			expectedDomains: nil,
+		},
+		{
+			desc:    "wildcard already exists in ACME certificates",
+			domains: []string{"*.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "*.traefik.wtf"},
+				},
+			},
+			expectedDomains: nil,
+		},
+		{
+			desc:            "domain CN and SANs to generate",
+			domains:         []string{"traefik.wtf", "foo.traefik.wtf"},
+			expectedDomains: []string{"traefik.wtf", "foo.traefik.wtf"},
+		},
+		{
+			desc:            "domain CN already exists in dynamic certificates and SANs to generate",
+			domains:         []string{"traefik.wtf", "foo.traefik.wtf"},
+			dynamicCerts:    domainSafe,
+			expectedDomains: []string{"foo.traefik.wtf"},
+		},
+		{
+			desc:    "domain CN already exists in ACME certificates and SANs to generate",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "traefik.wtf"},
+				},
+			},
+			expectedDomains: []string{"foo.traefik.wtf"},
+		},
+		{
+			desc:            "domain already exists in dynamic certificates",
+			domains:         []string{"traefik.wtf"},
+			dynamicCerts:    domainSafe,
+			expectedDomains: nil,
+		},
+		{
+			desc:    "domain already exists in ACME certificates",
+			domains: []string{"traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "traefik.wtf"},
+				},
+			},
+			expectedDomains: nil,
+		},
+		{
+			desc:            "domain matched by wildcard in dynamic certificates",
+			domains:         []string{"who.traefik.wtf", "foo.traefik.wtf"},
+			dynamicCerts:    wildcardSafe,
+			expectedDomains: nil,
+		},
+		{
+			desc:    "domain matched by wildcard in ACME certificates",
+			domains: []string{"who.traefik.wtf", "foo.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "*.traefik.wtf"},
+				},
+			},
+			expectedDomains: nil,
+		},
+		{
+			desc:    "root domain with wildcard in ACME certificates",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "*.traefik.wtf"},
+				},
+			},
+			expectedDomains: []string{"traefik.wtf"},
+		},
+		{
+			desc:    "all domains already managed by ACME",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"traefik.wtf":     {},
+				"foo.traefik.wtf": {},
+			},
+			expectedDomains: []string{},
+		},
+		{
+			desc:    "one domain already managed by ACME",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"traefik.wtf": {},
+			},
+			expectedDomains: []string{"foo.traefik.wtf"},
+		},
+		{
+			desc:    "wildcard domain already managed by ACME checks the domains",
+			domains: []string{"bar.traefik.wtf", "foo.traefik.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"*.traefik.wtf": {},
+			},
+			expectedDomains: []string{},
+		},
+		{
+			desc:    "wildcard domain already managed by ACME checks domains and another domain checks one other domain, one domain still unchecked",
+			domains: []string{"traefik.wtf", "bar.traefik.wtf", "foo.traefik.wtf", "acme.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"*.traefik.wtf": {},
+				"traefik.wtf":   {},
+			},
+			expectedDomains: []string{"acme.wtf"},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			if test.resolvingDomains == nil {
+				test.resolvingDomains = make(map[string]struct{})
+			}
+
+			acmeProvider := Provider{
+				// certificateStore: &traefiktls.CertificateStore{
+				// 	DynamicCerts: test.dynamicCerts,
+				// },
+				certificates:     test.acmeCertificates,
+				resolvingDomains: test.resolvingDomains,
+			}
+
+			domains := acmeProvider.getUncheckedDomains(context.Background(), test.domains, false)
+			assert.Equal(t, len(test.expectedDomains), len(domains), "Unexpected domains.")
+		})
+	}
+}
+
+func TestGetValidDomain(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		domains         types.Domain
+		wildcardAllowed bool
+		dnsChallenge    *DNSChallenge
+		expectedErr     string
+		expectedDomains []string
+	}{
+		{
+			desc:            "valid wildcard",
+			domains:         types.Domain{Main: "*.traefik.wtf"},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "",
+			expectedDomains: []string{"*.traefik.wtf"},
+		},
+		{
+			desc:            "no wildcard",
+			domains:         types.Domain{Main: "traefik.wtf", SANs: []string{"foo.traefik.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			expectedErr:     "",
+			wildcardAllowed: true,
+			expectedDomains: []string{"traefik.wtf", "foo.traefik.wtf"},
+		},
+		{
+			desc:            "unauthorized wildcard",
+			domains:         types.Domain{Main: "*.traefik.wtf"},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: false,
+			expectedErr:     "unable to generate a wildcard certificate in ACME provider for domain \"*.traefik.wtf\" from a 'Host' rule",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "no domain",
+			domains:         types.Domain{},
+			dnsChallenge:    nil,
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a certificate in ACME provider when no domain is given",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "no DNSChallenge",
+			domains:         types.Domain{Main: "*.traefik.wtf", SANs: []string{"foo.traefik.wtf"}},
+			dnsChallenge:    nil,
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a wildcard certificate in ACME provider for domain \"*.traefik.wtf,foo.traefik.wtf\" : ACME needs a DNSChallenge",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "unauthorized wildcard with SAN",
+			domains:         types.Domain{Main: "*.*.traefik.wtf", SANs: []string{"foo.traefik.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a wildcard certificate in ACME provider for domain \"*.*.traefik.wtf,foo.traefik.wtf\" : ACME does not allow '*.*' wildcard domain",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "wildcard and SANs",
+			domains:         types.Domain{Main: "*.traefik.wtf", SANs: []string{"traefik.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "",
+			expectedDomains: []string{"*.traefik.wtf", "traefik.wtf"},
+		},
+		{
+			desc:            "unexpected SANs",
+			domains:         types.Domain{Main: "*.traefik.wtf", SANs: []string{"*.acme.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a certificate in ACME provider for domains \"*.traefik.wtf,*.acme.wtf\": SAN \"*.acme.wtf\" can not be a wildcard domain",
+			expectedDomains: nil,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{Configuration: &Configuration{DNSChallenge: test.dnsChallenge}}
+
+			domains, err := acmeProvider.getValidDomains(context.Background(), test.domains, test.wildcardAllowed)
+
+			if len(test.expectedErr) > 0 {
+				assert.EqualError(t, err, test.expectedErr, "Unexpected error.")
+			} else {
+				assert.Equal(t, len(test.expectedDomains), len(domains), "Unexpected domains.")
+			}
+		})
+	}
+}
+
+func TestDeleteUnnecessaryDomains(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		domains         []types.Domain
+		expectedDomains []types.Domain
+	}{
+		{
+			desc: "no domain to delete",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "*.foo.acme.wtf",
+				},
+				{
+					Main: "acme02.wtf",
+					SANs: []string{"traefik.acme02.wtf", "bar.foo"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "*.foo.acme.wtf",
+					SANs: []string{},
+				},
+				{
+					Main: "acme02.wtf",
+					SANs: []string{"traefik.acme02.wtf", "bar.foo"},
+				},
+			},
+		},
+		{
+			desc: "wildcard and root domain",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+				},
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{"acme.wtf"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{},
+				},
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{},
+				},
+			},
+		},
+		{
+			desc: "2 equals domains",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+			},
+		},
+		{
+			desc: "2 domains with same values",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf"},
+				},
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf"},
+				},
+				{
+					Main: "foo.bar",
+					SANs: []string{},
+				},
+			},
+		},
+		{
+			desc: "domain totally checked by wildcard",
+			domains: []types.Domain{
+				{
+					Main: "who.acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "bar.acme.wtf"},
+				},
+				{
+					Main: "*.acme.wtf",
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{},
+				},
+			},
+		},
+		{
+			desc: "duplicated wildcard",
+			domains: []types.Domain{
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{"acme.wtf"},
+				},
+				{
+					Main: "*.acme.wtf",
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{"acme.wtf"},
+				},
+			},
+		},
+		{
+			desc: "domain partially checked by wildcard",
+			domains: []types.Domain{
+				{
+					Main: "traefik.acme.wtf",
+					SANs: []string{"acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "*.acme.wtf",
+				},
+				{
+					Main: "who.acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "bar.acme.wtf"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"foo.bar"},
+				},
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{},
+				},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{Configuration: &Configuration{Domains: test.domains}}
+
+			acmeProvider.deleteUnnecessaryDomains(context.Background())
+			assert.Equal(t, test.expectedDomains, acmeProvider.Domains, "unexpected domain")
+		})
+	}
+}
+
+func TestIsAccountMatchingCaServer(t *testing.T) {
+	testCases := []struct {
+		desc       string
+		accountURI string
+		serverURI  string
+		expected   bool
+	}{
+		{
+			desc:       "acme staging with matching account",
+			accountURI: "https://acme-staging-v02.api.letsencrypt.org/acme/acct/1234567",
+			serverURI:  "https://acme-staging-v02.api.letsencrypt.org/acme/directory",
+			expected:   true,
+		},
+		{
+			desc:       "acme production with matching account",
+			accountURI: "https://acme-v02.api.letsencrypt.org/acme/acct/1234567",
+			serverURI:  "https://acme-v02.api.letsencrypt.org/acme/directory",
+			expected:   true,
+		},
+		{
+			desc:       "http only acme with matching account",
+			accountURI: "http://acme.api.letsencrypt.org/acme/acct/1234567",
+			serverURI:  "http://acme.api.letsencrypt.org/acme/directory",
+			expected:   true,
+		},
+		{
+			desc:       "different subdomains for account and server",
+			accountURI: "https://test1.example.org/acme/acct/1234567",
+			serverURI:  "https://test2.example.org/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "different domains for account and server",
+			accountURI: "https://test.example1.org/acme/acct/1234567",
+			serverURI:  "https://test.example2.org/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "different tld for account and server",
+			accountURI: "https://test.example.com/acme/acct/1234567",
+			serverURI:  "https://test.example.org/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "malformed account url",
+			accountURI: "//|\\/test.example.com/acme/acct/1234567",
+			serverURI:  "https://test.example.com/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "malformed server url",
+			accountURI: "https://test.example.com/acme/acct/1234567",
+			serverURI:  "//|\\/test.example.com/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "malformed server and account url",
+			accountURI: "//|\\/test.example.com/acme/acct/1234567",
+			serverURI:  "//|\\/test.example.com/acme/directory",
+			expected:   false,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			result := isAccountMatchingCaServer(context.Background(), test.accountURI, test.serverURI)
+
+			assert.Equal(t, test.expected, result)
+		})
+	}
+}
+
+func TestUseBackOffToObtainCertificate(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		domains          []string
+		dnsChallenge     *DNSChallenge
+		expectedResponse bool
+	}{
+		{
+			desc:             "only one single domain",
+			domains:          []string{"acme.wtf"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: false,
+		},
+		{
+			desc:             "only one wildcard domain",
+			domains:          []string{"*.acme.wtf"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: false,
+		},
+		{
+			desc:             "wildcard domain with no root domain",
+			domains:          []string{"*.acme.wtf", "foo.acme.wtf", "bar.acme.wtf", "foo.bar"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: false,
+		},
+		{
+			desc:             "wildcard and root domain",
+			domains:          []string{"*.acme.wtf", "foo.acme.wtf", "bar.acme.wtf", "acme.wtf"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: true,
+		},
+		{
+			desc:             "wildcard and root domain but no DNS challenge",
+			domains:          []string{"*.acme.wtf", "acme.wtf"},
+			dnsChallenge:     nil,
+			expectedResponse: false,
+		},
+		{
+			desc:             "two wildcard domains (must never happen)",
+			domains:          []string{"*.acme.wtf", "*.bar.foo"},
+			dnsChallenge:     nil,
+			expectedResponse: false,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{Configuration: &Configuration{DNSChallenge: test.dnsChallenge}}
+
+			actualResponse := acmeProvider.useCertificateWithRetry(test.domains)
+			assert.Equal(t, test.expectedResponse, actualResponse, "unexpected response to use backOff")
+		})
+	}
+}
+
+func TestInitAccount(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		account         *Account
+		email           string
+		keyType         string
+		expectedAccount *Account
+	}{
+		{
+			desc: "Existing account with all information",
+			account: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc:    "Account nil",
+			email:   "foo@foo.net",
+			keyType: "EC256",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc: "Existing account with no email",
+			account: &Account{
+				KeyType: certcrypto.RSA4096,
+			},
+			email:   "foo@foo.net",
+			keyType: "EC256",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc: "Existing account with no key type",
+			account: &Account{
+				Email: "foo@foo.net",
+			},
+			email:   "bar@foo.net",
+			keyType: "EC256",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc: "Existing account and provider with no key type",
+			account: &Account{
+				Email: "foo@foo.net",
+			},
+			email: "bar@foo.net",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.RSA4096,
+			},
+		},
+	}
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{account: test.account, Configuration: &Configuration{Email: test.email, KeyType: test.keyType}}
+
+			actualAccount, err := acmeProvider.initAccount(context.Background())
+			assert.Nil(t, err, "Init account in error")
+			assert.Equal(t, test.expectedAccount.Email, actualAccount.Email, "unexpected email account")
+			assert.Equal(t, test.expectedAccount.KeyType, actualAccount.KeyType, "unexpected keyType account")
+		})
+	}
+}

pkg/provider/acme/store.go

@@ -0,0 +1,25 @@
+package acme
+
+// StoredData represents the data managed by Store
+type StoredData struct {
+	Account        *Account
+	Certificates   []*Certificate
+	HTTPChallenges map[string]map[string][]byte
+	TLSChallenges  map[string]*Certificate
+}
+
+// Store is a generic interface that represents a storage
+type Store interface {
+	GetAccount() (*Account, error)
+	SaveAccount(*Account) error
+	GetCertificates() ([]*Certificate, error)
+	SaveCertificates([]*Certificate) error
+
+	GetHTTPChallengeToken(token, domain string) ([]byte, error)
+	SetHTTPChallengeToken(token, domain string, keyAuth []byte) error
+	RemoveHTTPChallengeToken(token, domain string) error
+
+	AddTLSChallenge(domain string, cert *Certificate) error
+	GetTLSChallenge(domain string) (*Certificate, error)
+	RemoveTLSChallenge(domain string) error
+}

pkg/provider/aggregator/aggregator.go

@@ -0,0 +1,105 @@
+package aggregator
+
+import (
+	"encoding/json"
+
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/config/static"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/provider"
+	"github.com/containous/traefik/pkg/provider/file"
+	"github.com/containous/traefik/pkg/safe"
+)
+
+// ProviderAggregator aggregates providers.
+type ProviderAggregator struct {
+	fileProvider *file.Provider
+	providers    []provider.Provider
+}
+
+// NewProviderAggregator returns an aggregate of all the providers configured in the static configuration.
+func NewProviderAggregator(conf static.Providers) ProviderAggregator {
+	p := ProviderAggregator{}
+
+	if conf.File != nil {
+		p.quietAddProvider(conf.File)
+	}
+
+	if conf.Docker != nil {
+		p.quietAddProvider(conf.Docker)
+	}
+
+	if conf.Marathon != nil {
+		p.quietAddProvider(conf.Marathon)
+	}
+
+	if conf.Rest != nil {
+		p.quietAddProvider(conf.Rest)
+	}
+
+	if conf.Kubernetes != nil {
+		p.quietAddProvider(conf.Kubernetes)
+	}
+
+	if conf.KubernetesCRD != nil {
+		p.quietAddProvider(conf.KubernetesCRD)
+	}
+
+	return p
+}
+
+func (p *ProviderAggregator) quietAddProvider(provider provider.Provider) {
+	err := p.AddProvider(provider)
+	if err != nil {
+		log.WithoutContext().Errorf("Error while initializing provider %T: %v", provider, err)
+	}
+}
+
+// AddProvider adds a provider in the providers map.
+func (p *ProviderAggregator) AddProvider(provider provider.Provider) error {
+	err := provider.Init()
+	if err != nil {
+		return err
+	}
+
+	if fileProvider, ok := provider.(*file.Provider); ok {
+		p.fileProvider = fileProvider
+	} else {
+		p.providers = append(p.providers, provider)
+	}
+	return nil
+}
+
+// Init the provider
+func (p ProviderAggregator) Init() error {
+	return nil
+}
+
+// Provide calls the provide method of every providers
+func (p ProviderAggregator) Provide(configurationChan chan<- config.Message, pool *safe.Pool) error {
+	if p.fileProvider != nil {
+		launchProvider(configurationChan, pool, p.fileProvider)
+	}
+
+	for _, prd := range p.providers {
+		safe.Go(func() {
+			launchProvider(configurationChan, pool, prd)
+		})
+	}
+	return nil
+}
+
+func launchProvider(configurationChan chan<- config.Message, pool *safe.Pool, prd provider.Provider) {
+	jsonConf, err := json.Marshal(prd)
+	if err != nil {
+		log.WithoutContext().Debugf("Cannot marshal the provider configuration %T: %v", prd, err)
+	}
+
+	log.WithoutContext().Infof("Starting provider %T %s", prd, jsonConf)
+
+	currentProvider := prd
+	err = currentProvider.Provide(configurationChan, pool)
+	if err != nil {
+		log.WithoutContext().Errorf("Cannot start the provider %T: %v", prd, err)
+	}
+}

pkg/provider/base_provider.go

@@ -0,0 +1,105 @@
+package provider
+
+import (
+	"bytes"
+	"strings"
+	"text/template"
+
+	"github.com/BurntSushi/toml"
+	"github.com/Masterminds/sprig"
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/tls"
+	"github.com/containous/traefik/pkg/types"
+)
+
+// BaseProvider should be inherited by providers.
+type BaseProvider struct {
+	Watch                     bool              `description:"Watch provider" export:"true"`
+	Filename                  string            `description:"Override default configuration template. For advanced users :)" export:"true"`
+	Constraints               types.Constraints `description:"Filter services by constraint, matching with Traefik tags." export:"true"`
+	Trace                     bool              `description:"Display additional provider logs (if available)." export:"true"`
+	DebugLogGeneratedTemplate bool              `description:"Enable debug logging of generated configuration template." export:"true"`
+}
+
+// Init for compatibility reason the BaseProvider implements an empty Init.
+func (p *BaseProvider) Init() error {
+	return nil
+}
+
+// MatchConstraints must match with EVERY single constraint
+// returns first constraint that do not match or nil.
+func (p *BaseProvider) MatchConstraints(tags []string) (bool, *types.Constraint) {
+	// if there is no tags and no constraints, filtering is disabled
+	if len(tags) == 0 && len(p.Constraints) == 0 {
+		return true, nil
+	}
+
+	for _, constraint := range p.Constraints {
+		// xor: if ok and constraint.MustMatch are equal, then no tag is currently matching with the constraint
+		if ok := constraint.MatchConstraintWithAtLeastOneTag(tags); ok != constraint.MustMatch {
+			return false, constraint
+		}
+	}
+
+	// If no constraint or every constraints matching
+	return true, nil
+}
+
+// CreateConfiguration creates a provider configuration from content using templating.
+func (p *BaseProvider) CreateConfiguration(tmplContent string, funcMap template.FuncMap, templateObjects interface{}) (*config.Configuration, error) {
+	var defaultFuncMap = sprig.TxtFuncMap()
+	// tolower is deprecated in favor of sprig's lower function
+	defaultFuncMap["tolower"] = strings.ToLower
+	defaultFuncMap["normalize"] = Normalize
+	defaultFuncMap["split"] = split
+	for funcID, funcElement := range funcMap {
+		defaultFuncMap[funcID] = funcElement
+	}
+
+	tmpl := template.New(p.Filename).Funcs(defaultFuncMap)
+
+	_, err := tmpl.Parse(tmplContent)
+	if err != nil {
+		return nil, err
+	}
+
+	var buffer bytes.Buffer
+	err = tmpl.Execute(&buffer, templateObjects)
+	if err != nil {
+		return nil, err
+	}
+
+	var renderedTemplate = buffer.String()
+	if p.DebugLogGeneratedTemplate {
+		log.Debugf("Template content: %s", tmplContent)
+		log.Debugf("Rendering results: %s", renderedTemplate)
+	}
+	return p.DecodeConfiguration(renderedTemplate)
+}
+
+// DecodeConfiguration Decodes a *types.Configuration from a content.
+func (p *BaseProvider) DecodeConfiguration(content string) (*config.Configuration, error) {
+	configuration := &config.Configuration{
+		HTTP: &config.HTTPConfiguration{
+			Routers:     make(map[string]*config.Router),
+			Middlewares: make(map[string]*config.Middleware),
+			Services:    make(map[string]*config.Service),
+		},
+		TCP: &config.TCPConfiguration{
+			Routers:  make(map[string]*config.TCPRouter),
+			Services: make(map[string]*config.TCPService),
+		},
+		TLS:        make([]*tls.Configuration, 0),
+		TLSStores:  make(map[string]tls.Store),
+		TLSOptions: make(map[string]tls.TLS),
+	}
+	if _, err := toml.Decode(content, configuration); err != nil {
+		return nil, err
+	}
+	return configuration, nil
+}
+
+func split(sep, s string) []string {
+	return strings.Split(s, sep)
+}

pkg/provider/configuration.go

@@ -0,0 +1,193 @@
+package provider
+
+import (
+	"bytes"
+	"context"
+	"reflect"
+	"sort"
+	"strings"
+	"text/template"
+	"unicode"
+
+	"github.com/Masterminds/sprig"
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/log"
+)
+
+// Merge Merges multiple configurations.
+func Merge(ctx context.Context, configurations map[string]*config.Configuration) *config.Configuration {
+	logger := log.FromContext(ctx)
+
+	configuration := &config.Configuration{
+		HTTP: &config.HTTPConfiguration{
+			Routers:     make(map[string]*config.Router),
+			Middlewares: make(map[string]*config.Middleware),
+			Services:    make(map[string]*config.Service),
+		},
+		TCP: &config.TCPConfiguration{
+			Routers:  make(map[string]*config.TCPRouter),
+			Services: make(map[string]*config.TCPService),
+		},
+	}
+
+	servicesToDelete := map[string]struct{}{}
+	services := map[string][]string{}
+
+	routersToDelete := map[string]struct{}{}
+	routers := map[string][]string{}
+
+	middlewaresToDelete := map[string]struct{}{}
+	middlewares := map[string][]string{}
+
+	var sortedKeys []string
+	for key := range configurations {
+		sortedKeys = append(sortedKeys, key)
+	}
+	sort.Strings(sortedKeys)
+
+	for _, root := range sortedKeys {
+		conf := configurations[root]
+		for serviceName, service := range conf.HTTP.Services {
+			services[serviceName] = append(services[serviceName], root)
+			if !AddService(configuration.HTTP, serviceName, service) {
+				servicesToDelete[serviceName] = struct{}{}
+			}
+		}
+
+		for routerName, router := range conf.HTTP.Routers {
+			routers[routerName] = append(routers[routerName], root)
+			if !AddRouter(configuration.HTTP, routerName, router) {
+				routersToDelete[routerName] = struct{}{}
+			}
+		}
+
+		for middlewareName, middleware := range conf.HTTP.Middlewares {
+			middlewares[middlewareName] = append(middlewares[middlewareName], root)
+			if !AddMiddleware(configuration.HTTP, middlewareName, middleware) {
+				middlewaresToDelete[middlewareName] = struct{}{}
+			}
+		}
+	}
+
+	for serviceName := range servicesToDelete {
+		logger.WithField(log.ServiceName, serviceName).
+			Errorf("Service defined multiple times with different configurations in %v", services[serviceName])
+		delete(configuration.HTTP.Services, serviceName)
+	}
+
+	for routerName := range routersToDelete {
+		logger.WithField(log.RouterName, routerName).
+			Errorf("Router defined multiple times with different configurations in %v", routers[routerName])
+		delete(configuration.HTTP.Routers, routerName)
+	}
+
+	for middlewareName := range middlewaresToDelete {
+		logger.WithField(log.MiddlewareName, middlewareName).
+			Errorf("Middleware defined multiple times with different configurations in %v", middlewares[middlewareName])
+		delete(configuration.HTTP.Middlewares, middlewareName)
+	}
+
+	return configuration
+}
+
+// AddService Adds a service to a configurations.
+func AddService(configuration *config.HTTPConfiguration, serviceName string, service *config.Service) bool {
+	if _, ok := configuration.Services[serviceName]; !ok {
+		configuration.Services[serviceName] = service
+		return true
+	}
+
+	if !configuration.Services[serviceName].LoadBalancer.Mergeable(service.LoadBalancer) {
+		return false
+	}
+
+	configuration.Services[serviceName].LoadBalancer.Servers = append(configuration.Services[serviceName].LoadBalancer.Servers, service.LoadBalancer.Servers...)
+	return true
+}
+
+// AddRouter Adds a router to a configurations.
+func AddRouter(configuration *config.HTTPConfiguration, routerName string, router *config.Router) bool {
+	if _, ok := configuration.Routers[routerName]; !ok {
+		configuration.Routers[routerName] = router
+		return true
+	}
+
+	return reflect.DeepEqual(configuration.Routers[routerName], router)
+}
+
+// AddMiddleware Adds a middleware to a configurations.
+func AddMiddleware(configuration *config.HTTPConfiguration, middlewareName string, middleware *config.Middleware) bool {
+	if _, ok := configuration.Middlewares[middlewareName]; !ok {
+		configuration.Middlewares[middlewareName] = middleware
+		return true
+	}
+
+	return reflect.DeepEqual(configuration.Middlewares[middlewareName], middleware)
+}
+
+// MakeDefaultRuleTemplate Creates the default rule template.
+func MakeDefaultRuleTemplate(defaultRule string, funcMap template.FuncMap) (*template.Template, error) {
+	defaultFuncMap := sprig.TxtFuncMap()
+	defaultFuncMap["normalize"] = Normalize
+
+	for k, fn := range funcMap {
+		defaultFuncMap[k] = fn
+	}
+
+	return template.New("defaultRule").Funcs(defaultFuncMap).Parse(defaultRule)
+}
+
+// BuildRouterConfiguration Builds a router configuration.
+func BuildRouterConfiguration(ctx context.Context, configuration *config.HTTPConfiguration, defaultRouterName string, defaultRuleTpl *template.Template, model interface{}) {
+	logger := log.FromContext(ctx)
+
+	if len(configuration.Routers) == 0 {
+		if len(configuration.Services) > 1 {
+			log.FromContext(ctx).Info("Could not create a router for the container: too many services")
+		} else {
+			configuration.Routers = make(map[string]*config.Router)
+			configuration.Routers[defaultRouterName] = &config.Router{}
+		}
+	}
+
+	for routerName, router := range configuration.Routers {
+		loggerRouter := logger.WithField(log.RouterName, routerName)
+		if len(router.Rule) == 0 {
+			writer := &bytes.Buffer{}
+			if err := defaultRuleTpl.Execute(writer, model); err != nil {
+				loggerRouter.Errorf("Error while parsing default rule: %v", err)
+				delete(configuration.Routers, routerName)
+				continue
+			}
+
+			router.Rule = writer.String()
+			if len(router.Rule) == 0 {
+				loggerRouter.Error("Undefined rule")
+				delete(configuration.Routers, routerName)
+				continue
+			}
+		}
+
+		if len(router.Service) == 0 {
+			if len(configuration.Services) > 1 {
+				delete(configuration.Routers, routerName)
+				loggerRouter.
+					Error("Could not define the service name for the router: too many services")
+				continue
+			}
+
+			for serviceName := range configuration.Services {
+				router.Service = serviceName
+			}
+		}
+	}
+}
+
+// Normalize Replace all special chars with `-`.
+func Normalize(name string) string {
+	fargs := func(c rune) bool {
+		return !unicode.IsLetter(c) && !unicode.IsNumber(c)
+	}
+	// get function
+	return strings.Join(strings.FieldsFunc(name, fargs), "-")
+}

pkg/provider/docker/builder_test.go

@@ -0,0 +1,214 @@
+package docker
+
+import (
+	docker "github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/go-connections/nat"
+)
+
+func containerJSON(ops ...func(*docker.ContainerJSON)) docker.ContainerJSON {
+	c := &docker.ContainerJSON{
+		ContainerJSONBase: &docker.ContainerJSONBase{
+			Name:       "fake",
+			HostConfig: &container.HostConfig{},
+		},
+		Config: &container.Config{},
+		NetworkSettings: &docker.NetworkSettings{
+			NetworkSettingsBase: docker.NetworkSettingsBase{},
+		},
+	}
+
+	for _, op := range ops {
+		op(c)
+	}
+
+	return *c
+}
+
+func name(name string) func(*docker.ContainerJSON) {
+	return func(c *docker.ContainerJSON) {
+		c.ContainerJSONBase.Name = name
+	}
+}
+
+func networkMode(mode string) func(*docker.ContainerJSON) {
+	return func(c *docker.ContainerJSON) {
+		c.ContainerJSONBase.HostConfig.NetworkMode = container.NetworkMode(mode)
+	}
+}
+
+func nodeIP(ip string) func(*docker.ContainerJSON) {
+	return func(c *docker.ContainerJSON) {
+		c.ContainerJSONBase.Node = &docker.ContainerNode{
+			IPAddress: ip,
+		}
+	}
+}
+
+func labels(labels map[string]string) func(*docker.ContainerJSON) {
+	return func(c *docker.ContainerJSON) {
+		c.Config.Labels = labels
+	}
+}
+
+func ports(portMap nat.PortMap) func(*docker.ContainerJSON) {
+	return func(c *docker.ContainerJSON) {
+		c.NetworkSettings.NetworkSettingsBase.Ports = portMap
+	}
+}
+
+func withNetwork(name string, ops ...func(*network.EndpointSettings)) func(*docker.ContainerJSON) {
+	return func(c *docker.ContainerJSON) {
+		if c.NetworkSettings.Networks == nil {
+			c.NetworkSettings.Networks = map[string]*network.EndpointSettings{}
+		}
+		c.NetworkSettings.Networks[name] = &network.EndpointSettings{}
+		for _, op := range ops {
+			op(c.NetworkSettings.Networks[name])
+		}
+	}
+}
+
+func ipv4(ip string) func(*network.EndpointSettings) {
+	return func(s *network.EndpointSettings) {
+		s.IPAddress = ip
+	}
+}
+
+func swarmTask(id string, ops ...func(*swarm.Task)) swarm.Task {
+	task := &swarm.Task{
+		ID: id,
+	}
+
+	for _, op := range ops {
+		op(task)
+	}
+
+	return *task
+}
+
+func taskSlot(slot int) func(*swarm.Task) {
+	return func(task *swarm.Task) {
+		task.Slot = slot
+	}
+}
+
+func taskNetworkAttachment(id string, name string, driver string, addresses []string) func(*swarm.Task) {
+	return func(task *swarm.Task) {
+		task.NetworksAttachments = append(task.NetworksAttachments, swarm.NetworkAttachment{
+			Network: swarm.Network{
+				ID: id,
+				Spec: swarm.NetworkSpec{
+					Annotations: swarm.Annotations{
+						Name: name,
+					},
+					DriverConfiguration: &swarm.Driver{
+						Name: driver,
+					},
+				},
+			},
+			Addresses: addresses,
+		})
+	}
+}
+
+func taskStatus(ops ...func(*swarm.TaskStatus)) func(*swarm.Task) {
+	return func(task *swarm.Task) {
+		status := &swarm.TaskStatus{}
+
+		for _, op := range ops {
+			op(status)
+		}
+
+		task.Status = *status
+	}
+}
+
+func taskState(state swarm.TaskState) func(*swarm.TaskStatus) {
+	return func(status *swarm.TaskStatus) {
+		status.State = state
+	}
+}
+
+func taskContainerStatus(id string) func(*swarm.TaskStatus) {
+	return func(status *swarm.TaskStatus) {
+		status.ContainerStatus = swarm.ContainerStatus{
+			ContainerID: id,
+		}
+	}
+}
+
+func swarmService(ops ...func(*swarm.Service)) swarm.Service {
+	service := &swarm.Service{
+		ID: "serviceID",
+		Spec: swarm.ServiceSpec{
+			Annotations: swarm.Annotations{
+				Name: "defaultServiceName",
+			},
+		},
+	}
+
+	for _, op := range ops {
+		op(service)
+	}
+
+	return *service
+}
+
+func serviceName(name string) func(service *swarm.Service) {
+	return func(service *swarm.Service) {
+		service.Spec.Annotations.Name = name
+	}
+}
+
+func serviceLabels(labels map[string]string) func(service *swarm.Service) {
+	return func(service *swarm.Service) {
+		service.Spec.Annotations.Labels = labels
+	}
+}
+
+func withEndpoint(ops ...func(*swarm.Endpoint)) func(*swarm.Service) {
+	return func(service *swarm.Service) {
+		endpoint := &swarm.Endpoint{}
+
+		for _, op := range ops {
+			op(endpoint)
+		}
+
+		service.Endpoint = *endpoint
+	}
+}
+
+func virtualIP(networkID, addr string) func(*swarm.Endpoint) {
+	return func(endpoint *swarm.Endpoint) {
+		if endpoint.VirtualIPs == nil {
+			endpoint.VirtualIPs = []swarm.EndpointVirtualIP{}
+		}
+		endpoint.VirtualIPs = append(endpoint.VirtualIPs, swarm.EndpointVirtualIP{
+			NetworkID: networkID,
+			Addr:      addr,
+		})
+	}
+}
+
+func withEndpointSpec(ops ...func(*swarm.EndpointSpec)) func(*swarm.Service) {
+	return func(service *swarm.Service) {
+		endpointSpec := &swarm.EndpointSpec{}
+
+		for _, op := range ops {
+			op(endpointSpec)
+		}
+
+		service.Spec.EndpointSpec = endpointSpec
+	}
+}
+
+func modeDNSSR(spec *swarm.EndpointSpec) {
+	spec.Mode = swarm.ResolutionModeDNSRR
+}
+
+func modeVIP(spec *swarm.EndpointSpec) {
+	spec.Mode = swarm.ResolutionModeVIP
+}

pkg/provider/docker/config.go

@@ -0,0 +1,263 @@
+package docker
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/provider"
+	"github.com/containous/traefik/pkg/provider/label"
+	"github.com/docker/go-connections/nat"
+)
+
+func (p *Provider) buildConfiguration(ctx context.Context, containersInspected []dockerData) *config.Configuration {
+	configurations := make(map[string]*config.Configuration)
+
+	for _, container := range containersInspected {
+		containerName := getServiceName(container) + "-" + container.ID
+		ctxContainer := log.With(ctx, log.Str("container", containerName))
+
+		if !p.keepContainer(ctxContainer, container) {
+			continue
+		}
+
+		logger := log.FromContext(ctxContainer)
+
+		confFromLabel, err := label.DecodeConfiguration(container.Labels)
+		if err != nil {
+			logger.Error(err)
+			continue
+		}
+
+		err = p.buildServiceConfiguration(ctxContainer, container, confFromLabel.HTTP)
+		if err != nil {
+			logger.Error(err)
+			continue
+		}
+
+		serviceName := getServiceName(container)
+
+		model := struct {
+			Name   string
+			Labels map[string]string
+		}{
+			Name:   serviceName,
+			Labels: container.Labels,
+		}
+
+		provider.BuildRouterConfiguration(ctx, confFromLabel.HTTP, serviceName, p.defaultRuleTpl, model)
+
+		configurations[containerName] = confFromLabel
+	}
+
+	return provider.Merge(ctx, configurations)
+}
+
+func (p *Provider) buildServiceConfiguration(ctx context.Context, container dockerData, configuration *config.HTTPConfiguration) error {
+	serviceName := getServiceName(container)
+
+	if len(configuration.Services) == 0 {
+		configuration.Services = make(map[string]*config.Service)
+		lb := &config.LoadBalancerService{}
+		lb.SetDefaults()
+		configuration.Services[serviceName] = &config.Service{
+			LoadBalancer: lb,
+		}
+	}
+
+	for _, service := range configuration.Services {
+		err := p.addServer(ctx, container, service.LoadBalancer)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (p *Provider) keepContainer(ctx context.Context, container dockerData) bool {
+	logger := log.FromContext(ctx)
+
+	if !container.ExtraConf.Enable {
+		logger.Debug("Filtering disabled container")
+		return false
+	}
+
+	if ok, failingConstraint := p.MatchConstraints(container.ExtraConf.Tags); !ok {
+		if failingConstraint != nil {
+			logger.Debugf("Container pruned by %q constraint", failingConstraint.String())
+		}
+		return false
+	}
+
+	if container.Health != "" && container.Health != "healthy" {
+		logger.Debug("Filtering unhealthy or starting container")
+		return false
+	}
+
+	return true
+}
+
+func (p *Provider) addServer(ctx context.Context, container dockerData, loadBalancer *config.LoadBalancerService) error {
+	serverPort := getLBServerPort(loadBalancer)
+	ip, port, err := p.getIPPort(ctx, container, serverPort)
+	if err != nil {
+		return err
+	}
+
+	if len(loadBalancer.Servers) == 0 {
+		server := config.Server{}
+		server.SetDefaults()
+
+		loadBalancer.Servers = []config.Server{server}
+	}
+
+	if serverPort != "" {
+		port = serverPort
+		loadBalancer.Servers[0].Port = ""
+	}
+
+	if port == "" {
+		return errors.New("port is missing")
+	}
+
+	loadBalancer.Servers[0].URL = fmt.Sprintf("%s://%s", loadBalancer.Servers[0].Scheme, net.JoinHostPort(ip, port))
+	loadBalancer.Servers[0].Scheme = ""
+
+	return nil
+}
+
+func (p *Provider) getIPPort(ctx context.Context, container dockerData, serverPort string) (string, string, error) {
+	logger := log.FromContext(ctx)
+
+	var ip, port string
+	usedBound := false
+
+	if p.UseBindPortIP {
+		portBinding, err := p.getPortBinding(container, serverPort)
+		switch {
+		case err != nil:
+			logger.Infof("Unable to find a binding for container %q, falling back on its internal IP/Port.", container.Name)
+		case portBinding.HostIP == "0.0.0.0" || len(portBinding.HostIP) == 0:
+			logger.Infof("Cannot determine the IP address (got %q) for %q's binding, falling back on its internal IP/Port.", portBinding.HostIP, container.Name)
+		default:
+			ip = portBinding.HostIP
+			port = portBinding.HostPort
+			usedBound = true
+		}
+	}
+
+	if !usedBound {
+		ip = p.getIPAddress(ctx, container)
+		port = getPort(container, serverPort)
+	}
+
+	if len(ip) == 0 {
+		return "", "", fmt.Errorf("unable to find the IP address for the container %q: the server is ignored", container.Name)
+	}
+
+	return ip, port, nil
+}
+
+func (p Provider) getIPAddress(ctx context.Context, container dockerData) string {
+	logger := log.FromContext(ctx)
+
+	if container.ExtraConf.Docker.Network != "" {
+		settings := container.NetworkSettings
+		if settings.Networks != nil {
+			network := settings.Networks[container.ExtraConf.Docker.Network]
+			if network != nil {
+				return network.Addr
+			}
+
+			logger.Warnf("Could not find network named '%s' for container '%s'! Maybe you're missing the project's prefix in the label? Defaulting to first available network.", container.ExtraConf.Docker.Network, container.Name)
+		}
+	}
+
+	if container.NetworkSettings.NetworkMode.IsHost() {
+		if container.Node != nil && container.Node.IPAddress != "" {
+			return container.Node.IPAddress
+		}
+		return "127.0.0.1"
+	}
+
+	if container.NetworkSettings.NetworkMode.IsContainer() {
+		dockerClient, err := p.createClient()
+		if err != nil {
+			logger.Warnf("Unable to get IP address: %s", err)
+			return ""
+		}
+
+		connectedContainer := container.NetworkSettings.NetworkMode.ConnectedContainer()
+		containerInspected, err := dockerClient.ContainerInspect(context.Background(), connectedContainer)
+		if err != nil {
+			logger.Warnf("Unable to get IP address for container %s : Failed to inspect container ID %s, error: %s", container.Name, connectedContainer, err)
+			return ""
+		}
+		return p.getIPAddress(ctx, parseContainer(containerInspected))
+	}
+
+	for _, network := range container.NetworkSettings.Networks {
+		return network.Addr
+	}
+
+	logger.Warn("Unable to find the IP address.")
+	return ""
+}
+
+func (p *Provider) getPortBinding(container dockerData, serverPort string) (*nat.PortBinding, error) {
+	port := getPort(container, serverPort)
+	for netPort, portBindings := range container.NetworkSettings.Ports {
+		if strings.EqualFold(string(netPort), port+"/TCP") || strings.EqualFold(string(netPort), port+"/UDP") {
+			for _, p := range portBindings {
+				return &p, nil
+			}
+		}
+	}
+
+	return nil, fmt.Errorf("unable to find the external IP:Port for the container %q", container.Name)
+}
+
+func getLBServerPort(loadBalancer *config.LoadBalancerService) string {
+	if loadBalancer != nil && len(loadBalancer.Servers) > 0 {
+		return loadBalancer.Servers[0].Port
+	}
+	return ""
+}
+
+func getPort(container dockerData, serverPort string) string {
+	if len(serverPort) > 0 {
+		return serverPort
+	}
+
+	var ports []nat.Port
+	for port := range container.NetworkSettings.Ports {
+		ports = append(ports, port)
+	}
+
+	less := func(i, j nat.Port) bool {
+		return i.Int() < j.Int()
+	}
+	nat.Sort(ports, less)
+
+	if len(ports) > 0 {
+		min := ports[0]
+		return min.Port()
+	}
+
+	return ""
+}
+
+func getServiceName(container dockerData) string {
+	serviceName := container.ServiceName
+
+	if values, err := getStringMultipleStrict(container.Labels, labelDockerComposeProject, labelDockerComposeService); err == nil {
+		serviceName = values[labelDockerComposeService] + "_" + values[labelDockerComposeProject]
+	}
+
+	return serviceName
+}

pkg/provider/docker/docker.go

@@ -0,0 +1,537 @@
+package docker
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/job"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/provider"
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/containous/traefik/pkg/version"
+	dockertypes "github.com/docker/docker/api/types"
+	dockercontainertypes "github.com/docker/docker/api/types/container"
+	eventtypes "github.com/docker/docker/api/types/events"
+	"github.com/docker/docker/api/types/filters"
+	swarmtypes "github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/api/types/versions"
+	"github.com/docker/docker/client"
+	"github.com/docker/go-connections/nat"
+	"github.com/docker/go-connections/sockets"
+)
+
+const (
+	// SwarmAPIVersion is a constant holding the version of the Provider API traefik will use.
+	SwarmAPIVersion = "1.24"
+	// DefaultTemplateRule The default template for the default rule.
+	DefaultTemplateRule = "Host(`{{ normalize .Name }}`)"
+)
+
+var _ provider.Provider = (*Provider)(nil)
+
+// Provider holds configurations of the provider.
+type Provider struct {
+	provider.BaseProvider   `mapstructure:",squash" export:"true"`
+	Endpoint                string           `description:"Docker server endpoint. Can be a tcp or a unix socket endpoint"`
+	DefaultRule             string           `description:"Default rule"`
+	TLS                     *types.ClientTLS `description:"Enable Docker TLS support" export:"true"`
+	ExposedByDefault        bool             `description:"Expose containers by default" export:"true"`
+	UseBindPortIP           bool             `description:"Use the ip address from the bound port, rather than from the inner network" export:"true"`
+	SwarmMode               bool             `description:"Use Docker on Swarm Mode" export:"true"`
+	Network                 string           `description:"Default Docker network used" export:"true"`
+	SwarmModeRefreshSeconds int              `description:"Polling interval for swarm mode (in seconds)" export:"true"`
+	defaultRuleTpl          *template.Template
+}
+
+// Init the provider.
+func (p *Provider) Init() error {
+	defaultRuleTpl, err := provider.MakeDefaultRuleTemplate(p.DefaultRule, nil)
+	if err != nil {
+		return fmt.Errorf("error while parsing default rule: %v", err)
+	}
+
+	p.defaultRuleTpl = defaultRuleTpl
+	return p.BaseProvider.Init()
+}
+
+// dockerData holds the need data to the provider.
+type dockerData struct {
+	ID              string
+	ServiceName     string
+	Name            string
+	Labels          map[string]string // List of labels set to container or service
+	NetworkSettings networkSettings
+	Health          string
+	Node            *dockertypes.ContainerNode
+	ExtraConf       configuration
+}
+
+// NetworkSettings holds the networks data to the provider.
+type networkSettings struct {
+	NetworkMode dockercontainertypes.NetworkMode
+	Ports       nat.PortMap
+	Networks    map[string]*networkData
+}
+
+// Network holds the network data to the provider.
+type networkData struct {
+	Name     string
+	Addr     string
+	Port     int
+	Protocol string
+	ID       string
+}
+
+func (p *Provider) createClient() (client.APIClient, error) {
+	var httpClient *http.Client
+
+	if p.TLS != nil {
+		ctx := log.With(context.Background(), log.Str(log.ProviderName, "docker"))
+		conf, err := p.TLS.CreateTLSConfig(ctx)
+		if err != nil {
+			return nil, err
+		}
+		tr := &http.Transport{
+			TLSClientConfig: conf,
+		}
+
+		hostURL, err := client.ParseHostURL(p.Endpoint)
+		if err != nil {
+			return nil, err
+		}
+		if err := sockets.ConfigureTransport(tr, hostURL.Scheme, hostURL.Host); err != nil {
+			return nil, err
+		}
+
+		httpClient = &http.Client{
+			Transport: tr,
+		}
+	}
+
+	httpHeaders := map[string]string{
+		"User-Agent": "Traefik " + version.Version,
+	}
+
+	var apiVersion string
+	if p.SwarmMode {
+		apiVersion = SwarmAPIVersion
+	} else {
+		apiVersion = DockerAPIVersion
+	}
+
+	return client.NewClient(p.Endpoint, apiVersion, httpClient, httpHeaders)
+}
+
+// Provide allows the docker provider to provide configurations to traefik using the given configuration channel.
+func (p *Provider) Provide(configurationChan chan<- config.Message, pool *safe.Pool) error {
+	pool.GoCtx(func(routineCtx context.Context) {
+		ctxLog := log.With(routineCtx, log.Str(log.ProviderName, "docker"))
+		logger := log.FromContext(ctxLog)
+
+		operation := func() error {
+			var err error
+			ctx, cancel := context.WithCancel(ctxLog)
+			defer cancel()
+
+			ctx = log.With(ctx, log.Str(log.ProviderName, "docker"))
+
+			dockerClient, err := p.createClient()
+			if err != nil {
+				logger.Errorf("Failed to create a client for docker, error: %s", err)
+				return err
+			}
+
+			serverVersion, err := dockerClient.ServerVersion(ctx)
+			if err != nil {
+				logger.Errorf("Failed to retrieve information of the docker client and server host: %s", err)
+				return err
+			}
+			logger.Debugf("Provider connection established with docker %s (API %s)", serverVersion.Version, serverVersion.APIVersion)
+			var dockerDataList []dockerData
+			if p.SwarmMode {
+				dockerDataList, err = p.listServices(ctx, dockerClient)
+				if err != nil {
+					logger.Errorf("Failed to list services for docker swarm mode, error %s", err)
+					return err
+				}
+			} else {
+				dockerDataList, err = p.listContainers(ctx, dockerClient)
+				if err != nil {
+					logger.Errorf("Failed to list containers for docker, error %s", err)
+					return err
+				}
+			}
+
+			configuration := p.buildConfiguration(ctxLog, dockerDataList)
+			configurationChan <- config.Message{
+				ProviderName:  "docker",
+				Configuration: configuration,
+			}
+			if p.Watch {
+				if p.SwarmMode {
+					errChan := make(chan error)
+					// TODO: This need to be change. Linked to Swarm events docker/docker#23827
+					ticker := time.NewTicker(time.Second * time.Duration(p.SwarmModeRefreshSeconds))
+					pool.GoCtx(func(ctx context.Context) {
+
+						ctx = log.With(ctx, log.Str(log.ProviderName, "docker"))
+						logger := log.FromContext(ctx)
+
+						defer close(errChan)
+						for {
+							select {
+							case <-ticker.C:
+								services, err := p.listServices(ctx, dockerClient)
+								if err != nil {
+									logger.Errorf("Failed to list services for docker, error %s", err)
+									errChan <- err
+									return
+								}
+
+								configuration := p.buildConfiguration(ctx, services)
+								if configuration != nil {
+									configurationChan <- config.Message{
+										ProviderName:  "docker",
+										Configuration: configuration,
+									}
+								}
+
+							case <-ctx.Done():
+								ticker.Stop()
+								return
+							}
+						}
+					})
+					if err, ok := <-errChan; ok {
+						return err
+					}
+					// channel closed
+
+				} else {
+					f := filters.NewArgs()
+					f.Add("type", "container")
+					options := dockertypes.EventsOptions{
+						Filters: f,
+					}
+
+					startStopHandle := func(m eventtypes.Message) {
+						logger.Debugf("Provider event received %+v", m)
+						containers, err := p.listContainers(ctx, dockerClient)
+						if err != nil {
+							logger.Errorf("Failed to list containers for docker, error %s", err)
+							// Call cancel to get out of the monitor
+							return
+						}
+
+						configuration := p.buildConfiguration(ctx, containers)
+						if configuration != nil {
+							message := config.Message{
+								ProviderName:  "docker",
+								Configuration: configuration,
+							}
+							select {
+							case configurationChan <- message:
+							case <-ctx.Done():
+							}
+
+						}
+					}
+
+					eventsc, errc := dockerClient.Events(ctx, options)
+					for {
+						select {
+						case event := <-eventsc:
+							if event.Action == "start" ||
+								event.Action == "die" ||
+								strings.HasPrefix(event.Action, "health_status") {
+								startStopHandle(event)
+							}
+						case err := <-errc:
+							if err == io.EOF {
+								logger.Debug("Provider event stream closed")
+							}
+							return err
+						case <-ctx.Done():
+							return nil
+						}
+					}
+				}
+			}
+			return nil
+		}
+
+		notify := func(err error, time time.Duration) {
+			logger.Errorf("Provider connection error %+v, retrying in %s", err, time)
+		}
+		err := backoff.RetryNotify(safe.OperationWithRecover(operation), backoff.WithContext(job.NewBackOff(backoff.NewExponentialBackOff()), ctxLog), notify)
+		if err != nil {
+			logger.Errorf("Cannot connect to docker server %+v", err)
+		}
+	})
+
+	return nil
+}
+
+func (p *Provider) listContainers(ctx context.Context, dockerClient client.ContainerAPIClient) ([]dockerData, error) {
+	containerList, err := dockerClient.ContainerList(ctx, dockertypes.ContainerListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	var inspectedContainers []dockerData
+	// get inspect containers
+	for _, container := range containerList {
+		dData := inspectContainers(ctx, dockerClient, container.ID)
+		if len(dData.Name) == 0 {
+			continue
+		}
+
+		extraConf, err := p.getConfiguration(dData)
+		if err != nil {
+			log.FromContext(ctx).Errorf("Skip container %s: %v", getServiceName(dData), err)
+			continue
+		}
+		dData.ExtraConf = extraConf
+
+		inspectedContainers = append(inspectedContainers, dData)
+	}
+	return inspectedContainers, nil
+}
+
+func inspectContainers(ctx context.Context, dockerClient client.ContainerAPIClient, containerID string) dockerData {
+	containerInspected, err := dockerClient.ContainerInspect(ctx, containerID)
+	if err != nil {
+		log.FromContext(ctx).Warnf("Failed to inspect container %s, error: %s", containerID, err)
+		return dockerData{}
+	}
+
+	// This condition is here to avoid to have empty IP https://github.com/containous/traefik/issues/2459
+	// We register only container which are running
+	if containerInspected.ContainerJSONBase != nil && containerInspected.ContainerJSONBase.State != nil && containerInspected.ContainerJSONBase.State.Running {
+		return parseContainer(containerInspected)
+	}
+
+	return dockerData{}
+}
+
+func parseContainer(container dockertypes.ContainerJSON) dockerData {
+	dData := dockerData{
+		NetworkSettings: networkSettings{},
+	}
+
+	if container.ContainerJSONBase != nil {
+		dData.ID = container.ContainerJSONBase.ID
+		dData.Name = container.ContainerJSONBase.Name
+		dData.ServiceName = dData.Name // Default ServiceName to be the container's Name.
+		dData.Node = container.ContainerJSONBase.Node
+
+		if container.ContainerJSONBase.HostConfig != nil {
+			dData.NetworkSettings.NetworkMode = container.ContainerJSONBase.HostConfig.NetworkMode
+		}
+
+		if container.State != nil && container.State.Health != nil {
+			dData.Health = container.State.Health.Status
+		}
+	}
+
+	if container.Config != nil && container.Config.Labels != nil {
+		dData.Labels = container.Config.Labels
+	}
+
+	if container.NetworkSettings != nil {
+		if container.NetworkSettings.Ports != nil {
+			dData.NetworkSettings.Ports = container.NetworkSettings.Ports
+		}
+		if container.NetworkSettings.Networks != nil {
+			dData.NetworkSettings.Networks = make(map[string]*networkData)
+			for name, containerNetwork := range container.NetworkSettings.Networks {
+				dData.NetworkSettings.Networks[name] = &networkData{
+					ID:   containerNetwork.NetworkID,
+					Name: name,
+					Addr: containerNetwork.IPAddress,
+				}
+			}
+		}
+	}
+	return dData
+}
+
+func (p *Provider) listServices(ctx context.Context, dockerClient client.APIClient) ([]dockerData, error) {
+	logger := log.FromContext(ctx)
+
+	serviceList, err := dockerClient.ServiceList(ctx, dockertypes.ServiceListOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	serverVersion, err := dockerClient.ServerVersion(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	networkListArgs := filters.NewArgs()
+	// https://docs.docker.com/engine/api/v1.29/#tag/Network (Docker 17.06)
+	if versions.GreaterThanOrEqualTo(serverVersion.APIVersion, "1.29") {
+		networkListArgs.Add("scope", "swarm")
+	} else {
+		networkListArgs.Add("driver", "overlay")
+	}
+
+	networkList, err := dockerClient.NetworkList(ctx, dockertypes.NetworkListOptions{Filters: networkListArgs})
+	if err != nil {
+		logger.Debugf("Failed to network inspect on client for docker, error: %s", err)
+		return nil, err
+	}
+
+	networkMap := make(map[string]*dockertypes.NetworkResource)
+	for _, network := range networkList {
+		networkToAdd := network
+		networkMap[network.ID] = &networkToAdd
+	}
+
+	var dockerDataList []dockerData
+	var dockerDataListTasks []dockerData
+
+	for _, service := range serviceList {
+		dData, err := p.parseService(ctx, service, networkMap)
+		if err != nil {
+			logger.Errorf("Skip container %s: %v", getServiceName(dData), err)
+			continue
+		}
+
+		if dData.ExtraConf.Docker.LBSwarm {
+			if len(dData.NetworkSettings.Networks) > 0 {
+				dockerDataList = append(dockerDataList, dData)
+			}
+		} else {
+			isGlobalSvc := service.Spec.Mode.Global != nil
+			dockerDataListTasks, err = listTasks(ctx, dockerClient, service.ID, dData, networkMap, isGlobalSvc)
+			if err != nil {
+				logger.Warn(err)
+			} else {
+				dockerDataList = append(dockerDataList, dockerDataListTasks...)
+			}
+		}
+	}
+	return dockerDataList, err
+}
+
+func (p *Provider) parseService(ctx context.Context, service swarmtypes.Service, networkMap map[string]*dockertypes.NetworkResource) (dockerData, error) {
+	logger := log.FromContext(ctx)
+
+	dData := dockerData{
+		ID:              service.ID,
+		ServiceName:     service.Spec.Annotations.Name,
+		Name:            service.Spec.Annotations.Name,
+		Labels:          service.Spec.Annotations.Labels,
+		NetworkSettings: networkSettings{},
+	}
+
+	extraConf, err := p.getConfiguration(dData)
+	if err != nil {
+		return dockerData{}, err
+	}
+	dData.ExtraConf = extraConf
+
+	if service.Spec.EndpointSpec != nil {
+		if service.Spec.EndpointSpec.Mode == swarmtypes.ResolutionModeDNSRR {
+			if dData.ExtraConf.Docker.LBSwarm {
+				logger.Warnf("Ignored %s endpoint-mode not supported, service name: %s. Fallback to Traefik load balancing", swarmtypes.ResolutionModeDNSRR, service.Spec.Annotations.Name)
+			}
+		} else if service.Spec.EndpointSpec.Mode == swarmtypes.ResolutionModeVIP {
+			dData.NetworkSettings.Networks = make(map[string]*networkData)
+			for _, virtualIP := range service.Endpoint.VirtualIPs {
+				networkService := networkMap[virtualIP.NetworkID]
+				if networkService != nil {
+					if len(virtualIP.Addr) > 0 {
+						ip, _, _ := net.ParseCIDR(virtualIP.Addr)
+						network := &networkData{
+							Name: networkService.Name,
+							ID:   virtualIP.NetworkID,
+							Addr: ip.String(),
+						}
+						dData.NetworkSettings.Networks[network.Name] = network
+					} else {
+						logger.Debugf("No virtual IPs found in network %s", virtualIP.NetworkID)
+					}
+				} else {
+					logger.Debugf("Network not found, id: %s", virtualIP.NetworkID)
+				}
+			}
+		}
+	}
+	return dData, nil
+}
+
+func listTasks(ctx context.Context, dockerClient client.APIClient, serviceID string,
+	serviceDockerData dockerData, networkMap map[string]*dockertypes.NetworkResource, isGlobalSvc bool) ([]dockerData, error) {
+	serviceIDFilter := filters.NewArgs()
+	serviceIDFilter.Add("service", serviceID)
+	serviceIDFilter.Add("desired-state", "running")
+
+	taskList, err := dockerClient.TaskList(ctx, dockertypes.TaskListOptions{Filters: serviceIDFilter})
+	if err != nil {
+		return nil, err
+	}
+
+	var dockerDataList []dockerData
+	for _, task := range taskList {
+		if task.Status.State != swarmtypes.TaskStateRunning {
+			continue
+		}
+		dData := parseTasks(ctx, task, serviceDockerData, networkMap, isGlobalSvc)
+		if len(dData.NetworkSettings.Networks) > 0 {
+			dockerDataList = append(dockerDataList, dData)
+		}
+	}
+	return dockerDataList, err
+}
+
+func parseTasks(ctx context.Context, task swarmtypes.Task, serviceDockerData dockerData,
+	networkMap map[string]*dockertypes.NetworkResource, isGlobalSvc bool) dockerData {
+	dData := dockerData{
+		ID:              task.ID,
+		ServiceName:     serviceDockerData.Name,
+		Name:            serviceDockerData.Name + "." + strconv.Itoa(task.Slot),
+		Labels:          serviceDockerData.Labels,
+		ExtraConf:       serviceDockerData.ExtraConf,
+		NetworkSettings: networkSettings{},
+	}
+
+	if isGlobalSvc {
+		dData.Name = serviceDockerData.Name + "." + task.ID
+	}
+
+	if task.NetworksAttachments != nil {
+		dData.NetworkSettings.Networks = make(map[string]*networkData)
+		for _, virtualIP := range task.NetworksAttachments {
+			if networkService, present := networkMap[virtualIP.Network.ID]; present {
+				if len(virtualIP.Addresses) > 0 {
+					// Not sure about this next loop - when would a task have multiple IP's for the same network?
+					for _, addr := range virtualIP.Addresses {
+						ip, _, _ := net.ParseCIDR(addr)
+						network := &networkData{
+							ID:   virtualIP.Network.ID,
+							Name: networkService.Name,
+							Addr: ip.String(),
+						}
+						dData.NetworkSettings.Networks[network.Name] = network
+					}
+				} else {
+					log.FromContext(ctx).Debugf("No IP addresses found for network %s", virtualIP.Network.ID)
+				}
+			}
+		}
+	}
+	return dData
+}

pkg/provider/docker/docker_unix.go

@@ -0,0 +1,8 @@
+// +build !windows
+
+package docker
+
+const (
+	// DockerAPIVersion is a constant holding the version of the Provider API traefik will use
+	DockerAPIVersion = "1.21"
+)

pkg/provider/docker/docker_windows.go

@@ -0,0 +1,6 @@
+package docker
+
+const (
+	// DockerAPIVersion is a constant holding the version of the Provider API traefik will use
+	DockerAPIVersion string = "1.24"
+)

pkg/provider/docker/label.go

@@ -0,0 +1,63 @@
+package docker
+
+import (
+	"fmt"
+
+	"github.com/containous/traefik/pkg/provider/label"
+)
+
+const (
+	labelDockerComposeProject = "com.docker.compose.project"
+	labelDockerComposeService = "com.docker.compose.service"
+)
+
+// configuration Contains information from the labels that are globals (not related to the dynamic configuration) or specific to the provider.
+type configuration struct {
+	Enable bool
+	Tags   []string
+	Docker specificConfiguration
+}
+
+type specificConfiguration struct {
+	Network string
+	LBSwarm bool
+}
+
+func (p *Provider) getConfiguration(container dockerData) (configuration, error) {
+	conf := configuration{
+		Enable: p.ExposedByDefault,
+		Docker: specificConfiguration{
+			Network: p.Network,
+		},
+	}
+
+	err := label.Decode(container.Labels, &conf, "traefik.docker.", "traefik.enable", "traefik.tags")
+	if err != nil {
+		return configuration{}, err
+	}
+
+	return conf, nil
+}
+
+// getStringMultipleStrict get multiple string values associated to several labels
+// Fail if one label is missing
+func getStringMultipleStrict(labels map[string]string, labelNames ...string) (map[string]string, error) {
+	foundLabels := map[string]string{}
+	for _, name := range labelNames {
+		value := getStringValue(labels, name, "")
+		// Error out only if one of them is not defined.
+		if len(value) == 0 {
+			return nil, fmt.Errorf("label not found: %s", name)
+		}
+		foundLabels[name] = value
+	}
+	return foundLabels, nil
+}
+
+// getStringValue get string value associated to a label
+func getStringValue(labels map[string]string, labelName string, defaultValue string) string {
+	if value, ok := labels[labelName]; ok && len(value) > 0 {
+		return value
+	}
+	return defaultValue
+}

pkg/provider/docker/swarm_test.go

@@ -0,0 +1,412 @@
+package docker
+
+import (
+	"context"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/davecgh/go-spew/spew"
+	docker "github.com/docker/docker/api/types"
+	dockertypes "github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/swarm"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type fakeTasksClient struct {
+	dockerclient.APIClient
+	tasks     []swarm.Task
+	container dockertypes.ContainerJSON
+	err       error
+}
+
+func (c *fakeTasksClient) TaskList(ctx context.Context, options dockertypes.TaskListOptions) ([]swarm.Task, error) {
+	return c.tasks, c.err
+}
+
+func (c *fakeTasksClient) ContainerInspect(ctx context.Context, container string) (dockertypes.ContainerJSON, error) {
+	return c.container, c.err
+}
+
+func TestListTasks(t *testing.T) {
+	testCases := []struct {
+		service       swarm.Service
+		tasks         []swarm.Task
+		isGlobalSVC   bool
+		expectedTasks []string
+		networks      map[string]*docker.NetworkResource
+	}{
+		{
+			service: swarmService(serviceName("container")),
+			tasks: []swarm.Task{
+				swarmTask("id1",
+					taskSlot(1),
+					taskNetworkAttachment("1", "network1", "overlay", []string{"127.0.0.1"}),
+					taskStatus(taskState(swarm.TaskStateRunning)),
+				),
+				swarmTask("id2",
+					taskSlot(2),
+					taskNetworkAttachment("1", "network1", "overlay", []string{"127.0.0.2"}),
+					taskStatus(taskState(swarm.TaskStatePending)),
+				),
+				swarmTask("id3",
+					taskSlot(3),
+					taskNetworkAttachment("1", "network1", "overlay", []string{"127.0.0.3"}),
+				),
+				swarmTask("id4",
+					taskSlot(4),
+					taskNetworkAttachment("1", "network1", "overlay", []string{"127.0.0.4"}),
+					taskStatus(taskState(swarm.TaskStateRunning)),
+				),
+				swarmTask("id5",
+					taskSlot(5),
+					taskNetworkAttachment("1", "network1", "overlay", []string{"127.0.0.5"}),
+					taskStatus(taskState(swarm.TaskStateFailed)),
+				),
+			},
+			isGlobalSVC: false,
+			expectedTasks: []string{
+				"container.1",
+				"container.4",
+			},
+			networks: map[string]*docker.NetworkResource{
+				"1": {
+					Name: "foo",
+				},
+			},
+		},
+	}
+
+	for caseID, test := range testCases {
+		test := test
+		t.Run(strconv.Itoa(caseID), func(t *testing.T) {
+			t.Parallel()
+
+			p := Provider{}
+			dockerData, err := p.parseService(context.Background(), test.service, test.networks)
+			require.NoError(t, err)
+
+			dockerClient := &fakeTasksClient{tasks: test.tasks}
+			taskDockerData, _ := listTasks(context.Background(), dockerClient, test.service.ID, dockerData, test.networks, test.isGlobalSVC)
+
+			if len(test.expectedTasks) != len(taskDockerData) {
+				t.Errorf("expected tasks %v, got %v", spew.Sdump(test.expectedTasks), spew.Sdump(taskDockerData))
+			}
+
+			for i, taskID := range test.expectedTasks {
+				if taskDockerData[i].Name != taskID {
+					t.Errorf("expect task id %v, got %v", taskID, taskDockerData[i].Name)
+				}
+			}
+		})
+	}
+}
+
+type fakeServicesClient struct {
+	dockerclient.APIClient
+	dockerVersion string
+	networks      []dockertypes.NetworkResource
+	services      []swarm.Service
+	tasks         []swarm.Task
+	err           error
+}
+
+func (c *fakeServicesClient) ServiceList(ctx context.Context, options dockertypes.ServiceListOptions) ([]swarm.Service, error) {
+	return c.services, c.err
+}
+
+func (c *fakeServicesClient) ServerVersion(ctx context.Context) (dockertypes.Version, error) {
+	return dockertypes.Version{APIVersion: c.dockerVersion}, c.err
+}
+
+func (c *fakeServicesClient) NetworkList(ctx context.Context, options dockertypes.NetworkListOptions) ([]dockertypes.NetworkResource, error) {
+	return c.networks, c.err
+}
+
+func (c *fakeServicesClient) TaskList(ctx context.Context, options dockertypes.TaskListOptions) ([]swarm.Task, error) {
+	return c.tasks, c.err
+}
+
+func TestListServices(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		services         []swarm.Service
+		tasks            []swarm.Task
+		dockerVersion    string
+		networks         []dockertypes.NetworkResource
+		expectedServices []string
+	}{
+		{
+			desc: "Should return no service due to no networks defined",
+			services: []swarm.Service{
+				swarmService(
+					serviceName("service1"),
+					serviceLabels(map[string]string{
+						"traefik.docker.network": "barnet",
+						"traefik.docker.LBSwarm": "true",
+					}),
+					withEndpointSpec(modeVIP),
+					withEndpoint(
+						virtualIP("1", "10.11.12.13/24"),
+						virtualIP("2", "10.11.12.99/24"),
+					)),
+				swarmService(
+					serviceName("service2"),
+					serviceLabels(map[string]string{
+						"traefik.docker.network": "barnet",
+						"traefik.docker.LBSwarm": "true",
+					}),
+					withEndpointSpec(modeDNSSR)),
+			},
+			dockerVersion:    "1.30",
+			networks:         []dockertypes.NetworkResource{},
+			expectedServices: []string{},
+		},
+		{
+			desc: "Should return only service1",
+			services: []swarm.Service{
+				swarmService(
+					serviceName("service1"),
+					serviceLabels(map[string]string{
+						"traefik.docker.network": "barnet",
+						"traefik.docker.LBSwarm": "true",
+					}),
+					withEndpointSpec(modeVIP),
+					withEndpoint(
+						virtualIP("yk6l57rfwizjzxxzftn4amaot", "10.11.12.13/24"),
+						virtualIP("2", "10.11.12.99/24"),
+					)),
+				swarmService(
+					serviceName("service2"),
+					serviceLabels(map[string]string{
+						"traefik.docker.network": "barnet",
+						"traefik.docker.LBSwarm": "true",
+					}),
+					withEndpointSpec(modeDNSSR)),
+			},
+			dockerVersion: "1.30",
+			networks: []dockertypes.NetworkResource{
+				{
+					Name:       "network_name",
+					ID:         "yk6l57rfwizjzxxzftn4amaot",
+					Created:    time.Now(),
+					Scope:      "swarm",
+					Driver:     "overlay",
+					EnableIPv6: false,
+					Internal:   true,
+					Ingress:    false,
+					ConfigOnly: false,
+					Options: map[string]string{
+						"com.docker.network.driver.overlay.vxlanid_list": "4098",
+						"com.docker.network.enable_ipv6":                 "false",
+					},
+					Labels: map[string]string{
+						"com.docker.stack.namespace": "test",
+					},
+				},
+			},
+			expectedServices: []string{
+				"service1",
+			},
+		},
+		{
+			desc: "Should return service1 and service2",
+			services: []swarm.Service{
+				swarmService(
+					serviceName("service1"),
+					serviceLabels(map[string]string{
+						"traefik.docker.network": "barnet",
+					}),
+					withEndpointSpec(modeVIP),
+					withEndpoint(
+						virtualIP("yk6l57rfwizjzxxzftn4amaot", "10.11.12.13/24"),
+						virtualIP("2", "10.11.12.99/24"),
+					)),
+				swarmService(
+					serviceName("service2"),
+					serviceLabels(map[string]string{
+						"traefik.docker.network": "barnet",
+					}),
+					withEndpointSpec(modeDNSSR)),
+			},
+			tasks: []swarm.Task{
+				swarmTask("id1",
+					taskNetworkAttachment("yk6l57rfwizjzxxzftn4amaot", "network_name", "overlay", []string{"127.0.0.1"}),
+					taskStatus(taskState(swarm.TaskStateRunning)),
+				),
+				swarmTask("id2",
+					taskNetworkAttachment("yk6l57rfwizjzxxzftn4amaot", "network_name", "overlay", []string{"127.0.0.1"}),
+					taskStatus(taskState(swarm.TaskStateRunning)),
+				),
+			},
+			dockerVersion: "1.30",
+			networks: []dockertypes.NetworkResource{
+				{
+					Name:       "network_name",
+					ID:         "yk6l57rfwizjzxxzftn4amaot",
+					Created:    time.Now(),
+					Scope:      "swarm",
+					Driver:     "overlay",
+					EnableIPv6: false,
+					Internal:   true,
+					Ingress:    false,
+					ConfigOnly: false,
+					Options: map[string]string{
+						"com.docker.network.driver.overlay.vxlanid_list": "4098",
+						"com.docker.network.enable_ipv6":                 "false",
+					},
+					Labels: map[string]string{
+						"com.docker.stack.namespace": "test",
+					},
+				},
+			},
+			expectedServices: []string{
+				"service1.0",
+				"service1.0",
+				"service2.0",
+				"service2.0",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			dockerClient := &fakeServicesClient{services: test.services, tasks: test.tasks, dockerVersion: test.dockerVersion, networks: test.networks}
+
+			p := Provider{}
+
+			serviceDockerData, err := p.listServices(context.Background(), dockerClient)
+			assert.NoError(t, err)
+
+			assert.Equal(t, len(test.expectedServices), len(serviceDockerData))
+			for i, serviceName := range test.expectedServices {
+				if len(serviceDockerData) <= i {
+					require.Fail(t, "index", "invalid index %d", i)
+				}
+				assert.Equal(t, serviceName, serviceDockerData[i].Name)
+			}
+		})
+	}
+}
+
+func TestSwarmTaskParsing(t *testing.T) {
+	testCases := []struct {
+		service     swarm.Service
+		tasks       []swarm.Task
+		isGlobalSVC bool
+		expected    map[string]dockerData
+		networks    map[string]*docker.NetworkResource
+	}{
+		{
+			service: swarmService(serviceName("container")),
+			tasks: []swarm.Task{
+				swarmTask("id1", taskSlot(1)),
+				swarmTask("id2", taskSlot(2)),
+				swarmTask("id3", taskSlot(3)),
+			},
+			isGlobalSVC: false,
+			expected: map[string]dockerData{
+				"id1": {
+					Name: "container.1",
+				},
+				"id2": {
+					Name: "container.2",
+				},
+				"id3": {
+					Name: "container.3",
+				},
+			},
+			networks: map[string]*docker.NetworkResource{
+				"1": {
+					Name: "foo",
+				},
+			},
+		},
+		{
+			service: swarmService(serviceName("container")),
+			tasks: []swarm.Task{
+				swarmTask("id1"),
+				swarmTask("id2"),
+				swarmTask("id3"),
+			},
+			isGlobalSVC: true,
+			expected: map[string]dockerData{
+				"id1": {
+					Name: "container.id1",
+				},
+				"id2": {
+					Name: "container.id2",
+				},
+				"id3": {
+					Name: "container.id3",
+				},
+			},
+			networks: map[string]*docker.NetworkResource{
+				"1": {
+					Name: "foo",
+				},
+			},
+		},
+		{
+			service: swarmService(
+				serviceName("container"),
+				withEndpointSpec(modeVIP),
+				withEndpoint(
+					virtualIP("1", ""),
+				),
+			),
+			tasks: []swarm.Task{
+				swarmTask(
+					"id1",
+					taskNetworkAttachment("1", "vlan", "macvlan", []string{"127.0.0.1"}),
+					taskStatus(
+						taskState(swarm.TaskStateRunning),
+						taskContainerStatus("c1"),
+					),
+				),
+			},
+			isGlobalSVC: true,
+			expected: map[string]dockerData{
+				"id1": {
+					Name: "container.id1",
+					NetworkSettings: networkSettings{
+						Networks: map[string]*networkData{
+							"vlan": {
+								Name: "vlan",
+								Addr: "10.11.12.13",
+							},
+						},
+					},
+				},
+			},
+			networks: map[string]*docker.NetworkResource{
+				"1": {
+					Name: "vlan",
+				},
+			},
+		},
+	}
+
+	for caseID, test := range testCases {
+		test := test
+		t.Run(strconv.Itoa(caseID), func(t *testing.T) {
+			t.Parallel()
+
+			p := Provider{}
+
+			dData, err := p.parseService(context.Background(), test.service, test.networks)
+			require.NoError(t, err)
+
+			for _, task := range test.tasks {
+				taskDockerData := parseTasks(context.Background(), task, dData, test.networks, test.isGlobalSVC)
+				expected := test.expected[task.ID]
+				assert.Equal(t, expected.Name, taskDockerData.Name)
+			}
+		})
+	}
+}

pkg/provider/file/file.go

@@ -0,0 +1,307 @@
+package file
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"text/template"
+
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/provider"
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/containous/traefik/pkg/tls"
+	"github.com/pkg/errors"
+	"gopkg.in/fsnotify.v1"
+)
+
+const providerName = "file"
+
+var _ provider.Provider = (*Provider)(nil)
+
+// Provider holds configurations of the provider.
+type Provider struct {
+	provider.BaseProvider `mapstructure:",squash" export:"true"`
+	Directory             string `description:"Load configuration from one or more .toml files in a directory" export:"true"`
+	TraefikFile           string
+}
+
+// Init the provider
+func (p *Provider) Init() error {
+	return p.BaseProvider.Init()
+}
+
+// Provide allows the file provider to provide configurations to traefik
+// using the given configuration channel.
+func (p *Provider) Provide(configurationChan chan<- config.Message, pool *safe.Pool) error {
+	configuration, err := p.BuildConfiguration()
+
+	if err != nil {
+		return err
+	}
+
+	if p.Watch {
+		var watchItem string
+
+		switch {
+		case len(p.Directory) > 0:
+			watchItem = p.Directory
+		case len(p.Filename) > 0:
+			watchItem = filepath.Dir(p.Filename)
+		default:
+			watchItem = filepath.Dir(p.TraefikFile)
+		}
+
+		if err := p.addWatcher(pool, watchItem, configurationChan, p.watcherCallback); err != nil {
+			return err
+		}
+	}
+
+	sendConfigToChannel(configurationChan, configuration)
+	return nil
+}
+
+// BuildConfiguration loads configuration either from file or a directory specified by 'Filename'/'Directory'
+// and returns a 'Configuration' object
+func (p *Provider) BuildConfiguration() (*config.Configuration, error) {
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, providerName))
+
+	if len(p.Directory) > 0 {
+		return p.loadFileConfigFromDirectory(ctx, p.Directory, nil)
+	}
+
+	if len(p.Filename) > 0 {
+		return p.loadFileConfig(p.Filename, true)
+	}
+
+	if len(p.TraefikFile) > 0 {
+		return p.loadFileConfig(p.TraefikFile, false)
+	}
+
+	return nil, errors.New("error using file configuration backend, no filename defined")
+}
+
+func (p *Provider) addWatcher(pool *safe.Pool, directory string, configurationChan chan<- config.Message, callback func(chan<- config.Message, fsnotify.Event)) error {
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return fmt.Errorf("error creating file watcher: %s", err)
+	}
+
+	err = watcher.Add(directory)
+	if err != nil {
+		return fmt.Errorf("error adding file watcher: %s", err)
+	}
+
+	// Process events
+	pool.Go(func(stop chan bool) {
+		defer watcher.Close()
+		for {
+			select {
+			case <-stop:
+				return
+			case evt := <-watcher.Events:
+				if p.Directory == "" {
+					var filename string
+					if len(p.Filename) > 0 {
+						filename = p.Filename
+					} else {
+						filename = p.TraefikFile
+					}
+
+					_, evtFileName := filepath.Split(evt.Name)
+					_, confFileName := filepath.Split(filename)
+					if evtFileName == confFileName {
+						callback(configurationChan, evt)
+					}
+				} else {
+					callback(configurationChan, evt)
+				}
+			case err := <-watcher.Errors:
+				log.WithoutContext().WithField(log.ProviderName, providerName).Errorf("Watcher event error: %s", err)
+			}
+		}
+	})
+	return nil
+}
+
+func (p *Provider) watcherCallback(configurationChan chan<- config.Message, event fsnotify.Event) {
+	watchItem := p.TraefikFile
+	if len(p.Directory) > 0 {
+		watchItem = p.Directory
+	} else if len(p.Filename) > 0 {
+		watchItem = p.Filename
+	}
+
+	logger := log.WithoutContext().WithField(log.ProviderName, providerName)
+
+	if _, err := os.Stat(watchItem); err != nil {
+		logger.Errorf("Unable to watch %s : %v", watchItem, err)
+		return
+	}
+
+	configuration, err := p.BuildConfiguration()
+	if err != nil {
+		logger.Errorf("Error occurred during watcher callback: %s", err)
+		return
+	}
+
+	sendConfigToChannel(configurationChan, configuration)
+}
+
+func sendConfigToChannel(configurationChan chan<- config.Message, configuration *config.Configuration) {
+	configurationChan <- config.Message{
+		ProviderName:  "file",
+		Configuration: configuration,
+	}
+}
+
+func readFile(filename string) (string, error) {
+	if len(filename) > 0 {
+		buf, err := ioutil.ReadFile(filename)
+		if err != nil {
+			return "", err
+		}
+		return string(buf), nil
+	}
+	return "", fmt.Errorf("invalid filename: %s", filename)
+}
+
+func (p *Provider) loadFileConfig(filename string, parseTemplate bool) (*config.Configuration, error) {
+	fileContent, err := readFile(filename)
+	if err != nil {
+		return nil, fmt.Errorf("error reading configuration file: %s - %s", filename, err)
+	}
+
+	var configuration *config.Configuration
+	if parseTemplate {
+		configuration, err = p.CreateConfiguration(fileContent, template.FuncMap{}, false)
+	} else {
+		configuration, err = p.DecodeConfiguration(fileContent)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	var tlsConfigs []*tls.Configuration
+	for _, conf := range configuration.TLS {
+		bytes, err := conf.Certificate.CertFile.Read()
+		if err != nil {
+			log.Error(err)
+			continue
+		}
+		conf.Certificate.CertFile = tls.FileOrContent(string(bytes))
+
+		bytes, err = conf.Certificate.KeyFile.Read()
+		if err != nil {
+			log.Error(err)
+			continue
+		}
+		conf.Certificate.KeyFile = tls.FileOrContent(string(bytes))
+		tlsConfigs = append(tlsConfigs, conf)
+	}
+	configuration.TLS = tlsConfigs
+
+	return configuration, nil
+}
+
+func (p *Provider) loadFileConfigFromDirectory(ctx context.Context, directory string, configuration *config.Configuration) (*config.Configuration, error) {
+	logger := log.FromContext(ctx)
+
+	fileList, err := ioutil.ReadDir(directory)
+
+	if err != nil {
+		return configuration, fmt.Errorf("unable to read directory %s: %v", directory, err)
+	}
+
+	if configuration == nil {
+		configuration = &config.Configuration{
+			HTTP: &config.HTTPConfiguration{
+				Routers:     make(map[string]*config.Router),
+				Middlewares: make(map[string]*config.Middleware),
+				Services:    make(map[string]*config.Service),
+			},
+			TCP: &config.TCPConfiguration{
+				Routers:  make(map[string]*config.TCPRouter),
+				Services: make(map[string]*config.TCPService),
+			},
+		}
+	}
+
+	configTLSMaps := make(map[*tls.Configuration]struct{})
+	for _, item := range fileList {
+
+		if item.IsDir() {
+			configuration, err = p.loadFileConfigFromDirectory(ctx, filepath.Join(directory, item.Name()), configuration)
+			if err != nil {
+				return configuration, fmt.Errorf("unable to load content configuration from subdirectory %s: %v", item, err)
+			}
+			continue
+		} else if !strings.HasSuffix(item.Name(), ".toml") && !strings.HasSuffix(item.Name(), ".tmpl") {
+			continue
+		}
+
+		var c *config.Configuration
+		c, err = p.loadFileConfig(path.Join(directory, item.Name()), true)
+
+		if err != nil {
+			return configuration, err
+		}
+
+		for name, conf := range c.HTTP.Routers {
+			if _, exists := configuration.HTTP.Routers[name]; exists {
+				logger.WithField(log.RouterName, name).Warn("HTTP router already configured, skipping")
+			} else {
+				configuration.HTTP.Routers[name] = conf
+			}
+		}
+
+		for name, conf := range c.HTTP.Middlewares {
+			if _, exists := configuration.HTTP.Middlewares[name]; exists {
+				logger.WithField(log.MiddlewareName, name).Warn("HTTP middleware already configured, skipping")
+			} else {
+				configuration.HTTP.Middlewares[name] = conf
+			}
+		}
+
+		for name, conf := range c.HTTP.Services {
+			if _, exists := configuration.HTTP.Services[name]; exists {
+				logger.WithField(log.ServiceName, name).Warn("HTTP service already configured, skipping")
+			} else {
+				configuration.HTTP.Services[name] = conf
+			}
+		}
+
+		for name, conf := range c.TCP.Routers {
+			if _, exists := configuration.TCP.Routers[name]; exists {
+				logger.WithField(log.RouterName, name).Warn("TCP router already configured, skipping")
+			} else {
+				configuration.TCP.Routers[name] = conf
+			}
+		}
+
+		for name, conf := range c.TCP.Services {
+			if _, exists := configuration.TCP.Services[name]; exists {
+				logger.WithField(log.ServiceName, name).Warn("TCP service already configured, skipping")
+			} else {
+				configuration.TCP.Services[name] = conf
+			}
+		}
+
+		for _, conf := range c.TLS {
+			if _, exists := configTLSMaps[conf]; exists {
+				logger.Warnf("TLS configuration %v already configured, skipping", conf)
+			} else {
+				configTLSMaps[conf] = struct{}{}
+			}
+		}
+	}
+
+	for conf := range configTLSMaps {
+		configuration.TLS = append(configuration.TLS, conf)
+	}
+	return configuration, nil
+}

pkg/provider/file/file_test.go

@@ -0,0 +1,360 @@
+package file
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type ProvideTestCase struct {
+	desc               string
+	directoryContent   []string
+	fileContent        string
+	traefikFileContent string
+	expectedNumRouter  int
+	expectedNumService int
+	expectedNumTLSConf int
+}
+
+func TestProvideWithoutWatch(t *testing.T) {
+	for _, test := range getTestCases() {
+		t.Run(test.desc+" without watch", func(t *testing.T) {
+			provider, clean := createProvider(t, test, false)
+			defer clean()
+			configChan := make(chan config.Message)
+
+			provider.DebugLogGeneratedTemplate = true
+
+			go func() {
+				err := provider.Provide(configChan, safe.NewPool(context.Background()))
+				assert.NoError(t, err)
+			}()
+
+			timeout := time.After(time.Second)
+			select {
+			case conf := <-configChan:
+				assert.Len(t, conf.Configuration.HTTP.Services, test.expectedNumService)
+				assert.Len(t, conf.Configuration.HTTP.Routers, test.expectedNumRouter)
+				assert.Len(t, conf.Configuration.TLS, test.expectedNumTLSConf)
+			case <-timeout:
+				t.Errorf("timeout while waiting for config")
+			}
+		})
+	}
+}
+
+func TestProvideWithWatch(t *testing.T) {
+	for _, test := range getTestCases() {
+		t.Run(test.desc+" with watch", func(t *testing.T) {
+			provider, clean := createProvider(t, test, true)
+			defer clean()
+			configChan := make(chan config.Message)
+
+			go func() {
+				err := provider.Provide(configChan, safe.NewPool(context.Background()))
+				assert.NoError(t, err)
+			}()
+
+			timeout := time.After(time.Second)
+			select {
+			case conf := <-configChan:
+				assert.Len(t, conf.Configuration.HTTP.Services, 0)
+				assert.Len(t, conf.Configuration.HTTP.Routers, 0)
+				assert.Len(t, conf.Configuration.TLS, 0)
+			case <-timeout:
+				t.Errorf("timeout while waiting for config")
+			}
+
+			if len(test.fileContent) > 0 {
+				if err := ioutil.WriteFile(provider.Filename, []byte(test.fileContent), 0755); err != nil {
+					t.Error(err)
+				}
+			}
+
+			if len(test.traefikFileContent) > 0 {
+				if err := ioutil.WriteFile(provider.TraefikFile, []byte(test.traefikFileContent), 0755); err != nil {
+					t.Error(err)
+				}
+			}
+
+			if len(test.directoryContent) > 0 {
+				for _, fileContent := range test.directoryContent {
+					createRandomFile(t, provider.Directory, fileContent)
+				}
+			}
+
+			timeout = time.After(time.Second * 1)
+			var numUpdates, numServices, numRouters, numTLSConfs int
+			for {
+				select {
+				case conf := <-configChan:
+					numUpdates++
+					numServices = len(conf.Configuration.HTTP.Services)
+					numRouters = len(conf.Configuration.HTTP.Routers)
+					numTLSConfs = len(conf.Configuration.TLS)
+					t.Logf("received update #%d: services %d/%d, routers %d/%d, TLS configs %d/%d", numUpdates, numServices, test.expectedNumService, numRouters, test.expectedNumRouter, numTLSConfs, test.expectedNumTLSConf)
+
+					if numServices == test.expectedNumService && numRouters == test.expectedNumRouter && numTLSConfs == test.expectedNumTLSConf {
+						return
+					}
+				case <-timeout:
+					t.Fatal("timeout while waiting for config")
+				}
+			}
+		})
+	}
+}
+
+func TestErrorWhenEmptyConfig(t *testing.T) {
+	provider := &Provider{}
+	configChan := make(chan config.Message)
+	errorChan := make(chan struct{})
+	go func() {
+		err := provider.Provide(configChan, safe.NewPool(context.Background()))
+		assert.Error(t, err)
+		close(errorChan)
+	}()
+
+	timeout := time.After(time.Second)
+	select {
+	case <-configChan:
+		t.Fatal("We should not receive config message")
+	case <-timeout:
+		t.Fatal("timeout while waiting for config")
+	case <-errorChan:
+	}
+}
+
+func getTestCases() []ProvideTestCase {
+	return []ProvideTestCase{
+		{
+			desc:               "simple file",
+			fileContent:        createRoutersConfiguration(3) + createServicesConfiguration(6) + createTLS(5),
+			expectedNumRouter:  3,
+			expectedNumService: 6,
+			expectedNumTLSConf: 5,
+		},
+		{
+			desc:        "simple file and a traefik file",
+			fileContent: createRoutersConfiguration(4) + createServicesConfiguration(8) + createTLS(4),
+			traefikFileContent: `
+			debug=true
+`,
+			expectedNumRouter:  4,
+			expectedNumService: 8,
+			expectedNumTLSConf: 4,
+		},
+		{
+			desc: "template file",
+			fileContent: `
+[http.routers]
+{{ range $i, $e := until 20 }}
+  [http.routers.router{{ $e }}]
+  service = "application"  
+{{ end }}
+`,
+			expectedNumRouter: 20,
+		},
+		{
+			desc: "simple directory",
+			directoryContent: []string{
+				createRoutersConfiguration(2),
+				createServicesConfiguration(3),
+				createTLS(4),
+			},
+			expectedNumRouter:  2,
+			expectedNumService: 3,
+			expectedNumTLSConf: 4,
+		},
+		{
+			desc: "template in directory",
+			directoryContent: []string{
+				`
+[http.routers]
+{{ range $i, $e := until 20 }}
+  [http.routers.router{{ $e }}]
+  service = "application"  
+{{ end }}
+`,
+				`
+[http.services]
+{{ range $i, $e := until 20 }}
+  [http.services.application-{{ $e }}]
+	[[http.services.application-{{ $e }}.servers]]
+	url="http://127.0.0.1"
+	weight = 1
+{{ end }}
+`,
+			},
+			expectedNumRouter:  20,
+			expectedNumService: 20,
+		},
+		{
+			desc: "simple traefik file",
+			traefikFileContent: `
+				debug=true
+				[providers.file]	
+				` + createRoutersConfiguration(2) + createServicesConfiguration(3) + createTLS(4),
+			expectedNumRouter:  2,
+			expectedNumService: 3,
+			expectedNumTLSConf: 4,
+		},
+		{
+			desc: "simple traefik file with templating",
+			traefikFileContent: `
+				temp="{{ getTag \"test\" }}"
+				[providers.file]	
+				` + createRoutersConfiguration(2) + createServicesConfiguration(3) + createTLS(4),
+			expectedNumRouter:  2,
+			expectedNumService: 3,
+			expectedNumTLSConf: 4,
+		},
+	}
+}
+
+func createProvider(t *testing.T, test ProvideTestCase, watch bool) (*Provider, func()) {
+	tempDir := createTempDir(t, "testdir")
+
+	provider := &Provider{}
+	provider.Watch = watch
+
+	if len(test.directoryContent) > 0 {
+		if !watch {
+			for _, fileContent := range test.directoryContent {
+				createRandomFile(t, tempDir, fileContent)
+			}
+		}
+		provider.Directory = tempDir
+	}
+
+	if len(test.fileContent) > 0 {
+		if watch {
+			test.fileContent = ""
+		}
+		filename := createRandomFile(t, tempDir, test.fileContent)
+		provider.Filename = filename.Name()
+
+	}
+
+	if len(test.traefikFileContent) > 0 {
+		if watch {
+			test.traefikFileContent = ""
+		}
+		filename := createRandomFile(t, tempDir, test.traefikFileContent)
+		provider.TraefikFile = filename.Name()
+	}
+
+	return provider, func() {
+		os.Remove(tempDir)
+	}
+}
+
+// createRandomFile Helper
+func createRandomFile(t *testing.T, tempDir string, contents ...string) *os.File {
+	return createFile(t, tempDir, fmt.Sprintf("temp%d.toml", time.Now().UnixNano()), contents...)
+}
+
+// createFile Helper
+func createFile(t *testing.T, tempDir string, name string, contents ...string) *os.File {
+	t.Helper()
+	fileName := path.Join(tempDir, name)
+
+	tempFile, err := os.Create(fileName)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, content := range contents {
+		_, err = tempFile.WriteString(content)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	err = tempFile.Close()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return tempFile
+}
+
+// createTempDir Helper
+func createTempDir(t *testing.T, dir string) string {
+	t.Helper()
+	d, err := ioutil.TempDir("", dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return d
+}
+
+// createRoutersConfiguration Helper
+func createRoutersConfiguration(n int) string {
+	conf := "[http.routers]\n"
+	for i := 1; i <= n; i++ {
+		conf += fmt.Sprintf(` 
+[http.routers."router%[1]d"]
+	service = "application-%[1]d"
+`, i)
+	}
+	return conf
+}
+
+// createServicesConfiguration Helper
+func createServicesConfiguration(n int) string {
+	conf := "[http.services]\n"
+	for i := 1; i <= n; i++ {
+		conf += fmt.Sprintf(`
+[http.services.application-%[1]d.loadbalancer]
+   [[http.services.application-%[1]d.loadbalancer.servers]]
+     url = "http://172.17.0.%[1]d:80"
+     weight = 1
+`, i)
+	}
+	return conf
+}
+
+// createTLS Helper
+func createTLS(n int) string {
+	var conf string
+	for i := 1; i <= n; i++ {
+		conf += fmt.Sprintf(`[[TLS]]
+	EntryPoints = ["https"]
+	[TLS.Certificate]
+	CertFile = "integration/fixtures/https/snitest%[1]d.com.cert"
+	KeyFile = "integration/fixtures/https/snitest%[1]d.com.key"
+`, i)
+	}
+	return conf
+}
+
+func TestTLSContent(t *testing.T) {
+	tempDir := createTempDir(t, "testdir")
+	defer os.Remove(tempDir)
+
+	fileTLS := createRandomFile(t, tempDir, "CONTENT")
+	fileConfig := createRandomFile(t, tempDir, `
+[[tls]]
+entryPoints = ["https"]
+  [tls.certificate]
+    certFile = "`+fileTLS.Name()+`"
+    keyFile = "`+fileTLS.Name()+`"
+`)
+
+	provider := &Provider{}
+	configuration, err := provider.loadFileConfig(fileConfig.Name(), true)
+	require.NoError(t, err)
+
+	require.Equal(t, "CONTENT", configuration.TLS[0].Certificate.CertFile.String())
+	require.Equal(t, "CONTENT", configuration.TLS[0].Certificate.KeyFile.String())
+}

pkg/provider/kubernetes/crd/client.go

@@ -0,0 +1,362 @@
+package crd
+
+import (
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"time"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned"
+	"github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions"
+	"github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
+	corev1 "k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	kubeerror "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+const resyncPeriod = 10 * time.Minute
+
+type resourceEventHandler struct {
+	ev chan<- interface{}
+}
+
+func (reh *resourceEventHandler) OnAdd(obj interface{}) {
+	eventHandlerFunc(reh.ev, obj)
+}
+
+func (reh *resourceEventHandler) OnUpdate(oldObj, newObj interface{}) {
+	eventHandlerFunc(reh.ev, newObj)
+}
+
+func (reh *resourceEventHandler) OnDelete(obj interface{}) {
+	eventHandlerFunc(reh.ev, obj)
+}
+
+// Client is a client for the Provider master.
+// WatchAll starts the watch of the Provider resources and updates the stores.
+// The stores can then be accessed via the Get* functions.
+type Client interface {
+	WatchAll(namespaces k8s.Namespaces, stopCh <-chan struct{}) (<-chan interface{}, error)
+
+	GetIngressRoutes() []*v1alpha1.IngressRoute
+	GetMiddlewares() []*v1alpha1.Middleware
+
+	GetIngresses() []*extensionsv1beta1.Ingress
+	GetService(namespace, name string) (*corev1.Service, bool, error)
+	GetSecret(namespace, name string) (*corev1.Secret, bool, error)
+	GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error)
+	UpdateIngressStatus(namespace, name, ip, hostname string) error
+}
+
+// TODO: add tests for the clientWrapper (and its methods) itself.
+type clientWrapper struct {
+	csCrd  *versioned.Clientset
+	csKube *kubernetes.Clientset
+
+	factoriesCrd  map[string]externalversions.SharedInformerFactory
+	factoriesKube map[string]informers.SharedInformerFactory
+
+	ingressLabelSelector labels.Selector
+
+	isNamespaceAll    bool
+	watchedNamespaces k8s.Namespaces
+}
+
+func createClientFromConfig(c *rest.Config) (*clientWrapper, error) {
+	csCrd, err := versioned.NewForConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	csKube, err := kubernetes.NewForConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return newClientImpl(csKube, csCrd), nil
+}
+
+func newClientImpl(csKube *kubernetes.Clientset, csCrd *versioned.Clientset) *clientWrapper {
+	return &clientWrapper{
+		csCrd:         csCrd,
+		csKube:        csKube,
+		factoriesCrd:  make(map[string]externalversions.SharedInformerFactory),
+		factoriesKube: make(map[string]informers.SharedInformerFactory),
+	}
+}
+
+// newInClusterClient returns a new Provider client that is expected to run
+// inside the cluster.
+func newInClusterClient(endpoint string) (*clientWrapper, error) {
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create in-cluster configuration: %s", err)
+	}
+
+	if endpoint != "" {
+		config.Host = endpoint
+	}
+
+	return createClientFromConfig(config)
+}
+
+func newExternalClusterClientFromFile(file string) (*clientWrapper, error) {
+	configFromFlags, err := clientcmd.BuildConfigFromFlags("", file)
+	if err != nil {
+		return nil, err
+	}
+	return createClientFromConfig(configFromFlags)
+}
+
+// newExternalClusterClient returns a new Provider client that may run outside
+// of the cluster.
+// The endpoint parameter must not be empty.
+func newExternalClusterClient(endpoint, token, caFilePath string) (*clientWrapper, error) {
+	if endpoint == "" {
+		return nil, errors.New("endpoint missing for external cluster client")
+	}
+
+	config := &rest.Config{
+		Host:        endpoint,
+		BearerToken: token,
+	}
+
+	if caFilePath != "" {
+		caData, err := ioutil.ReadFile(caFilePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read CA file %s: %s", caFilePath, err)
+		}
+
+		config.TLSClientConfig = rest.TLSClientConfig{CAData: caData}
+	}
+
+	return createClientFromConfig(config)
+}
+
+// WatchAll starts namespace-specific controllers for all relevant kinds.
+func (c *clientWrapper) WatchAll(namespaces k8s.Namespaces, stopCh <-chan struct{}) (<-chan interface{}, error) {
+	eventCh := make(chan interface{}, 1)
+	eventHandler := c.newResourceEventHandler(eventCh)
+
+	if len(namespaces) == 0 {
+		namespaces = k8s.Namespaces{metav1.NamespaceAll}
+		c.isNamespaceAll = true
+	}
+	c.watchedNamespaces = namespaces
+
+	for _, ns := range namespaces {
+		factoryCrd := externalversions.NewSharedInformerFactoryWithOptions(c.csCrd, resyncPeriod, externalversions.WithNamespace(ns))
+		factoryCrd.Traefik().V1alpha1().IngressRoutes().Informer().AddEventHandler(eventHandler)
+		factoryCrd.Traefik().V1alpha1().Middlewares().Informer().AddEventHandler(eventHandler)
+
+		factoryKube := informers.NewFilteredSharedInformerFactory(c.csKube, resyncPeriod, ns, nil)
+		factoryKube.Extensions().V1beta1().Ingresses().Informer().AddEventHandler(eventHandler)
+		factoryKube.Core().V1().Services().Informer().AddEventHandler(eventHandler)
+		factoryKube.Core().V1().Endpoints().Informer().AddEventHandler(eventHandler)
+
+		c.factoriesCrd[ns] = factoryCrd
+		c.factoriesKube[ns] = factoryKube
+	}
+
+	for _, ns := range namespaces {
+		c.factoriesCrd[ns].Start(stopCh)
+		c.factoriesKube[ns].Start(stopCh)
+	}
+
+	for _, ns := range namespaces {
+		for t, ok := range c.factoriesCrd[ns].WaitForCacheSync(stopCh) {
+			if !ok {
+				return nil, fmt.Errorf("timed out waiting for controller caches to sync %s in namespace %q", t.String(), ns)
+			}
+		}
+
+		for t, ok := range c.factoriesKube[ns].WaitForCacheSync(stopCh) {
+			if !ok {
+				return nil, fmt.Errorf("timed out waiting for controller caches to sync %s in namespace %q", t.String(), ns)
+			}
+		}
+	}
+
+	// Do not wait for the Secrets store to get synced since we cannot rely on
+	// users having granted RBAC permissions for this object.
+	// https://github.com/containous/traefik/issues/1784 should improve the
+	// situation here in the future.
+	for _, ns := range namespaces {
+		c.factoriesKube[ns].Core().V1().Secrets().Informer().AddEventHandler(eventHandler)
+		c.factoriesKube[ns].Start(stopCh)
+	}
+
+	return eventCh, nil
+}
+
+func (c *clientWrapper) GetIngressRoutes() []*v1alpha1.IngressRoute {
+	var result []*v1alpha1.IngressRoute
+
+	for ns, factory := range c.factoriesCrd {
+		ings, err := factory.Traefik().V1alpha1().IngressRoutes().Lister().List(c.ingressLabelSelector)
+		if err != nil {
+			log.Errorf("Failed to list ingresses in namespace %s: %s", ns, err)
+		}
+		result = append(result, ings...)
+	}
+
+	return result
+}
+
+func (c *clientWrapper) GetMiddlewares() []*v1alpha1.Middleware {
+	var result []*v1alpha1.Middleware
+
+	for ns, factory := range c.factoriesCrd {
+		ings, err := factory.Traefik().V1alpha1().Middlewares().Lister().List(c.ingressLabelSelector)
+		if err != nil {
+			log.Errorf("Failed to list ingresses in namespace %s: %s", ns, err)
+		}
+		result = append(result, ings...)
+	}
+
+	return result
+}
+
+// GetIngresses returns all Ingresses for observed namespaces in the cluster.
+func (c *clientWrapper) GetIngresses() []*extensionsv1beta1.Ingress {
+	var result []*extensionsv1beta1.Ingress
+	for ns, factory := range c.factoriesKube {
+		ings, err := factory.Extensions().V1beta1().Ingresses().Lister().List(c.ingressLabelSelector)
+		if err != nil {
+			log.Errorf("Failed to list ingresses in namespace %s: %s", ns, err)
+		}
+		result = append(result, ings...)
+	}
+	return result
+}
+
+// UpdateIngressStatus updates an Ingress with a provided status.
+func (c *clientWrapper) UpdateIngressStatus(namespace, name, ip, hostname string) error {
+	if !c.isWatchedNamespace(namespace) {
+		return fmt.Errorf("failed to get ingress %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	ing, err := c.factoriesKube[c.lookupNamespace(namespace)].Extensions().V1beta1().Ingresses().Lister().Ingresses(namespace).Get(name)
+	if err != nil {
+		return fmt.Errorf("failed to get ingress %s/%s: %v", namespace, name, err)
+	}
+
+	if len(ing.Status.LoadBalancer.Ingress) > 0 {
+		if ing.Status.LoadBalancer.Ingress[0].Hostname == hostname && ing.Status.LoadBalancer.Ingress[0].IP == ip {
+			// If status is already set, skip update
+			log.Debugf("Skipping status update on ingress %s/%s", ing.Namespace, ing.Name)
+			return nil
+		}
+	}
+	ingCopy := ing.DeepCopy()
+	ingCopy.Status = extensionsv1beta1.IngressStatus{LoadBalancer: corev1.LoadBalancerStatus{Ingress: []corev1.LoadBalancerIngress{{IP: ip, Hostname: hostname}}}}
+
+	_, err = c.csKube.ExtensionsV1beta1().Ingresses(ingCopy.Namespace).UpdateStatus(ingCopy)
+	if err != nil {
+		return fmt.Errorf("failed to update ingress status %s/%s: %v", namespace, name, err)
+	}
+	log.Infof("Updated status on ingress %s/%s", namespace, name)
+	return nil
+}
+
+// GetService returns the named service from the given namespace.
+func (c *clientWrapper) GetService(namespace, name string) (*corev1.Service, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get service %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	service, err := c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().Services().Lister().Services(namespace).Get(name)
+	exist, err := translateNotFoundError(err)
+	return service, exist, err
+}
+
+// GetEndpoints returns the named endpoints from the given namespace.
+func (c *clientWrapper) GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get endpoints %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	endpoint, err := c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().Endpoints().Lister().Endpoints(namespace).Get(name)
+	exist, err := translateNotFoundError(err)
+	return endpoint, exist, err
+}
+
+// GetSecret returns the named secret from the given namespace.
+func (c *clientWrapper) GetSecret(namespace, name string) (*corev1.Secret, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get secret %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	secret, err := c.factoriesKube[c.lookupNamespace(namespace)].Core().V1().Secrets().Lister().Secrets(namespace).Get(name)
+	exist, err := translateNotFoundError(err)
+	return secret, exist, err
+}
+
+// lookupNamespace returns the lookup namespace key for the given namespace.
+// When listening on all namespaces, it returns the client-go identifier ("")
+// for all-namespaces. Otherwise, it returns the given namespace.
+// The distinction is necessary because we index all informers on the special
+// identifier iff all-namespaces are requested but receive specific namespace
+// identifiers from the Kubernetes API, so we have to bridge this gap.
+func (c *clientWrapper) lookupNamespace(ns string) string {
+	if c.isNamespaceAll {
+		return metav1.NamespaceAll
+	}
+	return ns
+}
+
+func (c *clientWrapper) newResourceEventHandler(events chan<- interface{}) cache.ResourceEventHandler {
+	return &cache.FilteringResourceEventHandler{
+		FilterFunc: func(obj interface{}) bool {
+			// Ignore Ingresses that do not match our custom label selector.
+			if ing, ok := obj.(*extensionsv1beta1.Ingress); ok {
+				lbls := labels.Set(ing.GetLabels())
+				return c.ingressLabelSelector.Matches(lbls)
+			}
+			return true
+		},
+		Handler: &resourceEventHandler{ev: events},
+	}
+}
+
+// eventHandlerFunc will pass the obj on to the events channel or drop it.
+// This is so passing the events along won't block in the case of high volume.
+// The events are only used for signaling anyway so dropping a few is ok.
+func eventHandlerFunc(events chan<- interface{}, obj interface{}) {
+	select {
+	case events <- obj:
+	default:
+	}
+}
+
+// translateNotFoundError will translate a "not found" error to a boolean return
+// value which indicates if the resource exists and a nil error.
+func translateNotFoundError(err error) (bool, error) {
+	if kubeerror.IsNotFound(err) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
+// isWatchedNamespace checks to ensure that the namespace is being watched before we request
+// it to ensure we don't panic by requesting an out-of-watch object.
+func (c *clientWrapper) isWatchedNamespace(ns string) bool {
+	if c.isNamespaceAll {
+		return true
+	}
+	for _, watchedNamespace := range c.watchedNamespaces {
+		if watchedNamespace == ns {
+			return true
+		}
+	}
+	return false
+}

pkg/provider/kubernetes/crd/client_mock_test.go

@@ -0,0 +1,133 @@
+package crd
+
+import (
+	"fmt"
+	"io/ioutil"
+
+	"github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
+	corev1 "k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1beta12 "k8s.io/api/extensions/v1beta1"
+	"k8s.io/client-go/kubernetes/scheme"
+)
+
+var _ Client = (*clientMock)(nil)
+
+func init() {
+	// required by k8s.MustParseYaml
+	err := v1alpha1.AddToScheme(scheme.Scheme)
+	if err != nil {
+		panic(err)
+	}
+}
+
+type clientMock struct {
+	ingresses []*extensionsv1beta1.Ingress
+	services  []*corev1.Service
+	secrets   []*corev1.Secret
+	endpoints []*corev1.Endpoints
+
+	apiServiceError       error
+	apiSecretError        error
+	apiEndpointsError     error
+	apiIngressStatusError error
+
+	ingressRoutes []*v1alpha1.IngressRoute
+	middlewares   []*v1alpha1.Middleware
+
+	watchChan chan interface{}
+}
+
+func newClientMock(paths ...string) clientMock {
+	var c clientMock
+
+	for _, path := range paths {
+		yamlContent, err := ioutil.ReadFile("./fixtures/" + path)
+		if err != nil {
+			panic(err)
+		}
+
+		k8sObjects := k8s.MustParseYaml(yamlContent)
+		for _, obj := range k8sObjects {
+			switch o := obj.(type) {
+			case *corev1.Service:
+				c.services = append(c.services, o)
+			case *corev1.Endpoints:
+				c.endpoints = append(c.endpoints, o)
+			case *v1alpha1.IngressRoute:
+				c.ingressRoutes = append(c.ingressRoutes, o)
+			case *v1alpha1.Middleware:
+				c.middlewares = append(c.middlewares, o)
+			case *v1beta12.Ingress:
+				c.ingresses = append(c.ingresses, o)
+			case *corev1.Secret:
+				c.secrets = append(c.secrets, o)
+			default:
+				panic(fmt.Sprintf("Unknown runtime object %+v %T", o, o))
+			}
+		}
+	}
+
+	return c
+}
+
+func (c clientMock) GetIngressRoutes() []*v1alpha1.IngressRoute {
+	return c.ingressRoutes
+}
+
+func (c clientMock) GetMiddlewares() []*v1alpha1.Middleware {
+	return c.middlewares
+}
+
+func (c clientMock) GetIngresses() []*extensionsv1beta1.Ingress {
+	return c.ingresses
+}
+
+func (c clientMock) GetService(namespace, name string) (*corev1.Service, bool, error) {
+	if c.apiServiceError != nil {
+		return nil, false, c.apiServiceError
+	}
+
+	for _, service := range c.services {
+		if service.Namespace == namespace && service.Name == name {
+			return service, true, nil
+		}
+	}
+	return nil, false, c.apiServiceError
+}
+
+func (c clientMock) GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error) {
+	if c.apiEndpointsError != nil {
+		return nil, false, c.apiEndpointsError
+	}
+
+	for _, endpoints := range c.endpoints {
+		if endpoints.Namespace == namespace && endpoints.Name == name {
+			return endpoints, true, nil
+		}
+	}
+
+	return &corev1.Endpoints{}, false, nil
+}
+
+func (c clientMock) GetSecret(namespace, name string) (*corev1.Secret, bool, error) {
+	if c.apiSecretError != nil {
+		return nil, false, c.apiSecretError
+	}
+
+	for _, secret := range c.secrets {
+		if secret.Namespace == namespace && secret.Name == name {
+			return secret, true, nil
+		}
+	}
+	return nil, false, nil
+}
+
+func (c clientMock) WatchAll(namespaces k8s.Namespaces, stopCh <-chan struct{}) (<-chan interface{}, error) {
+	return c.watchChan, nil
+}
+
+func (c clientMock) UpdateIngressStatus(namespace, name, ip, hostname string) error {
+	return c.apiIngressStatusError
+}

pkg/provider/kubernetes/crd/fixtures/services.yml

@@ -0,0 +1,88 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami
+  namespace: default
+
+spec:
+  ports:
+    - name: web
+      port: 80
+  selector:
+    app: containous
+    task: whoami
+
+---
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: whoami
+  namespace: default
+
+subsets:
+  - addresses:
+      - ip: 10.10.0.1
+      - ip: 10.10.0.2
+    ports:
+      - name: web
+        port: 80
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami2
+  namespace: default
+
+spec:
+  ports:
+    - name: web
+      port: 8080
+  selector:
+    app: containous
+    task: whoami2
+
+---
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: whoami2
+  namespace: default
+
+subsets:
+  - addresses:
+      - ip: 10.10.0.3
+      - ip: 10.10.0.4
+    ports:
+      - name: web
+        port: 8080
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoamitls
+  namespace: default
+
+spec:
+  ports:
+    - name: web-secure
+      port: 443
+  selector:
+    app: containous
+    task: whoami2
+
+---
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: whoamitls
+  namespace: default
+
+subsets:
+  - addresses:
+      - ip: 10.10.0.5
+      - ip: 10.10.0.6
+    ports:
+      - name: web-secure
+        port: 443

pkg/provider/kubernetes/crd/fixtures/simple.yml

@@ -0,0 +1,17 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - foo
+
+  routes:
+  - match: Host(`foo.com`) && PathPrefix(`/bar`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoami
+      port: 80

pkg/provider/kubernetes/crd/fixtures/with_bad_host_rule.yml

@@ -0,0 +1,17 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+  - match: Host(`foo.com"0"`) && PathPrefix(`/bar`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoami
+      port: 80

pkg/provider/kubernetes/crd/fixtures/with_https_default.yml

@@ -0,0 +1,17 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - foo
+
+  routes:
+  - match: Host(`foo.com`) && PathPrefix(`/bar`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoamitls
+      port: 443

pkg/provider/kubernetes/crd/fixtures/with_middleware.yml

@@ -0,0 +1,44 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: stripprefix
+  namespace: default
+
+spec:
+  stripPrefix:
+    prefixes:
+      - /tobestripped
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: addprefix
+  namespace: foo
+
+spec:
+  addPrefix:
+    prefix: /tobeadded
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test2.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+    - match: Host(`foo.com`) && PathPrefix(`/tobestripped`)
+      priority: 12
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80
+      middlewares:
+        - name: stripprefix
+        - name: addprefix
+          namespace: foo

pkg/provider/kubernetes/crd/fixtures/with_no_rule_value.yml

@@ -0,0 +1,17 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+  - match: ""
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoami
+      port: 80

pkg/provider/kubernetes/crd/fixtures/with_tls.yml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: supersecret
+  namespace: default
+
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+  - match: Host(`foo.com`) && PathPrefix(`/bar`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoami
+      port: 80
+
+  tls:
+    secretName: supersecret

pkg/provider/kubernetes/crd/fixtures/with_two_rules.yml

@@ -0,0 +1,23 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+  - match: Host(`foo.com`) && PathPrefix(`/foo`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoami
+      port: 80
+  - match: Host(`foo.com`) && PathPrefix(`/bar`)
+    kind: Rule
+    priority: 14
+    services:
+    - name: whoami
+      port: 80

pkg/provider/kubernetes/crd/fixtures/with_two_services.yml

@@ -0,0 +1,20 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+  - match: Host(`foo.com`) && PathPrefix(`/foo`)
+    kind: Rule
+    priority: 12
+    services:
+    - name: whoami
+      port: 80
+    - name: whoami2
+      port: 8080
+

pkg/provider/kubernetes/crd/fixtures/with_wrong_rule_kind.yml

@@ -0,0 +1,16 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+  - match: /prefix
+    priority: 12
+    services:
+    - name: whoami
+      port: 80

pkg/provider/kubernetes/crd/generated/clientset/versioned/clientset.go

@@ -0,0 +1,106 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	traefikv1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1"
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterface
+	TraefikV1alpha1() traefikv1alpha1.TraefikV1alpha1Interface
+	// Deprecated: please explicitly pick a version if possible.
+	Traefik() traefikv1alpha1.TraefikV1alpha1Interface
+}
+
+// Clientset contains the clients for groups. Each group has exactly one
+// version included in a Clientset.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	traefikV1alpha1 *traefikv1alpha1.TraefikV1alpha1Client
+}
+
+// TraefikV1alpha1 retrieves the TraefikV1alpha1Client
+func (c *Clientset) TraefikV1alpha1() traefikv1alpha1.TraefikV1alpha1Interface {
+	return c.traefikV1alpha1
+}
+
+// Deprecated: Traefik retrieves the default version of TraefikClient.
+// Please explicitly pick a version.
+func (c *Clientset) Traefik() traefikv1alpha1.TraefikV1alpha1Interface {
+	return c.traefikV1alpha1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+	var cs Clientset
+	var err error
+	cs.traefikV1alpha1, err = traefikv1alpha1.NewForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	var cs Clientset
+	cs.traefikV1alpha1 = traefikv1alpha1.NewForConfigOrDie(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
+	return &cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.traefikV1alpha1 = traefikv1alpha1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/doc.go

@@ -0,0 +1,28 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated clientset.
+package versioned

pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/clientset_generated.go

@@ -0,0 +1,90 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	clientset "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned"
+	traefikv1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1"
+	faketraefikv1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/fake"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	return c.discovery
+}
+
+var _ clientset.Interface = &Clientset{}
+
+// TraefikV1alpha1 retrieves the TraefikV1alpha1Client
+func (c *Clientset) TraefikV1alpha1() traefikv1alpha1.TraefikV1alpha1Interface {
+	return &faketraefikv1alpha1.FakeTraefikV1alpha1{Fake: &c.Fake}
+}
+
+// Traefik retrieves the TraefikV1alpha1Client
+func (c *Clientset) Traefik() traefikv1alpha1.TraefikV1alpha1Interface {
+	return &faketraefikv1alpha1.FakeTraefikV1alpha1{Fake: &c.Fake}
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/doc.go

@@ -0,0 +1,28 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake

pkg/provider/kubernetes/crd/generated/clientset/versioned/fake/register.go

@@ -0,0 +1,62 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	traefikv1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+var parameterCodec = runtime.NewParameterCodec(scheme)
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	AddToScheme(scheme)
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+func AddToScheme(scheme *runtime.Scheme) {
+	traefikv1alpha1.AddToScheme(scheme)
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/doc.go

@@ -0,0 +1,28 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme

pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme/register.go

@@ -0,0 +1,62 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	traefikv1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	AddToScheme(Scheme)
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+func AddToScheme(scheme *runtime.Scheme) {
+	traefikv1alpha1.AddToScheme(scheme)
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/doc.go

@@ -0,0 +1,28 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/fake/doc.go

@@ -0,0 +1,28 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/fake/fake_ingressroute.go

@@ -0,0 +1,136 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeIngressRoutes implements IngressRouteInterface
+type FakeIngressRoutes struct {
+	Fake *FakeTraefikV1alpha1
+	ns   string
+}
+
+var ingressroutesResource = schema.GroupVersionResource{Group: "traefik.containo.us", Version: "v1alpha1", Resource: "ingressroutes"}
+
+var ingressroutesKind = schema.GroupVersionKind{Group: "traefik.containo.us", Version: "v1alpha1", Kind: "IngressRoute"}
+
+// Get takes name of the ingressRoute, and returns the corresponding ingressRoute object, and an error if there is any.
+func (c *FakeIngressRoutes) Get(name string, options v1.GetOptions) (result *v1alpha1.IngressRoute, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(ingressroutesResource, c.ns, name), &v1alpha1.IngressRoute{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.IngressRoute), err
+}
+
+// List takes label and field selectors, and returns the list of IngressRoutes that match those selectors.
+func (c *FakeIngressRoutes) List(opts v1.ListOptions) (result *v1alpha1.IngressRouteList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(ingressroutesResource, ingressroutesKind, c.ns, opts), &v1alpha1.IngressRouteList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.IngressRouteList{ListMeta: obj.(*v1alpha1.IngressRouteList).ListMeta}
+	for _, item := range obj.(*v1alpha1.IngressRouteList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested ingressRoutes.
+func (c *FakeIngressRoutes) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(ingressroutesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a ingressRoute and creates it.  Returns the server's representation of the ingressRoute, and an error, if there is any.
+func (c *FakeIngressRoutes) Create(ingressRoute *v1alpha1.IngressRoute) (result *v1alpha1.IngressRoute, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(ingressroutesResource, c.ns, ingressRoute), &v1alpha1.IngressRoute{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.IngressRoute), err
+}
+
+// Update takes the representation of a ingressRoute and updates it. Returns the server's representation of the ingressRoute, and an error, if there is any.
+func (c *FakeIngressRoutes) Update(ingressRoute *v1alpha1.IngressRoute) (result *v1alpha1.IngressRoute, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(ingressroutesResource, c.ns, ingressRoute), &v1alpha1.IngressRoute{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.IngressRoute), err
+}
+
+// Delete takes name of the ingressRoute and deletes it. Returns an error if one occurs.
+func (c *FakeIngressRoutes) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(ingressroutesResource, c.ns, name), &v1alpha1.IngressRoute{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeIngressRoutes) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(ingressroutesResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.IngressRouteList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched ingressRoute.
+func (c *FakeIngressRoutes) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.IngressRoute, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(ingressroutesResource, c.ns, name, data, subresources...), &v1alpha1.IngressRoute{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.IngressRoute), err
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/fake/fake_middleware.go

@@ -0,0 +1,136 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeMiddlewares implements MiddlewareInterface
+type FakeMiddlewares struct {
+	Fake *FakeTraefikV1alpha1
+	ns   string
+}
+
+var middlewaresResource = schema.GroupVersionResource{Group: "traefik.containo.us", Version: "v1alpha1", Resource: "middlewares"}
+
+var middlewaresKind = schema.GroupVersionKind{Group: "traefik.containo.us", Version: "v1alpha1", Kind: "Middleware"}
+
+// Get takes name of the middleware, and returns the corresponding middleware object, and an error if there is any.
+func (c *FakeMiddlewares) Get(name string, options v1.GetOptions) (result *v1alpha1.Middleware, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(middlewaresResource, c.ns, name), &v1alpha1.Middleware{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.Middleware), err
+}
+
+// List takes label and field selectors, and returns the list of Middlewares that match those selectors.
+func (c *FakeMiddlewares) List(opts v1.ListOptions) (result *v1alpha1.MiddlewareList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(middlewaresResource, middlewaresKind, c.ns, opts), &v1alpha1.MiddlewareList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha1.MiddlewareList{ListMeta: obj.(*v1alpha1.MiddlewareList).ListMeta}
+	for _, item := range obj.(*v1alpha1.MiddlewareList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested middlewares.
+func (c *FakeMiddlewares) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(middlewaresResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a middleware and creates it.  Returns the server's representation of the middleware, and an error, if there is any.
+func (c *FakeMiddlewares) Create(middleware *v1alpha1.Middleware) (result *v1alpha1.Middleware, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(middlewaresResource, c.ns, middleware), &v1alpha1.Middleware{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.Middleware), err
+}
+
+// Update takes the representation of a middleware and updates it. Returns the server's representation of the middleware, and an error, if there is any.
+func (c *FakeMiddlewares) Update(middleware *v1alpha1.Middleware) (result *v1alpha1.Middleware, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(middlewaresResource, c.ns, middleware), &v1alpha1.Middleware{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.Middleware), err
+}
+
+// Delete takes name of the middleware and deletes it. Returns an error if one occurs.
+func (c *FakeMiddlewares) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(middlewaresResource, c.ns, name), &v1alpha1.Middleware{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeMiddlewares) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(middlewaresResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha1.MiddlewareList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched middleware.
+func (c *FakeMiddlewares) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.Middleware, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(middlewaresResource, c.ns, name, data, subresources...), &v1alpha1.Middleware{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.Middleware), err
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/fake/fake_traefik_client.go

@@ -0,0 +1,52 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeTraefikV1alpha1 struct {
+	*testing.Fake
+}
+
+func (c *FakeTraefikV1alpha1) IngressRoutes(namespace string) v1alpha1.IngressRouteInterface {
+	return &FakeIngressRoutes{c, namespace}
+}
+
+func (c *FakeTraefikV1alpha1) Middlewares(namespace string) v1alpha1.MiddlewareInterface {
+	return &FakeMiddlewares{c, namespace}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeTraefikV1alpha1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/generated_expansion.go

@@ -0,0 +1,31 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type IngressRouteExpansion interface{}
+
+type MiddlewareExpansion interface{}

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/ingressroute.go

@@ -0,0 +1,165 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	scheme "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// IngressRoutesGetter has a method to return a IngressRouteInterface.
+// A group's client should implement this interface.
+type IngressRoutesGetter interface {
+	IngressRoutes(namespace string) IngressRouteInterface
+}
+
+// IngressRouteInterface has methods to work with IngressRoute resources.
+type IngressRouteInterface interface {
+	Create(*v1alpha1.IngressRoute) (*v1alpha1.IngressRoute, error)
+	Update(*v1alpha1.IngressRoute) (*v1alpha1.IngressRoute, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha1.IngressRoute, error)
+	List(opts v1.ListOptions) (*v1alpha1.IngressRouteList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.IngressRoute, err error)
+	IngressRouteExpansion
+}
+
+// ingressRoutes implements IngressRouteInterface
+type ingressRoutes struct {
+	client rest.Interface
+	ns     string
+}
+
+// newIngressRoutes returns a IngressRoutes
+func newIngressRoutes(c *TraefikV1alpha1Client, namespace string) *ingressRoutes {
+	return &ingressRoutes{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the ingressRoute, and returns the corresponding ingressRoute object, and an error if there is any.
+func (c *ingressRoutes) Get(name string, options v1.GetOptions) (result *v1alpha1.IngressRoute, err error) {
+	result = &v1alpha1.IngressRoute{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of IngressRoutes that match those selectors.
+func (c *ingressRoutes) List(opts v1.ListOptions) (result *v1alpha1.IngressRouteList, err error) {
+	result = &v1alpha1.IngressRouteList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested ingressRoutes.
+func (c *ingressRoutes) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Create takes the representation of a ingressRoute and creates it.  Returns the server's representation of the ingressRoute, and an error, if there is any.
+func (c *ingressRoutes) Create(ingressRoute *v1alpha1.IngressRoute) (result *v1alpha1.IngressRoute, err error) {
+	result = &v1alpha1.IngressRoute{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		Body(ingressRoute).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a ingressRoute and updates it. Returns the server's representation of the ingressRoute, and an error, if there is any.
+func (c *ingressRoutes) Update(ingressRoute *v1alpha1.IngressRoute) (result *v1alpha1.IngressRoute, err error) {
+	result = &v1alpha1.IngressRoute{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		Name(ingressRoute.Name).
+		Body(ingressRoute).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the ingressRoute and deletes it. Returns an error if one occurs.
+func (c *ingressRoutes) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *ingressRoutes) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched ingressRoute.
+func (c *ingressRoutes) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.IngressRoute, err error) {
+	result = &v1alpha1.IngressRoute{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("ingressroutes").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/middleware.go

@@ -0,0 +1,165 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	scheme "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// MiddlewaresGetter has a method to return a MiddlewareInterface.
+// A group's client should implement this interface.
+type MiddlewaresGetter interface {
+	Middlewares(namespace string) MiddlewareInterface
+}
+
+// MiddlewareInterface has methods to work with Middleware resources.
+type MiddlewareInterface interface {
+	Create(*v1alpha1.Middleware) (*v1alpha1.Middleware, error)
+	Update(*v1alpha1.Middleware) (*v1alpha1.Middleware, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha1.Middleware, error)
+	List(opts v1.ListOptions) (*v1alpha1.MiddlewareList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.Middleware, err error)
+	MiddlewareExpansion
+}
+
+// middlewares implements MiddlewareInterface
+type middlewares struct {
+	client rest.Interface
+	ns     string
+}
+
+// newMiddlewares returns a Middlewares
+func newMiddlewares(c *TraefikV1alpha1Client, namespace string) *middlewares {
+	return &middlewares{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the middleware, and returns the corresponding middleware object, and an error if there is any.
+func (c *middlewares) Get(name string, options v1.GetOptions) (result *v1alpha1.Middleware, err error) {
+	result = &v1alpha1.Middleware{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("middlewares").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Middlewares that match those selectors.
+func (c *middlewares) List(opts v1.ListOptions) (result *v1alpha1.MiddlewareList, err error) {
+	result = &v1alpha1.MiddlewareList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("middlewares").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested middlewares.
+func (c *middlewares) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("middlewares").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Create takes the representation of a middleware and creates it.  Returns the server's representation of the middleware, and an error, if there is any.
+func (c *middlewares) Create(middleware *v1alpha1.Middleware) (result *v1alpha1.Middleware, err error) {
+	result = &v1alpha1.Middleware{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("middlewares").
+		Body(middleware).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a middleware and updates it. Returns the server's representation of the middleware, and an error, if there is any.
+func (c *middlewares) Update(middleware *v1alpha1.Middleware) (result *v1alpha1.Middleware, err error) {
+	result = &v1alpha1.Middleware{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("middlewares").
+		Name(middleware.Name).
+		Body(middleware).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the middleware and deletes it. Returns an error if one occurs.
+func (c *middlewares) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("middlewares").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *middlewares) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("middlewares").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched middleware.
+func (c *middlewares) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.Middleware, err error) {
+	result = &v1alpha1.Middleware{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("middlewares").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/provider/kubernetes/crd/generated/clientset/versioned/typed/traefik/v1alpha1/traefik_client.go

@@ -0,0 +1,103 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme"
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	rest "k8s.io/client-go/rest"
+)
+
+type TraefikV1alpha1Interface interface {
+	RESTClient() rest.Interface
+	IngressRoutesGetter
+	MiddlewaresGetter
+}
+
+// TraefikV1alpha1Client is used to interact with features provided by the traefik.containo.us group.
+type TraefikV1alpha1Client struct {
+	restClient rest.Interface
+}
+
+func (c *TraefikV1alpha1Client) IngressRoutes(namespace string) IngressRouteInterface {
+	return newIngressRoutes(c, namespace)
+}
+
+func (c *TraefikV1alpha1Client) Middlewares(namespace string) MiddlewareInterface {
+	return newMiddlewares(c, namespace)
+}
+
+// NewForConfig creates a new TraefikV1alpha1Client for the given config.
+func NewForConfig(c *rest.Config) (*TraefikV1alpha1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return &TraefikV1alpha1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new TraefikV1alpha1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *TraefikV1alpha1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new TraefikV1alpha1Client for the given RESTClient.
+func New(c rest.Interface) *TraefikV1alpha1Client {
+	return &TraefikV1alpha1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: scheme.Codecs}
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *TraefikV1alpha1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

pkg/provider/kubernetes/crd/generated/informers/externalversions/factory.go

@@ -0,0 +1,188 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	versioned "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned"
+	internalinterfaces "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
+	traefik "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefik"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+// Start initializes all requested informers.
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			go informer.Run(stopCh)
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+// WaitForCacheSync waits for all started informers' cache were synced.
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	res := map[reflect.Type]bool{}
+	for informType, informer := range informers {
+		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
+	}
+	return res
+}
+
+// InternalInformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	Traefik() traefik.Interface
+}
+
+func (f *sharedInformerFactory) Traefik() traefik.Interface {
+	return traefik.New(f, f.namespace, f.tweakListOptions)
+}

pkg/provider/kubernetes/crd/generated/informers/externalversions/generic.go

@@ -0,0 +1,72 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	"fmt"
+
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=traefik.containo.us, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithResource("ingressroutes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Traefik().V1alpha1().IngressRoutes().Informer()}, nil
+	case v1alpha1.SchemeGroupVersion.WithResource("middlewares"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Traefik().V1alpha1().Middlewares().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}

pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces/factory_interfaces.go

@@ -0,0 +1,46 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	versioned "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+}
+
+type TweakListOptionsFunc func(*v1.ListOptions)

pkg/provider/kubernetes/crd/generated/informers/externalversions/traefik/interface.go

@@ -0,0 +1,54 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package traefik
+
+import (
+	internalinterfaces "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions/traefik/v1alpha1"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() v1alpha1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha1 returns a new v1alpha1.Interface.
+func (g *group) V1alpha1() v1alpha1.Interface {
+	return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions)
+}

pkg/provider/kubernetes/crd/generated/informers/externalversions/traefik/v1alpha1/ingressroute.go

@@ -0,0 +1,97 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	time "time"
+
+	versioned "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned"
+	internalinterfaces "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/listers/traefik/v1alpha1"
+	traefikv1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// IngressRouteInformer provides access to a shared informer and lister for
+// IngressRoutes.
+type IngressRouteInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.IngressRouteLister
+}
+
+type ingressRouteInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewIngressRouteInformer constructs a new informer for IngressRoute type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewIngressRouteInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredIngressRouteInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredIngressRouteInformer constructs a new informer for IngressRoute type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredIngressRouteInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRoutes(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().IngressRoutes(namespace).Watch(options)
+			},
+		},
+		&traefikv1alpha1.IngressRoute{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *ingressRouteInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredIngressRouteInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *ingressRouteInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&traefikv1alpha1.IngressRoute{}, f.defaultInformer)
+}
+
+func (f *ingressRouteInformer) Lister() v1alpha1.IngressRouteLister {
+	return v1alpha1.NewIngressRouteLister(f.Informer().GetIndexer())
+}

pkg/provider/kubernetes/crd/generated/informers/externalversions/traefik/v1alpha1/interface.go

@@ -0,0 +1,60 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	internalinterfaces "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// IngressRoutes returns a IngressRouteInformer.
+	IngressRoutes() IngressRouteInformer
+	// Middlewares returns a MiddlewareInformer.
+	Middlewares() MiddlewareInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// IngressRoutes returns a IngressRouteInformer.
+func (v *version) IngressRoutes() IngressRouteInformer {
+	return &ingressRouteInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// Middlewares returns a MiddlewareInformer.
+func (v *version) Middlewares() MiddlewareInformer {
+	return &middlewareInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}

pkg/provider/kubernetes/crd/generated/informers/externalversions/traefik/v1alpha1/middleware.go

@@ -0,0 +1,97 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	time "time"
+
+	versioned "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/clientset/versioned"
+	internalinterfaces "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/informers/externalversions/internalinterfaces"
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/generated/listers/traefik/v1alpha1"
+	traefikv1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// MiddlewareInformer provides access to a shared informer and lister for
+// Middlewares.
+type MiddlewareInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.MiddlewareLister
+}
+
+type middlewareInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewMiddlewareInformer constructs a new informer for Middleware type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewMiddlewareInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredMiddlewareInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredMiddlewareInformer constructs a new informer for Middleware type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredMiddlewareInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().Middlewares(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.TraefikV1alpha1().Middlewares(namespace).Watch(options)
+			},
+		},
+		&traefikv1alpha1.Middleware{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *middlewareInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredMiddlewareInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *middlewareInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&traefikv1alpha1.Middleware{}, f.defaultInformer)
+}
+
+func (f *middlewareInformer) Lister() v1alpha1.MiddlewareLister {
+	return v1alpha1.NewMiddlewareLister(f.Informer().GetIndexer())
+}

pkg/provider/kubernetes/crd/generated/listers/traefik/v1alpha1/expansion_generated.go

@@ -0,0 +1,43 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// IngressRouteListerExpansion allows custom methods to be added to
+// IngressRouteLister.
+type IngressRouteListerExpansion interface{}
+
+// IngressRouteNamespaceListerExpansion allows custom methods to be added to
+// IngressRouteNamespaceLister.
+type IngressRouteNamespaceListerExpansion interface{}
+
+// MiddlewareListerExpansion allows custom methods to be added to
+// MiddlewareLister.
+type MiddlewareListerExpansion interface{}
+
+// MiddlewareNamespaceListerExpansion allows custom methods to be added to
+// MiddlewareNamespaceLister.
+type MiddlewareNamespaceListerExpansion interface{}

pkg/provider/kubernetes/crd/generated/listers/traefik/v1alpha1/ingressroute.go

@@ -0,0 +1,102 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// IngressRouteLister helps list IngressRoutes.
+type IngressRouteLister interface {
+	// List lists all IngressRoutes in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error)
+	// IngressRoutes returns an object that can list and get IngressRoutes.
+	IngressRoutes(namespace string) IngressRouteNamespaceLister
+	IngressRouteListerExpansion
+}
+
+// ingressRouteLister implements the IngressRouteLister interface.
+type ingressRouteLister struct {
+	indexer cache.Indexer
+}
+
+// NewIngressRouteLister returns a new IngressRouteLister.
+func NewIngressRouteLister(indexer cache.Indexer) IngressRouteLister {
+	return &ingressRouteLister{indexer: indexer}
+}
+
+// List lists all IngressRoutes in the indexer.
+func (s *ingressRouteLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.IngressRoute))
+	})
+	return ret, err
+}
+
+// IngressRoutes returns an object that can list and get IngressRoutes.
+func (s *ingressRouteLister) IngressRoutes(namespace string) IngressRouteNamespaceLister {
+	return ingressRouteNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// IngressRouteNamespaceLister helps list and get IngressRoutes.
+type IngressRouteNamespaceLister interface {
+	// List lists all IngressRoutes in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error)
+	// Get retrieves the IngressRoute from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha1.IngressRoute, error)
+	IngressRouteNamespaceListerExpansion
+}
+
+// ingressRouteNamespaceLister implements the IngressRouteNamespaceLister
+// interface.
+type ingressRouteNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all IngressRoutes in the indexer for a given namespace.
+func (s ingressRouteNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.IngressRoute, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.IngressRoute))
+	})
+	return ret, err
+}
+
+// Get retrieves the IngressRoute from the indexer for a given namespace and name.
+func (s ingressRouteNamespaceLister) Get(name string) (*v1alpha1.IngressRoute, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha1.Resource("ingressroute"), name)
+	}
+	return obj.(*v1alpha1.IngressRoute), nil
+}

pkg/provider/kubernetes/crd/generated/listers/traefik/v1alpha1/middleware.go

@@ -0,0 +1,102 @@
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// MiddlewareLister helps list Middlewares.
+type MiddlewareLister interface {
+	// List lists all Middlewares in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error)
+	// Middlewares returns an object that can list and get Middlewares.
+	Middlewares(namespace string) MiddlewareNamespaceLister
+	MiddlewareListerExpansion
+}
+
+// middlewareLister implements the MiddlewareLister interface.
+type middlewareLister struct {
+	indexer cache.Indexer
+}
+
+// NewMiddlewareLister returns a new MiddlewareLister.
+func NewMiddlewareLister(indexer cache.Indexer) MiddlewareLister {
+	return &middlewareLister{indexer: indexer}
+}
+
+// List lists all Middlewares in the indexer.
+func (s *middlewareLister) List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.Middleware))
+	})
+	return ret, err
+}
+
+// Middlewares returns an object that can list and get Middlewares.
+func (s *middlewareLister) Middlewares(namespace string) MiddlewareNamespaceLister {
+	return middlewareNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// MiddlewareNamespaceLister helps list and get Middlewares.
+type MiddlewareNamespaceLister interface {
+	// List lists all Middlewares in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error)
+	// Get retrieves the Middleware from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha1.Middleware, error)
+	MiddlewareNamespaceListerExpansion
+}
+
+// middlewareNamespaceLister implements the MiddlewareNamespaceLister
+// interface.
+type middlewareNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Middlewares in the indexer for a given namespace.
+func (s middlewareNamespaceLister) List(selector labels.Selector) (ret []*v1alpha1.Middleware, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha1.Middleware))
+	})
+	return ret, err
+}
+
+// Get retrieves the Middleware from the indexer for a given namespace and name.
+func (s middlewareNamespaceLister) Get(name string) (*v1alpha1.Middleware, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha1.Resource("middleware"), name)
+	}
+	return obj.(*v1alpha1.Middleware), nil
+}

pkg/provider/kubernetes/crd/kubernetes.go

@@ -0,0 +1,458 @@
+package crd
+
+import (
+	"context"
+	"crypto/sha256"
+	"flag"
+	"fmt"
+	"os"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/job"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/provider"
+	"github.com/containous/traefik/pkg/provider/kubernetes/crd/traefik/v1alpha1"
+	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/containous/traefik/pkg/tls"
+	"github.com/pkg/errors"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+const (
+	annotationKubernetesIngressClass = "kubernetes.io/ingress.class"
+	traefikDefaultIngressClass       = "traefik"
+)
+
+// IngressEndpoint holds the endpoint information for the Kubernetes provider.
+type IngressEndpoint struct {
+	IP               string `description:"IP used for Kubernetes Ingress endpoints"`
+	Hostname         string `description:"Hostname used for Kubernetes Ingress endpoints"`
+	PublishedService string `description:"Published Kubernetes Service to copy status from"`
+}
+
+// Provider holds configurations of the provider.
+type Provider struct {
+	provider.BaseProvider  `mapstructure:",squash" export:"true"`
+	Endpoint               string           `description:"Kubernetes server endpoint (required for external cluster client)"`
+	Token                  string           `description:"Kubernetes bearer token (not needed for in-cluster client)"`
+	CertAuthFilePath       string           `description:"Kubernetes certificate authority file path (not needed for in-cluster client)"`
+	DisablePassHostHeaders bool             `description:"Kubernetes disable PassHost Headers" export:"true"`
+	EnablePassTLSCert      bool             `description:"Kubernetes enable Pass TLS Client Certs" export:"true"` // Deprecated
+	Namespaces             k8s.Namespaces   `description:"Kubernetes namespaces" export:"true"`
+	LabelSelector          string           `description:"Kubernetes Ingress label selector to use" export:"true"`
+	IngressClass           string           `description:"Value of kubernetes.io/ingress.class annotation to watch for" export:"true"`
+	IngressEndpoint        *IngressEndpoint `description:"Kubernetes Ingress Endpoint"`
+	lastConfiguration      safe.Safe
+}
+
+func (p *Provider) newK8sClient(ctx context.Context, ingressLabelSelector string) (*clientWrapper, error) {
+	ingLabelSel, err := labels.Parse(ingressLabelSelector)
+	if err != nil {
+		return nil, fmt.Errorf("invalid ingress label selector: %q", ingressLabelSelector)
+	}
+	log.FromContext(ctx).Infof("ingress label selector is: %q", ingLabelSel)
+
+	withEndpoint := ""
+	if p.Endpoint != "" {
+		withEndpoint = fmt.Sprintf(" with endpoint %v", p.Endpoint)
+	}
+
+	var client *clientWrapper
+	switch {
+	case os.Getenv("KUBERNETES_SERVICE_HOST") != "" && os.Getenv("KUBERNETES_SERVICE_PORT") != "":
+		log.FromContext(ctx).Infof("Creating in-cluster Provider client%s", withEndpoint)
+		client, err = newInClusterClient(p.Endpoint)
+	case os.Getenv("KUBECONFIG") != "":
+		log.FromContext(ctx).Infof("Creating cluster-external Provider client from KUBECONFIG %s", os.Getenv("KUBECONFIG"))
+		client, err = newExternalClusterClientFromFile(os.Getenv("KUBECONFIG"))
+	default:
+		log.FromContext(ctx).Infof("Creating cluster-external Provider client%s", withEndpoint)
+		client, err = newExternalClusterClient(p.Endpoint, p.Token, p.CertAuthFilePath)
+	}
+
+	if err == nil {
+		client.ingressLabelSelector = ingLabelSel
+	}
+
+	return client, err
+}
+
+// Init the provider.
+func (p *Provider) Init() error {
+	return p.BaseProvider.Init()
+}
+
+// Provide allows the k8s provider to provide configurations to traefik
+// using the given configuration channel.
+func (p *Provider) Provide(configurationChan chan<- config.Message, pool *safe.Pool) error {
+	ctxLog := log.With(context.Background(), log.Str(log.ProviderName, "kubernetescrd"))
+	logger := log.FromContext(ctxLog)
+	// Tell glog (used by client-go) to log into STDERR. Otherwise, we risk
+	// certain kinds of API errors getting logged into a directory not
+	// available in a `FROM scratch` Docker container, causing glog to abort
+	// hard with an exit code > 0.
+	err := flag.Set("logtostderr", "true")
+	if err != nil {
+		return err
+	}
+
+	logger.Debugf("Using Ingress label selector: %q", p.LabelSelector)
+	k8sClient, err := p.newK8sClient(ctxLog, p.LabelSelector)
+	if err != nil {
+		return err
+	}
+
+	pool.Go(func(stop chan bool) {
+		operation := func() error {
+			stopWatch := make(chan struct{}, 1)
+			defer close(stopWatch)
+			eventsChan, err := k8sClient.WatchAll(p.Namespaces, stopWatch)
+			if err != nil {
+				logger.Errorf("Error watching kubernetes events: %v", err)
+				timer := time.NewTimer(1 * time.Second)
+				select {
+				case <-timer.C:
+					return err
+				case <-stop:
+					return nil
+				}
+			}
+			for {
+				select {
+				case <-stop:
+					return nil
+				case event := <-eventsChan:
+					conf := p.loadConfigurationFromIngresses(ctxLog, k8sClient)
+
+					if reflect.DeepEqual(p.lastConfiguration.Get(), conf) {
+						logger.Debugf("Skipping Kubernetes event kind %T", event)
+					} else {
+						p.lastConfiguration.Set(conf)
+						configurationChan <- config.Message{
+							ProviderName:  "kubernetescrd",
+							Configuration: conf,
+						}
+					}
+				}
+			}
+		}
+
+		notify := func(err error, time time.Duration) {
+			logger.Errorf("Provider connection error: %s; retrying in %s", err, time)
+		}
+		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
+		if err != nil {
+			logger.Errorf("Cannot connect to Provider: %s", err)
+		}
+	})
+
+	return nil
+}
+
+func checkStringQuoteValidity(value string) error {
+	_, err := strconv.Unquote(`"` + value + `"`)
+	return err
+}
+
+func loadServers(client Client, namespace string, svc v1alpha1.Service) ([]config.Server, error) {
+	strategy := svc.Strategy
+	if strategy == "" {
+		strategy = "RoundRobin"
+	}
+	if strategy != "RoundRobin" {
+		return nil, fmt.Errorf("load balancing strategy %v is not supported", strategy)
+	}
+
+	service, exists, err := client.GetService(namespace, svc.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	if !exists {
+		return nil, errors.New("service not found")
+	}
+
+	var portSpec corev1.ServicePort
+	var match bool
+	// TODO: support name ports? do we actually care?
+	for _, p := range service.Spec.Ports {
+		if svc.Port == p.Port {
+			portSpec = p
+			match = true
+			break
+		}
+	}
+
+	if !match {
+		return nil, errors.New("service port not found")
+	}
+
+	var servers []config.Server
+	if service.Spec.Type == corev1.ServiceTypeExternalName {
+		servers = append(servers, config.Server{
+			URL:    fmt.Sprintf("http://%s:%d", service.Spec.ExternalName, portSpec.Port),
+			Weight: 1,
+		})
+	} else {
+		endpoints, endpointsExists, endpointsErr := client.GetEndpoints(namespace, svc.Name)
+		if endpointsErr != nil {
+			return nil, endpointsErr
+		}
+
+		if !endpointsExists {
+			return nil, errors.New("endpoints not found")
+		}
+
+		if len(endpoints.Subsets) == 0 {
+			return nil, errors.New("subset not found")
+		}
+
+		var port int32
+		for _, subset := range endpoints.Subsets {
+			for _, p := range subset.Ports {
+				if portSpec.Name == p.Name {
+					port = p.Port
+					break
+				}
+			}
+
+			if port == 0 {
+				return nil, errors.New("cannot define a port")
+			}
+
+			protocol := "http"
+			if port == 443 || strings.HasPrefix(portSpec.Name, "https") {
+				protocol = "https"
+			}
+
+			for _, addr := range subset.Addresses {
+				servers = append(servers, config.Server{
+					URL:    fmt.Sprintf("%s://%s:%d", protocol, addr.IP, port),
+					Weight: 1,
+				})
+			}
+		}
+	}
+
+	return servers, nil
+}
+
+func (p *Provider) loadConfigurationFromIngresses(ctx context.Context, client Client) *config.Configuration {
+
+	conf := &config.Configuration{
+		HTTP: &config.HTTPConfiguration{
+			Routers:     map[string]*config.Router{},
+			Middlewares: map[string]*config.Middleware{},
+			Services:    map[string]*config.Service{},
+		},
+		TCP: &config.TCPConfiguration{},
+	}
+	tlsConfigs := make(map[string]*tls.Configuration)
+
+	for _, ingressRoute := range client.GetIngressRoutes() {
+		logger := log.FromContext(log.With(ctx, log.Str("ingress", ingressRoute.Name), log.Str("namespace", ingressRoute.Namespace)))
+
+		// TODO keep the name ingressClass?
+		if !shouldProcessIngress(p.IngressClass, ingressRoute.Annotations[annotationKubernetesIngressClass]) {
+			continue
+		}
+
+		err := getTLS(ctx, ingressRoute, client, tlsConfigs)
+		if err != nil {
+			logger.Errorf("Error configuring TLS: %v", err)
+		}
+
+		ingressName := ingressRoute.Name
+		if len(ingressName) == 0 {
+			ingressName = ingressRoute.GenerateName
+		}
+
+		for _, route := range ingressRoute.Spec.Routes {
+			if route.Kind != "Rule" {
+				logger.Errorf("Unsupported match kind: %s. Only \"Rule\" is supported for now.", route.Kind)
+				continue
+			}
+
+			if len(route.Match) == 0 {
+				logger.Errorf("Empty match rule")
+				continue
+			}
+
+			if err := checkStringQuoteValidity(route.Match); err != nil {
+				logger.Errorf("Invalid syntax for match rule: %s", route.Match)
+				continue
+			}
+
+			var allServers []config.Server
+			for _, service := range route.Services {
+				servers, err := loadServers(client, ingressRoute.Namespace, service)
+				if err != nil {
+					logger.
+						WithField("serviceName", service.Name).
+						WithField("servicePort", service.Port).
+						Errorf("Cannot create service: %v", err)
+					continue
+				}
+
+				allServers = append(allServers, servers...)
+			}
+
+			// TODO: support middlewares from other providers.
+			// Mechanism: in the spec, prefix the name with the provider name,
+			// with dot as the separator. In which case. we ignore the
+			// namespace.
+
+			var mds []string
+			for _, mi := range route.Middlewares {
+				ns := mi.Namespace
+				if len(ns) == 0 {
+					ns = ingressRoute.Namespace
+				}
+				mds = append(mds, makeID(ns, mi.Name))
+			}
+
+			h := sha256.New()
+			_, err = h.Write([]byte(route.Match))
+			if err != nil {
+				logger.Error(err)
+				continue
+			}
+			key := fmt.Sprintf("%s-%.10x", ingressName, h.Sum(nil))
+
+			serviceName := makeID(ingressRoute.Namespace, key)
+
+			conf.HTTP.Routers[serviceName] = &config.Router{
+				Middlewares: mds,
+				Priority:    route.Priority,
+				EntryPoints: ingressRoute.Spec.EntryPoints,
+				Rule:        route.Match,
+				Service:     serviceName,
+			}
+			if ingressRoute.Spec.TLS != nil {
+				conf.HTTP.Routers[serviceName].TLS = &config.RouterTLSConfig{}
+			}
+			conf.HTTP.Services[serviceName] = &config.Service{
+				LoadBalancer: &config.LoadBalancerService{
+					Servers: allServers,
+					// TODO: support other strategies.
+					Method:         "wrr",
+					PassHostHeader: true,
+				},
+			}
+		}
+	}
+
+	conf.TLS = getTLSConfig(tlsConfigs)
+
+	for _, middleware := range client.GetMiddlewares() {
+		conf.HTTP.Middlewares[makeID(middleware.Namespace, middleware.Name)] = &middleware.Spec
+	}
+
+	return conf
+}
+
+func makeID(namespace, name string) string {
+	if namespace == "" {
+		return name
+	}
+	return namespace + "/" + name
+}
+
+func shouldProcessIngress(ingressClass string, ingressClassAnnotation string) bool {
+	return ingressClass == ingressClassAnnotation ||
+		(len(ingressClass) == 0 && ingressClassAnnotation == traefikDefaultIngressClass)
+}
+
+func getTLS(ctx context.Context, ingressRoute *v1alpha1.IngressRoute, k8sClient Client, tlsConfigs map[string]*tls.Configuration) error {
+	if ingressRoute.Spec.TLS == nil {
+		return nil
+	}
+	if ingressRoute.Spec.TLS.SecretName == "" {
+		log.FromContext(ctx).Debugf("Skipping TLS sub-section: No secret name provided")
+		return nil
+	}
+
+	configKey := ingressRoute.Namespace + "/" + ingressRoute.Spec.TLS.SecretName
+	if _, tlsExists := tlsConfigs[configKey]; !tlsExists {
+		secret, exists, err := k8sClient.GetSecret(ingressRoute.Namespace, ingressRoute.Spec.TLS.SecretName)
+		if err != nil {
+			return fmt.Errorf("failed to fetch secret %s/%s: %v", ingressRoute.Namespace, ingressRoute.Spec.TLS.SecretName, err)
+		}
+		if !exists {
+			return fmt.Errorf("secret %s/%s does not exist", ingressRoute.Namespace, ingressRoute.Spec.TLS.SecretName)
+		}
+
+		cert, key, err := getCertificateBlocks(secret, ingressRoute.Namespace, ingressRoute.Spec.TLS.SecretName)
+		if err != nil {
+			return err
+		}
+
+		tlsConfigs[configKey] = &tls.Configuration{
+			Certificate: &tls.Certificate{
+				CertFile: tls.FileOrContent(cert),
+				KeyFile:  tls.FileOrContent(key),
+			},
+		}
+	}
+
+	return nil
+}
+
+func getTLSConfig(tlsConfigs map[string]*tls.Configuration) []*tls.Configuration {
+	var secretNames []string
+	for secretName := range tlsConfigs {
+		secretNames = append(secretNames, secretName)
+	}
+	sort.Strings(secretNames)
+
+	var configs []*tls.Configuration
+	for _, secretName := range secretNames {
+		configs = append(configs, tlsConfigs[secretName])
+	}
+
+	return configs
+}
+
+func getCertificateBlocks(secret *corev1.Secret, namespace, secretName string) (string, string, error) {
+	var missingEntries []string
+
+	tlsCrtData, tlsCrtExists := secret.Data["tls.crt"]
+	if !tlsCrtExists {
+		missingEntries = append(missingEntries, "tls.crt")
+	}
+
+	tlsKeyData, tlsKeyExists := secret.Data["tls.key"]
+	if !tlsKeyExists {
+		missingEntries = append(missingEntries, "tls.key")
+	}
+
+	if len(missingEntries) > 0 {
+		return "", "", fmt.Errorf("secret %s/%s is missing the following TLS data entries: %s",
+			namespace, secretName, strings.Join(missingEntries, ", "))
+	}
+
+	cert := string(tlsCrtData)
+	if cert == "" {
+		missingEntries = append(missingEntries, "tls.crt")
+	}
+
+	key := string(tlsKeyData)
+	if key == "" {
+		missingEntries = append(missingEntries, "tls.key")
+	}
+
+	if len(missingEntries) > 0 {
+		return "", "", fmt.Errorf("secret %s/%s contains the following empty TLS data entries: %s",
+			namespace, secretName, strings.Join(missingEntries, ", "))
+	}
+
+	return cert, key, nil
+}

pkg/provider/kubernetes/crd/kubernetes_test.go

@@ -0,0 +1,368 @@
+package crd
+
+import (
+	"context"
+	"testing"
+
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/provider"
+	"github.com/containous/traefik/pkg/tls"
+	"github.com/stretchr/testify/assert"
+)
+
+var _ provider.Provider = (*Provider)(nil)
+
+func TestLoadIngressRoutes(t *testing.T) {
+	testCases := []struct {
+		desc         string
+		ingressClass string
+		paths        []string
+		expected     *config.Configuration
+	}{
+		{
+			desc: "Empty",
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers:     map[string]*config.Router{},
+					Middlewares: map[string]*config.Middleware{},
+					Services:    map[string]*config.Service{},
+				},
+			},
+		},
+		{
+			desc:  "Simple Ingress Route, with foo entrypoint",
+			paths: []string{"services.yml", "simple.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers: map[string]*config.Router{
+						"default/test.crd-6b204d94623b3df4370c": {
+							EntryPoints: []string{"foo"},
+							Service:     "default/test.crd-6b204d94623b3df4370c",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/bar`)",
+							Priority:    12,
+						},
+					},
+					Middlewares: map[string]*config.Middleware{},
+					Services: map[string]*config.Service{
+						"default/test.crd-6b204d94623b3df4370c": {
+							LoadBalancer: &config.LoadBalancerService{
+								Servers: []config.Server{
+									{
+										URL:    "http://10.10.0.1:80",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.2:80",
+										Weight: 1,
+									},
+								},
+								Method:         "wrr",
+								PassHostHeader: true,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc:  "Simple Ingress Route with middleware",
+			paths: []string{"services.yml", "with_middleware.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers: map[string]*config.Router{
+						"default/test2.crd-23c7f4c450289ee29016": {
+							EntryPoints: []string{"web"},
+							Service:     "default/test2.crd-23c7f4c450289ee29016",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/tobestripped`)",
+							Priority:    12,
+							Middlewares: []string{"default/stripprefix", "foo/addprefix"},
+						},
+					},
+					Middlewares: map[string]*config.Middleware{
+						"default/stripprefix": {
+							StripPrefix: &config.StripPrefix{
+								Prefixes: []string{"/tobestripped"},
+							},
+						},
+						"foo/addprefix": {
+							AddPrefix: &config.AddPrefix{
+								Prefix: "/tobeadded",
+							},
+						},
+					},
+					Services: map[string]*config.Service{
+						"default/test2.crd-23c7f4c450289ee29016": {
+							LoadBalancer: &config.LoadBalancerService{
+								Servers: []config.Server{
+									{
+										URL:    "http://10.10.0.1:80",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.2:80",
+										Weight: 1,
+									},
+								},
+								Method:         "wrr",
+								PassHostHeader: true,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc:  "One ingress Route with two different rules",
+			paths: []string{"services.yml", "with_two_rules.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers: map[string]*config.Router{
+						"default/test.crd-6b204d94623b3df4370c": {
+							EntryPoints: []string{"web"},
+							Rule:        "Host(`foo.com`) && PathPrefix(`/bar`)",
+							Service:     "default/test.crd-6b204d94623b3df4370c",
+							Priority:    14,
+						},
+						"default/test.crd-77c62dfe9517144aeeaa": {
+							EntryPoints: []string{"web"},
+							Service:     "default/test.crd-77c62dfe9517144aeeaa",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/foo`)",
+							Priority:    12,
+						},
+					},
+					Middlewares: map[string]*config.Middleware{},
+					Services: map[string]*config.Service{
+						"default/test.crd-6b204d94623b3df4370c": {
+							LoadBalancer: &config.LoadBalancerService{
+								Servers: []config.Server{
+									{
+										URL:    "http://10.10.0.1:80",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.2:80",
+										Weight: 1,
+									},
+								},
+								Method:         "wrr",
+								PassHostHeader: true,
+							},
+						},
+						"default/test.crd-77c62dfe9517144aeeaa": {
+							LoadBalancer: &config.LoadBalancerService{
+								Servers: []config.Server{
+									{
+										URL:    "http://10.10.0.1:80",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.2:80",
+										Weight: 1,
+									},
+								},
+								Method:         "wrr",
+								PassHostHeader: true,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc:  "One ingress Route with two different services, their servers will merge",
+			paths: []string{"services.yml", "with_two_services.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers: map[string]*config.Router{
+						"default/test.crd-77c62dfe9517144aeeaa": {
+							EntryPoints: []string{"web"},
+							Service:     "default/test.crd-77c62dfe9517144aeeaa",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/foo`)",
+							Priority:    12,
+						},
+					},
+					Middlewares: map[string]*config.Middleware{},
+					Services: map[string]*config.Service{
+						"default/test.crd-77c62dfe9517144aeeaa": {
+							LoadBalancer: &config.LoadBalancerService{
+								Servers: []config.Server{
+									{
+										URL:    "http://10.10.0.1:80",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.2:80",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.3:8080",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.4:8080",
+										Weight: 1,
+									},
+								},
+								Method:         "wrr",
+								PassHostHeader: true,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc:         "Ingress class",
+			paths:        []string{"services.yml", "simple.yml"},
+			ingressClass: "tchouk",
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers:     map[string]*config.Router{},
+					Middlewares: map[string]*config.Middleware{},
+					Services:    map[string]*config.Service{},
+				},
+			},
+		},
+		{
+			desc:  "Route with empty rule value is ignored",
+			paths: []string{"services.yml", "with_no_rule_value.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers:     map[string]*config.Router{},
+					Middlewares: map[string]*config.Middleware{},
+					Services:    map[string]*config.Service{},
+				},
+			},
+		},
+		{
+			desc:  "Route with kind not of a rule type (empty kind) is ignored",
+			paths: []string{"services.yml", "with_wrong_rule_kind.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers:     map[string]*config.Router{},
+					Middlewares: map[string]*config.Middleware{},
+					Services:    map[string]*config.Service{},
+				},
+			},
+		},
+		{
+			desc:  "check rule quoting validity",
+			paths: []string{"services.yml", "with_bad_host_rule.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers:     map[string]*config.Router{},
+					Middlewares: map[string]*config.Middleware{},
+					Services:    map[string]*config.Service{},
+				},
+			},
+		},
+		{
+			desc:  "TLS",
+			paths: []string{"services.yml", "with_tls.yml"},
+			expected: &config.Configuration{
+				TLS: []*tls.Configuration{
+					{
+						Certificate: &tls.Certificate{
+							CertFile: tls.FileOrContent("-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----"),
+							KeyFile:  tls.FileOrContent("-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----"),
+						},
+					},
+				},
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers: map[string]*config.Router{
+						"default/test.crd-6b204d94623b3df4370c": {
+							EntryPoints: []string{"web"},
+							Service:     "default/test.crd-6b204d94623b3df4370c",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/bar`)",
+							Priority:    12,
+							TLS:         &config.RouterTLSConfig{},
+						},
+					},
+					Middlewares: map[string]*config.Middleware{},
+					Services: map[string]*config.Service{
+						"default/test.crd-6b204d94623b3df4370c": {
+							LoadBalancer: &config.LoadBalancerService{
+								Servers: []config.Server{
+									{
+										URL:    "http://10.10.0.1:80",
+										Weight: 1,
+									},
+									{
+										URL:    "http://10.10.0.2:80",
+										Weight: 1,
+									},
+								},
+								Method:         "wrr",
+								PassHostHeader: true,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc:  "Simple Ingress Route, defaulting to https for servers",
+			paths: []string{"services.yml", "with_https_default.yml"},
+			expected: &config.Configuration{
+				TCP: &config.TCPConfiguration{},
+				HTTP: &config.HTTPConfiguration{
+					Routers: map[string]*config.Router{
+						"default/test.crd-6b204d94623b3df4370c": {
+							EntryPoints: []string{"foo"},
+							Service:     "default/test.crd-6b204d94623b3df4370c",
+							Rule:        "Host(`foo.com`) && PathPrefix(`/bar`)",
+							Priority:    12,
+						},
+					},
+					Middlewares: map[string]*config.Middleware{},
+					Services: map[string]*config.Service{
+						"default/test.crd-6b204d94623b3df4370c": {
+							LoadBalancer: &config.LoadBalancerService{
+								Servers: []config.Server{
+									{
+										URL:    "https://10.10.0.5:443",
+										Weight: 1,
+									},
+									{
+										URL:    "https://10.10.0.6:443",
+										Weight: 1,
+									},
+								},
+								Method:         "wrr",
+								PassHostHeader: true,
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "port selected by name (TODO)",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			if test.expected == nil {
+				return
+			}
+
+			p := Provider{IngressClass: test.ingressClass}
+			conf := p.loadConfigurationFromIngresses(context.Background(), newClientMock(test.paths...))
+			assert.Equal(t, test.expected, conf)
+		})
+	}
+}

pkg/provider/kubernetes/crd/traefik/v1alpha1/doc.go

@@ -0,0 +1,5 @@
+// +k8s:deepcopy-gen=package
+
+// Package v1alpha1 is the v1alpha1 version of the API.
+// +groupName=traefik.containo.us
+package v1alpha1

pkg/provider/kubernetes/crd/traefik/v1alpha1/ingressroute.go

@@ -0,0 +1,72 @@
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// IngressRouteSpec is a specification for a IngressRouteSpec resource.
+type IngressRouteSpec struct {
+	Routes      []Route  `json:"routes"`
+	EntryPoints []string `json:"entryPoints"`
+	TLS         *TLS     `json:"tls,omitempty"`
+}
+
+// Route contains the set of routes.
+type Route struct {
+	Match       string          `json:"match"`
+	Kind        string          `json:"kind"`
+	Priority    int             `json:"priority"`
+	Services    []Service       `json:"services,omitempty"`
+	Middlewares []MiddlewareRef `json:"middlewares"`
+}
+
+// TLS contains the TLS certificates configuration of the routes.
+type TLS struct {
+	SecretName string `json:"secretName"`
+	// TODO MinimumProtocolVersion string `json:"minimumProtocolVersion,omitempty"`
+}
+
+// Service defines an upstream to proxy traffic.
+type Service struct {
+	Name string `json:"name"`
+	Port int32  `json:"port"`
+	// TODO Weight      int          `json:"weight,omitempty"`
+	HealthCheck *HealthCheck `json:"healthCheck,omitempty"`
+	Strategy    string       `json:"strategy,omitempty"`
+}
+
+// MiddlewareRef is a ref to the Middleware resources.
+type MiddlewareRef struct {
+	Name      string `json:"name"`
+	Namespace string `json:"namespace"`
+}
+
+// HealthCheck is the HealthCheck definition.
+type HealthCheck struct {
+	Path            string            `json:"path"`
+	Host            string            `json:"host,omitempty"`
+	Scheme          string            `json:"scheme"`
+	IntervalSeconds int64             `json:"intervalSeconds"`
+	TimeoutSeconds  int64             `json:"timeoutSeconds"`
+	Headers         map[string]string `json:"headers"`
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// IngressRoute is an Ingress CRD specification.
+type IngressRoute struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata"`
+
+	Spec IngressRouteSpec `json:"spec"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// IngressRouteList is a list of IngressRoutes.
+type IngressRouteList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+	Items           []IngressRoute `json:"items"`
+}

pkg/provider/kubernetes/crd/traefik/v1alpha1/middleware.go

@@ -0,0 +1,27 @@
+package v1alpha1
+
+import (
+	"github.com/containous/traefik/pkg/config"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Middleware is a specification for a Middleware resource.
+type Middleware struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata"`
+
+	Spec config.Middleware `json:"spec"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// MiddlewareList is a list of Middleware resources.
+type MiddlewareList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []Middleware `json:"items"`
+}

pkg/provider/kubernetes/crd/traefik/v1alpha1/register.go

@@ -0,0 +1,43 @@
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name for Traefik.
+const GroupName = "traefik.containo.us"
+
+var (
+	// SchemeBuilder collects the scheme builder functions.
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+
+	// AddToScheme applies the SchemeBuilder functions to a specified scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// SchemeGroupVersion is group version used to register these objects.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+// Kind takes an unqualified kind and returns back a Group qualified GroupKind.
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource.
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&IngressRoute{},
+		&IngressRouteList{},
+		&Middleware{},
+		&MiddlewareList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}

pkg/provider/kubernetes/crd/traefik/v1alpha1/zz_generated.deepcopy.go

@@ -0,0 +1,290 @@
+// +build !ignore_autogenerated
+
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HealthCheck) DeepCopyInto(out *HealthCheck) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HealthCheck.
+func (in *HealthCheck) DeepCopy() *HealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(HealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IngressRoute) DeepCopyInto(out *IngressRoute) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressRoute.
+func (in *IngressRoute) DeepCopy() *IngressRoute {
+	if in == nil {
+		return nil
+	}
+	out := new(IngressRoute)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *IngressRoute) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IngressRouteList) DeepCopyInto(out *IngressRouteList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]IngressRoute, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressRouteList.
+func (in *IngressRouteList) DeepCopy() *IngressRouteList {
+	if in == nil {
+		return nil
+	}
+	out := new(IngressRouteList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *IngressRouteList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IngressRouteSpec) DeepCopyInto(out *IngressRouteSpec) {
+	*out = *in
+	if in.Routes != nil {
+		in, out := &in.Routes, &out.Routes
+		*out = make([]Route, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.EntryPoints != nil {
+		in, out := &in.EntryPoints, &out.EntryPoints
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLS)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressRouteSpec.
+func (in *IngressRouteSpec) DeepCopy() *IngressRouteSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(IngressRouteSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Middleware) DeepCopyInto(out *Middleware) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Middleware.
+func (in *Middleware) DeepCopy() *Middleware {
+	if in == nil {
+		return nil
+	}
+	out := new(Middleware)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Middleware) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MiddlewareList) DeepCopyInto(out *MiddlewareList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Middleware, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MiddlewareList.
+func (in *MiddlewareList) DeepCopy() *MiddlewareList {
+	if in == nil {
+		return nil
+	}
+	out := new(MiddlewareList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *MiddlewareList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MiddlewareRef) DeepCopyInto(out *MiddlewareRef) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MiddlewareRef.
+func (in *MiddlewareRef) DeepCopy() *MiddlewareRef {
+	if in == nil {
+		return nil
+	}
+	out := new(MiddlewareRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Route) DeepCopyInto(out *Route) {
+	*out = *in
+	if in.Services != nil {
+		in, out := &in.Services, &out.Services
+		*out = make([]Service, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Middlewares != nil {
+		in, out := &in.Middlewares, &out.Middlewares
+		*out = make([]MiddlewareRef, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Route.
+func (in *Route) DeepCopy() *Route {
+	if in == nil {
+		return nil
+	}
+	out := new(Route)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Service) DeepCopyInto(out *Service) {
+	*out = *in
+	if in.HealthCheck != nil {
+		in, out := &in.HealthCheck, &out.HealthCheck
+		*out = new(HealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Service.
+func (in *Service) DeepCopy() *Service {
+	if in == nil {
+		return nil
+	}
+	out := new(Service)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLS) DeepCopyInto(out *TLS) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS.
+func (in *TLS) DeepCopy() *TLS {
+	if in == nil {
+		return nil
+	}
+	out := new(TLS)
+	in.DeepCopyInto(out)
+	return out
+}

pkg/provider/kubernetes/ingress/builder_ingress_test.go

@@ -0,0 +1,63 @@
+package ingress
+
+import (
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+)
+
+func buildIngress(opts ...func(*extensionsv1beta1.Ingress)) *extensionsv1beta1.Ingress {
+	i := &extensionsv1beta1.Ingress{}
+	i.Kind = "Ingress"
+	for _, opt := range opts {
+		opt(i)
+	}
+	return i
+}
+
+func iNamespace(value string) func(*extensionsv1beta1.Ingress) {
+	return func(i *extensionsv1beta1.Ingress) {
+		i.Namespace = value
+	}
+}
+
+func iRules(opts ...func(*extensionsv1beta1.IngressSpec)) func(*extensionsv1beta1.Ingress) {
+	return func(i *extensionsv1beta1.Ingress) {
+		s := &extensionsv1beta1.IngressSpec{}
+		for _, opt := range opts {
+			opt(s)
+		}
+		i.Spec = *s
+	}
+}
+
+func iRule(opts ...func(*extensionsv1beta1.IngressRule)) func(*extensionsv1beta1.IngressSpec) {
+	return func(spec *extensionsv1beta1.IngressSpec) {
+		r := &extensionsv1beta1.IngressRule{}
+		for _, opt := range opts {
+			opt(r)
+		}
+		spec.Rules = append(spec.Rules, *r)
+	}
+}
+
+func iHost(name string) func(*extensionsv1beta1.IngressRule) {
+	return func(rule *extensionsv1beta1.IngressRule) {
+		rule.Host = name
+	}
+}
+
+func iTLSes(opts ...func(*extensionsv1beta1.IngressTLS)) func(*extensionsv1beta1.Ingress) {
+	return func(i *extensionsv1beta1.Ingress) {
+		for _, opt := range opts {
+			iTLS := extensionsv1beta1.IngressTLS{}
+			opt(&iTLS)
+			i.Spec.TLS = append(i.Spec.TLS, iTLS)
+		}
+	}
+}
+
+func iTLS(secret string, hosts ...string) func(*extensionsv1beta1.IngressTLS) {
+	return func(i *extensionsv1beta1.IngressTLS) {
+		i.SecretName = secret
+		i.Hosts = hosts
+	}
+}

pkg/provider/kubernetes/ingress/client.go

@@ -0,0 +1,301 @@
+package ingress
+
+import (
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"time"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
+	corev1 "k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	kubeerror "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+const resyncPeriod = 10 * time.Minute
+
+type resourceEventHandler struct {
+	ev chan<- interface{}
+}
+
+func (reh *resourceEventHandler) OnAdd(obj interface{}) {
+	eventHandlerFunc(reh.ev, obj)
+}
+
+func (reh *resourceEventHandler) OnUpdate(oldObj, newObj interface{}) {
+	eventHandlerFunc(reh.ev, newObj)
+}
+
+func (reh *resourceEventHandler) OnDelete(obj interface{}) {
+	eventHandlerFunc(reh.ev, obj)
+}
+
+// Client is a client for the Provider master.
+// WatchAll starts the watch of the Provider resources and updates the stores.
+// The stores can then be accessed via the Get* functions.
+type Client interface {
+	WatchAll(namespaces k8s.Namespaces, stopCh <-chan struct{}) (<-chan interface{}, error)
+	GetIngresses() []*extensionsv1beta1.Ingress
+	GetService(namespace, name string) (*corev1.Service, bool, error)
+	GetSecret(namespace, name string) (*corev1.Secret, bool, error)
+	GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error)
+	UpdateIngressStatus(namespace, name, ip, hostname string) error
+}
+
+type clientWrapper struct {
+	clientset            *kubernetes.Clientset
+	factories            map[string]informers.SharedInformerFactory
+	ingressLabelSelector labels.Selector
+	isNamespaceAll       bool
+	watchedNamespaces    k8s.Namespaces
+}
+
+// newInClusterClient returns a new Provider client that is expected to run
+// inside the cluster.
+func newInClusterClient(endpoint string) (*clientWrapper, error) {
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create in-cluster configuration: %s", err)
+	}
+
+	if endpoint != "" {
+		config.Host = endpoint
+	}
+
+	return createClientFromConfig(config)
+}
+
+func newExternalClusterClientFromFile(file string) (*clientWrapper, error) {
+	configFromFlags, err := clientcmd.BuildConfigFromFlags("", file)
+	if err != nil {
+		return nil, err
+	}
+	return createClientFromConfig(configFromFlags)
+}
+
+// newExternalClusterClient returns a new Provider client that may run outside
+// of the cluster.
+// The endpoint parameter must not be empty.
+func newExternalClusterClient(endpoint, token, caFilePath string) (*clientWrapper, error) {
+	if endpoint == "" {
+		return nil, errors.New("endpoint missing for external cluster client")
+	}
+
+	config := &rest.Config{
+		Host:        endpoint,
+		BearerToken: token,
+	}
+
+	if caFilePath != "" {
+		caData, err := ioutil.ReadFile(caFilePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read CA file %s: %s", caFilePath, err)
+		}
+
+		config.TLSClientConfig = rest.TLSClientConfig{CAData: caData}
+	}
+	return createClientFromConfig(config)
+}
+
+func createClientFromConfig(c *rest.Config) (*clientWrapper, error) {
+	clientset, err := kubernetes.NewForConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return newClientImpl(clientset), nil
+}
+
+func newClientImpl(clientset *kubernetes.Clientset) *clientWrapper {
+	return &clientWrapper{
+		clientset: clientset,
+		factories: make(map[string]informers.SharedInformerFactory),
+	}
+}
+
+// WatchAll starts namespace-specific controllers for all relevant kinds.
+func (c *clientWrapper) WatchAll(namespaces k8s.Namespaces, stopCh <-chan struct{}) (<-chan interface{}, error) {
+	eventCh := make(chan interface{}, 1)
+	eventHandler := c.newResourceEventHandler(eventCh)
+
+	if len(namespaces) == 0 {
+		namespaces = k8s.Namespaces{metav1.NamespaceAll}
+		c.isNamespaceAll = true
+	}
+
+	c.watchedNamespaces = namespaces
+
+	for _, ns := range namespaces {
+		factory := informers.NewFilteredSharedInformerFactory(c.clientset, resyncPeriod, ns, nil)
+		factory.Extensions().V1beta1().Ingresses().Informer().AddEventHandler(eventHandler)
+		factory.Core().V1().Services().Informer().AddEventHandler(eventHandler)
+		factory.Core().V1().Endpoints().Informer().AddEventHandler(eventHandler)
+		c.factories[ns] = factory
+	}
+
+	for _, ns := range namespaces {
+		c.factories[ns].Start(stopCh)
+	}
+
+	for _, ns := range namespaces {
+		for t, ok := range c.factories[ns].WaitForCacheSync(stopCh) {
+			if !ok {
+				return nil, fmt.Errorf("timed out waiting for controller caches to sync %s in namespace %q", t.String(), ns)
+			}
+		}
+	}
+
+	// Do not wait for the Secrets store to get synced since we cannot rely on
+	// users having granted RBAC permissions for this object.
+	// https://github.com/containous/traefik/issues/1784 should improve the
+	// situation here in the future.
+	for _, ns := range namespaces {
+		c.factories[ns].Core().V1().Secrets().Informer().AddEventHandler(eventHandler)
+		c.factories[ns].Start(stopCh)
+	}
+
+	return eventCh, nil
+}
+
+// GetIngresses returns all Ingresses for observed namespaces in the cluster.
+func (c *clientWrapper) GetIngresses() []*extensionsv1beta1.Ingress {
+	var result []*extensionsv1beta1.Ingress
+	for ns, factory := range c.factories {
+		ings, err := factory.Extensions().V1beta1().Ingresses().Lister().List(c.ingressLabelSelector)
+		if err != nil {
+			log.Errorf("Failed to list ingresses in namespace %s: %s", ns, err)
+		}
+		result = append(result, ings...)
+	}
+	return result
+}
+
+// UpdateIngressStatus updates an Ingress with a provided status.
+func (c *clientWrapper) UpdateIngressStatus(namespace, name, ip, hostname string) error {
+	if !c.isWatchedNamespace(namespace) {
+		return fmt.Errorf("failed to get ingress %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	ing, err := c.factories[c.lookupNamespace(namespace)].Extensions().V1beta1().Ingresses().Lister().Ingresses(namespace).Get(name)
+	if err != nil {
+		return fmt.Errorf("failed to get ingress %s/%s: %v", namespace, name, err)
+	}
+
+	if len(ing.Status.LoadBalancer.Ingress) > 0 {
+		if ing.Status.LoadBalancer.Ingress[0].Hostname == hostname && ing.Status.LoadBalancer.Ingress[0].IP == ip {
+			// If status is already set, skip update
+			log.Debugf("Skipping status update on ingress %s/%s", ing.Namespace, ing.Name)
+			return nil
+		}
+	}
+	ingCopy := ing.DeepCopy()
+	ingCopy.Status = extensionsv1beta1.IngressStatus{LoadBalancer: corev1.LoadBalancerStatus{Ingress: []corev1.LoadBalancerIngress{{IP: ip, Hostname: hostname}}}}
+
+	_, err = c.clientset.ExtensionsV1beta1().Ingresses(ingCopy.Namespace).UpdateStatus(ingCopy)
+	if err != nil {
+		return fmt.Errorf("failed to update ingress status %s/%s: %v", namespace, name, err)
+	}
+	log.Infof("Updated status on ingress %s/%s", namespace, name)
+	return nil
+}
+
+// GetService returns the named service from the given namespace.
+func (c *clientWrapper) GetService(namespace, name string) (*corev1.Service, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get service %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	service, err := c.factories[c.lookupNamespace(namespace)].Core().V1().Services().Lister().Services(namespace).Get(name)
+	exist, err := translateNotFoundError(err)
+	return service, exist, err
+}
+
+// GetEndpoints returns the named endpoints from the given namespace.
+func (c *clientWrapper) GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get endpoints %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	endpoint, err := c.factories[c.lookupNamespace(namespace)].Core().V1().Endpoints().Lister().Endpoints(namespace).Get(name)
+	exist, err := translateNotFoundError(err)
+	return endpoint, exist, err
+}
+
+// GetSecret returns the named secret from the given namespace.
+func (c *clientWrapper) GetSecret(namespace, name string) (*corev1.Secret, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get secret %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
+	secret, err := c.factories[c.lookupNamespace(namespace)].Core().V1().Secrets().Lister().Secrets(namespace).Get(name)
+	exist, err := translateNotFoundError(err)
+	return secret, exist, err
+}
+
+// lookupNamespace returns the lookup namespace key for the given namespace.
+// When listening on all namespaces, it returns the client-go identifier ("")
+// for all-namespaces. Otherwise, it returns the given namespace.
+// The distinction is necessary because we index all informers on the special
+// identifier iff all-namespaces are requested but receive specific namespace
+// identifiers from the Kubernetes API, so we have to bridge this gap.
+func (c *clientWrapper) lookupNamespace(ns string) string {
+	if c.isNamespaceAll {
+		return metav1.NamespaceAll
+	}
+	return ns
+}
+
+func (c *clientWrapper) newResourceEventHandler(events chan<- interface{}) cache.ResourceEventHandler {
+	return &cache.FilteringResourceEventHandler{
+		FilterFunc: func(obj interface{}) bool {
+			// Ignore Ingresses that do not match our custom label selector.
+			if ing, ok := obj.(*extensionsv1beta1.Ingress); ok {
+				lbls := labels.Set(ing.GetLabels())
+				return c.ingressLabelSelector.Matches(lbls)
+			}
+			return true
+		},
+		Handler: &resourceEventHandler{ev: events},
+	}
+}
+
+// eventHandlerFunc will pass the obj on to the events channel or drop it.
+// This is so passing the events along won't block in the case of high volume.
+// The events are only used for signaling anyway so dropping a few is ok.
+func eventHandlerFunc(events chan<- interface{}, obj interface{}) {
+	select {
+	case events <- obj:
+	default:
+	}
+}
+
+// translateNotFoundError will translate a "not found" error to a boolean return
+// value which indicates if the resource exists and a nil error.
+func translateNotFoundError(err error) (bool, error) {
+	if kubeerror.IsNotFound(err) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
+// isWatchedNamespace checks to ensure that the namespace is being watched before we request
+// it to ensure we don't panic by requesting an out-of-watch object.
+func (c *clientWrapper) isWatchedNamespace(ns string) bool {
+	if c.isNamespaceAll {
+		return true
+	}
+	for _, watchedNamespace := range c.watchedNamespaces {
+		if watchedNamespace == ns {
+			return true
+		}
+	}
+	return false
+}

pkg/provider/kubernetes/ingress/client_mock_test.go

@@ -0,0 +1,108 @@
+package ingress
+
+import (
+	"fmt"
+	"io/ioutil"
+
+	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
+	corev1 "k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1beta12 "k8s.io/api/extensions/v1beta1"
+)
+
+var _ Client = (*clientMock)(nil)
+
+type clientMock struct {
+	ingresses []*extensionsv1beta1.Ingress
+	services  []*corev1.Service
+	secrets   []*corev1.Secret
+	endpoints []*corev1.Endpoints
+
+	apiServiceError       error
+	apiSecretError        error
+	apiEndpointsError     error
+	apiIngressStatusError error
+
+	watchChan chan interface{}
+}
+
+func newClientMock(paths ...string) clientMock {
+	var c clientMock
+
+	for _, path := range paths {
+		yamlContent, err := ioutil.ReadFile(path)
+		if err != nil {
+			panic(err)
+		}
+
+		k8sObjects := k8s.MustParseYaml(yamlContent)
+		for _, obj := range k8sObjects {
+			switch o := obj.(type) {
+			case *corev1.Service:
+				c.services = append(c.services, o)
+			case *corev1.Secret:
+				c.secrets = append(c.secrets, o)
+			case *corev1.Endpoints:
+				c.endpoints = append(c.endpoints, o)
+			case *v1beta12.Ingress:
+				c.ingresses = append(c.ingresses, o)
+			default:
+				panic(fmt.Sprintf("Unknown runtime object %+v %T", o, o))
+			}
+		}
+	}
+
+	return c
+}
+
+func (c clientMock) GetIngresses() []*extensionsv1beta1.Ingress {
+	return c.ingresses
+}
+
+func (c clientMock) GetService(namespace, name string) (*corev1.Service, bool, error) {
+	if c.apiServiceError != nil {
+		return nil, false, c.apiServiceError
+	}
+
+	for _, service := range c.services {
+		if service.Namespace == namespace && service.Name == name {
+			return service, true, nil
+		}
+	}
+	return nil, false, c.apiServiceError
+}
+
+func (c clientMock) GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error) {
+	if c.apiEndpointsError != nil {
+		return nil, false, c.apiEndpointsError
+	}
+
+	for _, endpoints := range c.endpoints {
+		if endpoints.Namespace == namespace && endpoints.Name == name {
+			return endpoints, true, nil
+		}
+	}
+
+	return &corev1.Endpoints{}, false, nil
+}
+
+func (c clientMock) GetSecret(namespace, name string) (*corev1.Secret, bool, error) {
+	if c.apiSecretError != nil {
+		return nil, false, c.apiSecretError
+	}
+
+	for _, secret := range c.secrets {
+		if secret.Namespace == namespace && secret.Name == name {
+			return secret, true, nil
+		}
+	}
+	return nil, false, nil
+}
+
+func (c clientMock) WatchAll(namespaces k8s.Namespaces, stopCh <-chan struct{}) (<-chan interface{}, error) {
+	return c.watchChan, nil
+}
+
+func (c clientMock) UpdateIngressStatus(namespace, name, ip, hostname string) error {
+	return c.apiIngressStatusError
+}

pkg/provider/kubernetes/ingress/client_test.go

@@ -0,0 +1,49 @@
+package ingress
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	kubeerror "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestTranslateNotFoundError(t *testing.T) {
+	testCases := []struct {
+		desc           string
+		err            error
+		expectedExists bool
+		expectedError  error
+	}{
+		{
+			desc:           "kubernetes not found error",
+			err:            kubeerror.NewNotFound(schema.GroupResource{}, "foo"),
+			expectedExists: false,
+			expectedError:  nil,
+		},
+		{
+			desc:           "nil error",
+			err:            nil,
+			expectedExists: true,
+			expectedError:  nil,
+		},
+		{
+			desc:           "not a kubernetes not found error",
+			err:            fmt.Errorf("bar error"),
+			expectedExists: false,
+			expectedError:  fmt.Errorf("bar error"),
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			exists, err := translateNotFoundError(test.err)
+			assert.Equal(t, test.expectedExists, exists)
+			assert.Equal(t, test.expectedError, err)
+		})
+	}
+}

pkg/provider/kubernetes/ingress/fixtures/2-ingresses-in-different-namespace-with-same-service-name_endpoint.yml

@@ -0,0 +1,29 @@
+---
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+  - addresses:
+      - ip: 10.10.0.1
+      - ip: 10.10.0.2
+    ports:
+      - name: tchouk
+        port: 8089
+
+---
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: toto
+
+subsets:
+  - addresses:
+      - ip: 10.11.0.1
+      - ip: 10.11.0.2
+    ports:
+      - name: tchouk
+        port: 8089

pkg/provider/kubernetes/ingress/fixtures/2-ingresses-in-different-namespace-with-same-service-name_ingress.yml

@@ -0,0 +1,37 @@
+---
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+    - host: traefik.tchouk
+      http:
+        paths:
+          - path: /bar
+            backend:
+              serviceName: service1
+              servicePort: tchouk
+          - path: /foo
+            backend:
+              serviceName: service1
+              servicePort: carotte
+
+---
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: toto
+
+spec:
+  rules:
+    - host: toto.traefik.tchouk
+      http:
+        paths:
+          - path: /bar
+            backend:
+              serviceName: service1
+              servicePort: tchouk

pkg/provider/kubernetes/ingress/fixtures/2-ingresses-in-different-namespace-with-same-service-name_service.yml

@@ -0,0 +1,24 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+    - name: tchouk
+      port: 80
+  clusterIp: 10.0.0.1
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: toto
+
+spec:
+  ports:
+    - name: tchouk
+      port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Double-Single-Service-Ingress_endpoint.yml

@@ -0,0 +1,32 @@
+kind: Endpoints
+apiversion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+  - addresses:
+      - ip: 10.30.0.1
+    ports:
+      - port: 8080
+  - addresses:
+      - ip: 10.41.0.1
+    ports:
+      - port: 8080
+
+---
+kind: Endpoints
+apiversion: v1
+metadata:
+  name: service2
+  namespace: testing
+
+subsets:
+  - addresses:
+      - ip: 10.10.0.1
+    ports:
+      - port: 8080
+  - addresses:
+      - ip: 10.21.0.1
+    ports:
+      - port: 8080

pkg/provider/kubernetes/ingress/fixtures/Double-Single-Service-Ingress_ingress.yml

@@ -0,0 +1,22 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  backend:
+    serviceName: service1
+    servicePort: 80
+
+---
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  backend:
+    serviceName: service2
+    servicePort: 80

pkg/provider/kubernetes/ingress/fixtures/Double-Single-Service-Ingress_service.yml

@@ -0,0 +1,22 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+    - port: 80
+  clusterIp: 10.0.0.1
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: service2
+  namespace: testing
+
+spec:
+  ports:
+    - port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-Two-rules-with-one-host-and-one-path_endpoint.yml

@@ -0,0 +1,15 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - port: 8080
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - port: 8080

pkg/provider/kubernetes/ingress/fixtures/Ingress-Two-rules-with-one-host-and-one-path_ingress.yml

@@ -0,0 +1,22 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - host: traefik.tchouk
+    http:
+      paths:
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 80
+  - host: traefik.courgette
+    http:
+      paths:
+      - path: /carotte
+        backend:
+          serviceName: service1
+          servicePort: 80

pkg/provider/kubernetes/ingress/fixtures/Ingress-Two-rules-with-one-host-and-one-path_service.yml

@@ -0,0 +1,10 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+  - port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-one-host-and-two-paths_endpoint.yml

@@ -0,0 +1,15 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - port: 8080
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - port: 8080

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-one-host-and-two-paths_ingress.yml

@@ -0,0 +1,19 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - host: traefik.tchouk
+    http:
+      paths:
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 80
+      - path: /foo
+        backend:
+          serviceName: service1
+          servicePort: 80

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-one-host-and-two-paths_service.yml

@@ -0,0 +1,10 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+  - port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-one-path-and-one-host_endpoint.yml

@@ -0,0 +1,15 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - port: 8080
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - port: 8080

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-one-path-and-one-host_ingress.yml

@@ -0,0 +1,15 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - host: traefik.tchouk
+    http:
+      paths:
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 80

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-one-path-and-one-host_service.yml

@@ -0,0 +1,10 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+  - port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-two-paths_endpoint.yml

@@ -0,0 +1,15 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - port: 8080
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - port: 8080

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-two-paths_ingress.yml

@@ -0,0 +1,18 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 80
+      - path: /foo
+        backend:
+          serviceName: service1
+          servicePort: 80

pkg/provider/kubernetes/ingress/fixtures/Ingress-one-rule-with-two-paths_service.yml

@@ -0,0 +1,10 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+  - port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-bad-host-syntax_endpoint.yml

@@ -0,0 +1,15 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - port: 8080
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - port: 8080

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-bad-host-syntax_ingress.yml

@@ -0,0 +1,22 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - host: traefik.tchouk"0"
+    http:
+      paths:
+      - path: /foo
+        backend:
+          serviceName: service1
+          servicePort: 80
+  - host: traefik.courgette
+    http:
+      paths:
+      - path: /carotte
+        backend:
+          serviceName: service1
+          servicePort: 80

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-bad-host-syntax_service.yml

@@ -0,0 +1,10 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+  - port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-bad-path-syntax_endpoint.yml

@@ -0,0 +1,15 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - port: 8080
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - port: 8080

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-bad-path-syntax_ingress.yml

@@ -0,0 +1,23 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - host: ""
+    http:
+      paths:
+      - path: /foo
+        backend:
+          serviceName: service1
+          servicePort: 80
+      - path: /bar-"0"
+        backend:
+          serviceName: service1
+          servicePort: 80
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 80

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-bad-path-syntax_service.yml

@@ -0,0 +1,10 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+  - port: 80
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-basic-rule-on-one-path-with-https-(port-==-443)_endpoint.yml

@@ -0,0 +1,15 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - port: 443
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - port: 443

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-basic-rule-on-one-path-with-https-(port-==-443)_ingress.yml

@@ -0,0 +1,14 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 443

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-basic-rule-on-one-path-with-https-(port-==-443)_service.yml

@@ -0,0 +1,10 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+spec:
+  ports:
+  - port: 443
+  clusterIp: 10.0.0.1

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-basic-rule-on-one-path-with-https-(portname-==-https)_endpoint.yml

@@ -0,0 +1,17 @@
+kind: Endpoints
+apiVersion: v1
+metadata:
+  name: service1
+  namespace: testing
+
+subsets:
+- addresses:
+  - ip: 10.10.0.1
+  ports:
+  - name: https
+    port: 8443
+- addresses:
+  - ip: 10.21.0.1
+  ports:
+  - name: https
+    port: 8443

pkg/provider/kubernetes/ingress/fixtures/Ingress-with-a-basic-rule-on-one-path-with-https-(portname-==-https)_ingress.yml

@@ -0,0 +1,14 @@
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: ""
+  namespace: testing
+
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 8443